Data encryption and decryption system, data encryption method and data decryption method

Abstract

The invention discloses a data encryption and decryption system, a data encryption method and a data decryption method. The system comprises an application terminal and a service system, and the service system comprises an application management subsystem, a secret management subsystem and an encryption subsystem. The encryption subsystem is used for sending a data key application to an encryption management system under the condition of receiving a broadcast data plaintext, receiving a data key sent by the encryption management system and encrypting the broadcast data plaintext by adopting the data key to obtain a broadcast data ciphertext; the secret key management system is used for receiving the data secret key application and generating a data secret key at least according to a secret key updating strategy; the application management subsystem is used for receiving the service key application sent by the application terminal and sending the service key generated by the key management system to the application terminal; and the application terminal is used for generating a data key according to the service key and the key updating strategy, decrypting the broadcast data ciphertext by adopting the data key, and outputting a broadcast data plaintext.

Description

Technical Field

[0001] The present application relates to the field of satellite communication technology, and in particular to a data encryption and decryption system, a data encryption method, and a decryption method. Background Art

[0002] For one-way broadcast communication using narrowband satellite communication systems, in order to ensure business security, only authorized receiving terminals can receive and parse broadcast data. Therefore, the broadcast data needs to be encrypted to prevent the data from being spread and causing losses without the knowledge of the service provider. For the above application scenarios, there are three constraints that need to be considered: first, satellite bandwidth resources are limited, and the higher the proportion of effective data transmitted by broadcast, the better; second, the terminal maintenance keys must be different, the number of terminal accesses is not limited, and the terminal can be opened at any time, independent of the terminal opening the service in the forward direction, and the terminal can receive broadcast data at any time; third, under the premise of no two-way communication, the broadcast data key is supported to be updated regularly in real time, and the key management is lightweight, taking into account the efficiency and security of data transmission.

[0003] Existing encryption schemes often have limitations when dealing with the above problems. For example, schemes based on pre-distributed keys cannot adapt to the needs of dynamic terminal access and frequent service activation, and the complexity of key management and update increases dramatically in large-scale terminal access scenarios. In addition, the key update mechanism that relies on two-way communication is not feasible in one-way broadcast communication, because the terminal cannot communicate directly with the server, which limits the possibility of real-time dynamic key update, resulting in low security of narrowband satellite one-way broadcast communication data transmission. Summary of the invention

[0004] The embodiments of the present application provide a data encryption and decryption system, a data encryption method and a decryption method to at least solve the technical problem of low security of narrowband satellite one-way broadcast communication data transmission in the related art.

[0005] According to one aspect of an embodiment of the present application, a data encryption and decryption system is provided, including: an application terminal and a service system, wherein the service system includes: an application management subsystem, a key management subsystem and an encryption subsystem; the encryption subsystem is used to send a data key application to the key management subsystem when receiving broadcast data plaintext, and receive the data key sent by the key management subsystem and use the data key to encrypt the broadcast data plaintext to obtain broadcast data ciphertext; the key management subsystem is used to receive the data key application and generate the data key at least according to a key update policy; the application management subsystem is used to receive a business key application sent by the application terminal, and send the business key generated by the key management subsystem to the application terminal; the application terminal is used to generate the data key according to the business key and the key update policy, and use the data key to decrypt the broadcast data ciphertext to output the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0006] Optionally, the application terminal is also used to send a terminal service activation application to the application management subsystem, and receive a response message sent by the application management subsystem after successfully activating the terminal service according to the application terminal identifier and the service validity period, confirming that the terminal service is successfully activated, wherein the terminal service activation application at least includes the application terminal identifier and the service validity period.

[0007] Optionally, the application management subsystem is also used to receive terminal key application information sent by the application terminal after the terminal service is activated, and obtain the application terminal identification and the application scenario of the terminal service from the terminal key application information, and send the application terminal identification, the application scenario of the terminal service and the terminal key validity period generated according to a preset policy to the key management subsystem; the key management subsystem is used to generate a terminal key according to the application terminal identification, the application scenario of the terminal service and the terminal key validity period, and send the terminal key to the application management subsystem, wherein the application scenarios of the terminal service include: with a ground network and without a ground network.

[0008] Optionally, the key management subsystem generates a terminal key when the application scenario is a ground network; the key management subsystem generates multiple terminal keys when the application scenario is no ground network, wherein the total validity period of the multiple terminal keys is the same as the validity period of the service, and the validity period of each of the multiple terminal keys is the same.

[0009] Optionally, the key management subsystem is used to receive business key application information sent by the application terminal when the application terminal receives the terminal key; the key management subsystem is also used to extract the application terminal identifier from the business key application information, and obtain the public key in the terminal key according to the application terminal identifier; the key management subsystem is also used to use the public key to encrypt the business key, the business key validity period and the key update policy to obtain an encrypted ciphertext, and send the encrypted ciphertext to the application terminal.

[0010] Optionally, the application terminal is further configured to, when the terminal key is valid, use a private key in the terminal key to decrypt the encrypted ciphertext to obtain the business key, the validity period of the business key and the key update policy.

[0011] Optionally, the key management subsystem is further used to generate the data key based on the business key and timestamp according to the key update policy.

[0012] According to another aspect of an embodiment of the present application, a data encryption method is also provided, including: upon receiving broadcast data plaintext, generating a data key, wherein the data key is generated at least according to a key update strategy; using the data key to encrypt the broadcast data plaintext to obtain a broadcast data ciphertext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0013] Optionally, when plain text broadcast data is received, generating a data key includes: acquiring a service key and a current timestamp; and generating the data key according to the service key and the current timestamp in accordance with the key update policy.

[0014] According to another aspect of the embodiment of the present application, a data decryption method is also provided, including: sending a business key application to a service system; receiving the business key sent by the service system; generating the data key according to the business key according to the key update strategy, and using the data key to decrypt the received broadcast data ciphertext, and outputting the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0015] According to another aspect of the embodiment of the present application, a computer device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned data encryption method.

[0016] According to another aspect of the embodiment of the present application, a computer device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned data decryption method.

[0017] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned data encryption method by running the computer program.

[0018] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned data decryption method by running the computer program.

[0019] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data encryption method when executed by a processor.

[0020] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data decryption method when executed by a processor.

[0021] In an embodiment of the present application, through an application terminal and a service system, the service system includes: an application management subsystem, a key management subsystem and an encryption subsystem; the encryption subsystem is used to send a data key application to the key management subsystem when receiving a broadcast data plaintext, and receive the data key sent by the key management subsystem and use the data key to encrypt the broadcast data plaintext to obtain the broadcast data ciphertext; the key management subsystem is used to receive the data key application and generate the data key at least according to the key update policy; the application management subsystem is used to receive the service key application sent by the application terminal, and send the service key generated by the key management subsystem to the application terminal; the application terminal is used to generate the data key according to the service key and the key update policy, and use the data key to decrypt the broadcast data ciphertext and output the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext, thereby achieving the purpose of updating the data key in real time according to the key update policy without negotiation, thereby achieving the technical effect of improving the security of narrowband satellite unidirectional broadcast communication data transmission, and thus solving the technical problem of low security of narrowband satellite unidirectional broadcast communication data transmission in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 is a schematic diagram of the structure of a data encryption and decryption system according to an embodiment of the present application;

[0024] Figure 2 This is a schematic diagram of a data encryption and decryption system workflow according to an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of a data encryption and decryption system framework according to an embodiment of the present application;

[0026] Figure 4 is a flow chart of a terminal service activation according to an embodiment of the present application;

[0027] Figure 5 is a flow chart of terminal key application distribution according to an embodiment of the present application;

[0028] Figure 6 It is a flow chart of pre-embedded business key and update strategy according to an embodiment of the present application;

[0029] Figure 7 is a flow chart of encryption and decryption of broadcast data according to an embodiment of the present application;

[0030] Figure 8 It is a real-time dynamic update process of a data key according to an embodiment of the present application;

[0031] Fig. 9 is a hardware structure block diagram of a computer terminal for implementing a data encryption method according to an embodiment of the present application;

[0032] Fig.10 is a flow chart of a data encryption method according to an embodiment of the present application;

[0033] Fig.11 It is a flow chart of a data decryption method according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0037] In order to solve the problems existing in the related art, the embodiment of the present application provides a data encryption and decryption system, such as Figure 1 As shown, it includes: an application terminal 10 and a service system 20, wherein the service system 20 includes: an application management subsystem 201, a key management subsystem 202 and an encryption subsystem 203;

[0038] The encryption subsystem 203 is used to send a data key application to the key management subsystem 202 when receiving the broadcast data plaintext, and receive the data key sent by the key management subsystem 202 and use the data key to encrypt the broadcast data plaintext to obtain the broadcast data ciphertext; the key management subsystem 202 is used to receive the data key application and generate the data key at least according to the key update policy; the application management subsystem 201 is used to receive the business key application sent by the application terminal 10, and send the business key generated by the key management subsystem 202 to the application terminal 10; the application terminal 10 is used to generate the data key according to the business key and the key update policy, and use the data key to decrypt the broadcast data ciphertext to output the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0039] In actual application scenarios, the keys involved in the system include terminal keys, data keys and business keys. Among them, the terminal key is directly associated with the terminal identification, adopts asymmetric encryption, and is composed of a public key and a private key; the data key is used for broadcast plaintext encryption and broadcast ciphertext decryption, adopts symmetric encryption, and the service system and application terminal dynamically generate data keys based on the same mechanism; the business key is the initial key dynamically generated by the data key and is managed by the key management subsystem in the service system.

[0040] Among them, the key management subsystem is responsible for terminal key generation and management, business key management, dynamic data key generation and management, and provides key services for the application management subsystem 201 and the encryption subsystem; the encryption subsystem receives broadcast data plaintext, implements broadcast data encryption function, and outputs broadcast data ciphertext; the application management subsystem 201 is responsible for managing the operation of encryption services, including realizing business activation, allocating business key validity period, and allocating terminal key validity period according to terminal application scenarios.

[0041] It should be noted that the application terminal is also provided with cryptographic software, a data key dynamic generation module and a security zone, among which, the cryptographic software: is stored and run in the authorized application terminal to realize the broadcast ciphertext decryption function; the data key dynamic generation module: is stored and run in the authorized application terminal, and dynamically generates data keys for broadcast ciphertext decryption in real time based on business keys, timestamps and update strategies; the security zone: has a certain security strength, and is used to store key sensitive parameters and information such as terminal identification, terminal keys and validity periods, business keys and validity periods, data keys and update strategies.

[0042] like Figure 2 As shown in the figure, the workflow of the narrowband satellite one-way broadcast communication data encryption and decryption system is divided into five stages, including: terminal service activation process, terminal key application and distribution process, service key and update strategy pre-embedded process, broadcast data encryption and decryption process and data key real-time dynamic update process. The specific execution process of the data encryption and decryption system is as follows: Figure 3 shown.

[0043] The application terminal 10 is also used to send a terminal service activation application to the application management subsystem 201, and receive a response message sent by the application management subsystem 201 after successfully activating the terminal service according to the application terminal 10 identification and the service validity period, confirming that the terminal service is successfully activated, wherein the terminal service activation application at least includes the application terminal 10 identification and the service validity period.

[0044] The specific terminal service activation process is as follows: Figure 4As shown, it includes: Step 1, after the application terminal 10 accesses the ground network, it carries the terminal identification and the application service duration to apply for service activation to the application management subsystem 201. Step 2, the application management subsystem 201 receives the service activation application, records and stores the terminal identification and the service validity period, and feeds back a successful service activation response to the application terminal 10. Step 3, the application terminal 10 receives the response and confirms that the terminal service is successfully activated.

[0045] The application management subsystem 201 is also used to receive the terminal key application information sent by the application terminal 10 after the terminal service is activated, and obtain the application terminal 10 identification and the application scenario of the terminal service from the terminal key application information, and send the application terminal 10 identification, the application scenario of the terminal service and the terminal key validity period generated according to the preset policy to the key management subsystem 202; the key management subsystem 202 is used to generate a terminal key according to the application terminal 10 identification, the application scenario of the terminal service and the terminal key validity period, and send the terminal key to the application management subsystem 201, wherein the application scenarios of the terminal service include: with a ground network and without a ground network.

[0046] When the application scenario is a ground network, the key management subsystem 202 generates a terminal key; when the application scenario is no ground network, the key management subsystem 202 generates multiple terminal keys, where the total validity period of the multiple terminal keys is the same as the service validity period, and the validity period of each of the multiple terminal keys is the same.

[0047] Based on the above execution process, the terminal key application distribution process involves the application management subsystem 201 and the key management subsystem 202 of the application terminal 10 and the service system 20. The specific distribution process is as follows: Figure 5 As shown, including:

[0048] Step 1: After the terminal activates the service and accesses the ground network, the terminal key application information is prepared according to the terminal identification and application scenario, and the terminal key is applied to the application management subsystem 201. The application scenarios are divided into two types: with ground network and without ground network.

[0049] Step 2, the application management subsystem 201 receives the terminal key application information sent by the application terminal 10, obtains the terminal key validity period according to the application management policy, and sends the terminal key acquisition application and key validity period with the terminal identifier to the key management subsystem 202. Among them, the application management policy includes: generating one terminal key with the ground network, generating multiple terminal keys without the ground network, the validity period of each terminal key is the same, and the total validity period of the multiple keys is the same as the service validity period applied when the service is activated.

[0050] Step 3: The key management subsystem 202 generates a terminal key and a corresponding validity period (one copy / multiple copies) according to the terminal key application information sent by the application management subsystem 201, sends it to the application management subsystem 201, and stores it in the key management subsystem 202.

[0051] Step 4: The application management subsystem 201 forwards the terminal key and the corresponding validity period (one copy / multiple copies) sent by the key management subsystem to the application terminal 10.

[0052] Step 5: The application terminal 10 verifies the legitimacy of the terminal key according to the terminal identification, and stores the terminal key and its validity period in the security area, thus completing the terminal key application distribution process.

[0053] In some embodiments of the present application, the key management subsystem 202 is used to receive the business key application information sent by the application terminal 10 when the application terminal 10 receives the terminal key; the key management subsystem 202 is also used to extract the application terminal 10 identifier from the business key application information, and obtain the public key in the terminal key according to the application terminal 10 identifier; the key management subsystem 202 is also used to use the public key to encrypt the business key, the business key validity period and the key update policy to obtain the encrypted ciphertext, and send the encrypted ciphertext to the application terminal 10.

[0054] It should be noted that the key update strategy at least includes: the key update frequency, validity period, and how to adjust the parameters of the key generation algorithm according to the timestamp.

[0055] The application terminal 10 is also used to, when the terminal key is valid, use the private key in the terminal key to decrypt the encrypted ciphertext to obtain the business key, the validity period of the business key and the key update policy.

[0056] Based on the process executed by the key management subsystem 202, in the actual application scenario, the business key and update strategy pre-embedded process involves the application terminal 10 and the application management subsystem 201 and the key management subsystem 202 of the service system. The specific process is as follows: Figure 6 As shown, including:

[0057] Step 1: After the application terminal 10 accesses the ground network and obtains the terminal key, it prepares service key application information according to the terminal identification, and applies for the service key from the application management subsystem 201 with the terminal identification.

[0058] Step 2: the application management subsystem 201 obtains the validity period of the service key according to the terminal identification and the information recorded when the service is activated, and sends a service key application to the key management subsystem 202 with the terminal identification and the service validity period.

[0059] Step 3, after receiving the application, the key management subsystem 202 obtains the terminal key public key according to the terminal identifier, encrypts the service key, service validity period and key update policy, and feeds the encrypted ciphertext back to the application management subsystem 201, which is forwarded to the application terminal 10 through the application management subsystem 201.

[0060] Step 4, the cryptographic software in the application terminal 10 obtains the terminal key and validity period from the security zone and verifies the validity. If the terminal key is within the validity period, the terminal key private key is used to decrypt the ciphertext to obtain the business key, business validity period and key update policy, and store them in the security zone to complete the pre-embedding of the business key and key update policy; if it exceeds the validity period, no processing is performed.

[0061] The key management subsystem 202 is also used to generate a data key based on the business key and the timestamp according to the key update policy.

[0062] It should be noted that the broadcast data encryption and decryption process involves the encryption subsystem 203 and the encryption management subsystem 202 of the application terminal 10 and the service system. Figure 7 As shown, including:

[0063] Step 1: The encryption subsystem 203 receives the plaintext broadcast data and applies for the data key from the key management subsystem 202.

[0064] Step 2: The data key dynamic generation module of the key management subsystem 202 calculates the data key in real time and feeds back to the encryption subsystem 203.

[0065] Step 3, the encryption subsystem 203 uses the data key to encrypt the encrypted broadcast plaintext and outputs the broadcast ciphertext, which is transparently forwarded to the application terminal 10 via the satellite. The data is encrypted in a 1:1 manner, that is, the plaintext and ciphertext data have the same length, do not carry other information, and have no additional data overhead.

[0066] Step 4, the application terminal 10 obtains the business key and validity period from the security zone and verifies the validity. If the business key is within the validity period, the terminal data key dynamic generation module calculates the data key in real time, and the cryptographic software uses the data key to decrypt the broadcast ciphertext and output the broadcast plaintext for subsequent processing; if it exceeds the validity period, no processing is performed.

[0067] In some embodiments of the present application, the data key real-time dynamic update process, such as Figure 8 shown.

[0068] The data keys used for broadcast plaintext encryption and ciphertext decryption are dynamically generated based on business keys, timestamps, and key update policies to ensure the real-time and security of data keys.

[0069] The present application also provides a data encryption method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0070] The data encryption method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Fig. 9 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data encryption method. Fig. 9 As shown, the computer terminal 90 may include one or more (902a, 902b, ..., 902n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 904 for storing data, and a transmission module 906 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. A person skilled in the art can understand that Fig. 9 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig. 9 More or fewer components as shown, or with Fig. 9 Different configurations are shown.

[0071] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 90. As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0072] The memory 904 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data encryption method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 904, that is, the above-mentioned data encryption method is realized. The memory 904 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 904 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 90 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0073] The transmission module 906 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 90. In one example, the transmission module 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 906 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0074] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 90 .

[0075] It should be noted that, in some optional embodiments, the above Fig. 9 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Fig. 9 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0076] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a data encryption method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0077] Fig.10 is a flow chart of a data encryption method according to an embodiment of the present application, such as Fig.10 As shown, the method comprises the following steps:

[0078] Step S110, when receiving the plaintext broadcast data, generating a data key, wherein the data key is generated at least according to a key update strategy;

[0079] Step S120: encrypt the broadcast data plaintext using the data key to obtain broadcast data ciphertext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0080] When the plain text broadcast data is received, the specific steps of generating the data key include: obtaining the service key and the current timestamp; and generating the data key according to the service key and the current timestamp in accordance with the key update policy.

[0081] Fig.11 is a flow chart of a data decryption method according to an embodiment of the present application. Fig.10 As shown, the method comprises the following steps:

[0082] Step S210, sending a business key application to the service system;

[0083] Step S220, receiving the service key sent by the service system;

[0084] Step S230, generates the data key according to the business key in accordance with the key update strategy, and uses the data key to decrypt the received broadcast data ciphertext, and outputs the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

[0085] The data encryption and decryption system, data encryption method and decryption method provided in the embodiment of the present application adopt the terminal key encryption service key mode, which ensures that no additional data overhead is added while meeting the requirements of different terminal maintenance keys, unlimited terminal access number, terminal opening service at any time, and independent and unrelated to the terminal opening service in the forward direction, and the effective data proportion of broadcast transmission is 100%, making full use of limited satellite bandwidth resources; under the constraint of no two-way communication, the key and update strategy pre-embedded strategy and non-negotiation real-time dynamic key generation technology are adopted to support regular real-time update of broadcast data keys to ensure the security of key and data transmission. Support key distribution management of unlimited access terminals, simplify service system management, and reduce network overhead and maintenance and operation costs.

[0086] According to another aspect of the embodiment of the present application, a computer device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned data encryption method.

[0087] According to another aspect of the embodiment of the present application, a computer device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned data decryption method.

[0088] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned data encryption method by running the computer program.

[0089] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned data decryption method by running the computer program.

[0090] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data encryption method when executed by a processor.

[0091] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data decryption method when executed by a processor.

[0092] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0093] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0096] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a communication device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0098] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data encryption and decryption system, characterized in that: include: Application terminal and service system, the service system includes: application management subsystem, key management subsystem and encryption subsystem; The encryption subsystem is used to send a data key application to the key management subsystem when receiving the plain text broadcast data, receive the data key sent by the key management subsystem, and use the data key to encrypt the plain text broadcast data to obtain the ciphertext broadcast data; The key management subsystem is used to receive the data key application and generate the data key at least according to the key update strategy; The application management subsystem is used to receive the service key application sent by the application terminal, and send the service key generated by the key management subsystem to the application terminal; The application terminal is used to generate the data key according to the business key and the key update strategy, and use the data key to decrypt the broadcast data ciphertext to output the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

2. The system according to claim 1, characterized in that The application terminal is also used to send a terminal service activation application to the application management subsystem, and receive a response message sent by the application management subsystem after successfully activating the terminal service according to the application terminal identifier and the service validity period, confirming that the terminal service is successfully activated, wherein the terminal service activation application at least includes the application terminal identifier and the service validity period.

3. The system according to claim 2, characterized in that The application management subsystem is further used to receive terminal key application information sent by the application terminal after the terminal service is activated, and obtain the application terminal identifier and the application scenario of the terminal service from the terminal key application information, and send the application terminal identifier, the application scenario of the terminal service and the terminal key validity period generated according to the preset policy to the key management subsystem; The key management subsystem is used to generate a terminal key according to the application terminal identifier, the application scenario of the terminal service and the validity period of the terminal key, and send the terminal key to the application management subsystem, wherein the application scenarios of the terminal service include: with a ground network and without a ground network.

4. The system according to claim 3, characterized in that The key management subsystem generates a terminal key when the application scenario has a ground network; The key management subsystem generates multiple terminal keys when the application scenario is without a ground network, wherein the total validity period of the multiple terminal keys is the same as the service validity period, and the validity period of each of the multiple terminal keys is the same.

5. The system according to claim 1, characterized in that The key management subsystem is used to receive the service key application information sent by the application terminal when the application terminal receives the terminal key; The key management subsystem is further used to extract the application terminal identifier from the business key application information, and obtain the public key in the terminal key according to the application terminal identifier; The key management subsystem is also used to use the public key to encrypt the business key, the business key validity period and the key update policy to obtain an encrypted ciphertext, and send the encrypted ciphertext to the application terminal.

6. The system according to claim 5, characterized in that The application terminal is also used to, when the terminal key is valid, use the private key in the terminal key to decrypt the encrypted ciphertext to obtain the business key, the validity period of the business key and the key update policy.

7. The system according to claim 6, characterized in that The key management subsystem is further used to generate the data key based on the business key and timestamp according to the key update policy.

8. A data encryption method, characterized in that: include: When receiving the plaintext broadcast data, generating a data key, wherein the data key is generated at least according to a key update strategy; The broadcast data plaintext is encrypted using the data key to obtain a broadcast data ciphertext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

9. The method according to claim 8, characterized in that When receiving the plaintext broadcast data, generate a data key, including: Get the business key and current timestamp; The data key is generated according to the business key and the current timestamp in accordance with the key update policy.

10. A data decryption method, characterized in that: include: Send a business key application to the service system; Receiving a service key sent by the service system; A data key is generated according to the business key in accordance with the key update strategy, and the received broadcast data ciphertext is decrypted using the data key to output the broadcast data plaintext, wherein the data length of the broadcast data plaintext is the same as the data length of the broadcast data ciphertext.

11. A computer device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the data encryption method described in claim 8.

12. A computer device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the data decryption method according to claim 10.

13. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the data encryption method of claim 8 is implemented.

14. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the data decryption method according to claim 10 is implemented.

Images