File encryption transmission method and device, electronic equipment and computer readable medium

Abstract

The embodiment of the invention discloses a file encryption transmission method and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the following steps: acquiring a to-be-transmitted file set, a key generation parameter set and a first user part public and private key pair; generating a second user part public and private key pair; performing key splicing on the first user part public and private key pair and the second user part public and private key pair to obtain a user public and private key pair; determining to receive user signature information; performing file signcryption processing on the to-be-transmitted file set to obtain a signcryption transmission file; encrypting the public and private key pair of the user to obtain an encrypted key pair; segmenting the signcryption transmission file to obtain a segmented signcryption transmission file set; generating a file transmission byte stream; and carrying out covert channel sending transmission on the file transmission byte stream. According to the embodiment, the security of file transmission can be improved through partial generation of the public and private keys and fused signcryption transmission of one-to-many user side identity information.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a file encryption transmission method, device, electronic device, and computer-readable medium. Background Art

[0002] With the continuous development of mobile communication technology and the increase in business needs of enterprises, internal enterprise files need to be frequently transmitted. How to ensure the security of transmitted files and avoid data leakage of private data during the transmission process has become an issue of increasing concern. For file encryption transmission, the usual method is: use KGC (Key Generation Center) to generate a master key. Then, the master key is used to generate a user private key and a user public key for the user's identity. Finally, the user public key and the user private key are used to perform bilinear pairing encryption on the file set to be transmitted, so that the file receiving user can decrypt and receive it.

[0003] However, it is found in practice that when the above method is used to encrypt and transmit files, the following technical problems often occur: Since the user private keys of all users are generated through the master key of KGC, once the master key of KGC is leaked, the user's private keys will be completely exposed, and the file set is encrypted by bilinear pairing operations without signing operations, resulting in high encryption calculation complexity and low encryption efficiency. There is also the possibility of leakage of stored private keys, which in turn causes low security in file transmission.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present disclosure propose a file encryption transmission method, device, electronic device, and computer-readable medium to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide a method for encrypted file transmission, including: obtaining a set of files to be transmitted, a key generation parameter set sent by a key generation server, and a first user partial public-private key pair, wherein the key generation parameter set includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key; generating a second user partial public-private key pair according to the elliptic curve non-zero multiplication group and the elliptic curve addition generator; performing key concatenation on the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair; determining a file receiving user The receiving user signature information of the terminal set, wherein the file receiving user terminal in the above-mentioned file receiving user terminal set is the user terminal that receives the above-mentioned file set to be transmitted; according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information, the above-mentioned file set to be transmitted is signed and encrypted to obtain a signed transmission file; the above-mentioned user public-private key pair is encrypted to obtain an encrypted key pair; the above-mentioned signed transmission file is segmented to obtain a segmented signed transmission file set; according to the above-mentioned encrypted key pair and the above-mentioned segmented signed transmission file set, a file transmission byte stream is generated; the above-mentioned file transmission byte stream is sent and transmitted through a covert channel for decryption and reception by the above-mentioned file receiving user terminal set.

[0008] In a second aspect, some embodiments of the present disclosure provide a file encryption transmission device, including: an acquisition unit, configured to acquire a set of files to be transmitted, a key generation parameter set sent by a key generation server, and a first user partial public-private key pair, wherein the key generation parameter set includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key; a first generation unit, configured to generate a second user partial public-private key pair based on the elliptic curve non-zero multiplication group and the elliptic curve addition generator; a key splicing unit, configured to perform key splicing on the first user partial public-private key pair and the second user partial public-private key pair based on the system public key and the key generation parameter set to obtain a user public-private key pair; a determination unit, configured to determine the receiving user signature of the file receiving user set. Information, wherein the file receiving user end in the above-mentioned file receiving user end set is a user end that receives the above-mentioned file set to be transmitted; a file signcryption unit is configured to perform file signcryption processing on the above-mentioned file set to be transmitted according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information to obtain a signed transmission file; a key encryption unit is configured to perform key encryption processing on the above-mentioned user public-private key pair to obtain an encrypted key pair; a segmentation unit is configured to perform segmentation processing on the above-mentioned signed transmission file to obtain a segmented signed transmission file set; a second generation unit is configured to generate a file transmission byte stream according to the above-mentioned encryption key pair and the above-mentioned segmented signed transmission file set; a covert channel sending and transmission unit is configured to perform covert channel sending and transmission on the above-mentioned file transmission byte stream for decryption and reception by the above-mentioned file receiving user end set.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0011] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the file encryption transmission method of some embodiments of the present disclosure can improve the security of file transmission by partially generating public and private keys and sending the fusion signcryption of one-to-many user terminal identity information. Specifically, the reason for the low security of the relevant file transmission is that: since the user private keys of all users are generated by the master key of KGC, once the master key of KGC is leaked, the user's private key will be fully exposed, and the file set is encrypted by bilinear pairing operation without signing operation, resulting in high encryption calculation complexity, low encryption efficiency, and the possibility of leakage of stored private keys, which leads to low security of file transmission. Based on this, the file encryption transmission method of some embodiments of the present disclosure can first obtain the file set to be transmitted, the key generation parameter set sent by the key generation server, and the first user's partial public and private key pair, wherein the above-mentioned key generation parameter set includes at least one of the following: elliptic curve non-zero multiplication group, elliptic curve addition generator and system public key. Here, it is used to subsequently generate the second user distributed public and private key pair and signcrypt the file set to be transmitted. Secondly, according to the above-mentioned elliptic curve non-zero multiplication group and the above-mentioned elliptic curve addition generator, a second user partial public-private key pair is generated. Here, by generating partial public-private key pairs by the user end and the key generation service end respectively, the possibility of key pair leakage can be reduced to a certain extent, the security of partial public-private key pairs can be improved, and the waste of secret key transmission resources can be reduced. Thirdly, according to the above-mentioned system public key and the above-mentioned key generation parameter set, the above-mentioned first user partial public-private key pair and the above-mentioned second user partial public-private key pair are key spliced ​​to obtain a user public-private key pair. Here, the security and complexity of the user public-private key pair can be improved, thereby improving the security of subsequent file encryption transmission. Subsequently, the receiving user signature information of the file receiving user end set is determined, wherein the file receiving user end in the above-mentioned file receiving user end set is the user end that receives the above-mentioned file set to be transmitted. Here, the identity identification information of multiple file receiving user ends is merged, the anonymity of the file recipient is realized, and the privacy protection of the file receiving user end can be improved. Then, according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information, the above-mentioned file set to be transmitted is subjected to file signcryption processing to obtain a signcrypted transmission file. Here, signcryption adds user signature technology to encryption, which can simultaneously achieve the security, integrity and unforgeability of files, and encrypt through elliptic curve operations, which can reduce encryption complexity and improve encryption efficiency. Afterwards, the above-mentioned user public and private key pairs are key encrypted to obtain an encrypted key pair. Here, the security of the user's public and private key pairs is improved. Then, the above-mentioned signcrypted transmission file is segmented to obtain a segmented signcrypted transmission file set. Here, segmentation facilitates subsequent segmentation processing, which can improve transmission efficiency and achieve breakpoint transmission.Then, according to the above encryption key pair and the above segmented signed transmission file set, a file transmission byte stream is generated. Here, the design of the file transmission byte stream for the file transmission scenario can improve the security and applicability of the file transmission. Finally, the above file transmission byte stream is sent and transmitted through a covert channel for the above file receiving user terminal set to decrypt and receive. Here, the covert channel sending and transmission can improve the security of file transmission and reduce the possibility of file leakage. It can be obtained that the file encryption transmission method generates a user's partial public and private key pair through the key generation server and the user terminal sending the file set, which can reduce the possibility of user private key leakage, and the file signing of identity fusion for multiple file recipients, which is suitable for one-to-many encryption transmission scenarios, improves the anonymity of the sender and the receiver, and thus improves the security of file transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flow chart of some embodiments of the file encryption transmission method according to the present disclosure;

[0014] Figure 2 is a schematic diagram of the structure of some embodiments of the file encryption transmission device according to the present disclosure;

[0015] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0017] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0018] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0019] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0020] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0021] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0022] Figure 1 The process 100 of some embodiments of the file encryption transmission method according to the present disclosure is shown. The file encryption transmission method includes the following steps:

[0023] Step 101, obtaining a set of files to be transmitted, a set of key generation parameters sent by a key generation server, and a partial public-private key pair of a first user.

[0024] In some embodiments, the execution subject (e.g., electronic device) of the above-mentioned file encryption transmission method can obtain the set of files to be transmitted, the set of key generation parameters sent by the key generation server, and the first user's partial public-private key pair through a wired connection or a wireless connection, wherein the above-mentioned key generation parameter set includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key. Among them, the files to be transmitted in the above-mentioned set of files to be transmitted can be files waiting to be transmitted to other user terminals or servers. The above-mentioned key generation server can be a server for generating and managing secret keys. The secret key generation parameters in the above-mentioned key generation parameter set can be parameters related to the key. The above-mentioned elliptic curve addition generator can be a point on the elliptic curve obtained by performing integer multiple addition operations on the elliptic curve addition generator to obtain all points on the elliptic curve except the point at infinity. The above-mentioned elliptic curve non-zero multiplication group can be a non-zero multiplication cyclic group based on a target prime number, and the above-mentioned target prime number can be a prime number. It should be noted that the target prime number can be determined according to actual conditions and is not limited here. The non-zero multiplication cyclic group may be a bilinear mapping of an elliptic curve additive cyclic group and a Cartesian product of an elliptic curve additive cyclic group. The elliptic curve additive cyclic group may be a cyclic group consisting of points on an elliptic curve, with an order of a target prime number and a group operation of addition. The elliptic curve multiplication cyclic group may be a cyclic group consisting of points on an elliptic curve, with an order of a target prime number and a group operation of multiplication. The system public key may be the product of a value randomly selected from the non-zero multiplication group of the elliptic curve and an elliptic curve additive generator. The first user partial public-private key pair may be a public key and a private key generated by the key generation server. The public key may be a value set used to encrypt a set of files to be transmitted. The private key may be a value set used to decrypt an encrypted set of files to be transmitted.

[0025] Step 102: Generate a partial public-private key pair of a second user according to the non-zero multiplication group of the elliptic curve and the elliptic curve addition generator.

[0026] In some embodiments, the execution subject may generate a second user partial public-private key pair based on the elliptic curve non-zero multiplication group and the elliptic curve addition generator, wherein the second user partial public-private key pair may be a public key and a private key generated by a user terminal sending the file set to be transmitted.

[0027] As an example, the execution subject may first randomly select a value from the non-zero multiplication group of the elliptic curve as the second user partial private key. The second user partial public key is different from the first value and the second value and is a value in the non-zero multiplication group of the elliptic curve. Then, the product of the second user partial private key and the elliptic curve addition generator is determined as the second user partial public key. Finally, the second user partial private key and the second user partial public key are determined as the second user partial public-private key pair.

[0028] Step 103: Concatenate the first user's partial public-private key pair and the second user's partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair.

[0029] In some embodiments, the execution subject may perform key concatenation on the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair. The user public-private key pair may represent the public key and private key of the user terminal identity information used to encrypt and decrypt the file set to be transmitted.

[0030] In some optional implementations of some embodiments, the key generation parameter set further includes: a first hash function and an elliptic curve additive cyclic group, and the second user partial public-private key pair includes: a second user partial public key and a second user partial private key. Among them, the elliptic curve additive cyclic group can be a cyclic group composed of points on an elliptic curve and having an order of a target prime number. The target prime number can be a prime number. It should be noted that the target prime number can be determined according to actual conditions and is not limited here. The first hash function can be a bilinear mapping function of a byte sequence of any length composed of 0 or 1, the domain of the Cartesian product of the elliptic curve additive cyclic group and the elliptic curve additive cyclic group, and the value range of the elliptic curve non-zero multiplication group based on the target prime number. The second user partial public key can be any value from the elliptic curve non-zero multiplication group. The second user partial private key can be the value of the product of the second user partial public key and the elliptic curve additive generator.

[0031] Optionally, the step of performing key concatenation on the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain the user public-private key pair may include the following steps:

[0032] In the first step, based on the second user's partial private key, the following determination steps are performed:

[0033] Sub-step 1, sending the user identity information and the second user partial public key to the above-mentioned key generation server, so that the above-mentioned key generation server can generate the above-mentioned first user partial public-private key pair according to the above-mentioned user identity information, wherein the above-mentioned first user partial public-private key pair includes: the first user partial public key and the first user partial private key. The above-mentioned user identity information can be identification information representing the identity of the user terminal that sends the above-mentioned file set to be transmitted. For example, the above-mentioned user identity information can be but is not limited to at least one of the following: the employee number, email address, and user mobile phone number of the user corresponding to the user terminal. The above-mentioned first user partial public key can be a public key generated by the key generation server. The above-mentioned first user partial private key can be a private key generated by the key generation server.

[0034] Sub-step 2, input the above-mentioned user identity information, the first target user partial public key and the second user partial public key into the first hash function to obtain a user hash byte sequence, wherein the first target user partial public key is the first user partial public key sent by the above-mentioned key generation server, and the above-mentioned first hash function represents a byte sequence of any length composed of 0 or 1, the domain of the above-mentioned elliptic curve additive cyclic group and the Cartesian product of the above-mentioned elliptic curve additive cyclic group, and a mapping function of the elliptic curve non-zero multiplication group based on the target prime number.

[0035] Sub-step 3, determining the product of the user hash byte sequence and the system public key and the sum of the first target user partial public key as the first verification byte sequence.

[0036] Sub-step 4, determining the product of the first target user partial private key and the above-mentioned elliptic curve addition generator as the second verification byte sequence, wherein the above-mentioned first target user partial private key is the first user partial private key sent by the above-mentioned key generation server.

[0037] Sub-step 5, in response to determining that the first verification byte sequence and the second verification byte sequence are the same, concatenating the second user partial public key, the first user partial public key, and the second verification byte sequence to determine the user public key.

[0038] Sub-step 6, determining the inverse of the product of the user hash byte sequence and the second user partial private key and the sum of the above-mentioned first user partial private key as the target user partial private key.

[0039] Sub-step 7, concatenating the second user partial private key and the target user partial private key to obtain a user private key.

[0040] Sub-step 8: determining the user public key and the user private key as a user public-private key pair.

[0041] In the second step, in response to determining that the first verification byte sequence and the second verification byte sequence are different, a value is reselected from the above-mentioned elliptic curve non-zero multiplication group as the second user partial private key to continue executing the above-mentioned determination step.

[0042] In some optional implementations of some embodiments, the first user partial public-private key pair may be obtained by the following steps:

[0043] In the first step, the non-zero values ​​included in the non-zero multiplication group of the elliptic curve are screened to obtain a first value and a second value. The first value and the second value may be different elements in the non-zero multiplication group of the elliptic curve. The execution subject of the first user partial public-private key pair is the key generation server.

[0044] The second step is to determine the product of the first numerical value and the elliptic curve addition generator as the first user partial public key.

[0045] The third step is to input the user identity information, the first user partial public key and the second user partial public key into the first hash function to obtain a first hash byte sequence.

[0046] The fourth step is to determine the product of the second value and the first hash byte sequence and the sum of the first value as the first user partial private key.

[0047] The fifth step is to determine the first user partial public key and the first user partial private key as a first user partial public-private key pair.

[0048] Step 104: Determine the signature information of the receiving user of the file receiving user terminal set.

[0049] In some embodiments, the execution subject may determine the receiving user signature information of the file receiving user terminal set, wherein the file receiving user terminal in the file receiving user terminal set is the user terminal that receives the file set to be transmitted. The receiving user signature information may represent the identity information of the file receiving user terminal set and the integrity authentication of the file set to be transmitted.

[0050] In some optional implementations of some embodiments, the above-mentioned determination of the receiving user signature information of the file receiving user terminal set may include the following steps:

[0051] The first step is to determine the product of a third value and the elliptic curve addition generator as a user signature parameter, wherein the third value is a value in the non-zero multiplication group of the elliptic curve. The third value may be different from the first value, the second value, and the second user partial private key, and is a value in the non-zero multiplication group of the elliptic curve.

[0052] In the second step, for each file receiving client in the above file receiving client set, the following generation steps are performed:

[0053] Sub-step 1, determining the user public key and user identity information corresponding to the file receiving user terminal as the receiving user public key and receiving user identity information. The receiving user public key may be the public key corresponding to the file receiving user terminal. The method for generating the receiving user public key may be the same as the method for generating the user public key.

[0054] Sub-step 2: determine the product of the sum of the second user partial private key and the target user partial private key included in the above user private key and the third value as the first user signature.

[0055] Sub-step 3, determining the sum of the second receiving user partial public key, the first receiving user partial public key, the second receiving verification byte sequence included in the above-mentioned receiving user public key, and the product of the receiving user hash byte sequence and the above-mentioned system public key as the second user signature, wherein the above-mentioned receiving user hash byte sequence is a byte sequence obtained by inputting the above-mentioned first receiving user partial public key, the above-mentioned second receiving user partial public key and the above-mentioned receiving user identity information into the above-mentioned first hash function. The above-mentioned second receiving user partial public key can be a partial public key generated by the file receiving user terminal itself. The above-mentioned first receiving user partial public key can be a partial public key generated by the key generation server based on the receiving user identity information. The above-mentioned second receiving verification byte sequence can be the product of the first receiving user partial private key and the above-mentioned elliptic curve addition generator. The above-mentioned first receiving user partial private key can be a partial key generated by the key generation server based on the receiving user identity information.

[0056] Sub-step 4: determine the product of the first user signature and the second user signature as the target user signature.

[0057] Sub-step 5: input the receiving user identity information, the target user signature and the user signature parameter into the first hash function to obtain a second hash byte sequence.

[0058] Sub-step 6, determining the difference between the sending signature parameter and the second hash byte sequence and the remainder of the fourth value divided by the target prime number as the receiving user signature item, wherein the fourth value is any value in the non-zero multiplication group of the elliptic curve. The sending signature parameter is an unknown parameter.

[0059] The third step is to perform cumulative multiplication processing on each of the received user signature items to obtain a user signature polynomial as the received user signature information.

[0060] Step 105, based on the user's public-private key pair and the received user's signature information, the file set to be transmitted is sign-encrypted to obtain a sign-encrypted transmission file.

[0061] In some embodiments, the execution subject may perform file signcryption processing on the set of files to be transmitted according to the public-private key pair of the user and the signature information of the receiving user to obtain a signed transmission file. The signed transmission file may be a file obtained by concatenating each file to be transmitted in the set of files to be transmitted after the user signs and encrypts the files.

[0062] In some optional implementations of some embodiments, the above-mentioned file signcryption processing is performed on the above-mentioned file set to be transmitted according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information to obtain the signcrypted transmission file, which may include the following steps:

[0063] In the first step, based on the third value, the system public key and the user public key included in the user public-private key pair, the file sender corresponding to the file set to be transferred is signed by the user to obtain the target user signature. The target user signature can represent the identity of the file sender itself.

[0064] As an example, the execution subject may first input the user identity information and the user public key into the first hash function to obtain a user signature hash byte sequence. Subsequently, the product of the user signature hash byte sequence and the system public key is determined as the target signature hash byte sequence. Then, the sum of the target signature hash byte sequence, the second user partial public key, the first user partial public key and the second verification value included in the user public key is determined as the signcrypted hash byte sequence. Finally, the product of the signcrypted hash byte sequence and the third value is determined as the target user signature.

[0065] The second step is to segment and obfuscate the above-mentioned file set to be transmitted to obtain an obfuscated reorganized file, wherein the above-mentioned obfuscated reorganized file contains file segmentation granularity information and segmented file location information. The above-mentioned obfuscated reorganized file can be a file obtained by segmenting each file to be transmitted in the above-mentioned file set twice with different granularities and then reorganizing them. The above-mentioned file segmentation granularity information can represent the number of file segmentations. The above-mentioned segmented file location information can represent the location information of each segmented part file in the above-mentioned file set to be transmitted.

[0066] As an example, the execution subject may first perform a first segmentation on each file to be transmitted in the file set to be transmitted to generate a first segmentation file group to obtain a first segmentation file group set. Then, each first segmentation file in the first segmentation file group set is segmented for a second time to generate each second segmentation file to obtain each second segmentation file group set. Finally, the second segmentation file group sets are sequentially combined to obtain an obfuscated reorganized file. The sequential combination may be firstly combining each second segmentation file group set with the second segmentation file located at the same position in the file to obtain a first combination file set, and then combining each first combination file obtained with the first combination file group located at the same position in the file to obtain an obfuscated reorganized file.

[0067] The third step is to input the fifth value into the second hash function and perform an XOR operation with the obfuscated reorganized file to obtain a signcrypted file, wherein the second hash function represents a function of mapping the domain of a byte sequence of any length consisting of 0 or 1 and an elliptic curve non-zero multiplication group based on a target prime number, and the second hash function is a parameter in the key generation parameter set. The fifth value can be any value in the elliptic curve non-zero multiplication group.

[0068] The fourth step is to input the above-mentioned signcryption file, the above-mentioned target user signature and the above-mentioned user signature parameters into the above-mentioned first hash function to obtain a third hash byte sequence.

[0069] The fifth step is to determine the sum of the third hash byte sequence and the second user partial private key and the target user partial private key included in the user private key as a ciphertext validity parameter.

[0070] The sixth step is to combine and concatenate the above-mentioned signcrypted file, the above-mentioned receiving user signature information, the above-mentioned user signature parameters, the above-mentioned target user signature and the above-mentioned ciphertext validity parameters to obtain the signcrypted transmission file.

[0071] Step 106: encrypt the user's public and private key pair to obtain an encrypted key pair.

[0072] In some embodiments, the execution subject may perform key encryption processing on the user's public-private key pair to obtain an encrypted key pair, wherein the encrypted key pair may be a key pair obtained by asymmetric encryption of the user's public-private key pair.

[0073] Step 107, segment the signcrypted transmission file to obtain a segmented signcrypted transmission file set.

[0074] In some embodiments, the execution subject may perform segmentation processing on the signcrypted transmission file to obtain a segmented signcrypted transmission file set. The segmentation processing may be performed according to 4 bytes.

[0075] Step 108: Generate a file transmission byte stream according to the encryption key pair and the segmented and signed transmission file set.

[0076] In some embodiments, the execution subject may generate a file transfer byte stream according to the encryption key pair and the segmented post-signcryption transfer file set, wherein the file transfer byte stream may be a byte stream obtained by converting the encryption key pair and the segmented post-signcryption transfer file set into a byte format for transmission.

[0077] In some optional implementations of some embodiments, generating a file transmission byte stream according to the encryption key pair and the segmented and signed transmission file set may include the following steps:

[0078] In the first step, for each segmented post-signature transmission file in the above segmented post-signature transmission file set, perform the following combined steps:

[0079] Sub-step 1, determining the message length, file encryption identification information, segment sequence number and receiving address information of the above-mentioned segmented and signed transmission file. Among them, the above-mentioned message length can be the number of bytes included in the above-mentioned segmented and signed transmission file. The above-mentioned file encryption identification information can be identification information obtained by numerically encoding the encryption algorithm adopted. The above-mentioned segment sequence number can be the position number of the above-mentioned segmented and signed transmission file in the above-mentioned signed transmission file. The above-mentioned receiving address information can be the address information of the file receiving user end.

[0080] Sub-step 2, performing integrity check on the segmented and signed encrypted transmission file to obtain a file check value. The file check value may be used to detect whether the file set obtained after transmitting the file set to be transmitted is the same as the file set to be transmitted. In practice, the execution subject may use a cyclic redundancy check algorithm to perform integrity check on the segmented and signed encrypted transmission file to obtain a file check value.

[0081] Sub-step 3, combining the message length, the file encryption identification information, the encryption key pair, the file checksum value and the receiving address information to obtain transmission header information. The transmission header information may be located before the segmented and signed transmission file and is used to ensure the secure and effective transmission of the segmented and signed transmission file.

[0082] Sub-step 4, converting the transmission header information and the segmented and signed encrypted transmission file into byte streams to obtain a transmission header byte stream and a transmission body byte stream. The transmission header byte stream may be a byte stream representing the transmission header information in the form of a byte type. The transmission body byte stream may be a byte stream representing the segmented and signed encrypted transmission file in the form of a byte type.

[0083] Sub-step 5, combining the above-mentioned transmission header byte stream and the above-mentioned transmission body byte stream to obtain a file segment transmission byte stream.

[0084] The second step is to sequentially combine the obtained file segment transmission byte streams according to the obtained segment sequence numbers to obtain a file transmission byte stream.

[0085] Step 109, the file transmission byte stream is transmitted through a covert channel for decryption and reception by the file receiving user terminal set.

[0086] In some embodiments, the execution subject may transmit the file transmission byte stream through a covert channel for the file receiving user terminal set to decrypt and receive. The decrypted execution subject file receiving user terminal set may decrypt by the following steps: First, the file transmission byte stream is parsed to obtain the target user signature, user signature parameters and signcrypted file. Secondly, the sum of the second user partial private key and the target user partial private key included in the receiving user private key corresponding to the file receiving user terminal and the product of the target user signature are determined as the receiving user signature. Thirdly, the receiving user identity information of the file receiving user terminal, the receiving user signature and the user signature parameters are input into the first hash function to obtain a receiving hash byte sequence. Subsequently, the receiving hash byte sequence is substituted into the target user signature item for solution to obtain the solution result value. The target user signature item may be a signature function in which the sending signature parameter in the receiving user signature item is replaced with the receiving hash byte sequence and the fourth value is used as the unknown item. Then, using the above solution result value, after decrypting the above signed file, each obfuscated transmission file set, file segmentation granularity information and segmented file location information are obtained. Finally, according to the above file segmentation granularity information and the above segmented file location information, each obfuscated transmission file set is reordered to obtain the file to be transmitted.

[0087] As an example, the execution subject may construct a time-based covert channel, and then utilize the time-based covert channel to perform file transmission on the file transmission byte stream, so that the file receiving user terminal can decrypt and receive it.

[0088] In the process of adopting technical solutions to solve the above-mentioned technical problem 1, the following technical problem 2 is often accompanied: with the emergence of random quantum computers and the improvement of computer computing power, there are more and more attacks on encryption technology. The security of only encrypting the private data in the files to be transmitted is getting lower and lower. How to further improve the security of the files to be transmitted on the basis of encryption technology. For the above-mentioned technical problem 2, the conventional solution is generally: fill the encrypted segmented file transfer byte stream into the payload part of the network protocol message to transmit and send the segmented file transfer byte stream. However, the above-mentioned conventional solution still has the following problems: because the payload part of the network protocol message is the key detection part of the message anomaly detection, and it destroys the original communication effect of the message, and the amount of data that can be filled in the payload part is small, resulting in low security of the encrypted segmented file transfer byte stream, the possibility of covert channel exposure, low transmission efficiency and transmission capacity, and increased waste of transmission resources. The inventors considered the shortcomings, and combined with the advantages / technical status of the encryption technology and covert channel construction owned by the inventor's company, we decided to adopt the following solution:

[0089] In some optional implementations of some embodiments, the above-mentioned covert channel transmission of the above-mentioned file transmission byte stream for decryption and reception by the above-mentioned file receiving user terminal set may include the following steps:

[0090] In the first step, for each file receiving client in the above file receiving client set, the following sending and transmission steps are performed:

[0091] Sub-step 1, determining the network protocol address of the file receiving client corresponding to the file transmission byte stream, wherein the network protocol address can be the domain name or IP (Internet Protocol Address) address of the file receiving client using SSL (Secure Sockets Layer) protocol.

[0092] Sub-step 2, in response to determining that the communication connection with the above-mentioned file receiving client is successfully established, a covert handshake message is sent to the above-mentioned file receiving client through the above-mentioned network protocol address, wherein the above-mentioned covert handshake message includes: the size of the file transfer byte stream, the file integrity check value, the covert channel version information and the covert channel type information. Among them, the above-mentioned covert handshake message can be used to inform the file receiving client of the user terminal identity information and the covert channel information of sending the file set to be transmitted. The above-mentioned file integrity check value can be a value used to verify whether the file set to be transmitted before and after the transmission is consistent. The above-mentioned covert channel type information can be information on the type of covert channel established with the file receiving client. The above-mentioned covert channel type information can include: storage type covert channel, sequence type covert channel, time type covert channel and packet length type covert channel. The above-mentioned sequence type covert channel can be a covert channel that transmits ciphertext through the sorting order between different cipher suites in the cipher suite list field in the Client Hello message that establishes the first handshake connection with the file receiving client. The above-mentioned packet length type covert channel can be a covert channel that transmits ciphertext through the length information of the Client Hello message.

[0093] Sub-step 3, in response to receiving a response message to the covert handshake message sent by the file receiving client, and the covert channel type information is a storage-type covert channel, generating a first symmetric key. The first symmetric key may be a symmetric key used to encrypt and decrypt a file transmission byte stream.

[0094] Sub-step 4, based on the first symmetric key and the segmented file transfer byte stream set, perform the following encryption steps:

[0095] The first sub-step is to encrypt the segmented file transfer byte stream located at the starting position in the segmented file transfer byte stream set according to the first symmetric key to obtain a first encrypted file transfer byte stream.

[0096] As an example, the execution entity may utilize a symmetric encryption algorithm to encrypt the segmented file transfer byte stream located at the starting position in the segmented file transfer byte stream set according to the first symmetric key to obtain a first encrypted file transfer byte stream.

[0097] The second sub-step is to determine the first encrypted file transmission byte stream as the second symmetric encryption key.

[0098] The third sub-step is to symmetrically encrypt the target segmented file transfer byte stream according to the second symmetric encryption key to obtain a second encrypted file transfer byte stream, wherein the target segmented file transfer byte stream is the byte stream after the segmented file transfer byte stream at the starting position.

[0099] The fourth sub-step, in response to determining that the above-mentioned target segmented file transfer byte stream is a transfer byte stream located at the end position of the above-mentioned segmented file transfer byte stream set, determines the first encrypted file transfer byte stream and the above-mentioned second encrypted file transfer byte stream as an encrypted transfer byte stream set.

[0100] Sub-step 5, in response to determining that the above-mentioned target segmented file transfer byte stream is not a byte stream located at the end position in the above-mentioned segmented file transfer byte stream set, the second encrypted file transfer byte stream is determined as a third symmetric encryption key as the first symmetric encryption key, and the segmented file transfer byte stream set without the segmented file transfer byte streams corresponding to the above-mentioned first encrypted file transfer byte stream and the above-mentioned second encrypted file transfer byte stream is determined as the segmented file transfer byte stream set, so as to perform the above-mentioned encryption step again.

[0101] Sub-step 6, embeds the above-mentioned encrypted transmission byte stream set and synchronous transmission identifier information into the target field set in the handshake protocol message to obtain a handshake embedded protocol message. Among them, the above-mentioned synchronous transmission identifier information can be the information of the sequence identifier used to prevent the encrypted transmission byte stream in the encrypted transmission byte stream set from being disordered. The above-mentioned target field set can be the Random field and Session ID field in the Client Hello message. The above-mentioned synchronous transmission identifier information is the information embedded in the Session ID field. It should be noted that since the Random field and Session ID field in the Client Hello message store some random fields generated by sending the file set to be transmitted in the original message, modifying them will not affect the recognition of the message, and can avoid being identified as an abnormal message to a certain extent.

[0102] Sub-step 7, performs traffic anomaly detection on the above-mentioned handshake embedded protocol message to obtain a traffic anomaly detection value. Among them, the above-mentioned traffic anomaly detection value can represent the probability value of the above-mentioned embedded handshake protocol message being identified as an abnormal message. The larger the above-mentioned traffic anomaly detection value is, the greater the possibility that the above-mentioned embedded handshake protocol message is identified as an abnormal message. In practice, the above-mentioned execution subject can first input the above-mentioned handshake embedded protocol message into a denoising autoencoder to obtain a protocol feature vector set. Then, the above-mentioned protocol feature vector set is input into a message traffic anomaly detection model optimized based on the moth-to-flame optimization algorithm to obtain a traffic anomaly value. Among them, the above-mentioned message traffic anomaly detection model can be a model in which a gated recurrent unit network is added to a convolutional neural network.

[0103] Sub-step 8, in response to determining that the above-mentioned traffic anomaly detection value is less than or equal to a preset anomaly value threshold, determine the number of times the above-mentioned handshake embedded protocol message is sent according to the above-mentioned encrypted transmission byte stream set. The above-mentioned preset anomaly value threshold may be a pre-set minimum value that is identified as an abnormal message. For example, the above-mentioned preset anomaly value threshold may be 0.85.

[0104] As an example, the execution entity may determine, in response to determining that the traffic anomaly value is less than or equal to a preset anomaly value threshold, the number of bytes corresponding to the encrypted transmission byte stream set divided by the number of bytes transmitted by the handshake embedded protocol message as the number of transmissions.

[0105] Sub-step 9: sending and transmitting the embedded handshake protocol messages sent the number of times and the corresponding handshake end messages, so that the file receiving user terminal can decrypt and receive them.

[0106] The above technical solution and its related contents, as an inventive point of an embodiment of the present disclosure, solve the second technical problem mentioned in the background technology: "Since the payload part of the network protocol message is the key detection part of the message anomaly detection, and destroys the original communication effect of the message, and the amount of data that can be filled in the payload part is small, the security of the encrypted segmented file transmission byte stream is low, there is a possibility of covert channel exposure, low transmission efficiency and transmission capacity, and increased waste of transmission resources." The factors that lead to the low security of the encrypted segmented file transmission byte stream, the possibility of covert channel exposure, low transmission efficiency and transmission capacity, and increased waste of transmission resources are often as follows: Since the payload part of the network protocol message is the key detection part of the message anomaly detection, and destroys the original communication effect of the message, and the amount of data that can be filled in the payload part is small. If the above factors are solved, the security of the encrypted segmented file transmission byte stream can be improved, the possibility of covert channel exposure can be reduced, the transmission efficiency and transmission capacity can be improved, and the waste of transmission resources can be reduced. In order to achieve this effect, the present invention first determines the network protocol address of the file receiving user end, establishes a network connection and sends a covert handshake message, which can determine the type of covert channel constructed by the user end that sends the file set to be transmitted, so that the file receiving user end performs corresponding extraction and decryption operations on the specific covert channel, thereby improving the decryption reception efficiency of the file receiving user end. Then, a cyclic symmetric key is generated, and the segmented file transmission byte stream set is subjected to cyclic symmetric encryption encoding processing, which can improve the concealment of the covert channel and improve the security of transmission. Subsequently, synchronous transmission identifier information is added to the encrypted transmission byte stream, and the encrypted transmission byte stream is embedded in the Random field and Session ID field in the handshake protocol message, which can improve the transmission capacity of the covert channel, and the transmission robustness of the covert channel can be enhanced by embedding the synchronous transmission identifier information. Finally, the handshake embedded protocol message is subjected to flow anomaly detection, which can reduce the possibility of the handshake embedded protocol message being detected, further improve the concealment of the handshake embedded protocol message, and improve the security of the encrypted segmented file transmission byte stream.

[0107] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the file encryption transmission method of some embodiments of the present disclosure can improve the security of file transmission by partially generating public and private keys and sending the fusion signcryption of one-to-many user terminal identity information. Specifically, the reason for the low security of the relevant file transmission is that: since the user private keys of all users are generated by the master key of KGC, once the master key of KGC is leaked, the user's private key will be fully exposed, and the file set is encrypted by bilinear pairing operation without signing operation, resulting in high encryption calculation complexity, low encryption efficiency, and the possibility of leakage of stored private keys, which leads to low security of file transmission. Based on this, the file encryption transmission method of some embodiments of the present disclosure can first obtain the file set to be transmitted, the key generation parameter set sent by the key generation server, and the first user's partial public and private key pair, wherein the above-mentioned key generation parameter set includes at least one of the following: elliptic curve non-zero multiplication group, elliptic curve addition generator and system public key. Here, it is used to subsequently generate the second user distributed public and private key pair and signcrypt the file set to be transmitted. Secondly, according to the above-mentioned elliptic curve non-zero multiplication group and the above-mentioned elliptic curve addition generator, a second user partial public-private key pair is generated. Here, by generating partial public-private key pairs by the user end and the key generation service end respectively, the possibility of key pair leakage can be reduced to a certain extent, the security of partial public-private key pairs can be improved, and the waste of secret key transmission resources can be reduced. Thirdly, according to the above-mentioned system public key and the above-mentioned key generation parameter set, the above-mentioned first user partial public-private key pair and the above-mentioned second user partial public-private key pair are key spliced ​​to obtain a user public-private key pair. Here, the security and complexity of the user public-private key pair can be improved, thereby improving the security of subsequent file encryption transmission. Subsequently, the receiving user signature information of the file receiving user end set is determined, wherein the file receiving user end in the above-mentioned file receiving user end set is the user end that receives the above-mentioned file set to be transmitted. Here, the identity identification information of multiple file receiving user ends is merged, the anonymity of the file recipient is realized, and the privacy protection of the file receiving user end can be improved. Then, according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information, the above-mentioned file set to be transmitted is subjected to file signcryption processing to obtain a signcrypted transmission file. Here, signcryption adds user signature technology to encryption, which can simultaneously achieve the security, integrity and unforgeability of files, and encrypt through elliptic curve operations, which can reduce encryption complexity and improve encryption efficiency. Afterwards, the above-mentioned user public and private key pairs are key encrypted to obtain an encrypted key pair. Here, the security of the user's public and private key pairs is improved. Then, the above-mentioned signcrypted transmission file is segmented to obtain a segmented signcrypted transmission file set. Here, segmentation facilitates subsequent segmentation processing, which can improve transmission efficiency and achieve breakpoint transmission.Then, according to the above encryption key pair and the above segmented signed transmission file set, a file transmission byte stream is generated. Here, the design of the file transmission byte stream for the file transmission scenario can improve the security and applicability of the file transmission. Finally, the above file transmission byte stream is sent and transmitted through a covert channel for the above file receiving user terminal set to decrypt and receive. Here, the covert channel sending and transmission can improve the security of file transmission and reduce the possibility of file leakage. It can be obtained that the file encryption transmission method generates a user's partial public and private key pair through the key generation server and the user terminal sending the file set, which can reduce the possibility of user private key leakage, and the file signing of identity fusion for multiple file recipients, which is suitable for one-to-many encryption transmission scenarios, improves the anonymity of the sender and the receiver, and thus improves the security of file transmission.

[0108] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a file encryption transmission device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the file encryption transmission device can be specifically applied to various electronic devices.

[0109] like Figure 2As shown, a file encryption transmission device 200 includes: an acquisition unit 201, a first generation unit 202, a key splicing unit 203, a determination unit 204, a file signcryption unit 205, a key encryption unit 206, a segmentation unit 207, a second generation unit 208 and a covert channel transmission unit 209. The acquisition unit 201 is configured to: acquire a set of files to be transmitted, a key generation parameter set sent by a key generation server, and a first user partial public-private key pair, wherein the key generation parameter set includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key. The first generation unit 202 is configured to: generate a second user partial public-private key pair according to the elliptic curve non-zero multiplication group and the elliptic curve addition generator. The key splicing unit 203 is configured to: perform key splicing on the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair. The determination unit 204 is configured to: determine the signature information of the receiving user of the file receiving user terminal set, wherein the file receiving user terminal in the above-mentioned file receiving user terminal set is the user terminal that receives the above-mentioned file set to be transmitted. The file signcryption unit 205 is configured to: perform file signcryption processing on the above-mentioned file set to be transmitted according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information to obtain a signed transmission file. The key encryption unit 206 is configured to: perform key encryption processing on the above-mentioned user public-private key pair to obtain an encryption key pair. The segmentation unit 207 is configured to: perform segmentation processing on the above-mentioned signed transmission file to obtain a segmented signed transmission file set. The second generation unit 208 is configured to: generate a file transmission byte stream according to the above-mentioned encryption key pair and the above-mentioned segmented signed transmission file set. The covert channel sending and transmission unit 209 is configured to: perform covert channel sending and transmission on the above-mentioned file transmission byte stream for decryption and reception by the above-mentioned file receiving user terminal set.

[0110] It is understandable that the units described in the file encryption transmission device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the file encryption transmission device 200 and the units included therein, and will not be described in detail here.

[0111] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0112] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0113] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0114] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0115] It should be noted that the computer-readable medium in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0116] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0117] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being installed in the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the file set to be transmitted, the key generation parameter set sent by the key generation server, and the first user partial public-private key pair, wherein the above-mentioned key generation parameter set includes at least one of the following items: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key; generates a second user partial public-private key pair according to the above-mentioned elliptic curve non-zero multiplication group and the above-mentioned elliptic curve addition generator; performs key concatenation on the above-mentioned first user partial public-private key pair and the above-mentioned second user partial public-private key pair according to the above-mentioned system public key and the above-mentioned key generation parameter set to obtain a user public-private key pair. ; Determine the receiving user signature information of the file receiving user terminal set, wherein the file receiving user terminal in the above-mentioned file receiving user terminal set is the user terminal that receives the above-mentioned file set to be transmitted; perform file signcryption processing on the above-mentioned file set to be transmitted according to the above-mentioned user public-private key pair and the above-mentioned receiving user signature information to obtain a signcrypted transmission file; perform key encryption processing on the above-mentioned user public-private key pair to obtain an encryption key pair; perform segmentation processing on the above-mentioned signcrypted transmission file to obtain a segmented signed transmission file set; generate a file transmission byte stream according to the above-mentioned encryption key pair and the above-mentioned segmented signed transmission file set; perform covert channel transmission transmission on the above-mentioned file transmission byte stream for decryption and reception by the above-mentioned file receiving user terminal set.

[0118] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be arranged in a processor, for example, may be described as: a processor including an acquisition unit, a first generation unit, a key splicing unit, a determination unit, a file signcryption unit, a key encryption unit, a segmentation unit, a second generation unit and a covert channel sending transmission unit. Among them, the names of these units do not constitute a limitation on the units themselves in certain cases. For example, the acquisition unit may also be described as "a unit for acquiring a set of files to be transmitted, a set of key generation parameters sent by a key generation server, and a partial public-private key pair of the first user".

[0121] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0122] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A file encryption transmission method, comprising: Obtaining a set of files to be transmitted, a key generation parameter set sent by a key generation server, and a partial public-private key pair of a first user, wherein the key generation parameter set includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key; Generate a partial public-private key pair of a second user according to the elliptic curve non-zero multiplication group and the elliptic curve addition generator; According to the system public key and the key generation parameter set, performing key concatenation on the first user partial public-private key pair and the second user partial public-private key pair to obtain a user public-private key pair; Determine the receiving user signature information of the file receiving user terminal set, wherein the file receiving user terminals in the file receiving user terminal set are the user terminals that receive the file set to be transmitted; According to the user public-private key pair and the receiving user signature information, the file set to be transmitted is sign-encrypted to obtain a sign-encrypted transmission file; Performing key encryption processing on the user's public and private key pair to obtain an encrypted key pair; Segmenting the signcrypted transmission file to obtain a segmented signcrypted transmission file set; Generate a file transmission byte stream according to the encryption key pair and the segmented and signed transmission file set; The file transmission byte stream is transmitted through a covert channel so as to be decrypted and received by the file receiving user terminal set.

2. The method according to claim 1, wherein: The step of generating a file transmission byte stream according to the encryption key pair and the segmented and signed transmission file set comprises: For each segmented post-signcryption transmission file in the segmented post-signcryption transmission file set, the following combined steps are performed: Determine the message length, file encryption identification information, segment sequence number and receiving address information of the segmented and signed encrypted transmission file; Performing integrity check on the segmented and signed encrypted transmission file to obtain a file check value; Combining the message length, the file encryption identification information, the encryption key pair, the file checksum value and the receiving address information to obtain transmission header information; Performing byte stream conversion on the transmission header information and the segmented and signed encrypted transmission file to obtain a transmission header byte stream and a transmission body byte stream; Combining the transmission header byte stream and the transmission body byte stream to obtain a file segment transmission byte stream; According to the obtained segment sequence numbers, the obtained file segment transmission byte streams are sequentially combined to obtain a file transmission byte stream.

3. The method according to claim 1, wherein: The key generation parameter set includes: a first hash function and an elliptic curve addition cycle group, the second user partial public-private key pair includes: a second user partial public key and a second user partial private key; and The step of performing key concatenation on the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair includes: Based on the second user partial private key, the following determination steps are performed: Sending the user identity information and the second user partial public key to the key generation server, so that the key generation server generates the first user partial public-private key pair according to the user identity information, wherein the first user partial public-private key pair includes: a first user partial public key and a first user partial private key; Input the user identity information, the first target user partial public key and the second user partial public key into the first Hash function to obtain a user hash byte sequence, wherein the first target user partial public key is the first user partial public key received from the key generation server, and the first Hash function represents a byte sequence of any length consisting of 0 or 1, the domain of the elliptic curve additive cyclic group and the Cartesian product of the elliptic curve additive cyclic group, and a mapping function of the elliptic curve non-zero multiplication group based on a target prime number; Determine the product of the user hash byte sequence and the system public key and the sum of the first target user partial public key as the first verification byte sequence; Determine a product of a first target user partial private key and the elliptic curve addition generator as a second verification byte sequence, wherein the first target user partial private key is the first user partial private key sent by the key generation server; In response to determining that the first verification byte sequence and the second verification byte sequence are the same, concatenating the second user partial public key, the first user partial public key, and the second verification byte sequence to determine the user public key; Determine the inverse of the sum of the product of the user hash byte sequence and the second user partial private key and the first user partial private key as the target user partial private key; Concatenate the second user's partial private key and the target user's partial private key to obtain a user private key; Determine the user's public key and the user's private key as a user's public-private key pair; In response to determining that the first verification byte sequence and the second verification byte sequence are different, a value is reselected from the non-zero multiplication group of the elliptic curve as the second user partial private key to continue executing the determining step.

4. The method according to claim 3, wherein: The first user partial public-private key pair is obtained by the following steps: Screening non-zero values ​​included in the non-zero multiplication group of the elliptic curve to obtain a first value and a second value; Determine a product of the first value and the elliptic curve addition generator as a first user partial public key; Inputting the user identity information, the first user partial public key and the second user partial public key into the first Hash function to obtain a first Hash byte sequence; Determine a sum of a product of the second value and the first hash byte sequence and the first value as a first user partial private key; The first user partial public key and the first user partial private key are determined as a first user partial public-private key pair.

5. The method according to claim 3, wherein: The step of determining the receiving user signature information of the file receiving user terminal set includes: Determine a product of a third value and the elliptic curve addition generator as a user signature parameter, wherein the third value is a value in a non-zero multiplication group of the elliptic curve; For each file receiving client in the file receiving client set, the following generation steps are performed: Determine the user public key and user identity information corresponding to the file receiving user end as the receiving user public key and the receiving user identity information; Determine a product of a sum of a second user partial private key and a target user partial private key included in the user private key and the third value as the first user signature; Determine the sum of the second receiving user partial public key, the first receiving user partial public key, the second receiving verification byte sequence, and the product of the receiving user hash byte sequence and the system public key, as the second user signature, wherein the receiving user hash byte sequence is a byte sequence obtained by inputting the first receiving user partial public key, the second receiving user partial public key, and the receiving user identity information into the first hash function; Determine a product of the first user signature and the second user signature as a target user signature; Inputting the receiving user identity information, the target user signature and the user signature parameter into the first hash function to obtain a second hash byte sequence; Determine the sum of the difference between the sending signature parameter and the second hash byte sequence and the remainder of a fourth value divided by the target prime number as the receiving user signature item, wherein the fourth value is any value in the non-zero multiplication group of the elliptic curve, and the sending signature parameter is an unknown parameter; The obtained receiving user signature items are multiplied to obtain a user signature polynomial as the receiving user signature information.

6. The method according to claim 5, wherein: The process of performing file signcryption processing on the to-be-transmitted file set according to the user public-private key pair and the receiving user signature information to obtain a signcrypted transmission file includes: Performing a user signature on the file sending end corresponding to the set of files to be transferred according to the third value, the system public key and the user public key included in the user public-private key pair to obtain a target user signature; Segmenting and obfuscating the file set to be transmitted to obtain an obfuscated reorganized file, wherein the obfuscated reorganized file contains file segmentation granularity information and segmented file location information; Input the fifth value into a second hash function and perform an XOR operation with the obfuscated reorganized file to obtain a signcrypted file, wherein the second hash function represents a function of a mapping between a domain of a byte sequence of any length consisting of 0 or 1 and an elliptic curve non-zero multiplication group based on a target prime number, and the fifth value is any value in the elliptic curve non-zero multiplication group; Input the signcryption file, the target user signature and the user signature parameter into the first Hash function to obtain a third Hash byte sequence; Determine the sum of the third hash byte sequence, the second user partial private key and the target user partial private key included in the user private key as a ciphertext validity parameter; The signcrypted file, the receiving user signature information, the user signature parameter, the target user signature and the ciphertext validity parameter are combined and spliced ​​to obtain a signcrypted transmission file.

7. A file encryption transmission device, comprising: An acquisition unit is configured to acquire a set of files to be transmitted, a set of key generation parameters sent by a key generation server, and a partial public-private key pair of a first user, wherein the set of key generation parameters includes at least one of the following: an elliptic curve non-zero multiplication group, an elliptic curve addition generator, and a system public key; A first generating unit is configured to generate a second user partial public-private key pair according to the elliptic curve non-zero multiplication group and the elliptic curve addition generator; a key concatenation unit configured to concatenate the first user partial public-private key pair and the second user partial public-private key pair according to the system public key and the key generation parameter set to obtain a user public-private key pair; A determining unit, configured to determine the signature information of a receiving user of a file receiving user terminal set, wherein the file receiving user terminals in the file receiving user terminal set are user terminals that receive the file set to be transmitted; A file signcryption unit is configured to perform file signcryption processing on the to-be-transmitted file set according to the user public-private key pair and the receiving user signature information to obtain a signcrypted transmission file; A key encryption unit, configured to perform key encryption processing on the user public-private key pair to obtain an encrypted key pair; A segmentation unit is configured to perform segmentation processing on the signcrypted transmission file to obtain a segmented signcrypted transmission file set; A second generating unit is configured to generate a file transmission byte stream according to the encryption key pair and the segmented and signed transmission file set; The covert channel transmission unit is configured to perform covert channel transmission on the file transmission byte stream for decryption and reception by the file receiving user terminal set.

8. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images