Data transmission method and related apparatus

Abstract

The application discloses a data transmission method and related device, and relates to the field of encryption technology; when a first terminal needs to send first data to a second terminal, it can be judged whether encryption software of the first terminal is in an online state; when the encryption software of the first terminal is in the online state, the first terminal can encrypt the first data to be sent to obtain first ciphertext, and send the first ciphertext to a server. After the server decrypts the first ciphertext to obtain the first data, the server sends notification information to the second terminal, so that the encryption software of the second terminal can be in the online state, the first data can be encrypted to obtain second ciphertext, the second ciphertext is sent to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of encryption technology, and particularly relates to a data transmission method and related device. BACKGROUND

[0002] With the development of quantum technology, the communication between users is usually carried out in the form of social software, that is, the information communicated between users is usually transmitted on the public Internet, at this time, the communicated information faces a greater risk of being leaked.

[0003] And some information can be relatively sensitive information, and the user can hope to be kept secret to avoid information leakage, at this time, the information needs to be encrypted and transmitted. Therefore, in the information interaction process between two terminals, it is of great significance to adopt a protection scheme to effectively protect the information. SUMMARY

[0004] The purpose of the application is to provide a data transmission method and related device, in the process of data interaction between the first terminal and the second terminal, when the data is transmitted on the public network, the data is transmitted in the form of ciphertext, so as to ensure the security of data transmission. The first terminal and the second terminal do not need to directly establish a session key, but the first terminal and the second terminal establish a session key with the server respectively, so as to realize the encrypted transmission between the first terminal and the second terminal. This way can greatly improve the applicability in the process of data encryption interaction.

[0005] In a first aspect, one embodiment of the application provides a data transmission method applied to a first terminal, wherein the first terminal is communicatively connected to a second terminal through a server; the method comprises the following steps:

[0006] determining whether the encryption software of the first terminal is in an online state; wherein the encryption software of the first terminal is pre-configured with an encryption and decryption protocol with the server;

[0007] encrypting first data to be sent to obtain first ciphertext when the encryption software of the first terminal is in the online state, and sending the first ciphertext to the server;

[0008] The service end is configured to decrypt the first ciphertext to obtain the first data, and generate notification information; the service end is further configured to send the notification information to the second terminal, and the second terminal is configured to control the encryption software of the second terminal to be in an online state based on the notification information; the service end is further configured to encrypt the first data to obtain second ciphertext, and send the second ciphertext to the second terminal, and the second terminal is configured to decrypt the second ciphertext to obtain the first data; wherein the encryption software of the second terminal also pre-establishes an encryption and decryption protocol with the service end.

[0009] Optionally, the encryption of the first data to be sent to obtain the first ciphertext comprises:

[0010] The first data is encrypted by using a predefined encryption algorithm to obtain the first ciphertext.

[0011] The predefined encryption algorithm comprises any one of the following:

[0012] a post-quantum algorithm;

[0013] a national encryption algorithm;

[0014] an international encryption algorithm;

[0015] a first hybrid algorithm based on the post-quantum algorithm and the national encryption algorithm;

[0016] a second hybrid algorithm based on the post-quantum algorithm and the international encryption algorithm;

[0017] a third hybrid algorithm based on the national encryption algorithm and the international encryption algorithm;

[0018] a fourth hybrid algorithm based on the post-quantum algorithm, the national encryption algorithm and the international encryption algorithm.

[0019] Optionally, before the first ciphertext is sent to the service end, the method further comprises:

[0020] sending first identity authentication information to the service end; wherein the service end is configured to verify the first identity authentication information, and determine a session key for decrypting the encrypted information sent by the first terminal when the verification is passed.

[0021] Optionally, the first identity authentication information is obtained in the following manner:

[0022] generating a key pair, wherein the key pair comprises a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national encryption algorithm;

[0023] Generate a certificate acquisition request based on the post-quantum public key, the national public key, and the attribute information of the first terminal in the key pair; and send the certificate acquisition request to a certificate generation server;

[0024] The attribute information of the first terminal includes at least one of domain name information and user identity information corresponding to the first terminal; the certificate generation server is configured to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request; and encrypt the private key corresponding to the public key certificate to obtain certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal;

[0025] Decrypt the certificate ciphertext to obtain the private key corresponding to the public key certificate, and generate the first identity verification information using the private key corresponding to the public key certificate and the public key certificate.

[0026] Optionally, the server is further configured to generate a symmetric key, encrypt the private key corresponding to the public key certificate using the symmetric key to obtain certificate ciphertext; the server is further configured to encrypt the symmetric key using the national public key and the post-quantum public key to obtain key ciphertext; and return the key ciphertext, the certificate ciphertext, and the public key certificate to the first terminal;

[0027] And the decryption of the certificate ciphertext to obtain the private key corresponding to the public key certificate comprises:

[0028] Decrypt the key ciphertext using the national private key and the post-quantum private key to obtain the symmetric key;

[0029] Decrypt the certificate ciphertext using the symmetric key to obtain the private key corresponding to the public key certificate.

[0030] In a second aspect, an embodiment of the present application provides a data transmission method applied to a second terminal, the second terminal being communicatively connected to a first terminal through a server; the method comprising:

[0031] In response to receiving notification information sent by the server, control the encryption software of the second terminal to be in an online state; wherein the server is configured to generate notification information based on first data to be sent to the first terminal; and the server is further configured to send the notification information to the second terminal;

[0032] Send notification information that the encryption software is in an online state to the server;

[0033] The service end encrypts the first data to obtain second ciphertext after the notification information is verified, and sends the second ciphertext to the second terminal.

[0034] The second ciphertext sent by the service end is received, and the second ciphertext is decrypted to obtain the first data.

[0035] In a third aspect, an embodiment of the present application provides a data transmission method applied to a service end, a first terminal and a second terminal are connected through the service end, the first terminal and the second terminal both pre-establish an encryption and decryption protocol with the service end, and the method comprises the following steps.

[0036] The first ciphertext sent by the first terminal is received, and the first ciphertext is decrypted to obtain first data, wherein the first terminal is used to encrypt the first data to obtain the first ciphertext.

[0037] Notification information is generated based on the first data, and the notification information is sent to the second terminal.

[0038] The first data is encrypted to obtain second ciphertext based on the notification information fed back by the second terminal, and the second ciphertext is sent to the second terminal.

[0039] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0040] In a fourth aspect, an embodiment of the present application provides a data transmission device applied to a first terminal, the first terminal and a second terminal are connected through a service end, and the method comprises the following steps.

[0041] A detection unit is configured to determine whether encryption software of the first terminal is in an online state, wherein the encryption software of the first terminal pre-establishes an encryption and decryption protocol with the service end.

[0042] An encryption unit is configured to encrypt first data to be sent to obtain first ciphertext when the encryption software of the first terminal is in the online state, and send the first ciphertext to the service end.

[0043] The service end is configured to decrypt the first ciphertext to obtain the first data, and generate notification information; the service end is further configured to send the notification information to the second terminal, and the second terminal is configured to control the encryption software of the second terminal to be in an online state based on the notification information; the service end is further configured to encrypt the first data to obtain second ciphertext, and send the second ciphertext to the second terminal, and the second terminal is configured to decrypt the second ciphertext to obtain the first data; and the encryption software of the second terminal also pre-establishes an encryption and decryption protocol with the service end.

[0044] In a fifth aspect, an embodiment of the present application provides a data transmission apparatus, applied to a second terminal, the second terminal being in communication connection with a first terminal through a service end; the method comprises the following steps:

[0045] A control unit is configured to control the encryption software of the second terminal to be in an online state in response to receiving notification information sent by the service end; the service end is configured to generate notification information based on first data to be sent to the first terminal; and the service end is further configured to send the notification information to the second terminal.

[0046] A sending unit is configured to send notification information that the encryption software is in an online state to the service end.

[0047] The service end is configured to encrypt the first data to obtain second ciphertext after verifying that the notification information is correct, and send the second ciphertext to the second terminal; and the encryption software of the second terminal also pre-establishes an encryption and decryption protocol with the service end.

[0048] A receiving unit is configured to receive second ciphertext sent by the service end, and decrypt the second ciphertext to obtain the first data.

[0049] In a sixth aspect, an embodiment of the present application provides a data transmission apparatus, applied to a service end, a first terminal and a second terminal being in communication connection through the service end, the first terminal and the second terminal pre-establishing an encryption and decryption protocol with the service end; and the method comprises the following steps:

[0050] A decryption unit is configured to decrypt first ciphertext sent by the first terminal to obtain first data in response to receiving the first ciphertext; the first terminal is configured to encrypt the first data to obtain the first ciphertext.

[0051] A transmission unit is configured to generate notification information based on the first data, and send the notification information to the second terminal.

[0052] An encryption unit is configured to encrypt the first data based on the feedback information from the second terminal to obtain second ciphertext, and send the second ciphertext to the second terminal.

[0053] The second terminal is configured to decrypt the second ciphertext to obtain the first data.

[0054] In a seventh aspect, another embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is configured to perform the data transmission method when running.

[0055] In an eighth aspect, another embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the data transmission method.

[0056] The data transmission method and related device provided by the present application can first determine whether the encryption software of the first terminal is in an online state when the first terminal needs to send first data to the second terminal, and the first terminal can encrypt the first data to be sent to obtain first ciphertext and send the first ciphertext to the server when the encryption software of the first terminal is in the online state. After the server decrypts the first ciphertext to obtain the first data, the server sends notification information to the second terminal, so that the encryption software of the second terminal can be in the online state, and the second terminal can encrypt the first data to obtain second ciphertext and send the second ciphertext to the second terminal, and the second terminal can decrypt the second ciphertext to obtain the first data. In the whole data transmission process, the public network transmission stage is in the form of ciphertext, so that the security of data transmission can be ensured, and the encryption and decryption protocol is established between the terminal and the server, and the encryption and decryption protocol does not need to be established between the terminals.

[0057] Further, each terminal needs to establish an encryption and decryption protocol with the server, so that the encryption transmission between each terminal can be realized, and the applicability of the encryption transmission process is higher. Meanwhile, when the terminal needs to receive an encrypted message, the server first sends notification information to ensure that the encryption software of the receiving terminal is in the online state, so that the user of the encrypted information can be decrypted without feeling, so that the operation burden of the user in the whole data transmission process is smaller, and the information encryption transmission is ensured, and the user's human-computer interaction experience is also ensured. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 A flowchart of a data transmission method provided by an embodiment of the present application is shown in the figure;

[0059] Figure 2 A data transmission process diagram provided by an embodiment of the present application is shown in the figure;

[0060] Figure 3 Another data transmission process diagram provided by an embodiment of the application is shown in FIG. 6.

[0061] Figure 4 A certificate issuing process diagram provided by an embodiment of the application is shown in FIG. 7.

[0062] Figure 5 A transmission protocol construction diagram provided by an embodiment of the application is shown in FIG. 8.

[0063] Figure 6 A flow diagram of a data transmission method provided by an embodiment of the application is shown in FIG. 9.

[0064] Figure 7 A flow diagram of a data transmission method provided by an embodiment of the application is shown in FIG. 10.

[0065] Figure 8 A connection diagram of a data transmission device provided by an embodiment of the application is shown in FIG. 11.

[0066] Figure 9 Another connection diagram of a data transmission device provided by an embodiment of the application is shown in FIG. 12.

[0067] Figure 10 Another connection diagram of a data transmission device provided by an embodiment of the application is shown in FIG. 13.

[0068] Figure 11 A structure diagram of a computer device provided by an embodiment of the application is shown in FIG. 14. DETAILED DESCRIPTION

[0069] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0070] As can be known from the description of the background, in the terminal interaction process, the sent data may be disclosed, and in order to avoid this situation, important data needs to be kept secret in the interaction process to protect the security of the data.

[0071] In the related art, when terminal A needs to send information to terminal B, terminal A and terminal B can establish an encryption and decryption protocol in advance, so that terminal A can encrypt the data and obtain the ciphertext, the ciphertext can be sent to the server and forwarded to terminal B through the server, and terminal B can decrypt the ciphertext to obtain the data corresponding to the ciphertext.

[0072] However, in this way, terminal A and terminal B need to establish encryption and decryption protocols in advance, and in actual application, it is usually complex to establish encryption and decryption protocols in advance between terminals, and both terminals need to establish session keys in advance. In addition, one terminal may have multiple sessions with multiple terminals, and one terminal may need multiple session keys. Therefore, the data encryption transmission method in the related art obviously has great limitations.

[0073] In the present disclosure, when data is transmitted on the public network in the process of data interaction between the first terminal and the second terminal, the data is transmitted in the form of ciphertext, so as to ensure the security of data transmission. The first terminal and the second terminal do not need to establish a session key directly, but the first terminal and the second terminal establish a session key with the server respectively, so as to realize the encryption transmission between the first terminal and the second terminal. This method can greatly improve the applicability in the process of data encryption interaction.

[0074] Referring to Figure 1 , Figure 1 A flowchart of a data transmission method provided by an embodiment of the present disclosure is shown, which can be applied to a first terminal. The first terminal and a second terminal can be connected in communication through a server.

[0075] In the present disclosure, it can be understood that the interaction between terminals can be carried out through the server.

[0076] As Figure 1 shown, the above data transmission method can include:

[0077] Step 101: Determine whether the encryption software of the first terminal is in an online state.

[0078] Step 102: When the encryption software of the first terminal is in an online state, encrypt the first data to be sent to obtain first ciphertext, and send the first ciphertext to the server.

[0079] Here, the server can be used to decrypt the first ciphertext to obtain the first data, and generate notification information. The server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be in an online state based on the notification information. The server is also used to encrypt the first data to obtain second ciphertext, and send the second ciphertext to the second terminal. The second terminal is used to decrypt the second ciphertext based on the encryption software of the second terminal to obtain the first data.

[0080] Here, the encryption software of the first terminal and the server have established an encryption and decryption protocol in advance, and of course, the encryption software of the second terminal and the server have also established an encryption and decryption protocol in advance.

[0081] As an example, the first data can be understood as the data that the first terminal needs to send to the second terminal. For instance, if a chat application is installed on the first terminal, it can send messages to the chat application installed on the second terminal. In this case, the chat data generated by the chat application can be understood as the first data.

[0082] As an example, when the encryption software is online, it can create a virtual network interface to receive chat data generated by the chat application on the first terminal, and encrypt the chat data to generate the first ciphertext. The first ciphertext can then be sent to the server through the physical network interface of the first terminal.

[0083] As an example, after receiving the first ciphertext, the server can decrypt it to obtain the first data because an encryption / decryption protocol has been pre-established between the server and the first terminal. At this point, the server does not directly send the first data to the second terminal; instead, it sends a notification to the second terminal, informing it to receive the first ciphertext sent by the first terminal. The server can then encrypt the first data according to the pre-established encryption / decryption protocol between the server and the second terminal to obtain the second ciphertext.

[0084] After the encryption software is activated on the second terminal, it can send a message to the server so that the server can send a second ciphertext to the second terminal. The second terminal can then decrypt the second ciphertext and obtain the first data.

[0085] To better understand the entire data transmission process, you can combine... Figure 2 To explain, Figure 2 This can be understood as a schematic diagram of the data transmission process when the first terminal 201 needs to send first data to the second terminal 202 in this disclosure. Figure 2 As can be seen, the first data can be encrypted into first ciphertext by the encryption software of the first terminal 201, and then the first ciphertext can be sent to the server 203 through the physical network interface. The server 203 can decrypt the first ciphertext to obtain the first data, and can generate notification information and second ciphertext based on the first data. The server can also send the notification information to the second terminal, and the second terminal can keep the encryption software online according to the notification information, and then send feedback information to the server, so that the server can send the second ciphertext. The second terminal can then decrypt the second ciphertext to obtain the first data.

[0086] As an example, the service end generates the notification information according to the first data, and sends the notification information to the second terminal, aiming at: the encryption software of the second terminal can not be in an online state, at this time, the received data can directly reach the chat application through the physical network interface, and the chat application obviously cannot know the data content contained in the second ciphertext information. Therefore, when the notification information is received, it can be represented that the first terminal sends the ciphertext to the second terminal, at this time, the second terminal can need to start the encryption software, so that after the physical interface of the second terminal receives the ciphertext, the encryption software can first decrypt the ciphertext to obtain the chat data, and then send it to the chat application, so that the chat application can obtain the data that can be normally displayed.

[0087] It can be seen that in this way, the two terminals do not need too many encryption and decryption determination operations when mutual sending of data that needs to be encrypted, which is similar to the process of normally sending non-encrypted data, so as to improve the user's use and interaction experience.

[0088] In the process of data interaction between the first terminal and the second terminal, the data is transmitted in the form of ciphertext when transmitted on the public network, so as to ensure the security of data transmission. The first terminal and the second terminal do not need to directly establish a session key, but the first terminal and the second terminal respectively establish a session key with the service end, so as to realize the encrypted transmission between the first terminal and the second terminal. This way can greatly improve the applicability in the process of data encryption interaction.

[0089] It can be seen that in the present disclosure, when the first terminal needs to send the first data to the second terminal, it can first determine whether the encryption software of the first terminal is in an online state. When the encryption software of the first terminal is in an online state, the first terminal can encrypt the to-be-sent first data to obtain the first ciphertext, and send the first ciphertext to the service end. After the service end decrypts the first ciphertext to obtain the first data, the notification information is sent to the second terminal, so that the encryption software of the second terminal can be in an online state, and the first data can be encrypted to obtain the second ciphertext, and the second ciphertext is sent to the second terminal. The second terminal can decrypt the second ciphertext to obtain the first data. In the whole data transmission process, the public network transmission stage is in the form of ciphertext, so as to ensure the security of data transmission, and the encryption and decryption protocol is established between the terminal and the service end, and the encryption and decryption protocol does not need to be established between the terminals.

[0090] Further, each terminal needs to establish an encryption and decryption protocol with the server, so as to realize encrypted transmission between terminals. The applicability of the encryption transmission process is high. Meanwhile, when a terminal needs to receive an encrypted message, the server first sends notification information to ensure that the encryption software of the receiving terminal is online, so as to realize user-unaware decryption of encrypted information, so that the user's operation burden in the whole data transmission process is small, and the user's human-computer interaction experience is guaranteed while ensuring encrypted transmission of information.

[0091] It should be understood that the establishment of the encryption and decryption protocol can be understood as an agreement between the encryption and decryption system and the encryption software, that is, the encryption and decryption system includes a session key corresponding to the encryption software in each terminal.

[0092] In some embodiments, the step 102 of "encrypting the first data to be sent to obtain first ciphertext" can specifically include:

[0093] The first data is encrypted by using a predefined encryption algorithm to obtain the first ciphertext.

[0094] Here, the predefined encryption algorithm uses any of the following:

[0095] a post-quantum algorithm;

[0096] a national algorithm;

[0097] an international algorithm;

[0098] a first hybrid algorithm based on the post-quantum algorithm and the national algorithm;

[0099] a second hybrid algorithm based on the post-quantum algorithm and the international algorithm;

[0100] a third hybrid algorithm based on the national algorithm and the international algorithm;

[0101] a fourth hybrid algorithm based on the post-quantum algorithm, the national algorithm, and the international algorithm.

[0102] It should be understood that international algorithms generally refer to cryptographic algorithm standards established by international standardization organizations (such as ISO (International Organization for Standardization), IEC (International Electrotechnical Commission), ITU (International Telecommunication Union), etc.) or industry alliances (such as IETF (Internet Engineering Task Force)). International algorithms can include but are not limited to: symmetric cryptographic algorithms, asymmetric encryption algorithms, digest algorithms, digital signature algorithms, etc.

[0103] National cryptographic algorithms generally refer to a series of domestic cryptographic algorithm standards identified and published by the National Cryptographic Administration. National cryptographic algorithms can include but are not limited to: symmetric encryption algorithms, asymmetric encryption algorithms based on elliptic curve cryptography, block cipher algorithms.

[0104] Post-quantum algorithms, also known as post-quantum cryptographic algorithms (PQC), refer to encryption algorithms that remain secure even in the face of quantum computers. Post-quantum algorithms can include but are not limited to: (1) lattice-based cryptographic algorithms; (2) code-based cryptographic algorithms; (3) multivariate-based cryptographic algorithms; (4) hash-based signature algorithms. Of course, the specific choice of post-quantum cryptographic algorithm can be limited according to actual conditions.

[0105] The first hybrid algorithm based on post-quantum algorithms and national cryptographic algorithms can be understood as integrating post-quantum key encapsulation algorithms on the basis of national cryptographic algorithms to obtain the final session negotiation key. This hybrid method can significantly reduce potential risks, thereby possessing the ability to resist key cracking by quantum computers to some extent. It can also be used in double signature mode, where a traditional public key cryptographic algorithm is used to sign a message, and then a post-quantum public key cryptographic algorithm is used to sign the message (which can include the traditional cryptographic signature result), and the combination of the two signature results is output. Or change the order of signing, first sign with the post-quantum public key cryptographic algorithm, then sign with the traditional public key cryptographic algorithm. Only when both signature results are verified successfully is the verification considered successful. This method can ensure that even if one of the algorithms is cracked, the other algorithm can still provide security guarantees.

[0106] Of course, the hybrid encryption mode based on the second hybrid algorithm of the post-quantum algorithm and the international algorithm, the hybrid encryption mode based on the third hybrid algorithm of the national algorithm and the international algorithm, and the hybrid encryption mode based on the fourth hybrid algorithm of the post-quantum algorithm, the national algorithm and the international algorithm can be similar to the hybrid encryption mode based on the post-quantum algorithm and the national algorithm. For the sake of brevity of the description, no further description is given here.

[0107] It should be understood that in the specific implementation, the specific encryption algorithm of the predefined encryption algorithm can be reasonably set according to the actual situation.

[0108] It should be understood that due to the development of quantum computing, the existing conventional encryption means has a high possibility of being cracked by a quantum computer when encrypting data. Therefore, in the present disclosure, a hybrid algorithm is used so that the ciphertext information after encryption can resist the cracking of a quantum computer, and a national algorithm is also used, which can also resist the cracking of a classical computer.

[0109] It should be understood that a quantum computer is a physical device that performs high-speed mathematical and logical operations, stores and processes quantum information according to the laws of quantum mechanics. When a device processes and computes quantum information and runs quantum algorithms, it is a quantum computer. Quantum computers have the ability to process mathematical problems more efficiently than ordinary computers, for example, they can speed up the time to crack RSA keys from hundreds of years to a few hours, so they have become a key technology under research.

[0110] In the present disclosure, the post-quantum algorithm can be included in the disclosed predefined encryption algorithm, thereby helping to resist attacks by quantum computers and making the encryption process for the first data more secure.

[0111] In some embodiments, a quantum random number generation unit can be provided in the first terminal, which can be used to generate random numbers, and when the first terminal and the server agree on the encryption and decryption protocol, the random numbers generated by the quantum random number generation unit can be used, which can to some extent avoid the situation that different terminals and the server use the same session key, thereby improving the security of data transmission.

[0112] In some embodiments, when the encryption software of the first terminal is in an offline state, the first data can be directly sent to the server through the physical network interface of the first terminal, and at this time the server can directly forward the first data to the second terminal.

[0113] That is, the present disclosure can artificially control which data needs to be encrypted and transmitted by the encryption software, and data that does not need to be encrypted and transmitted can be directly transmitted, thereby ensuring the timeliness of data transmission.

[0114] It can be seen that, in the manner of the present disclosure, when the first terminal and the second terminal need to perform data encryption transmission, only the encryption software installed on the first terminal needs to be started, and the encryption software can perform encryption or decryption on the data related to the software (for example, the related data can be understood as the data that the software needs to send or receive) by acquiring the application associated with the encryption software in advance (it can be understood that the encryption software can be associated with certain applications in advance, and when the encryption software is in an online state, the encryption software can intercept the data output by the interface of these applications or the data input to the interface of these applications). When the related data of the software does not need to be encrypted or decrypted, the encryption software installed on the first terminal can be directly closed.

[0115] In some embodiments, the encryption software can be understood as a VPN (Virtual Private Network).

[0116] In order to facilitate understanding of the data transmission process on the first terminal of the present disclosure, the following can be used for illustration: Figure 2 and Figure 3

[0117] Figure 3 It can be understood that when the VPN (encryption software) on the first terminal is in an offline state, the sending diagram of the first data (chat data) of the first application (which can be a chat application) on the first terminal, the forwarding diagram of the server, and the receiving diagram of the data of the chat application on the second terminal. The first terminal can directly send information to the server through a physical network interface, and the server can also directly forward the first data to the second terminal.

[0118] Compared with the data transmission process of Figure 2 It can be seen that when the encryption software is in an online state, the first data is directly sent, which is consistent with the usual data transmission process, and when the encryption software is in an online state, the data transmission process shown in Figure 2 is used for data encryption transmission.

[0119] In some embodiments, before the step 102 of "sending the first ciphertext to the server", the above method can further include:

[0120] sending the first identity authentication information to the server;

[0121] Here, the server is configured to verify the first identity authentication information, and to determine a session key for decrypting the encrypted information sent by the first terminal when the verification is passed.

[0122] ​As an example, in the interaction process, the server and the terminal device need to verify each other's identity before data interaction according to the same Transport Layer Security (TLS) interaction protocol.

[0123] As an example, since the server establishes a connection with multiple terminals, when the first terminal sends the first identity authentication information to the server, the server can determine the session key used when the first terminal and the server pre-establish the encryption and decryption transmission protocol when the identity authentication information is verified to be passed, so that the first data can be decrypted by using the session key.

[0124] In some embodiments, the first identity authentication information can be obtained in the following way:

[0125] A key pair is generated, wherein the key pair can include a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national cryptographic algorithm;

[0126] Based on the post-quantum public key, the national cryptographic public key, and the attribute information of the first terminal in the key pair, a certificate acquisition request is generated; the certificate acquisition request is sent to a certificate generation server; wherein the attribute information of the first terminal includes at least one of the following: domain name information, user identity information corresponding to the first terminal; the certificate generation server is used to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request, and to encrypt the private key corresponding to the public key certificate to obtain a certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal;

[0127] The private key corresponding to the public key certificate is obtained by decrypting the certificate ciphertext, and the first identity authentication information is generated by using the private key corresponding to the public key certificate and the public key certificate.

[0128] It should be understood that the post-quantum public and private key in the key pair includes a post-quantum private key and a post-quantum public key, which can be understood as a key generated by a post-quantum algorithm. The key pair can also include a classical private key and a classical public key, which can be understood as a key generated by a national cryptographic algorithm.

[0129] As an example, the certificate generation server can be understood as a certificate authentication and issuance server or a certificate authentication system, which can be set in the cloud or the server. The certificate authentication system can issue a certificate for identity information proof to the server, the first terminal and the second terminal, so as to facilitate mutual identity authentication between the server, the first terminal and the second terminal, thereby realizing normal encryption and decryption.

[0130] In some embodiments, the server can also be configured to generate a symmetric key, encrypt the private key corresponding to the public key certificate by using the symmetric key to obtain a certificate ciphertext, encrypt the symmetric key by using the national cryptographic public key and the post-quantum public key to obtain a key ciphertext, and return the key ciphertext, the certificate ciphertext and the public key certificate to the first terminal.

[0131] In addition, the decryption of the certificate ciphertext to obtain the private key corresponding to the public key certificate comprises:

[0132] The symmetric key is decrypted by using the national cryptographic private key and the post-quantum private key.

[0133] The certificate ciphertext is decrypted by using the symmetric key to obtain the private key corresponding to the public key certificate.

[0134] As an example, since the private key corresponding to the public key certificate is usually long, it may take a long time to encrypt the private key corresponding to the public key certificate, while the symmetric key is more efficient in encrypting the private key corresponding to the public key certificate, so that the time required for encrypting the private key corresponding to the public key certificate can be saved. The symmetric key is usually short, and at this time, the symmetric key is encrypted by using the national cryptographic public key and the post-quantum public key. In this way, the time required for encrypting the private key corresponding to the public key certificate is accelerated, and at the same time, the private key corresponding to the public key certificate can be transmitted in an encrypted manner.

[0135] As an example, since the first terminal generates the national cryptographic private key and the post-quantum private key, the symmetric key can be obtained by decrypting the key ciphertext by using the national cryptographic private key and the post-quantum private key, and then the private key corresponding to the public key certificate can be obtained by decrypting the certificate ciphertext by using the symmetric key. In this way, the difficulty of cracking the private key corresponding to the public key certificate is greatly increased.

[0136] In some embodiments, the public key certificate can include a signature certificate and an encapsulation certificate, and the private key corresponding to the public key certificate includes a private key generated by a national cryptographic algorithm and a private key generated by a post-quantum algorithm.

[0137] In order to facilitate the understanding of the identity information authentication process of the first terminal, the following will continue to combine Figure 4 for description, Figure 4 It can be understood as a schematic diagram of the terminal identity information authentication process of the present disclosure, which is Figure 4 As can be seen, the VPN terminal of the first terminal can generate a pair of SM2 public and private keys (pk1, sk1) and a pair of Dilithium public and private keys (pk2, sk2);

[0138] The VPN terminal generates a certificate signing request (CSR), and the CSR file contains the hybrid public key of the terminal and some identification information, such as domain name, user information, etc. These information will be used to create a certificate and sent to a certificate authentication system;

[0139] The certificate authentication system can check the information in the CSR;

[0140] The certificate authentication system can use its own signature hybrid private key to sign the CSR file to generate a hybrid signature certificate Cert1 of the VPN terminal;

[0141] The certificate authentication system can also generate a pair of SM2 public and private keys (pk3, sk3) and a pair of Kyber public and private keys (pk4, sk4) as the hybrid key encapsulation public and private key pair of the terminal;

[0142] The certificate authentication system can also generate a hybrid key encapsulation certificate Cert2 of the VPN terminal;

[0143] The certificate authentication system can also generate a symmetric key key, encrypt the hybrid key encapsulation private keys sk3 and sk4 of the terminal to obtain ciphertext cipher1;

[0144] The certificate authentication system can also use the SM2 signature public key PK1 of the VPN terminal to encrypt the symmetric key to obtain ciphertext cipher2;

[0145] The certificate authentication system can also send its own certificate Cert, hybrid signature certificate Cert1, hybrid key encapsulation certificate Cert2, encrypted hybrid key encapsulation private key cipher1, and encrypted symmetric key cipher2 to the terminal;

[0146] The VPN terminal uses the SM2 private key sk1 to decrypt cipher2 to obtain the symmetric key key, and uses the key to decrypt cipher1 to obtain the private keys sk3 and sk4;

[0147] The VPN terminal installs the certificates Cert, Cert1 and Cert2, and binds Cert1 and Cert2 with the corresponding private keys.

[0148] Please continue to refer to Figure 5 , understand the process diagram of establishing PQC-TLS protocol of the present disclosure, as Figure 5 shown, the client can send a request to the server to establish a TLS session;

[0149] The server can send its own PQC hybrid signature certificate and PQC hybrid key encapsulation certificate to the client;

[0150] The client can check whether the server's certificate is valid;

[0151] The client sends its own PQC hybrid signature certificate and PQC hybrid key encapsulation certificate to the server;

[0152] The server checks whether the client's certificate is valid;

[0153] The client and the server use a PQC hybrid key encapsulation certificate negotiation to obtain a session key;

[0154] The establishment of the TLS session is completed.

[0155] Referring to Figure 6 , Figure 6 A flowchart of a data transmission method is provided for an embodiment of the present application, and the data transmission method can be applied to a second terminal, which is in communication connection with a first terminal through a server.

[0156] In the present disclosure, it can be understood that the interaction between terminals can be performed through the server.

[0157] As Figure 6 indicated, the above data transmission method can include the following steps.

[0158] Step 601, in response to receiving the notification information sent by the server, the encryption software of the second terminal is controlled to be in an online state;

[0159] Step 602, sending the notification information that the encryption software is in the online state to the server;

[0160] Step 603, receiving the second ciphertext sent by the server, and decrypting the second ciphertext to obtain the first data.

[0161] Here, the server is configured to generate the notification information based on the first data to be sent to the first terminal, and the server is also configured to send the notification information to the second terminal.

[0162] Here, the server is configured to encrypt the first data to obtain the second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the server in advance.

[0163] As an example, when the second terminal receives the notification information, it can be indicated that the first terminal may have sent the ciphertext information to the second terminal at this time, and the second terminal can put the encryption software in an online state in order to normally obtain the ciphertext information, and inform the server, so that the ciphertext information sent by the server can be decrypted by the encryption software of the second terminal first, and then transmitted to the corresponding application for display.

[0164] It should be understood that the second terminal may also act as a data initiator in actual application, at this time, the process thereof is similar to that of the first terminal as the data initiator, and for the sake of brevity of the description, no further description is given herein. Of course, the first terminal can also act as a data receiver, and the process thereof is similar to that of the second terminal as the data receiver, and for the sake of brevity of the description, no further description is given herein.

[0165] In some embodiments, the second terminal obtains the second identity authentication information in the same way as the first terminal obtains the first identity authentication information. That is, the second terminal interacts with the certificate generation server to obtain the second identity authentication information corresponding to the second terminal. Specifically:

[0166] The second identity authentication information is obtained in the following way:

[0167] The second terminal can generate a key pair, wherein the key pair includes a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national cryptographic algorithm;

[0168] Based on the post-quantum public key, the national cryptographic public key, and the attribute information of the second terminal in the key pair, a certificate acquisition request is generated, and the certificate acquisition request is sent to the certificate generation server;

[0169] The attribute information of the second terminal includes at least one of the following: domain name information, and user identity information corresponding to the second terminal. The certificate generation server is configured to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request, and to encrypt the private key corresponding to the public key certificate to obtain a certificate ciphertext, and return the certificate ciphertext and the public key certificate to the second terminal;

[0170] The certificate ciphertext is decrypted to obtain the private key corresponding to the public key certificate, and the private key corresponding to the public key certificate and the public key certificate are used to generate the second identity authentication information.

[0171] In some embodiments, the second terminal can include the second identity authentication information in the feedback information provided to the server, so that the server can determine the encryption and decryption protocol used to encrypt the first data (specifically, determine the session key used) according to the second identity authentication information. In this way, the second terminal can accurately decrypt the second ciphertext sent by the server.

[0172] Please continue to see Figure 7 , Figure 7 A flowchart of a data transmission method is provided for an embodiment of the present application. The data transmission method can be applied to a server, and a first terminal and a second terminal are connected to the server for communication. The first terminal and the second terminal are pre-established with the server for encryption and decryption protocols.

[0173] In the present disclosure, it can be understood that the interaction between terminals can be performed through the server.

[0174] As Figure 7 shown, the data transmission method can include:

[0175] Step 701, in response to receiving the first terminal sending the first ciphertext, decrypting the first ciphertext to obtain the first data;

[0176] Step 702, generating notification information based on the first data, and sending the notification information to the second terminal;

[0177] Step 703, based on the feedback of the second terminal, encrypting the first data to obtain the second ciphertext, and sending the second ciphertext to the second terminal.

[0178] The first terminal is used to encrypt the first data to obtain the first ciphertext.

[0179] The second terminal is used to decrypt the second ciphertext to obtain the first data.

[0180] As an example, the server can set the encryption and decryption system in advance, for example, the original source of the company can be installed in advance, so as to realize the encryption and decryption protocol agreement with the VPN installed on the terminal, so as to realize the combination of post quantum algorithm and national encryption algorithm to encrypt the data needing encryption transmission.

[0181] Referring to Figure 8 , Figure 8 A structure diagram of a data transmission device provided by the embodiment of the application, the data transmission device 800 is applied to a first terminal, the first terminal and a second terminal are connected through a server; the device 800 comprises:

[0182] The detection unit 801 is used to determine whether the encryption software of the first terminal is in an online state; wherein the encryption software of the first terminal is previously arranged with the server to complete the encryption and decryption protocol agreement;

[0183] The encryption unit 802 is used to encrypt the first data to be sent to obtain the first ciphertext when the encryption software of the first terminal is in the online state, and send the first ciphertext to the server;

[0184] The server is used to decrypt the first ciphertext to obtain the first data, and is used to generate notification information; the server is also used to send the notification information to the second terminal, and the second terminal is used to control the encryption software of the second terminal to be in the online state based on the notification information; the server is also used to encrypt the first data to obtain the second ciphertext, and send the second ciphertext to the second terminal, and the second terminal is used to decrypt the second ciphertext to obtain the first data; wherein the encryption software of the second terminal also establishes the encryption and decryption protocol with the server in advance.

[0185] In some embodiments, the encryption unit 802 is further configured to encrypt the first data using a predefined encryption algorithm to obtain the first ciphertext.

[0186] The predefined encryption algorithm can be any one of the following:

[0187] a post-quantum algorithm;

[0188] a national encryption algorithm;

[0189] an international encryption algorithm;

[0190] a first hybrid algorithm based on the post-quantum algorithm and the national encryption algorithm;

[0191] a second hybrid algorithm based on the post-quantum algorithm and the international encryption algorithm;

[0192] a third hybrid algorithm based on the national encryption algorithm and the international encryption algorithm;

[0193] a fourth hybrid algorithm based on the post-quantum algorithm, the national encryption algorithm, and the international encryption algorithm.

[0194] In some embodiments, the encryption unit 802 is further configured to send the first identity authentication information to the server, wherein the server is configured to verify the first identity authentication information, and determine a session key for decrypting the encrypted information sent by the first terminal when the verification is passed.

[0195] In some embodiments, the data transmission device 8 is further configured to obtain the first identity authentication information in the following manner:

[0196] generate a key pair, wherein the key pair includes a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national encryption algorithm;

[0197] generate a certificate acquisition request based on the post-quantum public key, the national encryption public key, and attribute information of the first terminal in the key pair, and send the certificate acquisition request to a certificate generation server;

[0198] The attribute information of the first terminal includes at least one of the following: domain name information, and user identity information corresponding to the first terminal. The certificate generation server is configured to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request, and encrypt the private key corresponding to the public key certificate to obtain a certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal.

[0199] decrypt the certificate ciphertext to obtain the private key corresponding to the public key certificate, and generate the first identity authentication information using the private key corresponding to the public key certificate and the public key certificate.

[0200] In some embodiments, the server is further configured to generate a symmetric key, encrypt the private key corresponding to the public key certificate using the symmetric key to obtain certificate ciphertext, encrypt the symmetric key using the national secret key and the post-quantum key to obtain key ciphertext, and return the key ciphertext, the certificate ciphertext, and the public key certificate to the first terminal.

[0201] The data transmission device 8 is further configured to:

[0202] decrypt the key ciphertext using the national secret key and the post-quantum private key to obtain the symmetric key;

[0203] decrypt the certificate ciphertext using the symmetric key to obtain the private key corresponding to the public key certificate.

[0204] Referring to Figure 9 , Figure 9 A structural diagram of a data transmission device according to an embodiment of the present application is provided, the data transmission device 9 is applied to a second terminal, the second terminal is communicatively connected to a first terminal through a server, and the first terminal and the second terminal each pre-establishes an encryption and decryption protocol with the server; and the device 900 comprises:

[0205] in response to receiving notification information sent by the server, controlling the encryption software of the second terminal to be in an online state; wherein the server is configured to generate notification information based on first data to be sent to the first terminal, and send the notification information to the second terminal;

[0206] sending notification information that the encryption software is in an online state to the server;

[0207] wherein the server is configured to, after verifying that the notification information is passed, encrypt the first data to obtain second ciphertext, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also pre-establishes an encryption and decryption protocol with the server;

[0208] receiving second ciphertext sent by the server, and decrypting the second ciphertext to obtain the first data.

[0209] Referring to Figure 10 , Figure 10 A structural diagram of a data transmission device according to an embodiment of the present application is provided, the data transmission device 100 is applied to a server, a first terminal and a second terminal are communicatively connected through the server, and the first terminal and the second terminal each pre-establishes an encryption and decryption protocol with the server; and the device 100 comprises:

[0210] In response to receiving the first ciphertext sent by the first terminal, the first ciphertext is decrypted to obtain first data; wherein the first terminal is configured to encrypt the first data to obtain the first ciphertext;

[0211] Based on the first data, notification information is generated, and the notification information is sent to the second terminal;

[0212] Based on the notification information fed back by the second terminal, the first data is encrypted to obtain second ciphertext, and the second ciphertext is sent to the second terminal;

[0213] The second terminal is configured to decrypt the second ciphertext to obtain the first data.

[0214] Figure 11 A structure diagram of a computer device provided by an embodiment of the present application is shown, which includes a memory and a processor, the memory stores a computer program, and the processor implements the function of the computer system of the generation method of the amplitude preparation circuit in any of the above embodiments when executing the computer program.

[0215] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program makes the computer execute the function of the computer system of the data transmission method in any of the above embodiments when being executed by the computer.

[0216] The embodiment of the present application further provides a computer program product containing instructions, and the instructions make the computer execute the function of the computer system of the data transmission method in any of the above embodiments when being executed by the computer.

[0217] It can be understood that the specific examples in the present application are only to help those skilled in the art better understand the embodiments of the present application, and do not limit the scope of the present application.

[0218] It can be understood that in various embodiments of the present application, the size of the serial number of each process does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0219] It can be understood that the various embodiments described in the present application can be implemented alone or in combination, and the embodiments of the present application do not limit this.

[0220] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application. The use herein of the terms "and / or" includes a combination of one or more of the associated listed items. As used in this description and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0221] It can be understood that the processor in the embodiments of the present application can be an integrated circuit chip with a signal processing capability. In the implementation process, the steps of the above method embodiments can be completed by hardware integrated logic circuits in the processor or by instructions in the form of software. The processor mentioned above can be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor or the like. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.

[0222] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (EPROM), an electrically erasable programmable read only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM). It should be noted that the memory of the system and method described herein is intended to include but not limited to these and any other suitable type of memory.

[0223] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0224] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0225] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are merely schematic, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0226] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment scheme.

[0227] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0228] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0229] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data transmission method, characterized by, The application is applied to a first terminal, the first terminal is connected with a second terminal through a server; the method comprises: determining whether encryption software of the first terminal is in an online state; wherein the encryption software of the first terminal completes encryption and decryption protocol agreement with the server in advance; when the encryption software of the first terminal is in the online state, encrypting first data to be sent to obtain first ciphertext, and sending the first ciphertext to the server; wherein when the encryption software of the first terminal is in the online state, a virtual network interface is created, and data is received and encrypted and decrypted through the virtual network interface; an input interface of the encryption software of the first terminal is connected with an output interface of an application generating the first data, and an output interface of the encryption software of the first terminal is connected with an output interface of the first terminal; wherein the server is used for decrypting the first ciphertext to obtain the first data, and is used for generating notification information; the server is also used for sending the notification information to the second terminal, the second terminal is used for controlling the encryption software of the second terminal to be in the online state based on the notification information; the server is also used for encrypting the first data to obtain second ciphertext, and sending the second ciphertext to the second terminal, the second terminal is used for decrypting the second ciphertext to obtain the first data; wherein the encryption software of the second terminal also establishes encryption and decryption protocol with the server in advance.

2. The method of claim 1, wherein, the encryption of the first data to be sent to obtain the first ciphertext comprises: using a predefined encryption algorithm to encrypt the first data to obtain the first ciphertext; wherein the predefined encryption algorithm uses any of the following: post-quantum algorithm; national encryption algorithm; international algorithm; first hybrid algorithm based on the post-quantum algorithm and the national encryption algorithm; second hybrid algorithm based on the post-quantum algorithm and the international algorithm; third hybrid algorithm based on the national encryption algorithm and the international algorithm; fourth hybrid algorithm based on the post-quantum algorithm, the national encryption algorithm and the international algorithm.

3. The method of claim 1, wherein, Before the first ciphertext is sent to the server, the method further comprises: sending first identity authentication information to the server; wherein the server is used for verifying the first identity authentication information, and is used for determining a session key for decrypting encrypted information sent by the first terminal when the verification is passed.

4. The method of claim 3, wherein, The first identity authentication information is obtained in the following way: generating a key pair, wherein the key pair includes a post-quantum public and private key generated based on a post-quantum algorithm and a classical public and private key generated based on a national encryption algorithm; generating a certificate acquisition request based on the post-quantum public key, the national encryption public key and attribute information of the first terminal in the key pair, and sending the certificate acquisition request to a certificate generation server; The attribute information of the first terminal at least includes one of domain name information and user identity information corresponding to the first terminal. The certificate generation server is configured to generate a public key certificate and a private key corresponding to the public key certificate based on the certificate acquisition request, and encrypt the private key corresponding to the public key certificate to obtain certificate ciphertext, and return the certificate ciphertext and the public key certificate to the first terminal.

5. The method of claim 4, wherein, The service end is further configured to generate a symmetric key, encrypt the private key corresponding to the public key certificate by using the symmetric key to obtain certificate ciphertext, and encrypt the symmetric key by using the national secret public key and the post-quantum public key to obtain key ciphertext. The service end is further configured to return the key ciphertext, the certificate ciphertext and the public key certificate to the first terminal. The decryption of the certificate ciphertext to obtain the private key corresponding to the public key certificate comprises: The key ciphertext is decrypted by using the national secret private key and the post-quantum private key to obtain the symmetric key. The certificate ciphertext is decrypted by using the symmetric key to obtain the private key corresponding to the public key certificate.

6. A data transmission method, characterized by, The method comprises: In response to receiving the notification information sent by the service end, the encryption software of the second terminal is controlled to be in an online state, a virtual network interface is created when the encryption software is in the online state, and data is received and encrypted and decrypted through the virtual network interface; wherein the service end is configured to generate notification information based on first data to be sent to the second terminal; the service end is further configured to send the notification information to the second terminal; The notification information that the encryption software is in the online state is sent to the service end; wherein the service end is configured to encrypt the first data to obtain second ciphertext after verifying that the notification information is passed, and send the second ciphertext to the second terminal; wherein the encryption software of the second terminal also establishes an encryption and decryption protocol with the service end in advance; The second ciphertext sent by the service end is received, and the first data is obtained by decrypting the second ciphertext; wherein when the encryption software of the second terminal is in the online state, an input interface of the encryption software of the second terminal is connected to an input interface of the second terminal; an output interface of the encryption software of the second terminal is connected to an input interface of an application that displays the first data.

7. A data transmission method, characterized by, The method comprises: The first terminal and the second terminal are connected to the service end for communication, the first terminal and the second terminal both establish an encryption and decryption protocol with the service end in advance, and the method comprises: In response to receiving the first ciphertext sent by the first terminal, the first ciphertext is decrypted to obtain first data; wherein the first terminal is configured to encrypt the first data to obtain the first ciphertext; wherein when the encryption software of the first terminal is in an online state, a virtual network interface is created, and data is received and encrypted and decrypted through the virtual network interface; an input interface of the encryption software of the first terminal is connected to an output interface of an application generating the first data, and an output interface of the encryption software of the first terminal is connected to an output interface of the first terminal; Based on the first data, notification information is generated, and the notification information is sent to the second terminal, so that the second terminal controls the encryption software to be in an online state based on the notification information; when the encryption software is in the online state, a virtual network interface is created, and data is received and encrypted and decrypted through the virtual network interface; Based on the feedback information of the second terminal, the first data is encrypted to obtain second ciphertext, and the second ciphertext is sent to the second terminal; Wherein, the second terminal is configured to decrypt the second ciphertext to obtain the first data; wherein when the encryption software of the second terminal is in an online state, an input interface of the encryption software of the second terminal is connected to an input interface of the second terminal; an output interface of the encryption software of the second terminal is connected to an input interface of an application displaying the first data.

8. A data transmission apparatus, characterized by comprising: The application is applied to a first terminal, and the first terminal is connected to a second terminal through a server; the device comprises: A detection unit is configured to determine whether the encryption software of the first terminal is in an online state; wherein the encryption software of the first terminal is preconfigured with an encryption and decryption protocol with the server; An encryption unit is configured to encrypt first data to be sent to obtain first ciphertext when the encryption software of the first terminal is in an online state, and send the first ciphertext to the server; wherein when the encryption software of the first terminal is in an online state, a virtual network interface is created, and data is received and encrypted and decrypted through the virtual network interface; an input interface of the encryption software of the first terminal is connected to an output interface of an application generating the first data, and an output interface of the encryption software of the first terminal is connected to an output interface of the first terminal; Wherein, the server is configured to decrypt the first ciphertext to obtain the first data, and generate notification information; the server is also configured to send the notification information to the second terminal, and the second terminal is configured to control the encryption software of the second terminal to be in an online state based on the notification information; the server is also configured to encrypt the first data to obtain second ciphertext, and send the second ciphertext to the second terminal, and the second terminal is configured to decrypt the second ciphertext to obtain the first data; wherein the encryption software of the second terminal is also preconfigured with an encryption and decryption protocol with the server.

9. A data transmission apparatus, characterized by comprising: The application is applied to a second terminal, and the second terminal is connected to a first terminal through a server; the device comprises: The control unit is configured to control the encryption software of the second terminal to be in an online state in response to receiving the notification information sent by the server, and the encryption software in the online state is configured to create a virtual network interface and receive data and encrypt / decrypt the data through the virtual network interface; the server is configured to generate notification information based on first data to be sent to the second terminal; and the server is further configured to send the notification information to the second terminal; The sending unit is configured to send notification information that the encryption software is in an online state to the server; the server is configured to encrypt the first data to obtain second ciphertext after verifying that the notification information is correct, and send the second ciphertext to the second terminal; the encryption software of the second terminal also pre-establishes an encryption / decryption protocol with the server; The receiving unit is configured to receive the second ciphertext sent by the server and decrypt the second ciphertext to obtain the first data; when the encryption software of the second terminal is in an online state, an input interface of the encryption software of the second terminal is connected to an input interface of the second terminal, and an output interface of the encryption software of the second terminal is connected to an input interface of an application that displays the first data.

10. A data transmission apparatus, characterized by comprising: The application is applied to a server, a first terminal and a second terminal are connected in communication through the server, the first terminal and the second terminal both pre-establish an encryption / decryption protocol with the server; and the device comprises: The decryption unit is configured to decrypt first ciphertext sent by a first terminal to obtain first data in response to receiving the first ciphertext; the first terminal is configured to encrypt the first data to obtain the first ciphertext; when encryption software of the first terminal is in an online state, a virtual network interface is created, data is received and encrypted / decrypted through the virtual network interface; an input interface of the encryption software of the first terminal is connected to an output interface of an application that generates the first data, and an output interface of the encryption software of the first terminal is connected to an output interface of the first terminal; The transmission unit is configured to generate notification information based on the first data and send the notification information to a second terminal, so that the second terminal controls encryption software to be in an online state based on the notification information; when the encryption software is in the online state, a virtual network interface is created, data is received and encrypted / decrypted through the virtual network interface; The encryption unit is configured to encrypt the first data based on notification information fed back by the second terminal to obtain second ciphertext, and send the second ciphertext to the second terminal; The second terminal is configured to decrypt the second ciphertext to obtain the first data; when encryption software of the second terminal is in an online state, an input interface of the encryption software of the second terminal is connected to an input interface of the second terminal, and an output interface of the encryption software of the second terminal is connected to an input interface of an application that displays the first data.

11. A storage medium, characterized by The storage medium stores a computer program, and the computer program is configured to execute the method in any one of claims 1 to 7 when running. 12.An electronic device comprising a memory and a processor, the electronic device characterized by, The memory stores a computer program, and the processor is configured to execute the computer program to execute the method in any one of claims 1 to 7.

Images