Data security encryption processing method and system

Abstract

The invention discloses a data security encryption processing method and system, and relates to the technical field of data analysis processing, and the method comprises the steps: obtaining audio and video data and court trial document data generated in real time in a court trial process; processing the audio and video data through a symmetric encryption algorithm to obtain first encrypted data, processing the court hearing document data through an asymmetric encryption algorithm to obtain second encrypted data, obtaining an encrypted data abstract through a hash function, and generating a data packet group according to the first encrypted data, the second encrypted data and the encrypted data abstract; generating a first session key according to the first random private key, a second public key received from a remote server, a large prime number and a cardinal number; and performing encryption processing based on the first session key to obtain encrypted data packets, and sending each encrypted data packet to a remote server. Therefore, the cloud sharing court can dynamically generate the secret key, and the judicial transparency and the public trust are further improved by ensuring the security, the real-time performance and the integrity of the data.

Description

Technical Field

[0001] The present application relates to the technical field of data analysis and processing, and in particular to a data security encryption processing method and system. Background Art

[0002] With the advancement of paperless case handling, cloud-based shared courts have emerged. The current digital trial system mainly relies on pure intranet or pure extranet, resulting in strong system independence and lack of effective data interaction. Courts usually use the intranet to handle cases, while the extranet is used to communicate with the public or remote parties.

[0003] Although this approach guarantees information security to a certain extent, data between the internal and external networks cannot be effectively shared in real time, resulting in data inconsistency issues when the court conducts cross-regional trials. For example, differences in trial standards and information transmission between courts not only affect the efficiency of case handling, but may also undermine the fairness of the trial, especially when it comes to evidence submission and cross-examination.

[0004] In addition, the current digital trial system often adopts static key management schemes during data transmission and lacks dynamic encryption control, which leads to the risk of sensitive information (such as evidence, trial records, etc.) being intercepted during transmission. This poses a high security risk, which may not only lead to the leakage of the parties' information, but also undermine the public's trust in judicial fairness.

[0005] In response to the above problems, the industry has not yet proposed a better technical solution. Summary of the invention

[0006] The present application provides a data security encryption processing method, system, storage medium, computer program product and electronic device, which are used to at least solve the problems of data inconsistency and the risk of sensitive information being easily intercepted during transmission in cross-regional trials in current related technologies.

[0007] In a first aspect, an embodiment of the present application provides a data security encryption processing method, which is applied to a court trial service end, the method comprising: obtaining audio and video data and court trial document data generated in real time during the court trial; processing the audio and video data through a symmetric encryption algorithm to obtain first encrypted data, processing the court trial document data through an asymmetric encryption algorithm to obtain second encrypted data, processing the first metadata of the audio and video data and the second metadata of the court trial document data through a hash function to obtain an encrypted data summary, and generating a data packet group based on the first encrypted data, the second encrypted data and the encrypted data summary; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size and hash function type; generating a first random private key and based on the first random private key, a large prime number and a base Generate a first public key, send the first public key to the remote server, receive a second public key from the remote server, and generate a first session key according to the first random private key, the second public key, the large prime number and the base; wherein the large prime number and the base are differentially allocated by the trial server for each connected remote server by performing an agreed parameter generation operation; the second public key is generated by the remote server according to the second random private key, the large prime number and the base; the remote server is also used to generate a second session key according to the second random private key, the first public key, the large prime number and the base; encrypt each data packet in the data packet group based on the first session key to obtain a corresponding encrypted data packet, and send each of the encrypted data packets to the remote server.

[0008] In a second aspect, an embodiment of the present application provides a data security encryption processing system, which is deployed on a trial service end, and the system includes: a data acquisition unit, which is used to acquire audio and video data and trial document data generated in real time during the trial; a data encryption unit, which is used to process the audio and video data through a symmetric encryption algorithm to obtain first encrypted data, and process the trial document data through an asymmetric encryption algorithm to obtain second encrypted data, and process the first metadata of the audio and video data and the second metadata of the trial document data through a hash function to obtain an encrypted data summary, and generate a data packet group according to the first encrypted data, the second encrypted data and the encrypted data summary; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size and hash function type; a session encryption unit, which is used to generate a first random private key and generate a first encrypted data according to the first random private key, A first public key is generated based on a large prime number and a base, the first public key is sent to the remote server, a second public key is received from the remote server, and a first session key is generated based on the first random private key, the second public key, the large prime number and the base; wherein the large prime number and the base are differentially allocated by the trial server for each connected remote server by performing an agreed parameter generation operation respectively; the second public key is generated by the remote server based on the second random private key, the large prime number and the base; the remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number and the base; a data packet encryption transmission unit is used to encrypt each data packet in the data packet group based on the first session key to obtain a corresponding encrypted data packet, and send each of the encrypted data packets to the remote server.

[0009] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the data security encryption processing method of any embodiment of the present application.

[0010] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, characterized in that when the program is executed by a processor, the steps of the data security encryption processing method of any embodiment of the present application are implemented.

[0011] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the data security encryption processing method of any embodiment of the present application.

[0012] The data security encryption processing method provided by this application can produce at least the following technical effects:

[0013] (1) By using symmetric encryption algorithms for audio and video data in court trials, it is possible to achieve efficient encryption of large amounts of data and ensure real-time data transmission. Sensitive data such as court documents are further encrypted using asymmetric encryption algorithms to ensure their confidentiality during transmission. As a result, not only can audio and video data and court documents be shared synchronously and securely across regions, but the processing efficiency of the system is also improved. Compared with the existing pure intranet or extranet structure, data sharing between the intranet and the extranet is achieved through encryption, and the real-time encryption and decryption mechanism of data ensures that the trial data between different courts in cross-regional trials can remain consistent, reducing the data transmission delays and inconsistencies caused by network isolation.

[0014] (2) In the data encryption process, after generating the first encrypted data and the second encrypted data, the encrypted data summary (i.e., hash value) is generated by using a hash function to ensure that even if the data is tampered with or lost during the data transmission process, the receiver can quickly detect the integrity of the data, providing further protection for the data consistency of the remote terminal. Therefore, by encrypting the data summary, it is ensured that the audio and video data or trial documents received by each remote server have been verified and have not been tampered with, thereby greatly improving the reliability of the trial data.

[0015] (3) During the session encryption process, the key exchange mechanism in asymmetric encryption is used. The session key is not directly exposed on the network before transmission. Instead, it is exchanged through pre-agreed parameters (large prime numbers and bases) and the other party's second public key to ensure that the session keys of both parties are secure during data transmission. The session key is then used to encrypt the data packet group to ensure that sensitive data will not be intercepted or decrypted during transmission. Therefore, compared with traditional static key management, the session key is generated by dynamically generating private keys and public keys to ensure the secure transmission of encrypted data and reduce the risk of key leakage.

[0016] (4) The public and private keys generated by asymmetric encryption use large prime numbers and bases as the basis between the trial server and the remote server, preventing conventional key hijacking and man-in-the-middle attacks. In the absence of large prime numbers and bases, even if the attacker intercepts the public key and data stream, the session key cannot be cracked, effectively responding to key hijacking and tampering attacks, ensuring the security of key exchange during network transmission in cross-regional trials, and protecting the confidentiality of sensitive data.

[0017] Through this technical solution, the cloud-based shared court can dynamically generate keys, and by ensuring the security, real-time and integrity of data, the public's trust in judicial fairness will be enhanced. Especially in trials involving important cases, effective encryption processing can convey to the public the court's emphasis on information security, further enhancing judicial transparency and public trust. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 A flowchart of an example of a data security encryption processing method according to an embodiment of the present application is shown;

[0020] Figure 2 An operation flow chart of an example of dynamic update of session keys based on an invalidation detection mechanism according to an embodiment of the present application is shown;

[0021] Figure 3 An operation flow chart showing an example of data decryption operation of a remote server during a transition period according to an embodiment of the present application is shown;

[0022] Figure 4 An operation flow chart of an example of an adaptive adjustment mechanism of encryption strength according to network status according to an embodiment of the present application is shown;

[0023] Figure 5 An operation flow chart showing another example of a mechanism for adaptively adjusting encryption strength according to network status according to an embodiment of the present application;

[0024] Figure 6 A structural block diagram of an example of a data security encryption processing system according to an embodiment of the present application is shown;

[0025] Figure 7 It is a schematic structural diagram of an embodiment of an electronic device of the present application. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0028] Figure 1 A flowchart of an example of a data security encryption processing method according to an embodiment of the present application is shown.

[0029] Regarding the executor of the method of the embodiment of the present application, it can be any controller or processor with computing or processing capabilities. Specifically, the trial service end deployed for the trial court can implement various data security encryption processing operations. Through the dynamic update of the key, the trial data can be kept synchronized and consistent in the cross-regional and multi-party trial process, ensuring that the data received by the current trial court service end and all online remote participating remote service ends (for example, third-party service ends open to the public or court service ends in other regions) are consistent and synchronized.

[0030] In some examples, it may be integrated and configured in an electronic device or terminal by means of software, hardware, or a combination of software and hardware, and the type of the terminal or electronic device may be diverse, such as a mobile phone, a tablet computer, or a desktop computer, etc.

[0031] like Figure 1 As shown, in step S110, audio and video data and trial document data generated in real time during the trial are obtained.

[0032] In some embodiments, a first acquisition device (such as an audio and video recording device) and a second acquisition device (such as a document generation device) are installed in the trial court space, which can obtain audio and video data and trial document data in real time during the trial.

[0033] Specifically, by installing high-quality cameras and microphones at the trial site, it is ensured that all audio and video information in the trial can be captured in real time. Then, using audio and video capture software, the audio and video streams are converted into digital formats through an encoder, supporting multiple formats (such as H.264, AAC) to meet different needs. At the beginning of the trial, the system automatically starts data collection, and stores the generated audio and video data in the local cache, and synchronizes it to the trial server on the local intranet. On the other hand, during the trial, electronic recording tools are used to record the legal documents, evidence, court opinions and other information in the trial in real time. Then, the recorded data is automatically formatted into a standardized document format (such as PDF, DOCX), and necessary metadata can also be attached to it (such as generating timestamps, participant information, case numbers, etc.).

[0034] In addition, in order to ensure that audio and video data and court document data can be processed synchronously, the system will add a timestamp and serial number to each data block to ensure the integrity and sequence of the data during subsequent encryption and transmission.

[0035] In step S120, the audio and video data are processed by a symmetric encryption algorithm to obtain first encrypted data, the trial document data are processed by an asymmetric encryption algorithm to obtain second encrypted data, the first metadata of the audio and video data and the second metadata of the trial document data are processed by a hash function to obtain an encrypted data summary, and a data packet group is generated according to the first encrypted data, the second encrypted data and the encrypted data summary.

[0036] Here, the data type of the metadata includes at least one of: a generation timestamp, participant information, a case number, a data size, and a hash function type.

[0037] In some embodiments, a combination of a symmetric encryption algorithm for processing audio and video data (such as an AES algorithm or a ChaCha20 algorithm) and an asymmetric encryption algorithm (such as an RSA algorithm or an ECC (Elliptic Curve Cryptography) algorithm) for processing trial document data maximizes encryption performance while ensuring data security. Symmetric encryption algorithms are suitable for large-volume real-time audio and video streaming data and have higher encryption and decryption speeds; while asymmetric encryption algorithms are suitable for smaller but more sensitive trial documents and can provide higher security. Therefore, through the combination of symmetric and asymmetric encryption algorithms, the speed and efficiency of encryption processing can be improved while ensuring the security of trial audio and video data and trial document data, especially improving the performance of real-time data transmission in remote trials.

[0038] In addition, various secure hash algorithms (such as SHA-256) can be used to hash the metadata of audio and video data and the metadata of document data (for example, timestamp, data size, hash function type, etc.) to generate a fixed-length summary, and then the generated hash value is combined with the encrypted data to form a complete data packet group. Each data packet contains the encrypted data fragment and corresponding verification information to enhance the non-repudiation of the data.

[0039] In step S130, a first random private key is generated and a first public key is generated based on the first random private key, a large prime number and a base, the first public key is sent to a remote server, a second public key is received from the remote server, and a first session key is generated based on the first random private key, the second public key, a large prime number and a base.

[0040] Here, the trial server and the remote server pre-agreed on a large prime number and a base, and the second public key is generated by the remote server according to the second random private key, the large prime number and the base. The remote server is also used to generate a second session key according to the second random private key, the first public key, the large prime number and the base.

[0041] Specifically, the large prime numbers and cardinal numbers are differentially allocated by the trial server by performing the agreed parameter generation operation for each connected remote server. Exemplarily, the agreed parameter generation operation is performed for each connected remote server to generate the corresponding large prime numbers and cardinal numbers, and each large prime number and cardinal number is synchronously transmitted to the corresponding remote server as the pre-agreed parameters between the remote server and the trial server.

[0042] In this way, the trial server can generate dynamic and differentiated pre-agreed parameters (i.e., large prime numbers and bases) for different remote servers, implement differentiated encryption transmission processing for different remote servers, and further improve the security of data transmission.

[0043] In some embodiments, a secure random number generator (e.g., CSPRNG) is used to generate a first random private key to ensure the randomness and unpredictability of the key. A corresponding first public key is generated by a preset large prime number and base number, and the public key will be used for the subsequent generation of session keys between the trial server and the remote server. Furthermore, the first public key is calculated and generated using the large prime number and base number, and then sent to the remote server.

[0044] After receiving the first public key, the remote server generates a second public key based on the second random private key, the large prime number and the base, and sends it back to the trial server.

[0045] After the two parties exchange public keys, the trial server generates a first session key through key exchange based on the first random private key and the second public key of the remote server. Similarly, the remote server also generates a second session key based on the second random private key and the first public key of the trial server. The two parties negotiate a consistent session key through key exchange for subsequent data encryption transmission.

[0046] Through this embodiment, the session key used by both parties is generated by combining the private key and public key of both parties, ensuring that only the two parties can calculate the same session key. Through the key exchange protocol, the two parties do not need to directly transmit the session key on the network, which greatly improves the security of key exchange and prevents man-in-the-middle attacks or key hijacking. In addition, each court session generates a different random private key and session key, which can avoid the security risks caused by the long-term use of the same key and improve the security and flexibility of the encryption system.

[0047] In step S140, each data packet in the data packet group is encrypted based on the first session key to obtain a corresponding encrypted data packet, and each encrypted data packet is sent to the remote server.

[0048] In some embodiments, based on the first session key, a symmetric encryption algorithm is used to independently encrypt each data packet in the data packet group to ensure that even if a portion of the data packets are attacked, the other data packets are still safe. In addition, each encrypted data packet is serialized and necessary metadata (such as a serial number, timestamp, sender information, etc.) is attached to ensure that the receiving remote server can correctly parse the data.

[0049] Then, the encrypted data packet is sent to the remote server through a predetermined secure network channel (such as VPN, TLS). During the network transmission process, the encrypted content and verification information in the data packet can be transmitted through the network protocol (such as TCP / IP), and the session key is used to ensure the confidentiality and anti-tampering of the data. In addition, a data packet retransmission mechanism can be used to ensure that the data can be transmitted completely in the case of unstable network, avoiding information loss caused by packet loss.

[0050] After the remote server receives the encrypted data packet, it can use the second session key to decrypt the data and verify the integrity through the data summary to ensure that the data has not been tampered with. It can then be further processed or stored according to the business logic.

[0051] Through the embodiments of the present application, each data packet in the data packet group is encrypted separately based on the session key to ensure that the data will not be intercepted or tampered with by a third party during the transmission process, which greatly improves the security of data transmission. In addition, the encrypted data packet maintains efficient encrypted transmission during the transmission process, and can quickly decrypt and restore the data at the remote server end, ensuring the real-time and integrity of the data during the trial. In addition, the remote server performs integrity verification through the data summary, which can quickly discover and reject any data that has been tampered with during the transmission process, further improving the reliability and transparency of judicial data.

[0052] In some examples of the embodiments of the present application, the session key is calculated and updated through an enhanced key exchange protocol. More specifically, the first session key is calculated by the following operations:

[0053] K=B a modp , formula (1)

[0054] B=g b modp , formula (2)

[0055] In the formula, K represents the first session key, mod represents the modulus operator, p represents a large prime number, g represents a base, a and b represent the first random private key and the second random private key respectively, and B represents the second public key.

[0056] Specifically, both parties first agree on a large prime number p and a base number g, for example, p = 23 and g = 5. Each party generates a random private key, for example, the court trial server selects private key a = 6, and the remote server selects b = 15.

[0057] Then, the trial server calculates its public key, that is, A = 5 6 mod23=8. The remote server calculates its public key, that is, B=5 15 mod23 = 19. After the two parties exchange public keys, the trial server calculates the session key K = B a modp, user B calculates K' = A b modp, and ultimately get the same session key.

[0058] Through the embodiments of the present application, an enhanced key exchange algorithm is adopted to ensure that the generation of session keys does not rely on the private keys of any party, reducing the risk of key leakage. Even if an attacker intercepts the public key, the private key and session key cannot be deduced, ensuring the confidentiality of the data. In addition, a new session key will be generated for each trial or data transmission, ensuring that even if a session key is compromised, the attacker can only obtain a one-time access right and cannot decrypt historical data, greatly improving the system's anti-attack capability. As a result, it supports a trial process involving multiple parties, and can flexibly generate session keys between different courts and remote parties, meeting the needs of cross-regional trials and promoting the paperless case handling process.

[0059] Regarding the operation details of the agreed parameter generation operation in the embodiments of the present application, in some implementations, it can be implemented in the following ways:

[0060] The large prime number is assumed to be a prime number whose number of digits n is 2048 digits.

[0061] Generate a random number in the range of 2 using a cryptographically secure random number generator. (n-1) To 2 n A random integer N between -1 is used to test whether N is prime by the following operation:

[0062] Represent N-1 as 2 s d, where d is an odd number:

[0063] N-1=2 s ·d , Formula (3)

[0064] Wherein, in the initialization state, s = 0 and d = N-1. During the iteration process, d is continuously divided by 2 until d is an odd number, and the value of s is increased at the same time.

[0065] Choose a random number e for primality test, where 2≤e≤N-2.

[0066] Here, an advanced primality test method is used to verify whether N is a prime number.

[0067] Calculate x = e d modN, and make the following checks based on x:

[0068] If x=1 or x=N-1, the primality test is passed.

[0069] If x≠1 and x≠N-1, perform s-1 iterations to calculate x=x 2 modN and check if N-1 appears in some iteration, then the primality test is passed.

[0070] Through this embodiment, the primality test is combined with a random number generator to efficiently generate large prime numbers that meet encryption requirements. Compared with the traditional prime number generation method, the advanced prime number test is a probability-based primality test algorithm that can verify the primality of prime numbers in a short time, and the reliability of the results can be further improved by increasing the number of test rounds. Thus, compared to completely relying on the deterministic prime number generation method, even in the case of a large number of bits (such as 2048 or 4096 bits), qualified large prime numbers can be generated within a reasonable time, which is more efficient in calculation.

[0071] Set N to a large prime number p that passes the test:

[0072] p=N . Formula (4)

[0073] In encrypted communication, the base g is an important component for generating session keys, and its selection directly affects the security and efficiency of the encryption algorithm.

[0074] Specifically, an initial base g0 is selected, g0<p.

[0075] Calculate the factor list of p-1 and find all the factors:

[0076] p-1=2 s ·d , Formula (5)

[0077] For each factor q, calculate the corresponding g0 (p-1) / q modp, if all results are not equal to 1, then g0 is the primitive root, otherwise the initial cardinality is iteratively updated until the primitive root verification condition is met (that is, the results corresponding to all factors are equal to 1).

[0078] Here, the primitive root verification condition is used to verify whether the selected cardinality g is a primitive root of p. The primitive root is defined as if g is a primitive root of p, then the power of g can generate all the residue classes of p.

[0079] The cardinality that satisfies the original root verification condition is taken as the final cardinality g.

[0080] In the trial system, the trial server and the remote server need to agree on p and g in advance to ensure that both parties use the same parameters during the encryption process and to ensure the consistency of the session keys automatically generated subsequently.

[0081] It should be noted that in traditional encryption systems, prime numbers and bases are often fixed or rarely updated, which provides attackers with time to analyze and crack them. However, through the embodiment of the present application, by dynamically generating large prime numbers and bases, it is possible to ensure that the encryption parameters used in each session are unique and unpredictable. Even if an attacker successfully obtains the encryption key in a session, it cannot be used to decrypt data in other sessions, significantly reducing the risk of replay attacks and key reuse attacks, thereby improving the security of the entire system.

[0082] Through the embodiments of the present application, a prime number test is used to generate a large prime number, and the base number verification is performed by decomposing p-1 to ensure that the generated prime number and base number meet the strict primitive root conditions. In traditional encryption systems, if the base number is not selected properly, the session key may not cover all the remainder classes modulo p, thereby affecting the security of key generation. However, the precise primitive root verification and prime number test provided by the embodiments of the present application can effectively avoid encryption weaknesses caused by incorrect selection of base numbers or prime numbers, and fundamentally enhance the confidentiality strength of the key.

[0083] It should be noted that in order to avoid the security risks caused by using the same session key for a long time during a session, the potential risk of cracking can be reduced by dynamically replacing the private key and session key.

[0084] Figure 2 An operational flow chart of an example of dynamic update of session keys based on an invalidation detection mechanism according to an embodiment of the present application is shown.

[0085] like Figure 2 As shown, by introducing the session key failure detection and dynamic update mechanism, the long-term security of the encryption process and the continuity of data transmission are ensured, which can effectively prevent the security risks caused by the long-term use of the same session key. At the same time, by dynamically replacing the private key and session key, the potential cracking risk is reduced.

[0086] Specifically, in step S210, it is detected whether the time length between the generation timestamp of the first session key and the current system time exceeds a preset key expiration deadline.

[0087] In some embodiments, when the first session key is generated, the system will mark the key with a generation timestamp, which records the generation time of the key for subsequent failure detection. Here, the timestamp can be recorded in a standard time format (such as a UNIX timestamp) to ensure that the system can accurately determine the validity of the session key in subsequent operations.

[0088] In addition, a session key expiration deadline is preset, for example, every 30 minutes is an expiration deadline, then the expiration deadline can be set to every 25 minutes, and the setting of this threshold is determined according to the security requirements of the system. When the time difference between the current system time and the session key generation timestamp is greater than the expiration deadline, the system will determine that the key is about to expire, and quickly start the key update process to complete the key update within the transition time (for example, 5 minutes).

[0089] Therefore, by checking the expiration of session keys, it is possible to ensure that the keys will not be used for a long time, thus avoiding the risk of cracking due to long-term encryption. Regularly updating the keys reduces the possibility of potential attackers intercepting the keys and cracking them through brute force, especially during long trials, ensuring that data is always transmitted in a highly secure encrypted state.

[0090] In step S220, if it exceeds, a third random private key is regenerated to replace the first random private key, and a third public key is generated based on the third random private key, a large prime number and a base, the third public key is sent to the remote server, and a fourth public key is received from the remote server, and a third session key is generated based on the third random private key, the fourth public key, a large prime number and a base to update the first session key.

[0091] In some embodiments, when it is detected that the session key is about to expire, a new private key, namely a third random private key, is regenerated based on a random number generator to replace the previous first random private key. The random number generator can ensure its unpredictability and uniqueness. Then, a new third session key is generated based on the third random private key and the second public key of the remote server using a key exchange algorithm to replace the previous first session key. After the new third session key is generated, the system will use the key to encrypt data packets for a subsequent period of time (for example, not less than 25 minutes).

[0092] Through the embodiments of the present application, by generating a new session key to replace the old key, the continuity of the encryption process can be maintained, ensuring that the encryption strength of the data remains at a high standard even during a long trial. In addition, the regular update of the session key and the dynamic generation of the private key further improve the security of data transmission and prevent any potential attacker from cracking the key by capturing the encrypted data stream.

[0093] On the other hand, the remote server also synchronously uses the corresponding public key and key exchange algorithm to update the session key to achieve synchronous data encryption and decryption processing.

[0094] It should be noted that in order to ensure that the encryption and decryption operations of data are not interrupted during the update of the session key, a short transition period (for example, 5 minutes) can be introduced. At this time, the system supports encryption and decryption operations of both the old session key and the new session key, ensuring that the encrypted data packets can still be decrypted by the old key during the transition period, while the newly encrypted data packets are encrypted using the new session key.

[0095] Figure 3 An operation flow chart showing an example of data decryption operation of a remote server during a transition period according to an embodiment of the present application is shown.

[0096] In step S310, a fourth random private key is generated, and a fourth session key is generated according to the fourth random private key, the third public key and a large prime number.

[0097] In step S320, the received encrypted data packet is decrypted based on the second session key and the fourth session key.

[0098] In step S330, when it is detected that the second session key cannot be successfully decrypted for a number of times exceeding a preset number threshold, the second session key is deleted.

[0099] Here, the number threshold can be set or adjusted according to business needs, such as 3 times or 5 times. When the old session key is replaced by a new session key, the old session key will not be deleted immediately. Instead, a certain decryption failure number threshold is set to determine the time to discard the old session key, which can reduce the computing resource burden caused by frequent key switching and avoid the decryption failure problem that may occur during the key switching process. Therefore, through a flexible key deletion mechanism, encryption and decryption operations can be managed more efficiently, resource waste can be avoided, and the overall system performance can be improved.

[0100] In terms of business scenarios, during the transition period, if the current session key is about to expire, the trial server can automatically trigger the re-encryption of unsent data packets after the session key is updated, ensuring that all sent data packets use the latest session key. Since the cost of synchronously negotiating when to replace the new session key during the transition period is high, in order to avoid the failure of decryption of some data packets, the second session key and the fourth session key are used in parallel to ensure the reliability of data packet decryption during the key update process.

[0101] Through the embodiment of the present application, based on the third public key sent by the trial service end, the remote service end enters the key transition period, and by using the key smooth switching mechanism during the key transition period, it can complete the key update and replacement without affecting the trial process, avoiding the interruption of data decryption and transmission caused by key switching, and ensuring the security and timeliness of audio and video data and trial documents in transmission. Therefore, the security of encryption is enhanced through the key rotation mechanism. Even if the attacker obtains the encrypted content of part of the data packet, it is difficult to decipher the session key through a long-term attack, which greatly improves the system's ability to resist attacks.

[0102] Regarding the selection of the encryption algorithm in the above step S120, in some implementations, the symmetric encryption algorithm adopts the ChaCha20-Poly1305 algorithm, and the asymmetric encryption algorithm adopts the elliptic curve encryption algorithm.

[0103] Regarding the selection of ChaCha20-Poly1305 algorithm, ChaCha20 is a symmetric encryption algorithm based on stream cipher, which is faster than AES on many hardware platforms, especially on mobile devices or devices with limited resources. The efficiency of ChaCha20 makes it an ideal choice for symmetric encryption. In addition, Poly1305 is a message authentication code algorithm that can effectively prevent data tampering during transmission. The combination of ChaCha20-Poly1305 not only provides powerful encryption functions, but also provides data authentication functions.

[0104] Specifically, ChaCha20 is a stream cipher that does not require block encryption, but instead generates a pseudo-random key stream and encrypts the plaintext byte by byte using XOR. The initialization vector (IV) is used together with the key during the encryption process to ensure that the encryption results of the same plaintext in different sessions are different.

[0105] When ChaCha20 is used in combination with Poly1305, Poly1305 is used to generate a message authentication code (MAC) to ensure the integrity of the data. In this way, during the decryption process on the remote server, it can first verify whether the MAC matches. If the MAC verification is successful, the decryption operation will be performed.

[0106] In some preferred implementations, ChaCha20 can also use a key rolling mechanism during long-term data transmission to regularly generate new ChaCha20 keys. ChaCha20 key updates do not require a large amount of computing resources like AES, so it is more suitable for encryption of real-time audio and video data.

[0107] Through the embodiments of the present application, ChaCha20-Poly1305 has a faster encryption speed than AES, especially when processing audio and video streams. Its stream cipher characteristics allow byte-level encryption of data, avoiding block operations during the encryption process, thereby reducing encryption delays and ensuring the instant transmission of audio and video data during the trial. In addition, ChaCha20 has low CPU requirements and is particularly suitable for use on mobile devices, embedded devices, and servers with poor performance. By using ChaCha20-Poly1305 on the court service side and the remote service side, it can be ensured that the transmission of audio and video data on different devices remains efficient, and both low-performance devices and high-performance servers can achieve a smooth trial process. In addition, ChaCha20 has excellent resistance to side channel attacks (such as cache timing attacks), and is particularly suitable for cloud environments and open network scenarios. As an online system with multiple parties involved, the cloud shared court can effectively resist side channel attacks that may target the encryption process and further improve security.

[0108] Regarding the selection of elliptic curve encryption algorithms, compared with the traditional asymmetric RSA encryption algorithm, ECC requires a much smaller key length while providing the same security strength. For example, the security provided by 256-bit ECC is equivalent to that of 3072-bit RSA. Therefore, at the same security level, ECC has higher computational efficiency. In addition, since ECC uses shorter keys, it requires less storage and computing resources, making it particularly suitable for mobile devices, IoT devices, and cloud computing environments.

[0109] Specifically, the ECC algorithm is based on a specific elliptic curve encryption algorithm, such as the curve secp256k1, which is used by many cryptocurrencies such as Bitcoin and is also a very secure and efficient elliptic curve. The public and private key pairs generated by ECC are based on a random number, and the public key is generated by point multiplication on the curve, and the document is encrypted using the public key of the remote server, thereby converting the document data into points on the curve and encrypting them, so that the remote server can use the private key interface ciphertext and restore the original document.

[0110] Compared with RSA, ECC can reduce the bandwidth usage during encryption key transmission due to its shorter key length while ensuring the same security. It also reduces the demand for computing resources and can encrypt and decrypt larger documents with fewer computing resources. Therefore, in the technical scenario of shared courts on the cloud, ECC is particularly suitable for encrypting sensitive trial documents and evidence files.

[0111] Through the embodiments of the present application, the key length used by ECC is shorter (for example, 256-bit ECC is equivalent to the security of 3072-bit RSA), but it can still provide the same or even stronger security as RSA. This not only shortens the time required for encryption and decryption, but also reduces the computing resource usage in the encryption process, especially when a large number of trial documents are involved, which can significantly improve the efficiency of document encryption. In addition, when the recipient decrypts, ECC can complete the decryption process more quickly, which is particularly suitable for scenarios where the remote server may have poor performance. Due to the short key, the computing power required for ECC decryption is low, so that remote parties, lawyers, witnesses or other legal-related institutions can quickly receive decrypted trial documents and evidence files, and the trial efficiency will not be affected by the long decryption time, thereby realizing document encryption support for multiple parties.

[0112] It should be noted that the existing encryption scheme lacks sufficient adaptability to network conditions. In the case of complex network environments and limited bandwidth, the current encryption scheme does not make dynamic adjustments to data traffic and network status, resulting in increased data transmission delays when the network is congested, affecting the real-time nature of the trial. This situation is particularly evident in remote trials or cross-regional trials involving multiple parties, which may cause delays in audio and video data transmission, affecting the trial experience and, in turn, the efficiency of the trial.

[0113] In view of this, an embodiment of the present application provides an adaptive adjustment mechanism for encryption strength according to network status, thereby improving the flexibility and adaptability of the data transmission encryption system.

[0114] Figure 4 An operational flow chart of an example of a mechanism for adaptively adjusting encryption strength according to network status according to an embodiment of the present application is shown.

[0115] like Figure 4 As shown, in step S410, the network transmission status between the remote server and the remote server is detected.

[0116] Specifically, the network status delay, bandwidth and packet loss rate are periodically detected to dynamically evaluate the current network transmission status. Through the quantitative indicators of the network transmission status (such as RTT, packet loss rate, available bandwidth, etc.), the corresponding network transmission status is judged in real time.

[0117] In step S421, if the network transmission state is a smooth network state, the video data is encrypted using a 256-bit key through the ChaCha20-Poly1305 algorithm.

[0118] In step S423, if the network transmission status is a network congestion status, the channel audio and video components corresponding to the preset sensitive channel information in the audio and video data are encrypted using a 256-bit key through the ChaCha20-Poly1305 algorithm, and the other channel audio and video components in the audio and video data are encrypted using a 128-bit key.

[0119] Here, the sensitive channel information includes the channel information of the judge's microphone and the channel information of the evidence playback device. Exemplarily, multiple microphones are deployed in the trial environment, and the channel information of key devices (e.g., the judge's microphone and the evidence playback device) is sensitively identified in the system in advance to distinguish other devices, such as scene shooting devices and other microphones, so that the system can automatically identify and mark the audio and video data of these device channels as sensitive data. Therefore, even in poor network conditions, these key audio and video data can still be highly encrypted. By using 256-bit key encryption for the audio and video data of the judge's microphone channel and the evidence playback device channel, the security of core sensitive data can be ensured.

[0120] It should be noted that by detecting the network transmission status in real time and dynamically adjusting the encryption strategy according to the changes in network bandwidth, it is ensured that the highest security level of encryption (i.e., 256-bit ChaCha20-Poly1305 algorithm) is used for all audio and video data when the network status is good. In the case of network congestion or bandwidth limitation, the core data still maintains high encryption strength, while the encryption strength of non-critical data is appropriately reduced. Differential encryption is used to maintain the smoothness of data transmission, thereby ensuring the real-time and transmission performance of the system. In addition, in the case of network congestion, reducing the encryption strength of some audio and video data (128-bit key) can reduce the computational load of encryption and decryption, while reducing the network bandwidth occupancy, especially in the case of large audio and video transmission volume, effectively avoiding data transmission delays caused by excessive encryption, and ensuring the smoothness of the trial process. Therefore, by lightly encrypting non-critical data, the system can still maintain a low delay under network congestion conditions, improving the continuity and viewing experience of the trial, and avoiding trial interruptions or audio and video freezes.

[0121] Figure 5 An operation flow chart of another example of a mechanism for adaptively adjusting encryption strength according to network status according to an embodiment of the present application is shown.

[0122] In step S510, the network transmission status between the remote server and the remote server is detected.

[0123] In step S521, if the network transmission status is a smooth network status, the trial document data is encrypted using the secp521r1 curve through the elliptic curve encryption algorithm.

[0124] Specifically, secp521r1 is a 521-bit elliptic curve that provides higher security than 256-bit and 384-bit. Due to its longer key length, it is more resistant to attacks, but the computational complexity of encryption and decryption is relatively high. When the network status is smooth and the system has sufficient bandwidth and computing resources, choosing this curve can ensure the highest security of the transmitted data. Therefore, when the network is smooth, using secp521r1 can provide higher encryption strength, increase the difficulty of cracking, and ensure that the security of important information can be guaranteed to the greatest extent even when the data flow is large.

[0125] In step S523, if the network transmission status is a smooth network status, the trial document data is encrypted using the Curve25519 curve through the elliptic curve encryption algorithm.

[0126] Specifically, Curve25519 is an elliptic curve based on the Montgomery curve, which strikes a good balance between security and performance. Compared with the traditional secp256r1 curve, Curve25519 has higher computational efficiency while providing protection equivalent to 256-bit security. When network transmission is congested and bandwidth is limited, especially in scenarios involving remote witnesses or trial scenarios when the network is unstable, Curve25519 can be selected to speed up the encryption and decryption process, reduce the computational burden, and increase the data transmission speed. Therefore, the use of Curve25519 can significantly reduce the complexity of encryption calculations, reduce the computational load, and provide smooth data transmission when bandwidth is limited.

[0127] Through the embodiment of the present application, according to the detected network status, the system can automatically switch the elliptic curve used, enable secp521r1 for encryption when the network is smooth, to ensure high security, and switch to Curve25519 for encryption when the network is congested, giving priority to ensuring transmission efficiency. Therefore, through real-time detection of network status and adaptive curve switching, the encryption strength and computational complexity can be flexibly adjusted according to network conditions, ensuring that court trial document data can be efficiently transmitted under various network conditions without affecting security.

[0128] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of actions combined, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0129] Figure 6 A structural block diagram of an example of a data security encryption processing system according to an embodiment of the present application is shown.

[0130] like Figure 6 As shown, the data security encryption processing system 600 includes a data acquisition unit 610, a data encryption unit 620, a session encryption unit 630 and a data packet encryption transmission unit 640.

[0131] The data acquisition unit 610 is used to acquire audio and video data and trial document data generated in real time during the trial process.

[0132] The data encryption unit 620 is used to process the audio and video data through a symmetric encryption algorithm to obtain first encrypted data, process the trial document data through an asymmetric encryption algorithm to obtain second encrypted data, process the first metadata of the audio and video data and the second metadata of the trial document data through a hash function to obtain an encrypted data summary, and generate a data packet group according to the first encrypted data, the second encrypted data and the encrypted data summary; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size and hash function type.

[0133] The session encryption unit 630 is used to generate a first random private key and generate a first public key based on the first random private key, a large prime number and a base, send the first public key to the remote server, receive a second public key from the remote server, and generate a first session key based on the first random private key, the second public key, the large prime number and the base; wherein the large prime number and the base are differentially allocated by the trial server for each connected remote server by performing an agreed parameter generation operation respectively; the second public key is generated by the remote server based on the second random private key, the large prime number and the base; the remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number and the base.

[0134] The data packet encryption transmission unit 640 is used to encrypt each data packet in the data packet group based on the first session key to obtain a corresponding encrypted data packet, and send each of the encrypted data packets to the remote server.

[0135] In some embodiments, an embodiment of the present application provides a non-volatile computer-readable storage medium, which stores one or more programs including execution instructions, and the execution instructions can be read and executed by an electronic device (including but not limited to a computer, a server, or a network device, etc.) to execute the steps of any of the above-mentioned data security encryption processing methods of the present application.

[0136] In some embodiments, the embodiments of the present application also provide a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of any one of the above-mentioned data security encryption processing methods.

[0137] In some embodiments, an embodiment of the present application also provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the data security encryption processing method.

[0138] Figure 7 is a schematic diagram of the hardware structure of an electronic device for executing a data security encryption processing method provided by another embodiment of the present application, such as Figure 7 As shown, the device includes:

[0139] One or more processors 710 and memory 720, Figure 7 A processor 710 is taken as an example.

[0140] The device for executing the data security encryption processing method may further include: an input device 730 and an output device 740 .

[0141] The processor 710, the memory 720, the input device 730 and the output device 740 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0142] The memory 720 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the data security encryption processing method in the embodiment of the present application. The processor 710 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 720, that is, implementing the data security encryption processing method in the above method embodiment.

[0143] The memory 720 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 720 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 720 may optionally include a memory remotely arranged relative to the processor 710, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0144] The input device 730 may receive input digital or character information and generate signals related to user settings and function control of the electronic device. The output device 740 may include a display device such as a display screen.

[0145] The one or more modules are stored in the memory 720, and when executed by the one or more processors 710, the data security encryption processing method in any of the above method embodiments is executed.

[0146] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0147] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:

[0148] (1) Mobile communication equipment: This type of equipment is characterized by having mobile communication functions and its main purpose is to provide voice and data communications. This type of terminal includes: smart phones, multimedia phones, functional phones, and low-end phones.

[0149] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, etc.

[0150] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players, handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0151] (4) Other onboard electronic devices with data interaction functions, such as on-board devices installed in vehicles.

[0152] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security encryption processing method, applied to a court trial service end, comprising: Obtain audio and video data and trial document data generated in real time during the trial; Process the audio and video data by a symmetric encryption algorithm to obtain first encrypted data, process the trial document data by an asymmetric encryption algorithm to obtain second encrypted data, process the first metadata of the audio and video data and the second metadata of the trial document data by a hash function to obtain an encrypted data summary, and generate a data packet group according to the first encrypted data, the second encrypted data and the encrypted data summary; The data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; Generate a first random private key and generate a first public key according to the first random private key, a large prime number and a base, send the first public key to a remote server, receive a second public key from the remote server, and generate a first session key according to the first random private key, the second public key, the large prime number and the base; wherein the large prime number and the base are differentially allocated by the trial server for each connected remote server by performing an agreed parameter generation operation respectively; the second public key is generated by the remote server according to the second random private key, the large prime number and the base; the remote server is also used to generate a second session key according to the second random private key, the first public key, the large prime number and the base; Each data packet in the data packet group is encrypted based on the first session key to obtain a corresponding encrypted data packet, and each encrypted data packet is sent to the remote service end.

2. The method according to claim 1, wherein: After generating a first session key according to the first random private key, the second public key, the large prime number and the base, the method further includes: Detecting whether the time length between the generation timestamp of the first session key and the current system time exceeds a preset key expiration deadline; If it exceeds, regenerate a third random private key to replace the first random private key, generate a third public key based on the third random private key, a large prime number and a base, send the third public key to the remote server, receive a fourth public key from the remote server, and generate a third session key based on the third random private key, the fourth public key, the large prime number and the base to update the first session key.

3. The method according to claim 2, wherein: After the remote server receives the third public key, the remote server is further configured to perform the following operations: generating a fourth random private key, and generating a fourth session key according to the fourth random private key, the third public key and the large prime number; decrypting the received encrypted data packet based on the second session key and the fourth session key; When it is detected that the number of times that the second session key cannot be successfully decrypted exceeds a preset number threshold, the second session key is deleted.

4. The method according to claim 1, wherein: The first session key is calculated by the following operations: K=B a modp, God b modp, In the formula, K represents the first session key, mod represents the modulus operator, p represents a large prime number, g represents a base, a and b represent the first random private key and the second random private key respectively, and B represents the second public key.

5. The method according to claim 4, wherein: The agreement parameter generation operation includes: Assume that a large prime number is a prime number with digit n of 2048 digits; Generate a random number in the range of 2 using a cryptographically secure random number generator. (n-1) To 2 n A random integer N between -1 is used to test whether N is prime by the following operation: Represent N-1 as 2 s d, where d is an odd number: N-1=2 s ·d, Wherein, in the initialization state, s=0 and d=N-1; Select a random number e for primality test, where 2≤e≤N-2; Calculate x = e d modN, and make the following checks based on x: If x = 1 or x = N-1, the primality test is passed; If x≠1 and x≠N-1, perform s-1 iterations to calculate x=x 2 modN and check if N-1 appears in a certain iteration, the primality test is passed; Set N to a large prime number p that passes the test: p = N; Select the initial base g0, g0<p; Calculate the factor list of p-1 and find all the factors: p-1=2 s ·d, For each factor q, calculate the corresponding If all results are not equal to 1, g0 is the original root, otherwise the initial cardinality is iteratively updated until the original root verification condition is met; The cardinality that satisfies the original root verification condition is taken as the final cardinality g.

6. The method according to claim 1, wherein: The symmetric encryption algorithm adopts the ChaCha20-Poly1305 algorithm, and the asymmetric encryption algorithm adopts the elliptic curve encryption algorithm.

7. The method according to claim 6, wherein: The method further comprises: Detecting the network transmission status between the remote server and the remote server; If the network transmission state is a smooth network state, encrypting the audio and video data using a 256-bit key through a ChaCha20-Poly1305 algorithm; If the network transmission status is a network congestion status, the channel audio and video components corresponding to the preset sensitive channel information in the audio and video data are encrypted using a 256-bit key through the ChaCha20-Poly1305 algorithm, and other channel audio and video components in the audio and video data are encrypted using a 128-bit key; the sensitive channel information includes the channel information of the judge's microphone and the channel information of the evidence playback device.

8. The method according to claim 7, wherein: The method further comprises: If the network transmission state is a smooth network state, the court trial document data is encrypted using the secp521r1 curve through an elliptic curve encryption algorithm; If the network transmission status is a smooth network status, the trial document data is encrypted using the Curve25519 curve through the elliptic curve encryption algorithm.

9. A data security encryption processing system, deployed on a court trial server, comprising: A data acquisition unit, used to acquire audio and video data and trial document data generated in real time during the trial; a data encryption unit, configured to process the audio and video data by a symmetric encryption algorithm to obtain first encrypted data, process the trial document data by an asymmetric encryption algorithm to obtain second encrypted data, process the first metadata of the audio and video data and the second metadata of the trial document data by a hash function to obtain an encrypted data summary, and generate a data packet group according to the first encrypted data, the second encrypted data and the encrypted data summary; The data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; A session encryption unit, used to generate a first random private key and generate a first public key according to the first random private key, a large prime number and a base, send the first public key to a remote server, receive a second public key from the remote server, and generate a first session key according to the first random private key, the second public key, the large prime number and the base; wherein the large prime number and the base are differentially allocated by the trial server for each connected remote server by performing an agreed parameter generation operation respectively; the second public key is generated by the remote server according to the second random private key, the large prime number and the base; the remote server is also used to generate a second session key according to the second random private key, the first public key, the large prime number and the base; The data packet encryption transmission unit is used to encrypt each data packet in the data packet group based on the first session key to obtain a corresponding encrypted data packet, and send each of the encrypted data packets to the remote service end.

10. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

Images