Encryption transmission method and satellite communication method

Abstract

The invention provides an encryption transmission method and a satellite communication method. The encryption transmission method is applied to a data sending end, and comprises the following steps: acquiring first data and second data; generating a security protocol packet and a first key for encryption by using the second data based on a key generation protocol pre-negotiated by a data sending end and a data receiving end; encrypting the first data by using the first key to obtain encrypted data; signing the first data by using a private key of data sending end equipment to obtain signature data; and transmitting the encrypted data, the signature data and the security protocol packet to a data receiving end. According to the encryption transmission method and the satellite communication method, the efficiency, the security and the real-time performance of data encryption transmission can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an encryption transmission method and a satellite communication method. Background Art

[0002] In the existing information encryption transmission process, traditional methods are based on VPN and IPSec protocols to achieve encryption security protection of communication links. However, these methods lack the authenticity judgment of the identities of the communicating parties (communication sources). This static, pre-made shared key cannot prevent the risks of illegal access and intrusion caused by key leakage, and has low security. In addition, these methods require multiple handshakes and authentications during the process of establishing a secure tunnel and key negotiation, resulting in significantly increased communication latency and poor real-time performance. Summary of the Invention

[0003] In view of this, the purpose of this application is to propose an encrypted transmission method and a satellite communication method to solve the technical problems of poor security and poor real-time performance in the existing technology.

[0004] Based on the above objectives, the first aspect of the present application provides an encrypted transmission method, which is applied to a data sending end, comprising:

[0005] Acquiring first data and second data;

[0006] Based on a key generation protocol pre-negotiated between the data sending end and the data receiving end, generating a security protocol packet and a first key for encryption using the second data;

[0007] encrypting the first data using the first key to obtain encrypted data;

[0008] Signing the first data using a private key of a data sending end device to obtain signed data;

[0009] The encrypted data, the signed data and the security protocol packet are transmitted to a data receiving end.

[0010] Furthermore, the generating of the security protocol packet and the first key for encryption using the second data based on the key generation protocol pre-negotiated between the data sending end and the data receiving end includes:

[0011] Packaging the second data to obtain a security protocol packet;

[0012] generating a first key salt using the security protocol package;

[0013] An elliptic curve public key cryptography algorithm and a key exchange algorithm are used to generate a first key based on the private key of the data sending end device, the identification information of the data receiving end device and the first key salt.

[0014] Furthermore, the step of signing the first data using the private key of the data sending end device to obtain the signed data includes:

[0015] Calculating a hash value of the first data using a hash algorithm to obtain a first hash value;

[0016] The first hash value is encrypted using the private key of the data sending end device to obtain the signature data.

[0017] Furthermore, the transmitting of the encrypted data, the signed data and the security protocol package to the data receiving end includes:

[0018] Packaging the encrypted data and the signed data to obtain an initial data packet;

[0019] Determining header information of a data packet based on the initial data packet;

[0020] Encapsulating the initial data packet and the packet header information to obtain a transmission data packet;

[0021] The transmission data packet and the security protocol packet are transmitted to a data receiving end.

[0022] Furthermore, the first data is power data.

[0023] In a second aspect of the present application, another encryption transmission method is provided, which is applied to a data receiving end, comprising:

[0024] Obtain the encrypted data, signature data and security protocol package sent by the data sender;

[0025] Based on a key generation protocol pre-negotiated between the data sending end and the data receiving end, generating a second key for decryption using the security protocol packet;

[0026] decrypting the encrypted data using the second key to obtain third data;

[0027] Performing signature verification based on the third data, the public key of the data sending end device and the signature data;

[0028] In response to the signature verification being successful, the third data is displayed.

[0029] Furthermore, the generating of the second key for decryption using the security protocol packet based on the key generation protocol pre-negotiated between the data sending end and the data receiving end includes:

[0030] generating a second key salt using the security protocol package;

[0031] The second key is generated based on the data receiving device private key, the data sending device identification information and the second key salt using an elliptic curve public key cryptography algorithm and a key exchange algorithm.

[0032] Furthermore, the performing signature verification based on the third data, the public key of the data sending end device and the signature data includes:

[0033] Calculating a hash value of the third data using a hash algorithm to obtain a second hash value;

[0034] Decrypting the signature data using the public key of the data sending end device to obtain a third hash value;

[0035] The second hash value is compared with the third hash value to see if they are consistent. If they are consistent, the verification is passed; otherwise, the verification is failed.

[0036] Further, in response to the signature verification failing, the third data is discarded.

[0037] A third aspect of the present application provides a satellite communication method, which is applied to a satellite communication system, wherein the satellite communication system includes a data transmitting end and a data receiving end, and the method includes:

[0038] The data sending end sends information to the data receiving end according to the encryption transmission method described in the first aspect of the present application;

[0039] The data receiving end processes the information sent by the data sending end according to an encryption transmission method described in the second aspect of this application.

[0040] As can be seen from the above description, the present application provides an encrypted transmission method and satellite communication method. At a data sending end, a first key and a security protocol package are generated through a key generation protocol pre-negotiated between the data sending end and the data receiving end, and first data is encrypted using the first key to obtain encrypted data, thereby achieving data encryption. The first data is then signed using the data sending end device's private key, so that the data receiving end can verify the data source identity and signature using the data sending end device's public key, thereby ensuring the trustworthiness of the data source and the authenticity of the data. Finally, the encrypted data, signed data, and security protocol package are transmitted to the data sending end, so that the data sending end can use the encrypted data, signed data, and security protocol package to achieve data decryption, data source identity verification, and data authenticity verification based on the pre-negotiated key generation protocol. No key transmission is involved between the data sending end and the data receiving end, resulting in higher data security, confirmation of the data sending end's identity, ensuring the trustworthiness of the data source, and effectively protecting the authenticity, integrity, and confidentiality of the data transmission. At the same time, the data sending end and the data receiving end do not need multiple handshakes and authentications during the transmission process, which can effectively improve the real-time performance of data transmission, thereby achieving high data security and efficient transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 A schematic diagram of an encrypted transmission method according to an embodiment of the present application;

[0043] Figure 2 A schematic diagram of another encrypted transmission method according to an embodiment of the present application;

[0044] Figure 3 A schematic diagram of assembling a transmission data packet according to an embodiment of the present application;

[0045] Figure 4 Schematic diagram of the calculation process of the first key and the second key according to an embodiment of the present application;

[0046] Figure 5 This is a schematic diagram of the system structure for implementing the encrypted transmission method according to an embodiment of the present application;

[0047] Figure 6 A schematic diagram of a satellite communication method according to an embodiment of the present application;

[0048] Figure 7This is a schematic structural diagram of an encrypted transmission device according to an embodiment of the present application;

[0049] Figure 8 This is a schematic structural diagram of another encrypted transmission device according to an embodiment of the present application;

[0050] Figure 9 This is a schematic structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0052] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0053] The frequent occurrence of extreme weather disasters in recent years has posed significant challenges to the safe and stable operation of power communications. As an important complement to fiber-optic communications, satellite communications technology has been widely used in emergency power repairs and major event support. Furthermore, the digital transformation of the power grid and the continued acceleration of the construction of new power systems have placed higher demands on the reliability, flexibility, compatibility, and real-time performance of power communications. As a key component of the power industry's integrated "air-space-ground" communications system, satellite communications are playing an increasingly important role within the industry.

[0054] With the deepening development of the power Internet of Things (IoT), the demand for communication bandwidth and real-time data transmission is increasing. Traditional satellite communication systems rely on VPN (Virtual Private Network) and IPSec (Internet Protocol Security) protocols to implement encrypted communication link security. However, these methods lack the ability to verify the authenticity of the communicating parties (the communication source). Because these parties cannot be trusted, the transmitted data carries the risk of carrying dangerous data packets such as viruses and Trojans. Furthermore, the authenticity, integrity, and confidentiality of the transmitted data also pose security risks.

[0055] At the same time, VPN gateway devices and IPSec protocols perform identity authentication and key negotiation based on pre-made shared keys or certificates. However, this static, pre-made shared key cannot prevent the risk of illegal access and intrusion caused by key leakage. Secondly, although the certificate verification method can establish a secure communication tunnel between domains, the sender must first send the certificate to the receiver before the channel is established, and the receiver can then verify it. This may also cause the sender to be impersonated, posing certain security risks.

[0056] Existing encrypted transmission schemes lack the ability to verify the authenticity of the communicating parties (the communication sources). Because these parties cannot be trusted, the risk of transmitted data carrying dangerous data packets such as viruses and Trojans increases. The authenticity, integrity, and confidentiality of the transmitted data also pose security risks, resulting in poor data security. Furthermore, traditional security protocols require multiple handshakes and authentication processes during the secure tunnel establishment and key negotiation process, significantly increasing communication latency and resulting in poor real-time performance. This is particularly true in satellite communications, which inherently suffer from limited bandwidth and high latency. The multiple handshakes and authentication required by existing encrypted transmission methods further exacerbate this poor real-time performance, leading to inefficient information transmission and clearly failing to meet the real-time requirements of power communications. Furthermore, traditional security protocols also suffer from centralized reliance on key management and distribution, as well as poor scalability, making them difficult to adapt to the massive access needs of the power Internet of Things.

[0057] In view of this, the present application provides an encryption transmission method that can achieve efficient and secure transmission of information and is applied to the data sending end, such as Figure 1 Shown, including:

[0058] S101, obtaining first data and second data;

[0059] Specifically, the first data is data that needs to be encrypted, and the second data is data that does not need to be encrypted and is transmitted in plain text. During data transmission, not all data needs to be encrypted. Some non-sensitive information can be transmitted directly in plain text, such as version number, data type, length, etc. For routing and parsing, some fields in network protocols (such as IP addresses and port numbers) generally must also be transmitted in plain text.

[0060] like Figure 3 As shown in Figure 1, OSI (Open Systems Interconnection) is a network communication framework proposed by the seven-layer protocol organization. It divides complex network communications into seven layers: application layer, presentation layer, session layer, transport layer, network layer, data link layer, and physical layer. The application layer provides various request services for applications or user requests; the presentation layer handles data format conversion (such as encoding / decoding, encryption / decryption, and compression / decompression) to ensure compatibility between different systems; the session layer establishes, manages, and terminates sessions between applications; the transport layer provides end-to-end data transmission services, managing flow control, error retransmission, and port number allocation; the network layer implements logical addressing and routing across networks through IP addresses, ensuring the transmission of data packets from source to destination; the data link layer provides media access and link management; and the physical layer manages the interconnection between communication devices and network media. When the application layer generates data that needs to be encrypted for transmission, the IP message of the network layer (i.e., the original IP data packet) can be intercepted, and the payload of the data, i.e., the valid data part actually transmitted in the communication, can be further extracted from the original IP data packet. The payload can be used as the first data for subsequent processing, and the data that does not need to be encrypted and transmitted in plain text (such as IP address, port number, etc.) can be used as the second data.

[0061] S102: Based on a key generation protocol pre-negotiated between the data sending end and the data receiving end, generate a security protocol packet and a first encryption key using the second data;

[0062] Specifically, the key generation protocol clearly documents the required inputs, specific calculation steps, specific parameters, cryptographic algorithms, and other details for calculating the first key, ensuring the smooth generation of the first key and security protocol package, and providing the foundation for subsequent encryption and decryption. The key generation protocol is pre-negotiated between the data sender and the data receiver, allowing them to independently calculate the corresponding key using the same method, achieving the generation of a non-interactive shared key. This allows encrypted data transmission without the need for key exchange between the two parties.

[0063] S103: Encrypt the first data using the first key to obtain encrypted data;

[0064] Specifically, after obtaining the first key, the first data can be used to encrypt to obtain encrypted data, thereby improving the security of data transmission.

[0065] S104: Sign the first data using the private key of the data sending end device to obtain signed data;

[0066] Specifically, the private key of the data sending device serves as the data sending device's identity credential. It is used to sign the first data, verifying the data sending device's identity and ensuring the data's source is trustworthy. In an asymmetric encryption system, a private key is part of a key pair, the other part of which is the public key. The private key is confidential and known only to the data sending device or its owner, while the public key can be publicly distributed to anyone. Data encryption and decryption are achieved through the pairing of the public and private keys. The public key of the data sending device is pre-stored on the corresponding data receiving end to verify the identity of the data source. Furthermore, the first data is signed using the private key of the data sending device, allowing the data receiving end to verify the signature during the decryption process to verify the authenticity of the data.

[0067] S105: Transmit the encrypted data, the signed data, and the security protocol packet to a data receiving end.

[0068] Specifically, the obtained encrypted data, signature data and security protocol package are all sent to the data receiving end, and the data receiving end further decrypts the received encrypted data, signature data and security protocol package.

[0069] In the present application, based on steps S101 to S105, at the data sending end, a first key and a security protocol package are generated through a key generation protocol pre-negotiated between the data sending end and the data receiving end, and the first data is encrypted using the first key to obtain encrypted data, thereby realizing data encryption; then the first data is signed using the private key of the data sending end device, so that the data receiving end can verify the identity of the data source and the signature through the public key of the data sending end device, thereby ensuring the credibility of the data source and the authenticity of the data; finally, the encrypted data, the signed data and the security protocol package are transmitted to the data sending end, so that the data sending end can use the encrypted data, the signed data and the security protocol package to realize data decryption, data source identity authentication and data authenticity verification according to the pre-negotiated key generation protocol; between the data sending end and the data receiving end, no key transmission is involved, the data security is higher, the identity of the data sending end is confirmed, the credibility of the data source is ensured, and the authenticity, integrity and confidentiality of the data transmission are effectively guaranteed; at the same time, the data sending end and the data receiving end do not need multiple handshakes and authentications during the transmission process, which can effectively improve the real-time performance of data transmission, thereby realizing high security and efficient data transmission.

[0070] In some embodiments, the step of generating a security protocol packet and a first encryption key using the second data based on a key generation protocol pre-negotiated between the data sending end and the data receiving end includes:

[0071] S1021. Packaging the second data to obtain a security protocol package;

[0072] Specifically, the key generation protocol stipulates a package format for the security protocol package, such as the package structure, rules, additional fields, etc. Therefore, after obtaining the second data, the second data is packaged according to the format requirements in the key generation protocol to obtain a security protocol package. Exemplarily, the second data includes data such as length and version number. The data is arranged and packaged according to the package format, for example, to obtain the following structure: [version number] [data type]. If the key generation protocol stipulates that a timestamp and serial number need to be added to the end of the package as additional fields, the corresponding structure obtained is: [version number] [data type] [timestamp] [serial number]. Users can agree on the package format of the security protocol package in the key generation protocol according to actual conditions, and there is no specific restriction.

[0073] S1022. Generate a first key salt using the security protocol package;

[0074] Specifically, a key salt is a random value or specific data block used in cryptography to enhance the security of key generation. It can increase the randomness and uniqueness of the key, prevent the repeated use of the same input to generate the same key, and thus enhance cryptographic security. In the key generation protocol, a key salt calculation process is agreed upon. After obtaining the security protocol package, specific fields such as the protocol header, timestamp, and serial number are obtained from the security protocol package according to the key salt calculation process recorded in the key generation protocol to calculate the first key salt. By introducing the first key salt, the randomness and uniqueness of the first key can be effectively increased, thereby improving the security of the key.

[0075] S1023. Generate a first key based on the data sending end device private key, the data receiving end device identification information, and the first key salt using an elliptic curve public key cryptography algorithm and a key exchange algorithm.

[0076] Specifically, elliptic curve public key cryptography algorithms include the SM2 algorithm, and key exchange algorithms include the ECDH (Elliptic Curve Diffie-Hellman) algorithm. The SM2 algorithm, a public key cryptography algorithm issued by the China National Cryptography Administration, is an asymmetric encryption algorithm based on elliptic curve cryptography, characterized by high security, wide application scenarios, strong anti-attack resistance, flexibility, and efficiency. Elliptic curve public key cryptography algorithms may also include international algorithms, such as the RSA algorithm, without specific limitations. The ECDH algorithm is a key exchange algorithm based on elliptic curve cryptography. It utilizes the mathematical properties of elliptic curves to enable two parties to negotiate a shared key for subsequent encrypted communications without sharing any secrets. Using the elliptic curve public key cryptography algorithm and key exchange algorithm, the first key can be calculated using the private key of the data sending device, the identification information of the data receiving device, and the first key salt as input parameters for key calculation. The identification information of the data receiving device is pre-stored at the data sending end and can be either the public key of the data receiving device or the ID information of the data receiving device, without specific limitations.

[0077] Through steps S1021 to S1023, the calculation of the first key can be realized. In the process of calculating the first key, the introduction of the first key salt can effectively increase the randomness and security of the first key, and provide effective protection for the security of the data; at the same time, the elliptic curve public key cryptography algorithm and the key exchange algorithm can be used to independently calculate the first key without interaction with the data receiving end, thereby realizing the generation of a non-interactive shared key, and providing a basis for the subsequent data receiving end to decrypt the data without interaction with the data sending end.

[0078] In some embodiments, the step of signing the first data using a private key of a data sending end device to obtain signed data includes:

[0079] Calculating a hash value of the first data using a hash algorithm to obtain a first hash value;

[0080] The first hash value is encrypted using the private key of the data sending end device to obtain the signature data.

[0081] Specifically, a hash algorithm is a one-way function used to map input data to an output of fixed length. Common hash algorithms include the MD5 (Message-Digest Algorithm 5) algorithm, the Secure Hash Algorithm (SHA) algorithm, and the Cyclic Redundancy Check (CRC32) algorithm. Using a hash algorithm to calculate a hash value from input data is easy, but deducing the input data from the hash value is computationally infeasible. Slight changes in the input data will cause significant changes in the output hash value. The irreversibility of the hash function makes it impossible to deducing the original data from the hash value. The same input data can generate the same hash value, while different input data will generate different hash values. Therefore, the first hash value corresponding to the first data is unique. When the first data is maliciously tampered with, even if the change is very slight, the calculated hash value will be different from the first hash value. This can verify whether the data has been tampered with, further improving the authenticity of the data.

[0082] In this application, the private key of the data sending device is the identity proof of the data sending end. It is used to encrypt the first hash value. On the one hand, it can realize the identity authentication of the data source and ensure that the data comes from a legitimate device; on the other hand, the first hash value can be used to verify whether the data has been tampered with during the transmission process, so that the authenticity, integrity and confidentiality of the data transmission are effectively guaranteed.

[0083] In some embodiments, transmitting the encrypted data, the signed data, and the security protocol packet to a data receiving end includes:

[0084] Packaging the encrypted data and the signed data to obtain an initial data packet;

[0085] Determining header information of a data packet based on the initial data packet;

[0086] Encapsulating the initial data packet and the packet header information to obtain a transmission data packet;

[0087] The transmission data packet and the security protocol packet are transmitted to a data receiving end.

[0088] Specifically, based on a secure transmission protocol pre-negotiated between the data sender and the data receiver, the encrypted data and the signed data packet are repackaged to form an initial data packet. On the one hand, the length and other information of the initial data packet have changed, so to ensure the correct transmission of the data packet, some information in the packet header needs to be updated. On the other hand, modifying certain fields in the packet header (such as the protocol type) can instruct the receiver how to process the data packet and ensure that the data packet can be correctly routed to the destination address. In addition, the packet header can be modified to hide some information of the original data packet, thereby improving the security of data transmission. Therefore, re-determining the packet header information based on the initial data packet can ensure the effective transmission of data and further improve data security. The packet header information can include the source IP address, the destination IP address data length, the protocol type, etc., without specific restrictions. In addition, a security message trailer can be added to the initial data packet to increase the security of data transmission.

[0089] For example, Figure 3 As shown, the original IP data packet includes an IP message header and IP message data; it can be determined that the packet header information includes the IP message header and security message header of the original IP data packet, and the content of the security message header can be the data length, protocol type, etc. determined based on the initial data packet, and a security message tail is added to form a transmission data packet with a [IP message header][security message header][initial data packet][security message tail] structure.

[0090] In some embodiments, the first data is power data. Power data is a series of data generated during the operation of the power system, including power production data, power consumption data, monitoring data, etc. During the operation of the power system, it is necessary to collect voltage, current, frequency and other data of power generation, transmission, distribution and other links in real time and quickly transmit them to the control center. If the delay is too high or the packet loss is serious, it may cause the control instruction to lag, causing accidents such as overload and power outage. If the data is tampered with (such as falsifying the equipment status), it may lead to misjudgment and wrong operation, such as wrongly disconnecting the normal line or ignoring the fault signal, threatening the security of the power grid; at the same time, the power system is also the core of the country's critical infrastructure, and its data security is directly related to the normal operation of national defense, transportation, medical care and other fields. Using the encrypted transmission method of the present application for power data transmission can effectively improve the security and real-time performance of power data transmission, thereby ensuring the stable operation of the power system.

[0091] Based on the same inventive concept, this application also provides another encryption transmission method, which is applied to the data receiving end, such as Figure 2 Shown, including:

[0092] S201, obtaining encrypted data, signature data and security protocol package sent by the data sending end;

[0093] Specifically, a data transmitter processes encrypted data, signed data, and a security protocol packet according to an encryption transmission method described in any of the aforementioned embodiments, and transmits the aforementioned data to a data receiver. After receiving the original IP data packet to be transmitted, the data transmitter obtains first data and second data based on the original IP data packet, generates a security protocol packet and a first encryption key using the second data according to a pre-negotiated key generation protocol, then encrypts the first data using the first key to obtain encrypted data, signs the first data using a private key of the data transmitter device to obtain signed data, and finally transmits the encrypted data, signed data, and security protocol packet to the data receiver, which then receives the aforementioned data.

[0094] S202: Generate a second key for decryption using the security protocol packet based on a key generation protocol pre-negotiated between the data sending end and the data receiving end;

[0095] Specifically, the key generation protocol is negotiated in advance between the data sending end and the data receiving end. The data receiving end can use the same algorithm as the data sending end, and use the data in the security protocol package sent by the data sending end to calculate a second key that can be decrypted to achieve decryption of the encrypted data.

[0096] S203, decrypting the encrypted data using the second key to obtain third data;

[0097] Specifically, after calculating the second key, the second key can be used to decrypt the received encrypted data to obtain the third data. If the encrypted data has not been tampered with, the third data is the first data to be encrypted and transmitted. If the encrypted data is tampered with by another party during the encrypted transmission, the third data is actually the tampered data. Therefore, to ensure the authenticity of the data, further signature verification is required.

[0098] S204: Perform signature verification based on the third data, the public key of the data sending end device, and the signature data;

[0099] Specifically, the public key of the data sending end device is stored in the data receiving end in advance. After the encrypted data is decrypted to obtain the third data, in order to verify the authenticity of the third data, the public key of the data sending end device and the signature data can be used to perform signature verification on the third data.

[0100] S205 . In response to the signature verification being successful, display the third data.

[0101] Specifically, when the signature verification passes, it means that the third data is the first data that originally needs to be encrypted and transmitted, and the third data is authentic, so the third data is passed to the application layer to be displayed to the user.

[0102] In the present application, through steps S201 to S205, at the data receiving end, a second key is generated through a key generation protocol pre-negotiated by the data sending end and the data receiving end to realize decryption of the encrypted data; then, the third data obtained by decryption is signed and verified through the public key and signature data of the data sending end device to realize verification of the identity of the data source, ensuring the credibility of the data source and the authenticity of the data; finally, the third data that has passed the signature verification is displayed to complete the encrypted transmission of the data; between the data sending end and the data receiving end, there is no transmission of keys involved, and the data receiving end independently calculates the second key for decryption based on the received security protocol package, which has higher data security. At the same time, the public key and signature data of the data sending end device are used to confirm the identity of the data sending end and verify the authenticity of the decrypted data, ensuring the credibility of the data source and the authenticity of the data, and the authenticity, integrity and confidentiality of the data transmission are effectively guaranteed; at the same time, the data receiving end does not need to shake hands and authenticate with the data sending end multiple times during the decryption process, which can effectively improve the real-time performance of data transmission, thereby realizing high security and efficient transmission of data.

[0103] In some embodiments, the step of generating the second key for decryption using the security protocol packet based on a key generation protocol pre-negotiated between the data sending end and the data receiving end includes:

[0104] generating a second key salt using the security protocol package;

[0105] The second key is generated based on the data receiving device private key, the data sending device identification information and the second key salt using an elliptic curve public key cryptography algorithm and a key exchange algorithm.

[0106] Specifically, at the data sending end, the first key salt is calculated using a security protocol package based on the steps pre-agreed upon in the key generation protocol. When the data receiving end receives the security protocol package, it parses the security protocol package and can obtain the same information as the data receiving end. The elliptic curve public key cryptography algorithm and key exchange algorithm are the same as those used by the data sending end to calculate the first key. When the input parameters are the same and the calculation steps are the same, the second key salt finally calculated should naturally be the same as the first key salt. In this way, the data receiving end can generate the same key salt as the data sending end without any key interaction with the data sending end, providing a basis for the subsequent calculated second key to achieve the smooth decryption of encrypted data. The data sending end device identification information is pre-stored at the data receiving end, which can be the data sending end device public key or the data sending end device ID information, without any specific restrictions.

[0107] For example, taking the sender S and the receiver R as an example, the generation process of the first key and the second key is as follows: Figure 4As shown. The sender S is the data sending end, which packages the second data to obtain a security protocol package, then generates a first key salt based on the security protocol package, and then generates a first key based on the data sending end device private key, the data receiving end device identification information and the first key salt. After being encrypted with the first key, it is encrypted and transmitted to the receiver R, which is the data receiving end. The receiver R parses the received security protocol package, calculates the second key salt based on the parsed data, and finally generates a second key based on the data receiving end device private key, the data sending end device identification information and the second key salt. In this way, the sender S and the receiver R can realize the generation of a shared key (i.e., the first key and the second key) without key interaction.

[0108] In some embodiments, the performing signature verification based on the third data, the public key of the data sending end device and the signature data includes:

[0109] Calculating a hash value of the third data using a hash algorithm to obtain a second hash value;

[0110] Decrypting the signature data using the public key of the data sending end device to obtain a third hash value;

[0111] The second hash value is compared with the third hash value to determine whether they are consistent. If they are consistent, the verification is successful; otherwise, the verification is failed.

[0112] Specifically, after decrypting the third data, the hash value of the third data is calculated using the same hash algorithm as the data sender. If the third data is the untampered first data, the calculated second hash value should be the same as the first hash value calculated by the data sender. If the third data is tampered with, the calculated second hash value will be different from the first hash value, thereby verifying the authenticity of the third data. Decrypting the signed data using the public key of the data sender's device can, on the one hand, authenticate the source of the data, and on the other hand, use the decrypted third hash value to verify the authenticity of the third data. When the signed data has not been tampered with, the third hash value is the same as the first hash value calculated by the data sender. Generally speaking, hash values are very difficult to tamper with, so the decrypted third hash value is the same as the first hash value. Even if the data is maliciously tampered with during data transmission, the authenticity of the data can be verified by comparing the third hash value with the second hash value. When the second hash value is consistent with the third hash value, it means that the third data corresponding to the second hash value and the third hash value are both real data that have not been tampered with; if the comparison is inconsistent, it means that at least one of the third data or the third hash value has been maliciously tampered with. Regardless of which one has been maliciously tampered with, the third data is no longer credible data, thereby further improving the authenticity of the data.

[0113] In some embodiments, in response to the signature verification failing, the third data is discarded. When the signature verification fails, it indicates that the third data is untrustworthy data that has been maliciously tampered with, and is then directly discarded.

[0114] Figure 5 This is a schematic diagram of a system structure that can implement the encryption transmission method of this application. Figure 5 As shown, the encrypted transmission method of the present application can be implemented through transparent bridge technology and firewall technology. Based on transparent bridge technology, data entering from the LAN (Local Area Network) port is forwarded through the WAN (Wide Area Network) port to achieve device stealth and transparent data transmission. Firewall technology is used to intercept data in and out of both directions, encrypt and decrypt data packets allowed to pass, and discard data packets not allowed to pass. Through a pre-negotiated key generation protocol based on identification keys (i.e., the private key of the data sending device and the private key of the data receiving device), the generation of non-interactive shared keys and secure data transmission are achieved, which can realize device identity authentication and encrypted data transmission.

[0115] Based on the same inventive concept, the present application also provides a satellite communication method, which is applied to a satellite communication system, wherein the satellite communication system includes a data transmitting end and a data receiving end, and the method includes:

[0116] The data sending end sends information to the data receiving end according to an encryption transmission method described in any one of the aforementioned embodiments;

[0117] The data receiving end processes the information sent by the data sending end according to an encryption transmission method described in any of the aforementioned embodiments.

[0118] In the existing satellite communication process, on the one hand, since satellite communication relies on specific frequency bands (such as C, Ku, and Ka bands), spectrum allocation is limited and requires international coordination. On the other hand, long-distance transmission causes serious signal attenuation, and the transmission rate needs to be reduced to ensure the signal-to-noise ratio. At the same time, the same satellite needs to serve a large number of terminals, and the bandwidth is dynamically allocated. Therefore, the user's available bandwidth is limited, and there are problems such as limited bandwidth and high latency. With the deepening of the construction of the power Internet of Things, the demand for communication bandwidth and real-time data transmission is increasing. The encrypted transmission method of the traditional satellite communication system is difficult to meet the high security and high real-time requirements required in the power data transmission process. Deploying the encrypted transmission method of the present application in a satellite communication system can effectively improve the security and real-time performance of data transmission.

[0119] Specifically, the satellite communication system includes a high-throughput satellite system. High-throughput satellites have higher communication capacity and lower transmission latency, and can meet the real-time transmission requirements of high-bandwidth, high-throughput data services such as high-definition video and high-quality images in the power production process, and better support the real-time data transmission requirements in the power Internet of Things. Therefore, the encryption transmission method of the present application can also be applied to high-throughput satellite communication systems to achieve two-way low-latency real-time encrypted transmission of high-throughput satellite communication data, which is of great significance for ensuring the security of power production data and improving the reliability and real-time performance of power communication systems. It is an important technical support for promoting the development of smart grids.

[0120] For example, Figure 6 As shown, when using a satellite communication system to transmit power data, the system includes a collection end and a service end. The collection end includes a power collection terminal and a terminal station, and the service end includes a master station. The terminal station and the master station are connected via a satellite network. Encryption modules are deployed on both the collection end and the service end, respectively. These modules serve as data transmitters and receivers, enabling data encryption and decryption. When the power collection end collects data from power equipment, the encryption module on the service end encrypts the collected power data to generate a corresponding transmission data packet and security protocol packet. These packets are then transmitted via the satellite network to the master station. Upon receiving the transmission data packet and security protocol packet, the master station decrypts them to obtain the original power data. The decrypted power data is then distributed to the corresponding user device via the intranet, achieving satellite-based encrypted transmission of power data. Optionally, the server includes a security gateway device based on an encryption module that can provide high-concurrency services; the encryption module supports RJ45 and RS485 interfaces and can be integrated with a satellite access terminal to achieve satellite terminal network access authentication and two-way encrypted communication of satellite communication data, quickly build a satellite communication encryption link, and achieve encrypted return of high-throughput communication data and secure issuance of business instructions.

[0121] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0122] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0123] Based on the same inventive concept, corresponding to any of the above embodiments and methods, this application also provides an encrypted transmission device. The encrypted transmission device can be used as a data sending end, refer to Figure 7 , the encrypted transmission device includes:

[0124] An acquisition module 701 is used to acquire first data and second data;

[0125] A first calculation module 702 is configured to generate a security protocol packet and a first encryption key using the second data based on a key generation protocol pre-negotiated between the data sending end and the data receiving end;

[0126] an encryption calculation module 703, configured to encrypt the first data using the first key to obtain encrypted data;

[0127] A signature module 704 is configured to sign the first data using a private key of a data sending end device to obtain signature data;

[0128] The sending module 705 is used to transmit the encrypted data, the signed data and the security protocol packet to a data receiving end.

[0129] In some embodiments, the first calculation module 702 includes:

[0130] a first packaging unit, configured to package the second data to obtain a security protocol package;

[0131] A first key salt calculation unit, configured to generate a first key salt using the security protocol package;

[0132] The first key calculation unit is used to generate a first key based on the private key of the data sending end device, the identification information of the data receiving end device and the first key salt by using the elliptic curve public key cryptography algorithm and the key exchange algorithm.

[0133] In some embodiments, the signature module 704 includes:

[0134] a first hash value calculation unit, configured to calculate a hash value of the first data using a hash algorithm to obtain a first hash value;

[0135] The signature unit is used to encrypt the first hash value using the private key of the data sending end device to obtain the signature data.

[0136] In some embodiments, the sending module 705 includes:

[0137] A second packaging unit is used to package the encrypted data and the signature data to obtain an initial data packet;

[0138] a packet header information confirmation unit, configured to determine packet header information of a data packet based on the initial data packet;

[0139] A third packet unit is used to encapsulate the initial data packet and the packet header information to obtain a transmission data packet;

[0140] The transmission unit is used to transmit the transmission data packet and the security protocol packet to a data receiving end.

[0141] In some embodiments, the first data is power data.

[0142] Based on the same inventive concept, corresponding to any of the above embodiments and methods, this application also provides another encryption transmission device. The encryption transmission device can be used as a data receiving end, refer to Figure 8 , the encrypted transmission device includes:

[0143] Receiving module 801, used to obtain encrypted data, signature data and security protocol packets sent by the data sending end;

[0144] A second calculation module 802 is configured to generate a second key for decryption using the security protocol packet based on a key generation protocol pre-negotiated between the data sending end and the data receiving end;

[0145] a decryption calculation module 803, configured to decrypt the encrypted data using the second key to obtain third data;

[0146] a signature verification module 804 for performing signature verification based on the third data, the public key of the data sending end device, and the signature data;

[0147] The response module 805 is configured to display the third data in response to the signature verification being successful.

[0148] In some embodiments, the second calculation module 802 includes:

[0149] A second key salt calculation unit, configured to generate a second key salt using the security protocol package;

[0150] The second key calculation unit is used to generate a second key based on the data receiving end device private key, the data sending end device identification information and the second key salt by using the elliptic curve public key cryptography algorithm and the key exchange algorithm.

[0151] In some embodiments, the signature verification module 804 includes:

[0152] A second hash value calculation unit, configured to calculate a hash value of the third data using a hash algorithm to obtain a second hash value;

[0153] a decryption unit, configured to decrypt the signature data using the public key of the data sending end device to obtain a third hash value;

[0154] The verification unit is used to compare the second hash value with the third hash value to see if they are consistent. If they are consistent, the verification is passed; otherwise, the verification is failed.

[0155] In some embodiments, the response module 805 is further configured to:

[0156] In response to the signature verification failing, the third data is discarded.

[0157] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0158] The apparatus of the above embodiment is used to implement the corresponding encrypted transmission method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0159] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, the encryption transmission method described in any of the above embodiments is implemented.

[0160] Figure 9 10 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0161] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0162] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0163] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0164] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0165] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0166] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0167] The electronic device of the above embodiment is used to implement the corresponding encryption transmission method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0168] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the encryption transmission method described in any of the above embodiments.

[0169] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0170] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the encryption transmission method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0171] Based on the same concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a computer program product, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the encryption transmission method described in any of the above embodiments, which has the beneficial effects of the corresponding method embodiments and will not be repeated here.

[0172] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0173] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operation of the disclosed technical solution based on the prompt message.

[0174] As an optional but non-limiting implementation, in response to a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0175] It is understandable that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0176] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application is limited to these examples. In line with the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0177] In addition, for simplicity of description and discussion, and in order not to make the embodiment of the application difficult to understand, the known power supply / ground connection with integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the application difficult to understand, and this also takes into account the following fact, that is, the details of the embodiment of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuit) are set forth to describe exemplary embodiments of the application, it will be apparent to those skilled in the art that the embodiment of the application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0178] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0179] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the present application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. An encrypted transmission method, characterized in that: Applied to the data sending end, including: Acquiring first data and second data; Based on a key generation protocol pre-negotiated between the data sending end and the data receiving end, generating a security protocol packet and a first key for encryption using the second data; encrypting the first data using the first key to obtain encrypted data; Signing the first data using a private key of a data sending end device to obtain signed data; The encrypted data, the signed data and the security protocol packet are transmitted to a data receiving end.

2. The encrypted transmission method according to claim 1, wherein: The method of generating a security protocol packet and a first encryption key using the second data based on a key generation protocol pre-negotiated between a data sending end and a data receiving end includes: Packaging the second data to obtain a security protocol packet; generating a first key salt using the security protocol package; An elliptic curve public key cryptography algorithm and a key exchange algorithm are used to generate a first key based on the private key of the data sending end device, the identification information of the data receiving end device and the first key salt.

3. The encrypted transmission method according to claim 1, wherein: The step of signing the first data using the private key of the data sending end device to obtain the signed data includes: Calculating a hash value of the first data using a hash algorithm to obtain a first hash value; The first hash value is encrypted using the private key of the data sending end device to obtain the signature data.

4. The encrypted transmission method according to claim 1, wherein: The transmitting the encrypted data, the signed data and the security protocol packet to the data receiving end includes: Packaging the encrypted data and the signed data to obtain an initial data packet; Determining header information of a data packet based on the initial data packet; Encapsulating the initial data packet and the packet header information to obtain a transmission data packet; The transmission data packet and the security protocol packet are transmitted to a data receiving end.

5. The encryption transmission method according to claim 1, wherein: The first data is power data.

6. An encrypted transmission method, characterized in that: Applied to the data receiving end, including: Obtain the encrypted data, signature data and security protocol package sent by the data sender; Based on a key generation protocol pre-negotiated between the data sending end and the data receiving end, generating a second key for decryption using the security protocol packet; decrypting the encrypted data using the second key to obtain third data; Performing signature verification based on the third data, the public key of the data sending end device and the signature data; In response to the signature verification being successful, the third data is displayed.

7. The encrypted transmission method according to claim 6, wherein: The method of generating a second key for decryption using the security protocol packet based on a key generation protocol pre-negotiated between the data sending end and the data receiving end includes: generating a second key salt using the security protocol package; The second key is generated based on the data receiving device private key, the data sending device identification information and the second key salt using an elliptic curve public key cryptography algorithm and a key exchange algorithm.

8. The encrypted transmission method according to claim 6, wherein: The performing signature verification based on the third data, the public key of the data sending end device and the signature data includes: Calculating a hash value of the third data using a hash algorithm to obtain a second hash value; Decrypting the signature data using the public key of the data sending end device to obtain a third hash value; The second hash value is compared with the third hash value to determine whether they are consistent. If they are consistent, the verification is successful; otherwise, the verification is failed.

9. The encrypted transmission method according to claim 6, wherein: In response to the signature verification failing, the third data is discarded.

10. A satellite communication method, characterized in that: Applied to a satellite communication system, the satellite communication system includes a data sending end and a data receiving end, and the method includes: The data sending end sends information to the data receiving end according to the encryption transmission method according to any one of claims 1 to 5; The data receiving end processes the information sent by the data sending end according to the encryption transmission method according to any one of claims 6 to 9.

Images