Data encryption transmission method and device, equipment and storage medium

Abstract

The invention provides a data encryption transmission method and device, equipment and a storage medium, and belongs to the technical field of data encryption transmission, the method is applied to a vending machine, and the method comprises the following steps: in response to a received payment data transmission task, determining payment data to be transmitted and a first public key based on the payment data transmission task, and sending the first public key to a data receiver. And in response to a received second public key of the data receiver, encrypting the first encryption key based on the second public key to obtain a target encryption key, and sending the target encryption key to the data receiver. And encrypting payment data to be transmitted based on the target encryption key, and sending the encrypted payment data to a data receiver. According to the data encryption transmission method and device, the equipment and the storage medium provided by the invention, the data transmission security of the vending machine can be improved.

Description

Technical Field

[0001] The present disclosure belongs to the technical field of data encryption transmission, and more specifically, to a data encryption transmission method and device, equipment, and storage medium. Background Art

[0002] Devices such as vending machines communicate with servers through wireless networks or wired connections to transmit sales data, inventory information, payment information, etc., which involves a lot of private data. Data security is crucial. However, data transmission is often subject to man-in-the-middle attacks. Attackers may intercept wireless signals. If data transmission is not encrypted or uses weak encryption protocols, attackers can easily decrypt data, causing data leakage. In addition, vulnerabilities in the device itself can also lead to low data transmission security.

[0003] In summary, the existing data transmission method of vending machines still has the problem of low security. Summary of the invention

[0004] The purpose of the present disclosure is to provide a data encryption transmission method and device, equipment, and storage medium to improve the security of data transmission in a vending machine.

[0005] A first aspect of an embodiment of the present disclosure provides a data encryption transmission method, which is applied to an automatic vending machine, comprising: In response to receiving the payment data transmission task, determining the payment data and the first public key to be transmitted based on the payment data transmission task, and sending the first public key to a data recipient; In response to receiving a second public key of the data recipient, encrypting the first encryption key based on the second public key to obtain a target encryption key, and sending the target encryption key to the data recipient; The payment data to be transmitted is encrypted based on the target encryption key, and the encrypted payment data is sent to a data recipient.

[0006] A second aspect of the embodiments of the present disclosure provides a data encryption transmission device, which is applied to an automatic vending machine, comprising: A key distribution module, configured to, in response to receiving a payment data transmission task, determine the payment data to be transmitted and a first public key based on the payment data transmission task, and send the first public key to a data recipient; a key encryption module, configured to, in response to receiving a second public key of a data recipient, encrypt the first encryption key based on the second public key to obtain a target encryption key, and send the target encryption key to the data recipient; The data encryption transmission module is used to encrypt the payment data to be transmitted based on the target encryption key and send the encrypted payment data to a data recipient.

[0007] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the above-mentioned data encryption transmission method when executing the computer program.

[0008] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned data encryption transmission method are implemented.

[0009] The beneficial effects of a data encryption transmission method, device, equipment, and storage medium provided by the embodiments of the present disclosure are: On the one hand, through the two-way public key authentication mechanism, a trusted channel is established between the device and the server, which not only prevents illegal terminal access, but also ensures end-to-end encryption of payment data, meeting the requirements of payment security standards such as PCI DSS. A hybrid encryption architecture is adopted, and asymmetric encryption is used to complete key negotiation to ensure that the key exchange process resists man-in-the-middle attacks; symmetric encryption is used to achieve high-speed encrypted transmission of payment data, taking into account both security and processing efficiency.

[0010] On the other hand, an independent session key is generated for each transaction to implement dynamic key management, effectively preventing the risk of bulk data leakage caused by key reuse. Even if a single key is cracked, it will not affect the security of historical transactions.

[0011] In summary, the disclosed embodiments significantly improve the security and efficiency of vending machine data transmission through a dual encryption architecture that combines asymmetric encryption with symmetric encryption and a dynamic key management mechanism, reduce the risk of data being intercepted and cracked in the transmission link, and provide a highly available, low-latency secure payment solution for unmanned retail scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A schematic diagram of a data encryption transmission method according to an embodiment of the present disclosure; Figure 2 A structural block diagram of a data encryption transmission device provided by an embodiment of the present disclosure; Figure 3A schematic block diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0014] In the following description, specific details such as specific system structures and technologies are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present disclosure. However, it should be clear to those skilled in the art that the present disclosure may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obstructing the description of the present disclosure with unnecessary details.

[0015] In order to make the purpose, technical solutions and advantages of the present disclosure more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0016] Please refer to Figure 1 , Figure 1 A schematic flow chart of a data encryption transmission method provided in an embodiment of the present disclosure, the method is applied to an automatic vending machine and may include S101 to S103.

[0017] S101: In response to receiving a payment data transmission task, determining the payment data and the first public key to be transmitted based on the payment data transmission task, and sending the first public key to a data recipient.

[0018] In this embodiment, when a user purchases a product and performs a payment action, the business system of the vending machine will trigger the generation of a payment data transmission task, which may include specific payment data transmission instructions and payment data information. The payment data may include payment amount, product information, payment method, payment account number, etc. The data recipient may include a third-party payment platform. The first public key is one of the keys generated by the vending machine through an asymmetric encryption algorithm, and the key generated by the asymmetric encryption algorithm also includes a first private key. The first private key and the first public key are a pair of keys. The first public key is used to encrypt information for the data recipient, and the vending machine saves the first private key for decrypting the data transmitted back after the data recipient encrypts it with the first public key.

[0019] For example, when a user completes payment at a vending machine, the business system of the vending machine generates a transmission task containing payment instructions and data information. The vending machine uses an asymmetric encryption algorithm to generate a pair of keys, namely a first public key and a first private key. The first public key is sent to a third-party payment platform (data recipient), and the first private key is kept by the vending machine.

[0020] After the third-party payment platform receives the first public key, if there is information that needs to be sent back, such as payment result confirmation, transaction details supplement, etc., the first public key can be used to encrypt this information. Due to the characteristics of asymmetric encryption, only the corresponding first private key can decrypt the data encrypted with the first public key. Even if the encrypted information is intercepted during transmission, it cannot be cracked without the first private key. After receiving the encrypted information, the vending machine uses its own first private key to decrypt it, thereby obtaining the sent back information, ensuring the security and integrity of the payment data transmission, and completing the information interaction of the entire payment process.

[0021] S102: In response to receiving the second public key of the data recipient, encrypt the first encryption key based on the second public key to obtain a target encryption key, and send the target encryption key to the data recipient.

[0022] In this embodiment, a data encryption transmission method further includes: determining a first private key based on a payment data transmission task.

[0023] The first private key corresponds to the first public key, and the first private key is used to decrypt the encrypted payment data.

[0024] The second public key corresponds to a second private key, and the second private key is used to decrypt the encrypted target encryption key.

[0025] In this embodiment, the second public key and the second private key are an asymmetric encryption key pair generated by the data recipient. The second public key is sent to the vending machine, and is used by the vending machine to encrypt the first encryption key and generate a target encryption key. The second private key is kept by the data recipient and is used to decrypt the encrypted target encryption key sent by the vending machine. The first encryption key is a symmetric encryption key generated by the vending machine for encrypting payment data. The target encryption key is the result of encrypting the first encryption key with the second public key.

[0026] In this embodiment, based on an asymmetric encryption mechanism, the vending machine encrypts the first encryption key with the second public key, and only the second private key held by the data recipient can decrypt it, thereby ensuring the security of the first encryption key during transmission.

[0027] Exemplarily, the vending machine responds to the payment data transmission task and sends the first public key to the third-party payment platform. The third-party payment platform uses an asymmetric encryption algorithm to generate a second public key and a second private key, and sends the second public key to the vending machine. After receiving the second public key of the third-party payment platform, the vending machine selects a first encryption key, encrypts it with the second public key, obtains a target encryption key, and sends the encrypted target encryption key to the third-party payment platform.

[0028] S103: Encrypt the payment data to be transmitted based on the target encryption key, and send the encrypted payment data to the data recipient.

[0029] In this embodiment, the vending machine uses the target encryption key to encrypt the payment data to be transmitted, and sends the encrypted payment data to the third-party payment platform, which can ensure the confidentiality of the payment data. After receiving the encrypted payment data, the third-party payment platform can use the second private key it keeps to decrypt the encrypted target encryption key, obtain the first encryption key, and then use the first encryption key to decrypt the encrypted payment data to obtain the original payment data, and then perform subsequent operations such as payment processing. If the third-party payment platform has information that needs to be sent back, it can be encrypted using the first public key and sent, and the vending machine uses the first private key to decrypt the returned information.

[0030] From the above, it can be concluded that, on the one hand, this embodiment establishes a trusted channel between the device and the server through a two-way public key authentication mechanism, which not only prevents illegal terminal access, but also ensures that the end-to-end encryption of payment data meets the requirements of payment security standards such as PCI DSS. A hybrid encryption architecture is adopted, and asymmetric encryption is used to complete key negotiation to ensure that the key exchange process resists man-in-the-middle attacks; symmetric encryption is used to achieve high-speed encrypted transmission of payment data, taking into account both security and processing efficiency.

[0031] On the other hand, an independent session key is generated for each transaction to implement dynamic key management, effectively preventing the risk of bulk data leakage caused by key reuse. Even if a single key is cracked, it will not affect the security of historical transactions.

[0032] In summary, this embodiment significantly improves the security and efficiency of vending machine data transmission through a dual encryption architecture that combines asymmetric encryption with symmetric encryption and a dynamic key management mechanism, reduces the risk of data being intercepted and cracked in the transmission link, and provides a highly available, low-latency secure payment solution for unmanned retail scenarios.

[0033] In one embodiment of the present disclosure, the payment data to be transmitted includes user account information and transaction information.

[0034] Encrypting the data to be transmitted based on the target encryption key and sending the encrypted data to the data recipient includes: The transaction information is encrypted based on the target encryption key.

[0035] An initialization dynamic key is generated based on the target encryption key, transaction information and a key derivation function, a target dynamic key is generated based on the user's historical login information and the initialization dynamic key, and the user account information is encrypted based on the target dynamic key.

[0036] The encrypted transaction information and encrypted user account information are sent to the data recipient.

[0037] In this embodiment, user account information may include user login account, password hash value, bound mobile phone number, email address and other data that can identify user identity and account related data, which is used for identity authentication and user management. Transaction information may include transaction amount, transaction time, purchase goods list, order number and other information directly related to this payment transaction. Key derivation functions may include PBKDF2, HKDF and other functions, which are used to derive new keys from existing keys and other data. The target dynamic key is used to encrypt user account information to improve encryption targeting and security.

[0038] In this embodiment, the dual high requirements of timeliness and security for real-time payment data transmission are comprehensively considered. In combination with the payment data characteristics of the vending machine, the payment data is divided into two types of data (transaction information and user account information). Among them, the data sensitivity of transaction information and user account information is different. The sensitivity of user account information is higher than that of transaction information. The risk of using the same key to encrypt both is relatively high. If complex encryption strategies are used, the data transmission efficiency will be reduced; if simple encryption strategies are used, it will be difficult to ensure data security. User historical login information may include login time, IP address, device fingerprint, etc.

[0039] Therefore, this embodiment designs different encryption strategies for two types of data with different sensitivities. The transaction information is encrypted by the target encryption key to ensure the security of the transaction data. The key derivation function is then used to generate an initial dynamic key in combination with the transaction information, and the target dynamic key is generated by integrating the user's historical login information, thereby increasing the randomness and complexity of the key, improving the difficulty of cracking, and enhancing the security protection of highly sensitive user account information.

[0040] In this embodiment, the master key (target encryption key) is not used directly for user account encryption, but the final key is derived from historical login information and transaction information, forming a three-layer isolation of "master key → initialization dynamic key → target dynamic key". Even if the initialization key is leaked, the attacker still needs to crack the user's historical behavior pattern to derive the final key, which significantly increases the cost of the attack. If the attacker intercepts the encrypted data and tries to replay it, the target dynamic key depends on real-time transaction information and historical login information, and the key cannot be reused, and the data decryption will fail.

[0041] Exemplarily, the user's historical login information, such as the login timestamp, the IP address of the login device, the type of device used for login, etc., is obtained from the local database of the vending machine or the connected user management system. The initialized dynamic key is combined with the preprocessed user historical login information according to a hash operation or a bit operation to generate an intermediate result. The intermediate result is calculated using a hash function to generate the final target dynamic key.

[0042] In this embodiment, the user's historical login information is used as a dynamic factor for generating the target dynamic key, which can achieve a strong association between the key and the user's behavior. If the target dynamic key fails to be generated in the process of generating the target dynamic key based on the user's historical login information, it can indirectly reflect the abnormal user behavior (such as a sudden change in geographical location within a short period of time), which can trigger security verification.

[0043] In this embodiment, after encrypting the user account information based on the target dynamic key, the following steps are also included: A first timestamp is obtained from the encryption engine clock, the first timestamp is embedded into the target dynamic key, and the target dynamic key and the time constraint instruction embedded with the first timestamp are sent to a data receiver.

[0044] The time constraint instruction is used to instruct the data recipient to extract the embedded first timestamp information from the received target dynamic key.

[0045] The second timestamp is obtained from the encryption engine clock at the time of decryption.

[0046] A time offset is calculated based on the second time stamp and the first time stamp.

[0047] If the time deviation is greater than or equal to the preset time window, the target dynamic key is determined to be invalid, the target dynamic key is no longer used for decryption operations, and key expiration information is returned to the vending machine.

[0048] If the time deviation is less than the preset time window, it is determined that the target dynamic key has not expired and the key continues to be used for data decryption.

[0049] In this embodiment, the first timestamp is a time stamp obtained from the encryption engine clock when the encryption operation occurs, which is used to record the encryption moment. The time constraint instruction is used to instruct the data recipient how to process the received target dynamic key containing the timestamp. The second timestamp is a time stamp obtained from the encryption engine clock during decryption, which is used to record the decryption moment. The preset time window is a preset time deviation threshold, which is used to determine whether the key is invalid.

[0050] In this embodiment, after encrypting the user account information, the first timestamp at the encryption time is embedded in the target dynamic key and sent to the data recipient. Before decryption, the data recipient obtains the second timestamp at the time of decryption and calculates the time deviation by comparing the first and second timestamps. If the deviation is greater than or equal to the preset time window, it indicates that the interval from encryption to decryption is too long, and there is a risk of key leakage. The key is determined to be invalid and the vending machine is notified. If the time deviation is less than the preset time window, it is considered that the key is within the valid time and can continue to be used for decryption, ensuring that the data remains secure and available within the expected time range. This method ensures key security based on time validity.

[0051] Exemplarily, calculating the time deviation based on the second timestamp and the first timestamp includes: calculating an absolute value of a difference between a current decryption time (the second timestamp) and the extracted first timestamp to obtain the time deviation.

[0052] This embodiment performs targeted and precise encryption on data of different sensitivities, rationally utilizes encryption resources, and improves encryption efficiency while ensuring data security. This embodiment increases key complexity, reduces the risk of being cracked, and prevents data leakage and tampering through three-layer key isolation and integration of user historical login information. This embodiment is based on timestamp-based key validity verification, which can promptly detect potential key leakage risks and ensure that data is secure and available within a reasonable time. At the same time, failure to generate keys can trigger security verification, further strengthening security protection.

[0053] In one embodiment of the present disclosure, sending the encrypted transaction information and the encrypted user account information to the data recipient includes: The encrypted transaction information and the encrypted user account information are concatenated and encapsulated, and an encapsulation signature is generated.

[0054] The encapsulated signature and the encapsulated data are sent to the data recipient.

[0055] In this embodiment, the generation of the encapsulation signature includes: calculating a hash value for the encapsulated data based on a hash algorithm, encrypting the hash value to obtain the encapsulation signature, and verifying the integrity and source of the data.

[0056] In this embodiment, sending the encapsulation signature and the encapsulated data to the data recipient includes: adding the generated encapsulation signature to the end of the encapsulated data to obtain the encapsulation data with the encapsulation signature, and sending the encapsulation data with the encapsulation signature to the data recipient.

[0057] In this embodiment, the encrypted transaction information and the encrypted user account information are sequentially spliced ​​to form a data set to be processed. The encapsulation operation may include adding header metadata to the spliced ​​data set, such as data type, length, sender and receiver identifiers, etc. A hash value is calculated for the encapsulated data based on a hash algorithm as the "digital fingerprint" of the data. The hash value is encrypted to obtain an encapsulation signature, thereby binding the encapsulation signature to the sender's identity.

[0058] Add the encapsulation signature to the end of the encapsulated data and send it. After receiving the data, the data receiver can separate the encapsulation signature and the encapsulated data. Decrypt the encapsulation signature to get the hash value, and recalculate the hash value of the encapsulated data and compare the two. If they are consistent, it means that the data has not been tampered with during transmission and the source is reliable; if they are inconsistent, it means that there is a problem with the data integrity or source.

[0059] This embodiment calculates the hash value through the hash algorithm, and the generated "digital fingerprint" can effectively verify the integrity of the data. Once the data is tampered with, the hash value will change. The hash value encryption realizes the binding of the signature with the sender's identity, ensuring the source is reliable, and comprehensively guaranteeing the security and reliability of the payment data during transmission.

[0060] In one embodiment of the present disclosure, a data encryption transmission method further includes: In response to receiving a device data transmission task, a target encryption transmission mode is determined based on a task type of the device data transmission task.

[0061] The device data to be transmitted is encrypted and transmitted based on the target encryption transmission method.

[0062] In this embodiment, the target encryption transmission mode is determined based on the task type of the device data transmission task, including: If the task type of the device data transmission task is a device status data transmission task, the target index of the device data transmission task is determined.

[0063] The target encryption transmission mode is determined to be the first encryption transmission mode based on the device status data transmission task and the target index.

[0064] The first encryption transmission method includes: determining a target shared key based on a target index.

[0065] The device state data to be transmitted is encrypted based on the target shared key.

[0066] The encrypted device status data is sent to the background management system through the first encryption channel established with the background management system.

[0067] In this embodiment, the device data transmission task may include instructions and information related to the transmission of device data. The target encryption transmission method is an encryption transmission method determined according to the task type, and has different configurations for different tasks, such as encryption algorithms, key management methods, etc. The device status data transmission task is dedicated to tasks that transmit device status information. For example, a vending machine needs to transmit the device's operating status, fault information, temperature and humidity data to the background management system.

[0068] The first encrypted transmission mode is an encrypted transmission mode for device status data transmission tasks. The parameters include target shared key, encryption algorithm, protocol of the first encrypted channel, etc. The target shared key is an encryption key pre-shared between the device and the background management system, which is used to encrypt device status data. The first encrypted channel is a communication path established between the device and the background management system specifically for securely transmitting encrypted device status data. The target index is the sequential number of device data transmission tasks within a fixed time period (such as one day).

[0069] In this embodiment, determining the target shared key based on the target index includes: A first index is obtained by taking a modulus of the target index, and a target shared key corresponding to the first index is determined from the key mapping table.

[0070] In this embodiment, the first index is the result obtained by performing a modulo operation on the target index. The key mapping table is used to store the correspondence between the index and multiple shared keys. By performing a modulo operation on the target index, a value (first index) within the index range of the key mapping table is obtained, and the value is used to search the corresponding target shared key in the key mapping table, so as to quickly locate the target shared key according to the target index.

[0071] For example, considering that the amount of device status data is usually small but the transmission frequency is high, a lightweight symmetric encryption algorithm such as the Speck algorithm can be used to generate multiple shared keys to form a key mapping table. After quickly locating the target shared key in the key mapping table based on the target index, the vending machine and the backend management system pre-share this Speck key (target shared key). The vending machine encrypts the device status data using the target shared key and transmits it, and the backend management system uses the same key to decrypt it.

[0072] In order to prevent the key from being cracked, a key update cycle can be set (such as daily or weekly). The vending machine and the backend management system update the symmetric key in a secure manner to ensure the security of data transmission.

[0073] This embodiment determines the encryption transmission mode according to the task type, realizes targeted encryption, and improves encryption efficiency and security. The shared key is determined by the target index and modulus operation, making key management more flexible and efficient, and different keys can be used in order within a fixed time period, increasing encryption complexity and reducing the risk of key cracking. At the same time, the use of encrypted channel transmission further ensures the security and integrity of device status data during transmission.

[0074] In one embodiment of the present disclosure, determining a target encryption transmission mode based on a task type of a device data transmission task includes: If the task type of the device data transmission task is a device inventory data transmission task, the target encryption transmission mode is determined to be the second encryption transmission mode.

[0075] The second encrypted transmission method includes: A first asymmetric encryption key is generated based on an asymmetric encryption algorithm, and a digital signature is generated based on the device inventory data to be transmitted and the first asymmetric encryption key.

[0076] In response to receiving the second asymmetric encryption key from the background management system, the device inventory data to be transmitted is encrypted based on the second asymmetric encryption key.

[0077] The encrypted equipment inventory data and digital signature are sent to the back-end management system through a second encrypted channel established with the back-end management system.

[0078] In this embodiment, the commodity inventory data needs to be transmitted in real time or regularly between the vending machine and the background management system to ensure the accuracy of the inventory information and facilitate timely replenishment. The device inventory data transmission task is a task specifically used to transmit device inventory related data. The second encrypted transmission method is an encrypted transmission method for the device inventory data transmission task, and the parameters may include the first asymmetric encryption key, the second asymmetric encryption key, the encryption algorithm, the second encryption channel protocol, etc.

[0079] Digital signatures are used to verify data integrity and source. The first asymmetric encryption key is a key generated by the vending machine based on an asymmetric encryption algorithm. The second asymmetric encryption key is a key generated by the backend management system and provided to the vending machine for the vending machine to encrypt data. The second encryption channel is a communication path between the device and the backend management system for securely transmitting device inventory data.

[0080] In this embodiment, an asymmetric encryption algorithm is used to encrypt and transmit the device inventory data. At the same time, in order to ensure the integrity and authenticity of the data, the vending machine digitally signs the inventory data. After receiving the encrypted data, the background management system verifies the digital signature to determine whether the data has been tampered with. Since the commodity inventory data contains a large amount of commodity information, in order to reduce the transmission bandwidth and improve the transmission efficiency, the data can be compressed before encryption and then encrypted for transmission. After the background management system receives the data, it is first decrypted and then decompressed to obtain the original inventory data.

[0081] Exemplarily, a second encryption channel is established with the background management system based on a specified protocol such as SSL / TLS. After receiving the device data transmission task, the vending machine determines whether it is a device inventory data transmission task. If so, a first asymmetric encryption key pair is generated based on a selected asymmetric encryption algorithm such as RSA, and a private key in the first asymmetric encryption key is used to sign the device inventory data to be transmitted to generate a digital signature. The vending machine receives the second asymmetric encryption key sent by the background management system, and uses the public key in the second asymmetric encryption key to encrypt the device inventory data to be transmitted. The encrypted device inventory data and digital signature are sent to the background management system through the second encryption channel.

[0082] This embodiment uses asymmetric encryption algorithms and digital signatures to ensure the security, integrity and authenticity of device inventory data and prevent data tampering and forgery. Establish targeted encryption channels to further improve transmission security. Compress the data first and then encrypt it, which reduces the transmission bandwidth usage and improves transmission efficiency. The vending machine and the backend management system can efficiently and accurately transmit inventory data, ensuring that inventory information is updated in a timely manner, facilitating timely replenishment, and maintaining normal business operations.

[0083] Corresponding to a data encryption transmission method in the above embodiment, Figure 2 This is a structural block diagram of a data encryption transmission device provided by an embodiment of the present disclosure. For ease of explanation, only the parts related to the embodiment of the present disclosure are shown. Figure 2 The data encryption transmission device 20 is applied to a vending machine and includes: a key distribution module 21, a key encryption module 22 and a data encryption transmission module 23.

[0084] Among them, the key distribution module 21 is used to respond to receiving the payment data transmission task, determine the payment data and the first public key to be transmitted based on the payment data transmission task, and send the first public key to the data recipient.

[0085] The key encryption module 22 is used to encrypt the first encryption key based on the second public key in response to receiving the second public key of the data recipient, obtain the target encryption key, and send the target encryption key to the data recipient.

[0086] The data encryption transmission module 23 is used to encrypt the payment data to be transmitted based on the target encryption key and send the encrypted payment data to the data recipient.

[0087] In one embodiment of the present disclosure, the payment data to be transmitted includes user account information and transaction information. The data encryption transmission module 23 is specifically used to encrypt the transaction information based on the target encryption key.

[0088] An initialization dynamic key is generated based on the target encryption key, transaction information and a key derivation function, a target dynamic key is generated based on the user's historical login information and the initialization dynamic key, and the user account information is encrypted based on the target dynamic key.

[0089] The encrypted transaction information and encrypted user account information are sent to the data recipient.

[0090] In one embodiment of the present disclosure, the data encryption transmission module 23 is further configured to concatenate and encapsulate the encrypted transaction information and the encrypted user account information, and generate an encapsulation signature.

[0091] The encapsulated signature and the encapsulated data are sent to the data recipient.

[0092] In one embodiment of the present disclosure, a data encryption transmission device 20 further includes: The key generation module is used to determine a first private key based on a payment data transmission task.

[0093] The first private key corresponds to the first public key, and the first private key is used to decrypt the encrypted payment data.

[0094] The second public key corresponds to a second private key, and the second private key is used to decrypt the encrypted target encryption key.

[0095] In one embodiment of the present disclosure, a data encryption transmission device 20 further includes: The classification encryption module is used to determine a target encryption transmission mode based on the task type of the device data transmission task in response to receiving the device data transmission task.

[0096] The device data to be transmitted is encrypted and transmitted based on the target encryption transmission method.

[0097] In one embodiment of the present disclosure, the classification encryption module is specifically used to determine the target index of the device data transmission task if the task type of the device data transmission task is a device status data transmission task.

[0098] The target encryption transmission mode is determined to be the first encryption transmission mode based on the device status data transmission task and the target index.

[0099] The first encryption transmission method includes: determining a target shared key based on a target index.

[0100] The device state data to be transmitted is encrypted based on the target shared key.

[0101] The encrypted device status data is sent to the background management system through the first encryption channel established with the background management system.

[0102] In one embodiment of the present disclosure, the classification encryption module is further used to determine that the target encryption transmission mode is the second encryption transmission mode if the task type of the device data transmission task is a device inventory data transmission task.

[0103] The second encrypted transmission method includes: A first asymmetric encryption key is generated based on an asymmetric encryption algorithm, and a digital signature is generated based on the device inventory data to be transmitted and the first asymmetric encryption key.

[0104] In response to receiving the second asymmetric encryption key from the background management system, the device inventory data to be transmitted is encrypted based on the second asymmetric encryption key.

[0105] The encrypted equipment inventory data and digital signature are sent to the back-end management system through a second encrypted channel established with the back-end management system.

[0106] See also Figure 3 , Figure 3 A schematic block diagram of an electronic device provided by an embodiment of the present disclosure. Figure 3 The electronic device 300 in the embodiment shown may include: one or more processors 301, one or more input devices 302, one or more output devices 303 and one or more memories 304. The processors 301, input devices 302, output devices 303 and memories 304 communicate with each other via a communication bus 305. The memory 304 is used to store computer programs, which include program instructions. The processor 301 is used to execute the program instructions stored in the memory 304. The processor 301 is configured to call the program instructions to execute the functions of the modules in the above-mentioned device embodiments, such as Figure 2 The functions of modules 21 to 23 are shown.

[0107] It should be understood that in the embodiment of the present disclosure, the processor 301 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0108] The input device 302 may include a touch panel, a fingerprint collection sensor (for collecting the user's fingerprint information and fingerprint direction information), a microphone, etc., and the output device 303 may include a display (LCD, etc.), a speaker, etc.

[0109] The memory 304 may include a read-only memory and a random access memory, and provide instructions and data to the processor 301. A portion of the memory 304 may also include a non-volatile random access memory. For example, the memory 304 may also store information about the device type.

[0110] In a specific implementation, the processor 301, input device 302, and output device 303 described in the embodiments of the present disclosure can execute the implementation methods described in the first and second embodiments of a data encryption transmission method provided in the embodiments of the present disclosure, and can also execute the implementation methods of the electronic device 300 described in the embodiments of the present disclosure, which will not be repeated here.

[0111] In another embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by the processor, all or part of the processes in the above-mentioned embodiment method are implemented, and the computer program can also be completed by instructing the relevant hardware through the computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0112] The computer-readable storage medium may be an internal storage unit of the electronic device of any of the aforementioned embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0113] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0114] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the electronic devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0115] In the several embodiments provided in the present application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces or units, or it can be an electrical, mechanical or other form of connection.

[0116] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present disclosure.

[0117] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0118] The above are only specific embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present disclosure, and these modifications or replacements should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A data encryption transmission method, characterized in that: Applied to vending machines, including: In response to receiving the payment data transmission task, determining the payment data and the first public key to be transmitted based on the payment data transmission task, and sending the first public key to a data recipient; In response to receiving a second public key of the data recipient, encrypting the first encryption key based on the second public key to obtain a target encryption key, and sending the target encryption key to the data recipient; The payment data to be transmitted is encrypted based on the target encryption key, and the encrypted payment data is sent to a data recipient.

2. A data encryption transmission method as claimed in claim 1, characterized in that: The payment data to be transmitted includes user account information and transaction information; The step of encrypting the data to be transmitted based on the target encryption key and sending the encrypted data to a data receiver comprises: encrypting the transaction information based on the target encryption key; Generate an initialization dynamic key based on the target encryption key, the transaction information and a key derivation function, generate a target dynamic key based on the user's historical login information and the initialization dynamic key, and encrypt the user account information based on the target dynamic key; The encrypted transaction information and encrypted user account information are sent to the data recipient.

3. A data encryption transmission method as claimed in claim 2, characterized in that: The step of sending the encrypted transaction information and the encrypted user account information to the data receiving party includes: Concatenate and encapsulate the encrypted transaction information and the encrypted user account information, and generate an encapsulation signature; The encapsulated signature and the encapsulated data are sent to a data receiver.

4. A data encryption transmission method as claimed in claim 1, characterized in that: Also includes: Determining a first private key based on the payment data transmission task; The first private key corresponds to the first public key, and the first private key is used to decrypt the encrypted payment data; The second public key corresponds to a second private key, and the second private key is used to decrypt the encrypted target encryption key.

5. A data encryption transmission method as claimed in claim 1, characterized in that: Also includes: In response to receiving a device data transmission task, determining a target encryption transmission mode based on a task type of the device data transmission task; The device data to be transmitted is encrypted and transmitted based on the target encryption transmission mode.

6. A data encryption transmission method as claimed in claim 5, characterized in that: The determining of the target encryption transmission mode based on the task type of the device data transmission task includes: If the task type of the device data transmission task is a device status data transmission task, determining a target index of the device data transmission task; Determine the target encryption transmission mode as the first encryption transmission mode based on the device status data transmission task and the target index; The first encryption transmission mode includes: determining a target shared key based on the target index; encrypting the device state data to be transmitted based on the target shared key; The encrypted device status data is sent to the background management system through the first encryption channel established with the background management system.

7. A data encryption transmission method as claimed in claim 5, characterized in that: The determining of the target encryption transmission mode based on the task type of the device data transmission task includes: If the task type of the device data transmission task is a device inventory data transmission task, determining the target encryption transmission mode to be the second encryption transmission mode; The second encrypted transmission method includes: Generate a first asymmetric encryption key based on an asymmetric encryption algorithm, and generate a digital signature based on the device inventory data to be transmitted and the first asymmetric encryption key; In response to receiving a second asymmetric encryption key from the background management system, encrypting the device inventory data to be transmitted based on the second asymmetric encryption key; The encrypted equipment inventory data and the digital signature are sent to the back-end management system via a second encryption channel established with the back-end management system.

8. A data encryption transmission device, characterized in that: Applied to vending machines, including: A key distribution module, configured to, in response to receiving a payment data transmission task, determine the payment data to be transmitted and a first public key based on the payment data transmission task, and send the first public key to a data recipient; a key encryption module, configured to, in response to receiving a second public key of a data recipient, encrypt the first encryption key based on the second public key to obtain a target encryption key, and send the target encryption key to the data recipient; The data encryption transmission module is used to encrypt the payment data to be transmitted based on the target encryption key and send the encrypted payment data to a data recipient.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images