Data transmission method and related device

Abstract

The invention discloses a data transmission method and a related device, and relates to the technical field of encryption. When a first terminal needs to send first data to a second terminal, whether encryption software of the first terminal is in an online state or not can be judged firstly, and when the encryption software of the first terminal is in the online state, the first terminal can encrypt the to-be-sent first data to obtain a first ciphertext and send the first ciphertext to a server. And the server side decrypts the first ciphertext to obtain the first data and then sends the notification information to the second terminal, so that the second terminal can enable the encryption software to be in an online state, encrypts the first data to obtain the second ciphertext and sends the second ciphertext to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data.

Description

Technical Field

[0001] The present invention belongs to the field of encryption technology, and in particular to a data transmission method and related device. Background Art

[0002] With the development of quantum technology, communication between users is usually conducted in the form of social software, that is, the information exchanged between users is usually transmitted on the public Internet. At this time, the information exchanged faces a greater risk of being leaked.

[0003] Some information may be sensitive, and users may want to keep it confidential to avoid information leakage. In this case, the information needs to be encrypted for transmission. Therefore, in the process of information interaction between two terminals, it is important to adopt a protection scheme to effectively protect the information. Summary of the invention

[0004] The purpose of the present invention is to provide a data transmission method and related devices, in which during the data interaction between the first terminal and the second terminal, when the data is transmitted on the public network, it is transmitted in ciphertext form, thereby ensuring the security of data transmission. The first terminal and the second terminal do not need to directly establish a session key, but the first terminal and the second terminal respectively establish a session key with the server, so as to realize the encrypted transmission between the first terminal and the second terminal. This method can greatly improve the applicability in the process of data encryption interaction.

[0005] In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to a first terminal, wherein the first terminal is connected to a second terminal through a server; the method includes:

[0006] Determine whether the encryption software of the first terminal is online; wherein the encryption software of the first terminal has completed the encryption and decryption protocol agreement with the server in advance;

[0007] When the encryption software of the first terminal is in an online state, encrypting the first data to be sent to obtain a first ciphertext, and sending the first ciphertext to the server;

[0008] The server is used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain the second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

[0009] Optionally, encrypting the first data to be sent to obtain the first ciphertext includes:

[0010] Encrypting the first data using a predefined encryption algorithm to obtain the first ciphertext;

[0011] The predefined encryption algorithm is any of the following:

[0012] Post-quantum algorithms;

[0013] National secret algorithm;

[0014] International Algorithm;

[0015] A first hybrid algorithm based on the above post-quantum algorithm and the above national secret algorithm;

[0016] A second hybrid algorithm based on the above post-quantum algorithm and the above international algorithm;

[0017] A third hybrid algorithm based on the above national secret algorithm and the above international algorithm;

[0018] The fourth hybrid algorithm based on the above-mentioned post-quantum algorithm, the above-mentioned national secret algorithm and the above-mentioned international algorithm.

[0019] Optionally, before sending the first ciphertext to the server, the method further includes:

[0020] The first identity authentication information is sent to the above-mentioned server; wherein the above-mentioned server is used to verify the above-mentioned first identity authentication information, and, when the verification is passed, to determine the session key for decrypting the encrypted information sent by the above-mentioned first terminal.

[0021] Optionally, the first identity verification information is obtained in the following manner:

[0022] Generate a key pair, wherein the key pair includes: a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national secret algorithm;

[0023] Generate a certificate acquisition request based on the post-quantum public key, the national secret public key, and the attribute information of the first terminal in the key pair; and send the certificate acquisition request to the certificate generation server;

[0024] The attribute information of the first terminal includes at least one of the following: domain name information, user identity information corresponding to the first terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request; and is used to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal;

[0025] The certificate ciphertext is decrypted to obtain the private key corresponding to the public key certificate, and the first identity authentication information is generated using the private key corresponding to the public key certificate and the public key certificate.

[0026] Optionally, the server is further used to generate a symmetric key, and use the symmetric key to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext; the server is further used to encrypt the symmetric key using the national secret public key and the post-quantum public key to obtain the key ciphertext; and return the key ciphertext, the certificate ciphertext and the public key certificate to the first terminal;

[0027] And, decrypting the certificate ciphertext to obtain the private key corresponding to the public key certificate includes:

[0028] Using the national secret private key and the post-quantum private key, decrypt the key ciphertext to obtain the symmetric key;

[0029] The symmetric key is used to decrypt the certificate ciphertext to obtain the private key corresponding to the public key certificate.

[0030] In a second aspect, an embodiment of the present application provides a data transmission method, which is applied to a second terminal, where the second terminal is connected to the first terminal through a server; the method includes:

[0031] In response to receiving the notification information sent by the server, controlling the encryption software of the second terminal to be in an online state; wherein the server is used to generate the notification information based on the first data to be sent to the first terminal; and the server is also used to send the notification information to the second terminal;

[0032] Sending a notification message that the encryption software is online to the server;

[0033] The server is used to encrypt the first data to obtain a second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance;

[0034] Receive the second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

[0035] In a third aspect, an embodiment of the present application provides a data transmission method, which is applied to a server, wherein a first terminal and a second terminal are connected to each other through the server, and both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server; and the method includes:

[0036] In response to receiving a first ciphertext sent by a first terminal, decrypting the first ciphertext to obtain first data; wherein the first terminal is used to encrypt the first data to obtain the first ciphertext;

[0037] generating notification information based on the first data, and sending the notification information to the second terminal;

[0038] Based on the notification information fed back by the second terminal, encrypt the first data to obtain a second ciphertext, and send the second ciphertext to the second terminal;

[0039] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0040] In a fourth aspect, an embodiment of the present application provides a data transmission device, which is applied to a first terminal, wherein the first terminal is connected to a second terminal through a server; the method includes:

[0041] A detection unit, used to determine whether the encryption software of the first terminal is online; wherein the encryption software of the first terminal completes the encryption and decryption protocol agreement with the server in advance;

[0042] An encryption unit, used for encrypting the first data to be sent to obtain a first ciphertext when the encryption software of the first terminal is in an online state, and sending the first ciphertext to the server;

[0043] The server is used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain the second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

[0044] In a fifth aspect, an embodiment of the present application provides a data transmission device, which is applied to a second terminal, and the second terminal is connected to the first terminal through a server; the method includes:

[0045] A control unit, configured to control the encryption software of the second terminal to be in an online state in response to receiving the notification information sent by the server; wherein the server is configured to generate the notification information based on the first data to be sent to the first terminal; and the server is further configured to send the notification information to the second terminal;

[0046] A sending unit, used for sending a notification message that the encryption software is in an online state to the server;

[0047] The server is used to encrypt the first data to obtain a second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance;

[0048] The receiving unit is used to receive the second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

[0049] In a sixth aspect, an embodiment of the present application provides a data transmission device, which is applied to a server, a first terminal and a second terminal are connected to each other through the server, and both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server; and the method includes:

[0050] A decryption unit, configured to, in response to receiving a first ciphertext sent by a first terminal, decrypt the first ciphertext to obtain first data; wherein the first terminal is configured to encrypt the first data to obtain the first ciphertext;

[0051] A transmission unit, configured to generate notification information based on the first data, and send the notification information to the second terminal;

[0052] an encryption unit, configured to encrypt the first data to obtain a second ciphertext based on the notification information fed back by the second terminal, and send the second ciphertext to the second terminal;

[0053] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0054] In the seventh aspect, another embodiment of the present application provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the data transmission method when running.

[0055] In the eighth aspect, another embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the data transmission method.

[0056] The present invention provides a data transmission method and related device. When a first terminal needs to send first data to a second terminal, it can first determine whether the encryption software of the first terminal is online. When the encryption software of the first terminal is online, the first terminal can encrypt the first data to be sent to obtain the first ciphertext, and send the first ciphertext to the server. After the server decrypts the first ciphertext to obtain the first data, it sends a notification message to the second terminal, so that the second terminal can put the encryption software online, and can encrypt the first data to obtain the second ciphertext, send the second ciphertext to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data. In the entire data transmission process, the public network transmission stage is carried out in the form of ciphertext, so that the security of data transmission can be guaranteed. At the same time, the encryption and decryption protocol established between the terminal and the server does not need to be established between the terminals.

[0057] Furthermore, each terminal needs to establish an encryption and decryption protocol with the server, so that encrypted transmission between terminals can be realized, and the applicability of the encrypted transmission process is relatively high. At the same time, when the terminal needs to receive an encrypted message, the server first sends a notification message to ensure that the encryption software of the receiving terminal is online, so that the user can decrypt the encrypted information without feeling, which makes the user's operation burden during the entire data transmission process smaller, and while ensuring the encrypted transmission of information, it also guarantees the user's human-computer interaction experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of a data transmission method according to an embodiment of the present invention;

[0059] Figure 2 A schematic diagram of a data transmission process provided by an embodiment of the present invention;

[0060] Figure 3 A schematic diagram of another data transmission process provided by an embodiment of the present invention;

[0061] Figure 4 A schematic diagram of a certificate issuance process provided by an embodiment of the present invention;

[0062] Figure 5 A schematic diagram of constructing a transmission protocol provided by an embodiment of the present invention;

[0063] Figure 6 A schematic diagram of a data transmission method according to an embodiment of the present invention;

[0064] Figure 7 A schematic diagram of a data transmission method according to an embodiment of the present invention;

[0065] Figure 8 A connection diagram of a data transmission device provided by an embodiment of the present invention;

[0066] Fig. 9 A connection diagram of another data transmission device provided by an embodiment of the present invention;

[0067] Fig.10 A connection diagram of another data transmission device provided by an embodiment of the present invention;

[0068] Fig.11 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0070] As can be seen from the description of the background art, during the terminal interaction process, the transmitted data may be leaked. In order to avoid this situation, it is usually necessary to keep important data confidential during the interaction process to protect the security of the data.

[0071] In the related technology, when terminal A needs to send information to terminal B, terminal A and terminal B can establish an encryption and decryption protocol in advance, so that terminal A can encrypt the data and obtain the ciphertext, which can be sent to the server and forwarded to terminal B through the server. Terminal B can decrypt the ciphertext to obtain the data corresponding to the ciphertext.

[0072] However, this method requires that terminal A and terminal B establish an encryption and decryption protocol in advance. In actual application, the need to establish an encryption and decryption protocol in advance between terminals is usually more complicated, requiring both terminals to establish a session key in advance, and a terminal may have a session with multiple terminals, in which case a terminal may need multiple session keys. Therefore, the data encryption transmission method in the related art obviously has great limitations.

[0073] In the present disclosure, during the data interaction between the first terminal and the second terminal, when the data is transmitted on the public network, it is transmitted in ciphertext form, so that the security of data transmission can be guaranteed. The first terminal and the second terminal do not need to directly establish a session key, but the first terminal and the second terminal respectively establish a session key with the server, so as to realize the encrypted transmission between the first terminal and the second terminal. This method can greatly improve the applicability in the process of data interaction that requires encryption.

[0074] See also Figure 1 , Figure 1 A flow chart of a data transmission method provided in an embodiment of the present invention is provided. The data transmission method can be applied to a first terminal, and the first terminal and a second terminal can be connected for communication via a server.

[0075] In the present disclosure, it can be understood that the interaction between terminals can be performed through the server.

[0076] like Figure 1 As shown, the above data transmission method may include:

[0077] Step 101: Determine whether the encryption software of the first terminal is online.

[0078] Step 102: When the encryption software of the first terminal is online, encrypt the first data to be sent to obtain a first ciphertext, and send the first ciphertext to the server.

[0079] Here, the server can be used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain the second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext based on the encryption software of the second terminal to obtain the first data.

[0080] Here, the encryption software of the first terminal has pre-established an encryption and decryption protocol with the server, and of course, the encryption software of the second terminal has also pre-established an encryption and decryption protocol with the server.

[0081] As an example, the first data can be understood as data that the first terminal needs to send to the second terminal. For example, if a chat application is installed on the first terminal, information can be sent to the chat application installed on the second terminal through the chat application. At this time, the chat data generated by the chat application can be understood as the first data.

[0082] As an example, when the encryption software is online, the encryption software can create a virtual network interface, receive chat data generated by the chat application in the first terminal, and encrypt the chat data to generate a first ciphertext, which can be sent to the server through the physical network interface of the first terminal.

[0083] As an example, after receiving the first ciphertext, the server can decrypt the first ciphertext to obtain the first data because the server and the first terminal have already established an encryption and decryption protocol in advance. At this time, the server does not directly send the first data to the second terminal, but only sends a notification message to the second terminal to notify the second terminal to receive the first ciphertext sent by the first terminal. The first data can be encrypted according to the encryption and decryption protocol pre-established by the server and the second terminal to obtain the second ciphertext.

[0084] After the second terminal completes the activation of the encryption software, it can feed back to the server, so that the server sends the second ciphertext to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data.

[0085] In order to facilitate the understanding of the entire data transmission process, you can combine Figure 2 To explain, Figure 2 It can be understood as a schematic diagram of a data transmission process when the first terminal 201 needs to send first data to the second terminal 202 in the present disclosure, Figure 2 It can be seen that the first data can first be encrypted into a first ciphertext by the encryption software of the first terminal 201, and then the first ciphertext can be sent to the server 203 through the physical network interface, and the server 203 can decrypt the first ciphertext to obtain the first data, and can generate notification information based on the first data, and generate a second ciphertext; the server can also send the notification information to the second terminal, and the second terminal can put the encryption software online according to the notification information, and then feedback information to the server, so that the server sends the second ciphertext, and the second terminal can decrypt the second ciphertext to obtain the first data.

[0086] As an example, the purpose of the server generating notification information based on the first data and sending the notification information to the second terminal is that the encryption software of the second terminal may not be online. At this time, the received data may directly reach the chat application through the physical network interface, and the chat application obviously cannot know the data content contained in the second ciphertext information. Therefore, when the notification information is received, it can be represented that the first terminal has sent the ciphertext to the second terminal. At this time, the second terminal may need to turn on the encryption software. In this way, after the physical interface of the second terminal receives the ciphertext, the encryption software can first decrypt the ciphertext to obtain the chat data, and then send it to the chat application, so that the chat application can obtain data that can be displayed normally.

[0087] It can be seen that this method does not require too many encryption and decryption operations when two terminals send data that needs to be encrypted to each other. It is similar to the normal process of sending unencrypted data, which improves the user's interactive experience.

[0088] In the disclosed method, during the data interaction between the first terminal and the second terminal, when the data is transmitted on the public network, it is transmitted in ciphertext, thereby ensuring the security of data transmission. The first terminal and the second terminal do not need to directly establish a session key, but the first terminal and the second terminal respectively establish a session key with the server, so as to realize the encrypted transmission between the first terminal and the second terminal. This method can greatly improve the applicability in the process of data interaction that requires encryption.

[0089] It can be seen that in the present disclosure, when the first terminal needs to send the first data to the second terminal, it can first determine whether the encryption software of the first terminal is online. When the encryption software of the first terminal is online, the first terminal can encrypt the first data to be sent to obtain the first ciphertext, and send the first ciphertext to the server. After the server decrypts the first ciphertext to obtain the first data, it sends a notification message to the second terminal, so that the second terminal can put the encryption software online, and can encrypt the first data to obtain the second ciphertext, send the second ciphertext to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data. In the entire data transmission process, the public network transmission stage is carried out in the form of ciphertext, so that the security of data transmission can be guaranteed. At the same time, the encryption and decryption protocol established between the terminal and the server does not need to be established between the terminals.

[0090] Furthermore, each terminal needs to establish an encryption and decryption protocol with the server, so that encrypted transmission between terminals can be realized, and the applicability of the encrypted transmission process is relatively high. At the same time, when the terminal needs to receive an encrypted message, the server first sends a notification message to ensure that the encryption software of the receiving terminal is online, so that the user can decrypt the encrypted information without feeling, which makes the user's operation burden during the entire data transmission process smaller, and while ensuring the encrypted transmission of information, it also guarantees the user's human-computer interaction experience.

[0091] It should be understood that the establishment of the encryption and decryption protocol can be understood as an agreement between the encryption and decryption system and the encryption software, that is, the encryption and decryption system includes a session key corresponding to the encryption software in each terminal.

[0092] In some embodiments, "encrypting the first data to be sent to obtain the first ciphertext" in step 102 may specifically include:

[0093] The first data is encrypted using a predefined encryption algorithm to obtain a first ciphertext.

[0094] Here, the predefined encryption algorithm uses any of the following:

[0095] Post-quantum algorithms;

[0096] National secret algorithm;

[0097] International Algorithm;

[0098] The first hybrid algorithm based on post-quantum algorithm and national secret algorithm;

[0099] The second hybrid algorithm based on post-quantum algorithm and international algorithm;

[0100] The third hybrid algorithm based on the national secret algorithm and the international algorithm;

[0101] The fourth hybrid algorithm based on post-quantum algorithm, national secret algorithm and international algorithm.

[0102] It should be understood that international algorithms usually refer to cryptographic algorithm standards formulated by international standardization organizations (such as ISO (International Organization for Standardization), IEC (International Electrotechnical Commission), ITU (International Telecommunication Union), etc.) or industry alliances (such as IETF (Internet Engineering Task Force)). International algorithms may include but are not limited to: symmetric cryptographic algorithms, asymmetric encryption algorithms, digest algorithms, digital signature algorithms, etc.

[0103] National cryptographic algorithms usually refer to a series of domestic cryptographic algorithm standards recognized and announced by the National Cryptography Administration. National cryptographic algorithms may include but are not limited to: symmetric encryption algorithms, asymmetric encryption algorithms based on elliptic curve cryptography, and block cipher algorithms.

[0104] Post-quantum algorithms, also known as post-quantum cryptography (PQC), refer to encryption algorithms that can remain secure even in the presence of quantum computers. Post-quantum algorithms may include but are not limited to: (1) lattice-based cryptographic algorithms; (2) coding-based cryptographic algorithms; (3) multivariate-based cryptographic algorithms; (4) hash-based signature algorithms. Of course, the specific post-quantum cryptographic algorithm to be used can be limited according to actual conditions.

[0105] The first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm can be understood as integrating the post-quantum key encapsulation algorithm on the basis of the national secret algorithm to obtain the final session negotiation key. This hybrid method can significantly reduce potential risks, thereby having the ability to resist key cracking by quantum computers to a certain extent. It can also be a double signature method, in which the message is signed using the traditional public key cryptography algorithm, and then the message (which may include the traditional cryptographic signature result) is signed using the post-quantum public key cryptography algorithm, and the combination of the two signature results is output. Or the order of signatures can be swapped, first signing with the post-quantum public key cryptography algorithm, and then signing with the traditional public key cryptography algorithm. During verification, only when both signature results are successfully verified, is the verification considered successful. This method ensures that even if one of the algorithms is cracked, the other algorithm can still provide security.

[0106] Of course, the hybrid encryption method based on the second hybrid algorithm of the post-quantum algorithm and the international algorithm, the hybrid encryption method based on the third hybrid algorithm of the national secret algorithm and the international algorithm, and the hybrid encryption method based on the fourth hybrid algorithm of the post-quantum algorithm, the national secret algorithm and the international algorithm can all be similar to the hybrid encryption method based on the post-quantum algorithm and the national secret algorithm; for the sake of brevity of the specification, they will not be repeated here.

[0107] It should be understood that in a specific implementation, the predefined encryption algorithm may be reasonably set according to actual conditions as to which encryption algorithm is used.

[0108] It should be understood that due to the development of quantum computing, the existing conventional encryption methods are more likely to be cracked by quantum computers when performing data encryption. Therefore, in the present disclosure, a hybrid algorithm is adopted so that the encrypted ciphertext information can resist cracking by quantum computers. At the same time, a national secret algorithm is also adopted, which can also resist cracking by classical computers.

[0109] It should be understood that a quantum computer is a physical device that follows the laws of quantum mechanics to perform high-speed mathematical and logical operations, store and process quantum information. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Quantum computers have become a key technology under research because they have the ability to process mathematical problems more efficiently than ordinary computers. For example, they can speed up the time to crack RSA keys from hundreds of years to a few hours.

[0110] In the present disclosure, the disclosed predefined encryption algorithm may include a post-quantum algorithm, thereby helping to resist attacks from quantum computers, and thus helping to make the encryption process for the first data more secure.

[0111] In some embodiments, a quantum random number generation unit may be provided in the first terminal, and the generation unit may be used to generate random numbers. When the first terminal and the server agree on an encryption and decryption protocol, the encryption and decryption may be performed based on the random numbers generated by the quantum random number generation unit. This may avoid, to a certain extent, the situation where different terminals and the server use the same session key, thereby improving the security of data transmission.

[0112] In some embodiments, when the encryption software of the first terminal is in an offline state, the first data can be directly sent to the server through the physical network interface of the first terminal, and the server can directly forward the first data to the second terminal.

[0113] That is, the present disclosure can manually control which data needs to be encrypted for transmission through encryption software, while data that does not need to be encrypted for transmission can be sent directly, thereby ensuring the timeliness of data transmission.

[0114] It can be seen that in the method disclosed in the present invention, when the first terminal and the second terminal need to perform data encryption transmission, it is only necessary to start the encryption software installed on the first terminal, and the encryption software can obtain applications that are pre-associated with the encryption software (it can be understood that the encryption software can be pre-associated with certain applications, and when the encryption software is online, the encryption software can intercept the data output by the interface of these applications, or the data that needs to be input to the interface of these applications), thereby realizing the encryption or decryption of the data related to these software (for example, the related data can be understood as the data that the software needs to send or receive). When it is not necessary to encrypt or decrypt the data related to these software, the encryption software installed on the first terminal can be directly closed.

[0115] In some embodiments, the encryption software may be understood as a VPN (Virtual Private Network).

[0116] In order to facilitate understanding of the data transmission process on the first terminal of the present disclosure, it can be combined with Figure 2 and Figure 3 Provide explanation;

[0117] Figure 3 It can be understood that when the VPN (encryption software) on the first terminal is offline, the first application (which can be a chat application) on the first terminal sends the first data (chat data), the server forwards the first data (chat data), and the second terminal receives the chat application data. The first terminal can directly send information to the server through the physical network interface, and the server can also directly forward the first data to the second terminal.

[0118] and Figure 2 By comparing the data transmission process of FIG. 1 , it can be seen that when the encryption software is online, the first data is directly sent, which is consistent with the usual data transmission process. When the encryption software is online, the following is adopted: Figure 2 The data transmission process shown is to perform encrypted transmission of data.

[0119] In some embodiments, before "sending the first ciphertext to the server" in step 102, the above method may further include:

[0120] Sending the first identity authentication information to the server;

[0121] Here, the server is used to verify the first identity authentication information, and, when the verification is successful, to determine a session key for decrypting the encrypted information sent by the first terminal.

[0122] As an example, during the interaction process, the server and the terminal device need to verify each other's identities before they can interact with each other based on the same security layer interaction protocol (Transport Layer Security, TLS).

[0123] As an example, since the server has established connections with multiple terminals, when the first terminal sends the first identity authentication information to the server, the server can determine the session key used when pre-establishing the encryption and decryption transmission protocol with the first terminal when verifying that the identity authentication information is passed, and thus can use the session key to decrypt the first data.

[0124] In some embodiments, the first identity verification information may be obtained in the following manner:

[0125] Generate a key pair; wherein the key pair may include: a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national secret algorithm;

[0126] Generate a certificate acquisition request based on the post-quantum public key, the national secret public key, and the attribute information of the first terminal in the key pair; send the certificate acquisition request to the certificate generation server; wherein the attribute information of the first terminal includes at least one of the following: domain name information, user identity information corresponding to the first terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the above certificate acquisition request; and, is used to encrypt the private key corresponding to the public key certificate, obtain the certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal;

[0127] The certificate ciphertext is decrypted to obtain a private key corresponding to the public key certificate, and the private key corresponding to the public key certificate and the public key certificate are used to generate first identity authentication information.

[0128] It should be understood that the post-quantum public and private keys in the key pair include a post-quantum private key and a post-quantum public key, and the post-quantum public and private keys can be understood as keys generated using a post-quantum algorithm. The key pair can also include a classic private key and a classic public key, which can be understood as being generated using a national secret algorithm.

[0129] As an example, the certificate generation server can be understood as a certificate authentication issuing server or a certificate authentication system. The certificate authentication system can be set up in the cloud or on the server. The certificate authentication system can issue certificates for identity information proof to the server, the first terminal, and the second terminal, thereby facilitating mutual identity authentication between the server, the first terminal, and the second terminal, thereby achieving normal encryption and decryption.

[0130] In some embodiments, the server can also be used to generate a symmetric key, use the symmetric key to encrypt the private key corresponding to the public key certificate, and obtain the certificate ciphertext; the server can also be used to encrypt the symmetric key using the national secret public key and the post-quantum public key to obtain the key ciphertext; the key ciphertext, the certificate ciphertext and the public key certificate are returned to the first terminal;

[0131] And, the above decryption certificate ciphertext obtains the private key corresponding to the public key certificate, including:

[0132] Use the national secret private key and the post-quantum private key to decrypt the key ciphertext and obtain the symmetric key;

[0133] Use the symmetric key to decrypt the certificate ciphertext and obtain the private key corresponding to the public key certificate.

[0134] As an example, since the private key corresponding to the public key certificate is usually long, it may take a long time to encrypt the private key corresponding to the public key certificate, while the symmetric key is more efficient in encrypting the private key corresponding to the public key certificate, so the time required to encrypt the private key corresponding to the public key certificate can be saved. The symmetric key is usually shorter, so the national secret public key and the post-quantum public key are used to encrypt the symmetric key. In this way, the time required to encrypt the private key corresponding to the public key certificate is accelerated, and at the same time, the private key corresponding to the public key certificate can be encrypted and transmitted.

[0135] As an example, since the first terminal generates the national secret private key and the post-quantum private key, the national secret private key and the post-quantum private key can be used to decrypt the key ciphertext to obtain the symmetric key, and then the symmetric key can be used to decrypt the certificate ciphertext to obtain the private key corresponding to the public key certificate. This method will also greatly increase the difficulty of cracking the private key corresponding to the public key certificate.

[0136] In some embodiments, the public key certificate may include a signature certificate and a packaging certificate, and the private key corresponding to the public key certificate includes a private key generated by a national secret algorithm and a private key generated by a post-quantum algorithm.

[0137] In order to facilitate understanding of the identity information authentication process of the first terminal, we can continue to combine Figure 4 To explain, Figure 4 It can be understood as a schematic diagram of the terminal identity information authentication process disclosed in the present invention, Figure 4 It can be seen that the VPN terminal of the first terminal can generate a pair of SM2 public and private keys (pk1, sk1) and a pair of Dilithium public and private keys (pk2, sk2);

[0138] The VPN terminal generates a certificate signing request (CSR). The CSR file contains the terminal's hybrid public key and some identification information, such as domain name, user information, etc. This information will be used to create a certificate and send it to the certificate authentication system;

[0139] The certificate authentication system can verify the information in the CSR;

[0140] The certificate authentication system can use its own signature hybrid private key to sign the CSR file and generate a hybrid signature certificate Cert1 for the VPN terminal;

[0141] The certificate authentication system can also generate a pair of SM2 public-private keys (pk3, sk3) and a pair of Kyber public-private keys (pk4, sk4) as the terminal's hybrid key encapsulation public-private key pair;

[0142] The certificate authentication system can also generate a hybrid key encapsulation certificate Cert2 for the VPN terminal;

[0143] The certificate authentication system can also generate a symmetric key key, encrypt the terminal's hybrid key to encapsulate the private keys sk3 and sk4, and obtain the ciphertext cipher1;

[0144] The certificate authentication system can also use the VPN terminal's SM2 signature public key PK1 to encrypt the symmetric key to obtain the ciphertext cipher2;

[0145] The certificate authentication system can also send its own certificate Cert, hybrid signature certificate Cert1, hybrid key encapsulation certificate Cert2, encrypted hybrid key encapsulation private key cipher1, and encrypted symmetric key cipher2 to the terminal;

[0146] The VPN terminal uses SM2 private key sk1 to decrypt cipher2 to obtain the symmetric key key, and uses key to decrypt cipher1 to obtain private keys sk3 and sk4;

[0147] The VPN terminal installs certificates Cert, Cert1, and Cert2, and binds Cert1 and Cert2 to the corresponding private keys.

[0148] Please continue reading Figure 5 , understand the process diagram of establishing the PQC-TLS protocol in this disclosure, such as Figure 5 As shown, the client can send a request to the server to establish a TLS session;

[0149] The server can send its own PQC hybrid signature certificate and PQC hybrid key encapsulation certificate to the client;

[0150] The client can verify whether the server's certificate is valid;

[0151] The client sends its own PQC hybrid signature certificate and PQC hybrid key encapsulation certificate to the server;

[0152] The server verifies whether the client's certificate is valid;

[0153] The client and server negotiate the session key using their PQC hybrid key encapsulation certificates.

[0154] Complete the TLS session establishment.

[0155] See also Figure 6 , Figure 6 A flow chart of a data transmission method provided in an embodiment of the present invention, the data transmission method can be applied to a second terminal, and the second terminal is connected to the first terminal through a service end;

[0156] In the present disclosure, it can be understood that the interaction between terminals can be performed through the server.

[0157] like Figure 6 As shown, the above data transmission method may include:

[0158] Step 601, in response to receiving the notification information sent by the server, controlling the encryption software of the second terminal to be in an online state;

[0159] Step 602, sending a notification message that the encryption software is online to the server;

[0160] Step 603: Receive the second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

[0161] Here, the server is used to generate notification information based on the first data to be sent to the first terminal; the server is also used to send the notification information to the second terminal;

[0162] Here, the server is used to encrypt the first data to obtain the second ciphertext after the verification notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

[0163] As an example, when the second terminal receives the notification information, it can indicate that the first terminal may have sent encrypted information to the second terminal. In order to obtain the encrypted information normally, the second terminal can put the encryption software online and inform the server. In this way, the encrypted information sent by the server can first be decrypted by the encryption software of the second terminal and then transmitted to the corresponding application for display.

[0164] It should be understood that the second terminal may also be used as a data initiator in actual applications. In this case, the process is similar to that of the first terminal as a data initiator. For the sake of brevity, it will not be described here. Of course, the first terminal may also be used as a data receiver. The process is also similar to that of the second terminal as a data receiver. For the sake of brevity, it will not be described here.

[0165] In some embodiments, the second terminal obtains the second identity authentication information in the same manner as the first terminal obtains the first identity authentication information. That is, the second terminal interacts with the certificate generation server to obtain the second identity authentication information corresponding to the second terminal. Specifically:

[0166] The second identity verification information is obtained as follows:

[0167] The second terminal may generate a key pair, wherein the key pair includes: a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national secret algorithm;

[0168] Generate a certificate acquisition request based on the post-quantum public key, the national secret public key, and the attribute information of the second terminal in the key pair; and send the certificate acquisition request to the certificate generation server;

[0169] The attribute information of the second terminal includes at least one of the following: domain name information, user identity information corresponding to the second terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request; and is used to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext, and return the certificate ciphertext and the public key certificate to the second terminal;

[0170] The certificate ciphertext is decrypted to obtain the private key corresponding to the public key certificate, and the second identity authentication information is generated using the private key corresponding to the public key certificate and the public key certificate.

[0171] In some embodiments, the notification information fed back by the second terminal to the server may include the second identity authentication information, so that the server can determine the encryption and decryption protocol used to encrypt the first data (specifically, determine the session key used) based on the second identity authentication information. In this way, the second terminal can accurately decrypt the second ciphertext sent by the server.

[0172] Please continue to see Figure 7 , Figure 7 A flow chart of a data transmission method provided in an embodiment of the present invention, the data transmission method can be applied to a server, a first terminal and a second terminal are connected for communication through the server, and both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server.

[0173] In the present disclosure, it can be understood that the interaction between terminals can be performed through the server.

[0174] like Figure 7 As shown, the above data transmission method may include:

[0175] Step 701, in response to receiving a first ciphertext sent by a first terminal, decrypting the first ciphertext to obtain first data;

[0176] Step 702, generating notification information based on the first data, and sending the notification information to the second terminal;

[0177] Step 703: based on the notification information fed back by the second terminal, encrypt the first data to obtain a second ciphertext, and send the second ciphertext to the second terminal.

[0178] The first terminal is used to encrypt the first data to obtain the first ciphertext.

[0179] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0180] As an example, the server can pre-set the encryption and decryption system. For example, the company's Benyuan Panshi software can be pre-installed to implement the encryption and decryption protocol agreement with the VPN installed on the terminal, thereby realizing the combination of post-quantum algorithm and national secret algorithm to encrypt the data that needs to be encrypted for transmission.

[0181] See also Figure 8 , Figure 8 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present invention is provided. The data transmission device 800 is applied to a first terminal. The first terminal is connected to a second terminal through a server. The device 800 includes:

[0182] The detection unit 801 is used to determine whether the encryption software of the first terminal is online; wherein the encryption software of the first terminal has completed the encryption and decryption protocol agreement with the server in advance;

[0183] The encryption unit 802 is used to encrypt the first data to be sent to obtain the first ciphertext when the encryption software of the first terminal is in an online state, and send the first ciphertext to the server;

[0184] The server is used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain the second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

[0185] In some real number examples, the encryption unit 802 is further configured to: encrypt the first data using a predefined encryption algorithm to obtain the first ciphertext;

[0186] The predefined encryption algorithm is any of the following:

[0187] Post-quantum algorithms;

[0188] National secret algorithm;

[0189] International Algorithm;

[0190] A first hybrid algorithm based on the above post-quantum algorithm and the above national secret algorithm;

[0191] A second hybrid algorithm based on the above post-quantum algorithm and the above international algorithm;

[0192] A third hybrid algorithm based on the above national secret algorithm and the above international algorithm;

[0193] The fourth hybrid algorithm based on the above-mentioned post-quantum algorithm, the above-mentioned national secret algorithm and the above-mentioned international algorithm.

[0194] In some real number examples, the encryption unit 802 is also specifically used to: send the first identity authentication information to the server; wherein the server is used to verify the first identity authentication information, and, when the verification is successful, determine the session key for decrypting the encrypted information sent by the first terminal.

[0195] In some real number examples, the data transmission device 8 is further used to obtain the first identity authentication information in the following manner:

[0196] Generate a key pair, wherein the key pair includes: a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national secret algorithm;

[0197] Generate a certificate acquisition request based on the post-quantum public key, the national secret public key, and the attribute information of the first terminal in the key pair; and send the certificate acquisition request to the certificate generation server;

[0198] The attribute information of the first terminal includes at least one of the following: domain name information, user identity information corresponding to the first terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request; and is used to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal;

[0199] The certificate ciphertext is decrypted to obtain the private key corresponding to the public key certificate, and the first identity authentication information is generated using the private key corresponding to the public key certificate and the public key certificate.

[0200] In some real number examples, the server is further used to generate a symmetric key, and use the symmetric key to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext; the server is further used to encrypt the symmetric key using the national secret public key and the post-quantum public key to obtain the key ciphertext; and return the key ciphertext, the certificate ciphertext and the public key certificate to the first terminal;

[0201] Furthermore, the data transmission device 8 is further used for:

[0202] Using the national secret private key and the post-quantum private key, decrypt the key ciphertext to obtain the symmetric key;

[0203] The symmetric key is used to decrypt the certificate ciphertext to obtain the private key corresponding to the public key certificate.

[0204] See also Fig. 9 , Fig. 9 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present invention. The data transmission device 9 is applied to a second terminal, and the second terminal is connected to the first terminal through a server. The device 900 includes:

[0205] In response to receiving the notification information sent by the server, controlling the encryption software of the second terminal to be in an online state; wherein the server is used to generate the notification information based on the first data to be sent to the first terminal; and the server is also used to send the notification information to the second terminal;

[0206] Sending a notification message that the encryption software is online to the server;

[0207] The server is used to encrypt the first data to obtain a second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance;

[0208] Receive the second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

[0209] See also Fig.10 , Fig.10 The present invention provides a schematic diagram of a data transmission device according to an embodiment of the present invention. The data transmission device 100 is applied to a server. A first terminal and a second terminal are connected to each other through the server. Both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server. The device 100 includes:

[0210] In response to receiving a first ciphertext sent by a first terminal, decrypting the first ciphertext to obtain first data; wherein the first terminal is used to encrypt the first data to obtain the first ciphertext;

[0211] generating notification information based on the first data, and sending the notification information to the second terminal;

[0212] Based on the notification information fed back by the second terminal, encrypt the first data to obtain a second ciphertext, and send the second ciphertext to the second terminal;

[0213] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0214] Fig.11 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the functions of a computer system for implementing the method for generating an amplitude preparation circuit in any of the above-mentioned embodiments are realized.

[0215] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the computer executes the functions of the computer system of the data transmission method in any of the above-mentioned embodiments.

[0216] The embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enables the computer to perform the functions of a computer system of the data transmission method in any of the above embodiments.

[0217] It should be understood that the specific examples in this application are only intended to help those skilled in the art to better understand the embodiments of the present application, rather than to limit the scope of the present invention.

[0218] It can be understood that in the various implementations of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of the present application.

[0219] It can be understood that the various embodiments described in this application can be implemented individually or in combination, and the embodiments of this application are not limited to this.

[0220] Unless otherwise stated, all technical and scientific terms used in the embodiments of the present application have the same meaning as those generally understood by those skilled in the art of the technical field of the present application. The terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the scope of the present application. The term "and / or" used in the present application includes any and all combinations of one or more related listed items. The singular forms of "a kind of", "above" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0221] It can be understood that the processor of the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method implementation can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (DigitalSignal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiment of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0222] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0223] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0224] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0225] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0226] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0227] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0228] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0229] The above are only specific embodiments of the present application, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A data transmission method, characterized in that: Applied to a first terminal, the first terminal is connected to a second terminal through a server; the method includes: Determine whether the encryption software of the first terminal is online; wherein the encryption software of the first terminal completes the encryption and decryption protocol agreement with the server in advance; When the encryption software of the first terminal is in an online state, encrypting the first data to be sent to obtain a first ciphertext, and sending the first ciphertext to the server; The server is used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain a second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

2. The method according to claim 1, characterized in that The step of encrypting the first data to be sent to obtain the first ciphertext includes: Encrypting the first data using a predefined encryption algorithm to obtain the first ciphertext; The predefined encryption algorithm is any one of the following: Post-quantum algorithms; National secret algorithm; International Algorithm; A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm; A second hybrid algorithm based on the post-quantum algorithm and the international algorithm; A third hybrid algorithm based on the national secret algorithm and the international algorithm; A fourth hybrid algorithm based on the post-quantum algorithm, the national secret algorithm and the international algorithm.

3. The method according to claim 1, characterized in that Before sending the first ciphertext to the server, the method further includes: The first identity authentication information is sent to the server; wherein the server is used to verify the first identity authentication information, and, when the verification is successful, to determine a session key for decrypting the encrypted information sent by the first terminal.

4. The method according to claim 3, characterized in that The first identity verification information is obtained by: Generate a key pair, wherein the key pair includes: a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national secret algorithm; Generate a certificate acquisition request based on the post-quantum public key, the national secret public key, and the attribute information of the first terminal in the key pair; and send the certificate acquisition request to the certificate generation server; The attribute information of the first terminal includes at least one of the following: domain name information, user identity information corresponding to the first terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request; and is used to encrypt the private key corresponding to the public key certificate to obtain a certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal; The certificate ciphertext is decrypted to obtain a private key corresponding to the public key certificate, and the first identity authentication information is generated using the private key corresponding to the public key certificate and the public key certificate.

5. The method according to claim 4, characterized in that The server is also used to generate a symmetric key, and use the symmetric key to encrypt the private key corresponding to the public key certificate to obtain the certificate ciphertext; the server is also used to encrypt the symmetric key using the national secret public key and the post-quantum public key to obtain the key ciphertext; Returning the key ciphertext, the certificate ciphertext and the public key certificate to the first terminal; And, decrypting the certificate ciphertext to obtain the private key corresponding to the public key certificate includes: Decrypt the key ciphertext using the national secret private key and the post-quantum private key to obtain the symmetric key; The certificate ciphertext is decrypted using the symmetric key to obtain the private key corresponding to the public key certificate.

6. A data transmission method, characterized in that: Applied to a second terminal, the second terminal is connected to the first terminal through a server; the method includes: In response to receiving the notification information sent by the server, controlling the encryption software of the second terminal to be in an online state; wherein the server is used to generate the notification information based on the first data to be sent to the first terminal; the server is also used to send the notification information to the second terminal; Sending notification information that the encryption software is in an online state to the server; The server is used to encrypt the first data to obtain a second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance; Receive a second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

7. A data transmission method, characterized in that: Applied to a server, a first terminal and a second terminal are connected to each other through the server, and both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server; and the method comprises: In response to receiving a first ciphertext sent by a first terminal, decrypting the first ciphertext to obtain first data; wherein the first terminal is used to encrypt the first data to obtain the first ciphertext; generating notification information based on the first data, and sending the notification information to the second terminal; Based on the notification information fed back by the second terminal, encrypt the first data to obtain a second ciphertext, and send the second ciphertext to the second terminal; The second terminal is used to decrypt the second ciphertext to obtain the first data.

8. A data transmission device, characterized in that: Applied to a first terminal, the first terminal is connected to a second terminal through a server; the method includes: A detection unit, used to determine whether the encryption software of the first terminal is in an online state; wherein the encryption software of the first terminal completes an encryption and decryption protocol agreement with the server in advance; an encryption unit, configured to encrypt the first data to be sent to obtain a first ciphertext when the encryption software of the first terminal is in an online state, and to send the first ciphertext to the server; The server is used to decrypt the first ciphertext to obtain the first data, and to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be online based on the notification information; the server is also used to encrypt the first data to obtain a second ciphertext, and to send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

9. A data transmission device, characterized in that: Applied to a second terminal, the second terminal is connected to the first terminal through a server; the method includes: A control unit, configured to control the encryption software of the second terminal to be in an online state in response to receiving the notification information sent by the server; wherein the server is configured to generate the notification information based on the first data to be sent to the first terminal; and the server is further configured to send the notification information to the second terminal; A sending unit, used for sending notification information that the encryption software is in an online state to the server; The server is used to encrypt the first data to obtain a second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance; A receiving unit is used to receive a second ciphertext sent by the server, and decrypt the second ciphertext to obtain the first data.

10. A data transmission device, characterized in that: Applied to a server, a first terminal and a second terminal are connected to each other through the server, and both the first terminal and the second terminal pre-establish an encryption and decryption protocol with the server; and the method comprises: a decryption unit, configured to, in response to receiving a first ciphertext sent by a first terminal, decrypt the first ciphertext to obtain first data; wherein the first terminal is configured to encrypt the first data to obtain the first ciphertext; a transmission unit, configured to generate notification information based on the first data, and send the notification information to a second terminal; an encryption unit, configured to encrypt the first data to obtain a second ciphertext based on the notification information fed back by the second terminal, and send the second ciphertext to the second terminal; The second terminal is used to decrypt the second ciphertext to obtain the first data.

11. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

12. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images