A data security encryption processing method and system

Abstract

This application discloses a data security encryption processing method and system, relating to the field of data analysis and processing technology. The method includes: acquiring audio and video data and court document data generated in real time during court proceedings; processing the audio and video data using a symmetric encryption algorithm to obtain first encrypted data, processing the court document data using an asymmetric encryption algorithm to obtain second encrypted data, obtaining an encrypted data digest using a hash function, and generating data packet groups based on the first encrypted data, the second encrypted data, and the encrypted data digest; generating a first session key based on a first random private key, a second public key received from a remote server, a large prime number, and a radix; encrypting the data packets based on the first session key to obtain encrypted data packets, and sending each encrypted data packet to the remote server. Thus, a cloud-based shared court can dynamically generate keys, further enhancing judicial transparency and public trust by ensuring data security, real-time performance, and integrity.

Description

Technical Field

[0001] This application relates to the field of data analysis and processing technology, and in particular to a data security encryption processing method and system. Background Technology

[0002] With the advancement of paperless case handling, cloud-based shared courts have emerged. Current digital trial systems mainly rely on purely intranet or purely extranetic networks, resulting in strong system independence and a lack of effective data interaction. Courts typically use intranets to process cases, while extranets are used to communicate with the public or remote parties.

[0003] While this method provides some degree of information security, the inability to effectively share data in real time between internal and external networks leads to inconsistencies in court data when conducting cross-regional trials. For example, differences in trial standards and information transmission between courts not only affect the efficiency of case processing but may also undermine the fairness of trials, especially when it comes to the submission and examination of evidence.

[0004] Furthermore, current digital court hearing systems often employ static key management schemes during data transmission, lacking dynamic encryption control. This poses a significant security risk, as sensitive information (such as evidence and court records) may be intercepted during transmission. This could lead to the leakage of parties' information and undermine public trust in judicial fairness.

[0005] Currently, the industry has not proposed a better technical solution to the above problems. Summary of the Invention

[0006] This application provides a data security encryption processing method, system, storage medium, computer program product, and electronic device to at least solve the problems of data inconsistency and the risk of sensitive information being easily intercepted during transmission in cross-regional court hearings in current related technologies.

[0007] In a first aspect, embodiments of this application provide a data security encryption processing method applied to a court hearing server. The method includes: acquiring audio / video data and court hearing document data generated in real-time during the court hearing; processing the audio / video data using a symmetric encryption algorithm to obtain first encrypted data, processing the court hearing document data using an asymmetric encryption algorithm to obtain second encrypted data, processing the first metadata of the audio / video data and the second metadata of the court hearing document data using a hash function to obtain an encrypted data digest, and generating a data packet group based on the first encrypted data, the second encrypted data, and the encrypted data digest; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; generating a first random private key and processing it based on the first random private key, a large prime number, and a base. A first public key is generated and sent to the remote server. A second public key is received from the remote server. A first session key is generated based on the first random private key, the second public key, the large prime number, and the radix. The large prime number and the radix are differentially allocated by the court service for each connected remote server by performing a protocol parameter generation operation. The second public key is generated by the remote server based on the second random private key, the large prime number, and the radix. The remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number, and the radix. Each data packet in the data packet group is encrypted based on the first session key to obtain corresponding encrypted data packets, and each encrypted data packet is sent to the remote server.

[0008] Secondly, embodiments of this application provide a data security encryption processing system deployed on a court hearing server. The system includes: a data acquisition unit for acquiring audio / video data and court hearing document data generated in real-time during the court hearing; a data encryption unit for processing the audio / video data using a symmetric encryption algorithm to obtain first encrypted data, processing the court hearing document data using an asymmetric encryption algorithm to obtain second encrypted data, processing the first metadata of the audio / video data and the second metadata of the court hearing document data using a hash function to obtain an encrypted data digest, and generating a data packet group based on the first encrypted data, the second encrypted data, and the encrypted data digest; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; and a session encryption unit for generating a first random private key and, based on the first random private key, ... A first public key is generated using a large prime number and a radix, and the first public key is sent to the remote server. A second public key is received from the remote server, and a first session key is generated based on the first random private key, the second public key, the large prime number, and the radix. The large prime number and the radix are differentially allocated by the court service terminal for each connected remote server by performing a protocol parameter generation operation. The second public key is generated by the remote server based on the second random private key, the large prime number, and the radix. The remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number, and the radix. A data packet encryption transmission unit is used to encrypt each data packet in the data packet group based on the first session key to obtain corresponding encrypted data packets, and to send each encrypted data packet to the remote server.

[0009] Thirdly, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the data security encryption processing method of any embodiment of this application.

[0010] Fourthly, embodiments of this application provide a storage medium storing a computer program thereon, characterized in that, when the program is executed by a processor, it implements the steps of the data security encryption processing method of any embodiment of this application.

[0011] Fifthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the data security encryption processing method of any embodiment of this application.

[0012] The data security encryption method provided in this application can achieve at least the following technical effects:

[0013] (1) By using symmetric encryption algorithms on audio and video data during court hearings, efficient encryption of large volumes of data can be achieved, ensuring the real-time transmission of data. Sensitive data such as court documents are further encrypted using asymmetric encryption algorithms to ensure their confidentiality during transmission. This not only enables audio and video data and court documents to be shared synchronously and securely across regions, but also improves the system's processing efficiency. Compared to existing pure intranet or extranet structures, encryption methods enable data sharing between intranets and extranets, and the real-time encryption and decryption mechanism ensures that the trial data between different courts in cross-regional hearings remains consistent, reducing data transmission delays and inconsistencies caused by network isolation.

[0014] (2) During the data encryption process, after generating the first and second encrypted data, a hash function is used to generate an encrypted data digest (i.e., a hash value) for the data. This ensures that even if the data is tampered with or lost during transmission, the receiver can quickly detect the data integrity, providing further protection for the data consistency of remote terminals. Therefore, by using encrypted data digests, it is ensured that the audio and video data or court documents received by each remote server have been verified and have not been tampered with, thereby significantly improving the reliability of court data.

[0015] (3) During session encryption, the key exchange mechanism in asymmetric encryption is utilized. The session key is not directly exposed on the network before transmission. Instead, it is exchanged with the other party's second public key using pre-agreed parameters (large prime numbers and radix), ensuring the session key is secure during data transmission. The session key is then used to encrypt data packets, ensuring sensitive data is not intercepted or decrypted during transmission. Therefore, compared to traditional static key management, generating session keys using dynamically generated private and public keys ensures secure transmission of encrypted data and reduces the risk of key leakage.

[0016] (4) The public and private keys generated through asymmetric encryption use large prime numbers and radixes as the basis for communication between the court hearing server and the remote server, preventing conventional key hijacking and man-in-the-middle attacks. In the absence of large prime numbers and radixes, even if an attacker intercepts the public key and data stream, they still cannot crack the session key, effectively countering key hijacking and tampering attacks, ensuring the security of key exchange during network transmission in cross-regional court hearings, and protecting the confidentiality of sensitive data.

[0017] This technical solution enables cloud-based shared courts to dynamically generate keys, enhancing public trust in judicial fairness by ensuring data security, real-time performance, and integrity. Especially in trials involving important cases, effective encryption conveys the court's commitment to information security, further improving judicial transparency and public trust. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating an example of a data security encryption processing method according to an embodiment of this application is shown;

[0020] Figure 2 A flowchart illustrating an example of dynamic update of session keys based on a failure detection mechanism according to an embodiment of this application is shown.

[0021] Figure 3 A flowchart illustrating an example of data decryption operations during a transition period for a remote server according to an embodiment of this application is shown.

[0022] Figure 4 A flowchart illustrating an example of an adaptive encryption strength adjustment mechanism based on network state according to an embodiment of this application is shown.

[0023] Figure 5 A flowchart illustrating another example of an adaptive encryption strength adjustment mechanism based on network state according to an embodiment of this application is shown.

[0024] Figure 6 A structural block diagram of an example of a data security encryption processing system according to an embodiment of this application is shown;

[0025] Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] The technical solutions in this application, including the collection, storage, use, processing, transmission, provision, and disclosure of users' personal information, comply with relevant laws and regulations and do not violate public order and good morals.

[0028] Figure 1 A flowchart illustrating an example of a data security encryption processing method according to an embodiment of this application is shown.

[0029] Regarding the executing entity of the method in this application embodiment, it can be any controller or processor with computing or processing capabilities. Specifically, it can be a court hearing server deployed for the court hearing that performs various data security encryption operations. Through dynamic key updates, it is possible to maintain the synchronization and consistency of court hearing data during cross-regional, multi-party hearings, ensuring that the data received by the current court hearing server and all online remote participating remote servers (e.g., third-party servers open to the public or court servers in other regions) are consistent and synchronized.

[0030] In some examples, it can be integrated into an electronic device or terminal through software, hardware, or a combination of both, and the type of terminal or electronic device can be diverse, such as mobile phones, tablets, or desktop computers, etc.

[0031] like Figure 1 As shown, in step S110, audio and video data and court document data generated in real time during the court hearing are acquired.

[0032] In some implementations, a first acquisition device (such as an audio / video recording device) and a second acquisition device (such as a document generation device) are installed in the courtroom space, which can acquire audio / video data and court document data in real time during the trial.

[0033] Specifically, high-quality cameras and microphones installed in the courtroom ensure real-time capture of all audio and video information during the trial. Audio and video capture software then uses an encoder to convert the audio and video streams into digital formats, supporting multiple formats (such as H.264 and AAC) to meet different needs. At the start of the trial, the system automatically initiates data acquisition, storing the generated audio and video data in a local cache and synchronizing it to the trial server on the local area network. On the other hand, during the trial, electronic recording tools record legal documents, evidence, and court opinions in real time. The recorded data is then automatically formatted into standardized document formats (such as PDF and DOCX), and necessary metadata (such as timestamps, participant information, and case numbers) can be attached.

[0034] In addition, to ensure that audio and video data and court document data can be processed synchronously, the system will add a timestamp and sequence number to each data block to ensure the integrity and order of data during subsequent encryption and transmission.

[0035] In step S120, audio and video data are processed by a symmetric encryption algorithm to obtain first encrypted data, court document data are processed by an asymmetric encryption algorithm to obtain second encrypted data, and the first metadata of the audio and video data and the second metadata of the court document data are processed by a hash function to obtain an encrypted data digest. A data packet group is generated based on the first encrypted data, the second encrypted data, and the encrypted data digest.

[0036] Here, the data type of metadata includes at least one of the following: generation timestamp, participant information, case number, data size, and hash function type.

[0037] In some implementations, a combination of symmetric encryption algorithms (such as AES or ChaCha20) for audio and video data and asymmetric encryption algorithms (such as RSA or ECC) for court document data maximizes encryption performance while ensuring data security. Symmetric encryption algorithms are suitable for large volumes of real-time audio and video streams, offering faster encryption and decryption speeds; while asymmetric encryption algorithms are suitable for smaller but more sensitive court documents, providing higher security. Therefore, by combining symmetric and asymmetric encryption algorithms, the speed and efficiency of encryption processing can be improved while ensuring the security of court audio and video data and court document data, especially enhancing the performance of real-time data transmission in remote court hearings.

[0038] In addition, various secure hashing algorithms (such as SHA-256) can be used to hash the metadata of audio and video data and the metadata of document data (e.g., timestamps, data size, hash function type, etc.) to generate a fixed-length digest. The generated hash value is then combined with the encrypted data to form a complete data packet. Each data packet contains encrypted data fragments and corresponding verification information, enhancing the non-repudiation of the data.

[0039] In step S130, a first random private key is generated and a first public key is generated based on the first random private key, a large prime number, and a base. The first public key is sent to a remote server, a second public key is received from the remote server, and a first session key is generated based on the first random private key, the second public key, the large prime number, and the base.

[0040] Here, the court server and the remote server pre-agree on a large prime number and a base. The second public key is generated by the remote server based on the second random private key, the large prime number, and the base. The remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number, and the base.

[0041] Specifically, the large prime numbers and cardinal numbers are differentiated by the court server performing an agreement parameter generation operation for each connected remote server. For example, an agreement parameter generation operation is performed for each connected remote server to generate corresponding large prime numbers and cardinal numbers, and each large prime number and cardinal number is synchronously transmitted to the corresponding remote server as pre-agreement parameters between the remote server and the court server.

[0042] In this way, the court hearing server can generate dynamic and differentiated pre-agreement parameters (i.e., large prime numbers and radix) for different remote servers, and realize differentiated encrypted transmission processing for different remote servers, further improving the security of data transmission.

[0043] In some implementations, a secure random number generator (e.g., CSPRNG) is used to generate a first random private key, ensuring the randomness and unpredictability of the key. A corresponding first public key is generated using a preset large prime number and radix; this public key will be used between the trial server and the remote server to generate subsequent session keys. Furthermore, the first public key is calculated using a large prime number and radix, and then sent to the remote server.

[0044] After receiving the first public key, the remote server generates a second public key based on the second random private key, a large prime number, and a radix, and sends it back to the court hearing server.

[0045] After exchanging public keys, the court server generates a first session key using the first random private key and the remote server's second public key through key exchange. Similarly, the remote server generates a second session key using the second random private key and the court server's first public key. Both parties negotiate a consistent session key through key exchange, which is used for subsequent encrypted data transmission.

[0046] In this embodiment, the session key used by both parties is generated by combining their private and public keys, ensuring that only the two parties can calculate the same session key. Through the key exchange protocol, the parties do not need to directly transmit the session key over the network, greatly improving the security of key exchange and preventing man-in-the-middle attacks or key hijacking. Furthermore, generating different random private and session keys for each court session avoids the security risks associated with using the same key for extended periods, improving the security and flexibility of the encryption system.

[0047] In step S140, each data packet in the data packet group is encrypted based on the first session key to obtain the corresponding encrypted data packet, and each encrypted data packet is sent to the remote server.

[0048] In some implementations, based on the first session key, a symmetric encryption algorithm is used to independently encrypt each data packet in the data packet group, ensuring that even if some data packets are attacked, the others remain secure. Furthermore, each encrypted data packet is serialized and appended with necessary metadata (such as sequence number, timestamp, sender information, etc.) to ensure that the receiving remote server can correctly parse the data.

[0049] Subsequently, the encrypted data packets are sent to the remote server through a pre-defined secure network channel (such as VPN or TLS). During network transmission, the encrypted content and verification information in the data packets can be transmitted via network protocols (such as TCP / IP), and session keys are used to ensure the confidentiality and tamper resistance of the data. Additionally, a data packet retransmission mechanism can be employed to ensure complete data transmission even under unstable network conditions, avoiding information loss due to packet loss.

[0050] After receiving the encrypted data packet on the remote server, the data can be decrypted using the second session key and its integrity verified by the data digest to ensure that the data has not been tampered with. After that, it can be further processed or stored according to business logic.

[0051] This application's embodiments encrypt each data packet in a data packet group based on a session key, ensuring that data is not intercepted or tampered with by third parties during transmission, thus greatly improving data transmission security. Furthermore, the encrypted data packets maintain efficient encrypted transmission during the process and can be quickly decrypted and recovered on a remote server, ensuring the real-time nature and integrity of data during court proceedings. Additionally, the remote server performs integrity verification through data digests, quickly detecting and rejecting any data tampered with during transmission, further enhancing the reliability and transparency of judicial data.

[0052] In some examples of embodiments of this application, the session key is calculated and updated via an enhanced key exchange protocol. More specifically, the first session key is calculated by including the following operations:

[0053] K = B a modp, Equation (1)

[0054] B = g b modp, Equation (2)

[0055] In the formula, K represents the first session key, mod represents the modulo operator, p represents a large prime number, g represents the base, a and b represent the first and second random private keys respectively, and B represents the second public key.

[0056] Specifically, both parties first agree on a large prime number p and a base g, for example, choosing p = 23 and g = 5. Each party generates a random private key, for example, the court server chooses private key a = 6, and the remote server chooses b = 15.

[0057] Subsequently, the court server calculates its public key, i.e., A=5. 6 mod23 = 8. The remote server calculates its public key, i.e., B = 5. 15 mod23 = 19. After both parties exchange public keys, the court server calculates the session key K = B. a modp, user B calculates K' = A b modp ultimately yields the same session key.

[0058] This application employs an enhanced key exchange algorithm to ensure that the generation of session keys does not depend on any party's private key, reducing the risk of key leakage. Even if an attacker intercepts the public key, they cannot deduce the private key and session key, ensuring data confidentiality. Furthermore, a new session key is generated for each court hearing or data transmission, ensuring that even if a session key is compromised, the attacker can only gain one-time access and cannot decrypt historical data, greatly improving the system's resistance to attacks. Therefore, this supports multi-party court hearings, enabling flexible generation of session keys between different courts and remote parties, meeting the needs of cross-regional court hearings, and promoting paperless case handling.

[0059] Regarding the operational details of the agreement parameter generation operation in the embodiments of this application, in some implementations, it can be achieved in the following ways:

[0060] Large prime numbers are defined as prime numbers with n bits of 2048.

[0061] Generate a random number in the range of 2 using a cryptographically secure random number generator. (n-1) to 2 n A random integer N between -1 is used to test whether N is a prime number using the following operation:

[0062] Represent N-1 as 2 s ·d, where d is an odd number:

[0063] N-1=2 s ·d, Equation (3)

[0064] In the formula, under the initial state, s = 0 and d = N-1. During the iteration process, d is continuously divided by 2 until d becomes an odd number, while the value of s is increased.

[0065] Choose a random number e to perform a prime number test, where 2≤e≤N-2.

[0066] Here, we use the advanced primality test method to verify whether N is a prime number.

[0067] Calculate x = e d mod N, and perform the following checks based on x:

[0068] If x = 1 or x = N-1, then the prime number test is passed.

[0069] If x≠1 and x≠N-1, then perform s-1 iterations to calculate x = x. 2 The function modulo N is checked, and if N-1 appears in some iteration, then the prime number test has been passed.

[0070] This embodiment combines primality testing with a random number generator to efficiently generate large prime numbers that meet encryption requirements. Compared to traditional prime number generation methods, the advanced primality testing algorithm is a probability-based primality testing algorithm that can verify the primality of prime numbers in a shorter time, and the reliability of the results can be further improved by increasing the number of test rounds. Therefore, compared to methods that rely entirely on deterministic prime number generation, even with a large number of bits (such as 2048 bits or 4096 bits), it can generate qualified large prime numbers within a reasonable time, resulting in superior computational efficiency.

[0071] Set the N that passes the test to a large prime number p:

[0072] p = N. Equation (4)

[0073] In encrypted communication, the radix g is an important component in generating session keys, and its selection directly affects the security and efficiency of the encryption algorithm.

[0074] Specifically, an initial base number g0 is selected, where g0 < p.

[0075] Calculate the factor list of p-1 and find all factors:

[0076] p-1=2 s ·d, Equation (5)

[0077] For each factor q, calculate the corresponding g0. (p-1) / q If all results are not equal to 1, then g0 is a primitive root; otherwise, the initial cardinality is iteratively updated until the primitive root verification condition is met (that is, the result corresponding to all factors is equal to 1).

[0078] Here, the primitive root verification condition is used to verify whether a selected cardinality g is a primitive root of p. A primitive root is defined as follows: if g is a primitive root of p, then powers of g can generate all residue classes of p.

[0079] The cardinality that satisfies the primitive root verification condition is taken as the final cardinality g.

[0080] In the court hearing system, the court hearing server and the remote server need to agree on p and g in advance to ensure that both parties use the same parameters during the encryption process, thus ensuring the consistency of the session keys automatically generated subsequently.

[0081] It should be noted that in traditional encryption systems, prime numbers and radix are often fixed or rarely updated, which provides attackers with time to analyze and crack the system. However, by using the method of dynamically generating large prime numbers and radix in this application, it is possible to ensure that the encryption parameters used in each session are unique and unpredictable. Even if an attacker successfully obtains the encryption key for a particular session, it cannot be used to decrypt data from other sessions, significantly reducing the risk of replay attacks and key reuse attacks, thereby improving the overall security of the system.

[0082] This application's embodiments use prime number testing to generate large prime numbers and employ p-1 factorization for radix verification, ensuring that the generated prime numbers and radix satisfy strict primitive root conditions. In traditional encryption systems, improper radix selection may result in the session key failing to cover all remaining classes modulo p, thus affecting the security of key generation. However, the precise primitive root verification and prime number testing provided in this application's embodiments effectively avoid encryption weaknesses caused by incorrect radix or prime number selection, fundamentally enhancing the confidentiality of the key.

[0083] It should be noted that, in order to avoid the security risks that may arise from using the same session key for an extended period of time during a session, the private key and session key can be dynamically replaced to reduce the potential risk of being hacked.

[0084] Figure 2 A flowchart illustrating an example of dynamic update of session keys based on a failure detection mechanism according to an embodiment of this application is shown.

[0085] like Figure 2 As shown, by introducing a session key expiration detection and dynamic update mechanism, the long-term security of the encryption process and the continuity of data transmission are ensured. This can effectively prevent security risks caused by using the same session key for a long time. At the same time, by dynamically replacing the private key and session key, the potential risk of cracking is reduced.

[0086] Specifically, in step S210, it is detected whether the time length between the generation timestamp of the first session key and the current system time exceeds the preset key expiration period.

[0087] In some implementations, when the first session key is generated, the system marks the key with a generation timestamp, which records the time the key was generated and is used for subsequent invalidation detection. Here, the timestamp can be recorded using a standard time format (such as a UNIX timestamp) to ensure that the system can accurately determine the validity of the session key in subsequent operations.

[0088] Additionally, a pre-defined expiration proximity period for the session key can be set, for example, every 30 minutes. The expiration proximity period can then be set to every 25 minutes, and this threshold is determined based on the system's security requirements. When the time difference between the system's current time and the session key's generation timestamp exceeds the expiration proximity period, the system determines that the key is about to expire and quickly initiates a key update process to complete the key update within a transition period (e.g., 5 minutes).

[0089] Therefore, by detecting the expiration of session keys, it can be ensured that the keys are not used for extended periods, avoiding the risk of cracking due to prolonged encryption. Regularly updating the keys reduces the possibility of potential attackers intercepting the keys and attempting brute-force attacks, especially during lengthy court hearings, ensuring that data is transmitted under a highly secure encrypted state at all times.

[0090] In step S220, if the limit is exceeded, a third random private key is regenerated to replace the first random private key, and a third public key is generated based on the third random private key, a large prime number, and a base. The third public key is sent to the remote server, a fourth public key is received from the remote server, and a third session key is generated based on the third random private key, the fourth public key, the large prime number, and the base to update the first session key.

[0091] In some implementations, when the session key is detected to be about to expire, a new private key, namely a third random private key, is regenerated based on a random number generator to replace the previous first random private key. The random number generator ensures its unpredictability and uniqueness. Then, a new third session key is generated using a key exchange algorithm based on the third random private key and the remote server's second public key, replacing the previous first session key. After generating the new third session key, the system uses this key for data packet encryption for a subsequent period (e.g., no less than 25 minutes).

[0092] By generating a new session key to replace the old key, the continuity of the encryption process can be maintained, ensuring that the encryption strength of the data remains at a high standard even during lengthy court proceedings. Furthermore, the regular updating of the session key and the dynamic generation of the private key further enhance the security of data transmission, preventing any potential attacker from cracking the key by capturing the encrypted data stream.

[0093] On the other hand, the remote server also uses the corresponding public key and key exchange algorithm to update the session key, thereby achieving synchronous data encryption and decryption processing.

[0094] It should be noted that, to ensure uninterrupted encryption and decryption operations during session key updates, a short transition period (e.g., 5 minutes) can be introduced. During this period, the system supports encryption and decryption operations using both the old and new session keys, ensuring that already encrypted data packets can still be decrypted using the old key, while newly encrypted data packets are encrypted using the new session key.

[0095] Figure 3 A flowchart illustrating an example of data decryption operations during a transition period for a remote server according to an embodiment of this application is shown.

[0096] In step S310, a fourth random private key is generated, and a fourth session key is generated based on the fourth random private key, the third public key, and a large prime number.

[0097] In step S320, the received encrypted data packets are decrypted based on the second session key and the fourth session key.

[0098] In step S330, if the number of times the second session key fails to decrypt exceeds a preset threshold, the second session key is deleted.

[0099] Here, the threshold number of failed decryption attempts can be set or adjusted according to business needs, such as 3 or 5 attempts. When replacing an old session key with a new one, the old session key is not immediately deleted. Instead, a threshold number of failed decryption attempts is set to determine when the old session key should be discarded. This reduces the computational resource burden caused by frequent key switching and avoids decryption failures that may occur during key switching. Therefore, this flexible key deletion mechanism allows for more efficient management of encryption and decryption operations, avoids resource waste, and improves overall system performance.

[0100] In terms of business scenarios, during the transition period, if the current session key is about to expire, the court hearing server can automatically trigger the re-encryption of unsent data packets after the session key is updated, ensuring that all sent data packets use the latest session key. Since synchronously negotiating when to replace the session key during the transition period is costly, to avoid the failure to decipher some data packets, a second and fourth session key are used in parallel, ensuring the reliability of data packet decryption during the key update process.

[0101] In this embodiment, based on the third public key sent by the court hearing server, the remote server enters a key transition period. By using a smooth key switching mechanism during this period, key updates and replacements can be completed without affecting the court hearing process. This avoids interruptions in data decryption and transmission caused by key switching, ensuring the security and timeliness of audio and video data and court documents during transmission. Therefore, the key rotation mechanism enhances encryption security. Even if an attacker obtains partial encrypted data packets, it is difficult to decipher the session key through a prolonged attack, greatly improving the system's resistance to attacks.

[0102] Regarding the selection of the encryption algorithm in step S120 above, in some embodiments, the symmetric encryption algorithm is the ChaCha20-Poly1305 algorithm, and the asymmetric encryption algorithm is the elliptic curve encryption algorithm.

[0103] Regarding the selection of the ChaCha20-Poly1305 algorithm, ChaCha20 is a symmetric encryption algorithm based on stream ciphers. It is faster than AES on many hardware platforms, especially on mobile devices or resource-constrained devices, making it an ideal choice for symmetric encryption. Furthermore, Poly1305 is a message authentication code algorithm that effectively prevents data tampering during transmission. The combination of ChaCha20 and Poly1305 provides not only strong encryption capabilities but also data authentication functionality.

[0104] Specifically, ChaCha20 is a stream cipher algorithm that does not require block encryption. Instead, it generates a pseudo-random key stream and XORs the plaintext byte by byte to encrypt it. The initialization vector (IV) is used with the key during encryption to ensure that the same plaintext yields different encryption results in different sessions.

[0105] When using ChaCha20 in conjunction with Poly1305, Poly1305 is used to generate Message Authentication Codes (MACs) to ensure data integrity. This allows the remote server to first verify MAC matching during decryption. Decryption will only proceed if the MAC verification is successful.

[0106] In some preferred embodiments, ChaCha20 can also use a key rolling mechanism to periodically generate new ChaCha20 keys during long-term data transmission. Unlike AES, ChaCha20's key updates do not require a large amount of computational resources, making it more suitable for encrypting real-time audio and video data.

[0107] Through the embodiments of this application, the ChaCha20-Poly1305 exhibits faster encryption speeds than AES, particularly excelling in processing audio and video streams. Its stream cipher characteristics allow for byte-level encryption of data, avoiding block operations during the encryption process, thereby reducing encryption latency and ensuring the real-time transmission of audio and video data during court proceedings. Furthermore, the ChaCha20 has low CPU requirements, making it particularly suitable for use on mobile devices, embedded devices, and servers with lower performance. By employing the ChaCha20-Poly1305 on both the court server and remote server, efficient audio and video data transmission across different devices can be ensured, enabling smooth court proceedings on both low-performance devices and high-performance servers. In addition, the ChaCha20 possesses excellent resistance to side-channel attacks (such as cache timing attacks), making it especially suitable for cloud environments and open network scenarios. As a multi-party online system, the cloud-based shared courtroom can effectively resist side-channel attacks that may target the encryption process, further enhancing security.

[0108] Regarding the selection of elliptic curve cryptography (ECC) algorithms, compared to the traditional asymmetric RSA encryption algorithm, ECC requires a much shorter key length to provide the same level of security. For example, 256-bit ECC provides the same level of security as 3072-bit RSA. Therefore, ECC is more computationally efficient at the same level of security. Furthermore, because ECC uses shorter keys, it requires less storage and computing resources, making it particularly suitable for mobile devices, IoT devices, and cloud computing environments.

[0109] Specifically, the ECC algorithm is based on a specific elliptic curve cryptography algorithm, such as the secp256k1 curve, which is used by many cryptocurrencies like Bitcoin and is also a very secure and efficient elliptic curve. The public-private key pair generated by ECC is based on a random number, and the public key is generated through a dot product operation on the curve. The document is then encrypted using the public key from a remote server, thus transforming the document data into points on the curve and encrypting them. This allows the remote server to access the ciphertext using the private key and recover the original document.

[0110] Compared to RSA, ECC, with its shorter key, reduces bandwidth consumption during encryption key transmission and lowers computational resource requirements, allowing for the encryption and decryption of larger documents with less computing power, while maintaining equivalent security. Therefore, in cloud-based shared courtroom scenarios, ECC is particularly suitable for encrypting sensitive trial documents and evidence.

[0111] Through the embodiments of this application, the ECC uses a shorter key length (e.g., 256-bit ECC is equivalent to the security of 3072-bit RSA), yet still provides the same or even stronger security as RSA. This not only shortens the time required for encryption and decryption but also reduces the computational resources consumed during the encryption process, significantly improving document encryption efficiency, especially when dealing with a large number of court documents. Furthermore, ECC can complete the decryption process more quickly when the recipient performs decryption, making it particularly suitable for scenarios where the remote server may have poor performance. Due to the shorter key, ECC requires less computational power for decryption, enabling remote parties, lawyers, witnesses, or other legal institutions to quickly receive decrypted court documents and evidence files, preventing excessively long decryption times from affecting trial efficiency and achieving support for document encryption involving multiple parties.

[0112] It should be noted that existing encryption schemes lack sufficient adaptability to network conditions. In complex network environments with limited bandwidth, current encryption schemes do not dynamically adjust to data traffic and network status, leading to increased data transmission delays during network congestion and affecting the real-time nature of court proceedings. This is particularly evident in remote trials or multi-party cross-regional trials, potentially causing delays in audio and video data transmission, impacting the trial experience, and consequently affecting trial efficiency.

[0113] Therefore, this application provides an adaptive adjustment mechanism for encryption strength based on network conditions, thereby improving the flexibility and adaptability of the data transmission encryption system.

[0114] Figure 4 A flowchart illustrating an example of an adaptive encryption strength adjustment mechanism based on network state, according to an embodiment of this application, is shown.

[0115] like Figure 4 As shown, in step S410, the network transmission status between the server and the remote server is detected.

[0116] Specifically, the latency, bandwidth, and packet loss rate of the network are periodically monitored to dynamically assess the current network transmission status. Quantitative indicators of network transmission status (such as RTT, packet loss rate, and available bandwidth) are used to determine the corresponding network transmission status in real time.

[0117] In step S421, if the network transmission status is smooth, the video data is encrypted using a 256-bit key via the ChaCha20-Poly1305 algorithm.

[0118] In step S423, if the network transmission status is a network congestion status, the channel audio and video components corresponding to the preset sensitive channel information in the audio and video data are encrypted using a 256-bit key through the ChaCha20-Poly1305 algorithm, and the other channel audio and video components in the audio and video data are encrypted using a 128-bit key.

[0119] Here, sensitive channel information includes the channel information of the judge's microphone and the channel information of the evidence playback device. For example, multiple microphones are deployed in the courtroom environment, and the channel information of key devices (e.g., the judge's microphone and the evidence playback device) is pre-identified in the system to distinguish them from other devices, such as scene recording equipment and other microphones. This allows the system to automatically identify and label the audio and video data of these device channels as sensitive data. Therefore, even under poor network conditions, this critical audio and video data can still be encrypted with high strength. By using a 256-bit key to encrypt the audio and video data of the judge's microphone channel and the evidence playback device channel, the security of core sensitive data can be ensured.

[0120] It should be noted that by monitoring network transmission status in real time and dynamically adjusting encryption strategies based on changes in network bandwidth, the system ensures that all audio and video data are encrypted with the highest security level (i.e., 256-bit ChaCha20-Poly1305 algorithm) when network conditions are good. However, under network congestion or bandwidth limitations, core data maintains high encryption strength, while the encryption strength of non-critical data is appropriately reduced. This differentiated encryption maintains smooth data transmission, ensuring the system's real-time performance and transmission capabilities. Furthermore, in congested network conditions, reducing the encryption strength of some audio and video data (using a 128-bit key) reduces the computational load of encryption and decryption, while also reducing network bandwidth usage. This is particularly effective when audio and video transmission volumes are large, effectively preventing data transmission delays caused by excessive encryption and ensuring the smoothness of the court proceedings. Therefore, by using lightweight encryption for non-critical data, the system can maintain low latency even under network congestion conditions, improving the continuity and viewing experience of the court proceedings and preventing interruptions or audio / video stuttering.

[0121] Figure 5 A flowchart illustrating another example of an adaptive encryption strength adjustment mechanism based on network state, according to an embodiment of this application, is shown.

[0122] In step S510, the network transmission status between the server and the remote server is detected.

[0123] In step S521, if the network transmission status is smooth, the court document data is encrypted using the secp521r1 curve through the elliptic curve encryption algorithm.

[0124] Specifically, secp521r1 is a 521-bit elliptic curve cryptography, offering higher security than 256-bit and 384-bit cryptography. Due to its longer key length, it is more resistant to attacks, but the computational complexity of encryption and decryption is relatively high. When network conditions are smooth and the system has sufficient bandwidth and computing resources, choosing this curve ensures the highest level of security for transmitted data. Therefore, under smooth network conditions, using secp521r1 provides higher encryption strength, increases the difficulty of cracking, and ensures that even under heavy data traffic, the security of important information is maximized.

[0125] In step S523, if the network transmission status is smooth, the court document data is encrypted using the Curve 25519 curve through the elliptic curve encryption algorithm.

[0126] Specifically, Curve25519 is an elliptic curve based on the Montgomery curve, achieving a good balance between security and performance. Compared to the traditional secp256r1 curve, Curve25519 offers higher computational efficiency while providing protection equivalent to 256 bits of security. When network transmission is congested or bandwidth is limited, especially in scenarios involving remote witnesses or court proceedings with unstable networks, Curve25519 can be chosen to accelerate encryption and decryption processes, reduce computational burden, and increase data transmission speed. Therefore, using Curve25519 can significantly reduce the complexity of encryption calculations, alleviate computational load, and provide smooth data transmission even with limited bandwidth.

[0127] Through the embodiments of this application, the system can automatically switch the elliptic curve used based on the detected network status. When the network is smooth, it enables secp521r1 for encryption to ensure high security. Conversely, when the network is congested, it switches to Curve25519 for encryption to prioritize transmission efficiency. Therefore, through real-time network status detection and adaptive curve switching, the encryption strength and computational complexity can be flexibly adjusted according to network conditions, ensuring efficient transmission of court document data under various network conditions without compromising security.

[0128] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of combined actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Secondly, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application. In the above embodiments, the descriptions of each embodiment have their own emphasis; for parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0129] Figure 6 A structural block diagram of an example of a data security encryption processing system according to an embodiment of this application is shown.

[0130] like Figure 6 As shown, the data security encryption processing system 600 includes a data acquisition unit 610, a data encryption unit 620, a session encryption unit 630, and a data packet encryption transmission unit 640.

[0131] The data acquisition unit 610 is used to acquire audio and video data and court document data generated in real time during the court hearing.

[0132] The data encryption unit 620 is used to process the audio and video data using a symmetric encryption algorithm to obtain first encrypted data, process the court document data using an asymmetric encryption algorithm to obtain second encrypted data, process the first metadata of the audio and video data and the second metadata of the court document data using a hash function to obtain an encrypted data digest, and generate a data packet group based on the first encrypted data, the second encrypted data and the encrypted data digest; the data type of the metadata includes at least one of the following: generation timestamp, participant information, case number, data size and hash function type.

[0133] The session encryption unit 630 is used to generate a first random private key and generate a first public key based on the first random private key, a large prime number, and a radix; send the first public key to the remote server; receive a second public key from the remote server; and generate a first session key based on the first random private key, the second public key, the large prime number, and the radix. The large prime number and the radix are differentially allocated by the court service terminal for each connected remote server by performing a protocol parameter generation operation. The second public key is generated by the remote server based on the second random private key, the large prime number, and the radix. The remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number, and the radix.

[0134] The data packet encryption transmission unit 640 is used to encrypt each data packet in the data packet group based on the first session key to obtain the corresponding encrypted data packet, and send each of the encrypted data packets to the remote server.

[0135] In some embodiments, this application provides a non-volatile computer-readable storage medium storing one or more programs including execution instructions, which can be read and executed by electronic devices (including but not limited to computers, servers, or network devices) to perform the steps of any of the data security encryption methods described above.

[0136] In some embodiments, this application also provides a computer program product, the computer program product including a computer program stored on a non-volatile computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the steps of any of the above-described data security encryption methods.

[0137] In some embodiments, this application also provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of a data security encryption processing method.

[0138] Figure 7 This is a schematic diagram of the hardware structure of an electronic device for performing a data security encryption processing method according to another embodiment of this application, as shown below. Figure 7 As shown, the device includes:

[0139] One or more processors 710 and memory 720, Figure 7 Take the 710 processor as an example.

[0140] The device for performing the data security encryption processing method may further include: an input device 730 and an output device 740.

[0141] The processor 710, memory 720, input device 730, and output device 740 can be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0142] The memory 720, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions / modules corresponding to the data security encryption processing method in the embodiments of this application. The processor 710 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions, and modules stored in the memory 720, thereby implementing the data security encryption processing method in the above-described method embodiments.

[0143] The memory 720 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 720 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 720 may optionally include memory remotely located relative to the processor 710, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0144] Input device 730 can receive input digital or character information and generate signals related to user settings and function control of the electronic device. Output device 740 may include display devices such as a display screen.

[0145] The one or more modules are stored in the memory 720, and when executed by the one or more processors 710, they perform the data security encryption processing method in any of the above method embodiments.

[0146] The above-described product can perform the methods provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects for performing the methods. Technical details not described in detail in this embodiment can be found in the methods provided in the embodiments of this application.

[0147] The electronic devices in this application embodiments exist in various forms, including but not limited to:

[0148] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include smartphones, multimedia phones, feature phones, and low-end phones.

[0149] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include: PDAs, MIDs, and UMPCs, etc.

[0150] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes audio and video players, handheld game consoles, e-book readers, as well as smart toys and portable car navigation devices.

[0151] (4) Other airborne electronic devices with data interaction capabilities, such as vehicle-mounted systems installed on vehicles.

[0152] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0153] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data security encryption processing method, applied to a court hearing server, the method comprising: Acquire audio and video data and court document data generated in real time during the court hearing; The audio and video data are processed by a symmetric encryption algorithm to obtain first encrypted data, and the court document data are processed by an asymmetric encryption algorithm to obtain second encrypted data. The first metadata of the audio and video data and the second metadata of the court document data are processed by a hash function to obtain an encrypted data digest. A data packet group is generated based on the first encrypted data, the second encrypted data and the encrypted data digest. The data types of metadata include at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; A first random private key is generated, and a first public key is generated based on the first random private key, a large prime number, and a radix. The first public key is sent to a remote server, and a second public key is received from the remote server. A first session key is generated based on the first random private key, the second public key, the large prime number, and the radix. The large prime number and the radix are differentially allocated by the court service terminal for each connected remote server by performing a protocol parameter generation operation. The second public key is generated by the remote server based on the second random private key, the large prime number, and the radix. The remote server is also used to generate a second session key based on the second random private key, the first public key, the large prime number, and the radix. Each data packet in the data packet group is encrypted based on the first session key to obtain a corresponding encrypted data packet, and each encrypted data packet is sent to the remote server.

2. The method according to claim 1, wherein, After generating the first session key based on the first random private key, the second public key, the large prime number, and the radix, the method further includes: Detect whether the time between the generation timestamp of the first session key and the current system time exceeds the preset key expiration period; If the limit is exceeded, a third random private key is regenerated to replace the first random private key, and a third public key is generated based on the third random private key, the large prime number, and the radix. The third public key is sent to the remote server, a fourth public key is received from the remote server, and a third session key is generated based on the third random private key, the fourth public key, the large prime number, and the radix to update the first session key.

3. The method according to claim 2, wherein, After receiving the third public key, the remote server further performs the following operations: Generate a fourth random private key, and generate a fourth session key based on the fourth random private key, the third public key, and the large prime number; The received encrypted data packets are decrypted based on the second session key and the fourth session key; If the number of times the second session key fails to decrypt exceeds a preset threshold, the second session key is deleted.

4. The method according to claim 1, wherein, The first session key is calculated through operations including the following: K=B a modp, God b modp, In the formula, K represents the first session key, mod represents the modulo operator, p represents a large prime number, g represents the base, a and b represent the first and second random private keys respectively, and B represents the second public key.

5. The method according to claim 4, wherein, The protocol parameter generation operation includes: Large prime numbers are defined as prime numbers with n bits of 2048. Generate a random number in the range of 2 using a cryptographically secure random number generator. (n-1) to 2 n A random integer N between -1 is used to test whether N is a prime number using the following operation: Represent N-1 as 2 s ·d, where d is an odd number: N-1=2 s ·d, In the formula, under the initialization state, s = 0 and d = N-1; Choose a random number e to perform a prime number test, where 2≤e≤N-2; Calculate x = e d mod N, and perform the following checks based on x: If x = 1 or x = N-1, then the prime number test is passed; If x≠1 and x≠N-1, then perform s-1 iterations to calculate x = x. 2 mod N and check if N-1 appears in some iteration, then the prime number test has been passed; Set the N that passes the test to a large prime number p: p = N; Choose an initial base g0, where g0 < p; Calculate the factor list of p-1 and find all factors: p-1=2 s ·d, For each factor q, calculate the corresponding... If all results are not equal to 1, then g0 is the primitive root; otherwise, the initial cardinality is iteratively updated until the primitive root verification condition is met. The cardinality that satisfies the primitive root verification condition is taken as the final cardinality g.

6. The method according to claim 1, wherein, The symmetric encryption algorithm uses the ChaCha20-Poly1305 algorithm, and the asymmetric encryption algorithm uses the elliptic curve cryptography algorithm.

7. The method according to claim 6, wherein, The method further includes: Detect the network transmission status with the remote server; If the network transmission status is smooth, the audio and video data are encrypted using a 256-bit key via the ChaCha20-Poly1305 algorithm. If the network transmission status is a network congestion status, the channel audio and video components corresponding to the preset sensitive channel information in the audio and video data are encrypted using a 256-bit key through the ChaCha20-Poly1305 algorithm, and the other channel audio and video components in the audio and video data are encrypted using a 128-bit key; the sensitive channel information includes the channel information of the judge's microphone and the channel information of the evidence playback device.

8. The method according to claim 7, wherein, The method further includes: If the network transmission status is smooth, the court document data is encrypted using the secp521r1 curve with an elliptic curve encryption algorithm. If the network transmission status is congested, the court document data is encrypted using an elliptic curve encryption algorithm with a Curve 25519 curve.

9. A data security encryption processing system, deployed on a court hearing server, the system comprising: The data acquisition unit is used to acquire audio and video data and court document data generated in real time during the court hearing; The data encryption unit is used to process the audio and video data using a symmetric encryption algorithm to obtain first encrypted data, process the court document data using an asymmetric encryption algorithm to obtain second encrypted data, process the first metadata of the audio and video data and the second metadata of the court document data using a hash function to obtain an encrypted data digest, and generate a data packet group based on the first encrypted data, the second encrypted data and the encrypted data digest. The data types of metadata include at least one of the following: generation timestamp, participant information, case number, data size, and hash function type; A session encryption unit is configured to generate a first random private key and, based on the first random private key, a large prime number, and a radix, generate a first public key; send the first public key to a remote server; receive a second public key from the remote server; and generate a first session key based on the first random private key, the second public key, the large prime number, and the radix. The large prime number and the radix are differentially allocated by the court service terminal for each connected remote server by performing a protocol parameter generation operation. The second public key is generated by the remote server based on the second random private key, the large prime number, and the radix. The remote server is also configured to generate a second session key based on the second random private key, the first public key, the large prime number, and the radix. The data packet encryption transmission unit is used to encrypt each data packet in the data packet group based on the first session key to obtain the corresponding encrypted data packet, and send each of the encrypted data packets to the remote server.

10. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-8.

Images