Data transmission method and system

Abstract

The embodiment of the invention provides a data transmission method and system, and the data transmission method is applied to a client, and comprises the steps: obtaining an encrypted communication key sent by a server; the encrypted communication key is decrypted to obtain a target communication key, and the target communication key is a dynamic key generated by the server based on a key generation condition; encrypting the target transmission data by using the target communication key to obtain target encrypted data; and sending the target encrypted data to the server, so that the server decrypts the target encrypted data based on the target communication key to obtain target transmission data. As the target communication key is dynamically generated by the server side according to the key generation condition, different keys may be used in different data transmission processes, the security risk caused by leakage of a fixed key is effectively prevented, even if an attacker intercepts the key of a certain time of communication, the key cannot be used for all subsequent data transmission, and the security risk is effectively prevented. And the security of data transmission is obviously improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification relate to the technical field of data transmission, and in particular to a data transmission method and system. BACKGROUND

[0002] With the rapid development of information technology, the security of data communication is increasingly concerned. In various network application scenarios, such as instant messaging, online payment, enterprise collaborative office, etc., data is vulnerable to eavesdropping, tampering and replay attacks during transmission. Therefore, using encryption technology to protect the transmission data has become an important means to ensure information security.

[0003] At present, a fixed key encryption scheme is usually used to encrypt the transmission data. However, with the continuous evolution of network security threats, the security problem of the fixed key encryption scheme in actual application gradually appears. Once the fixed key is leaked, the communication security of the entire system will be seriously threatened. Therefore, a data transmission scheme with higher security is urgently needed. SUMMARY

[0004] Therefore, the embodiments of the present specification provide two data transmission methods. One or more embodiments of the present specification simultaneously relate to two data transmission devices, a data transmission system, a computing device, a computer readable storage medium and a computer program product to solve the technical defects existing in the prior art.

[0005] According to a first aspect of the embodiments of the present specification, a data transmission method is provided, applied to a client, comprising: obtaining an encrypted communication key sent by a server; decrypting the encrypted communication key to obtain a target communication key, wherein the target communication key is a dynamic key generated by the server based on a key generation condition; encrypting target transmission data using the target communication key to obtain target encrypted data; sending the target encrypted data to the server, so that the server decrypts the target encrypted data based on the target communication key to obtain the target transmission data.

[0006] According to a second aspect of the embodiments of the present specification, a data transmission method is provided, applied to a server, comprising: generating a key based on a key generation condition to obtain a target communication key, wherein the target communication key is a dynamic key; encrypting the target communication key to obtain an encrypted communication key; sending the encrypted communication key to the client, so that the client encrypts target transmission data based on the encrypted communication key to obtain target encrypted data.

[0007] According to a third aspect of the embodiments of the present specification, a data transmission apparatus applied to a client is provided, comprising: an obtaining module configured to obtain an encrypted communication key sent by a server; a decryption module configured to decrypt the encrypted communication key to obtain a target communication key, wherein the target communication key is a dynamic key generated by the server based on a key generation condition; a first encryption module configured to encrypt target transmission data by using the target communication key to obtain target encrypted data; a first sending module configured to send the target encrypted data to the server, so that the server decrypts the target encrypted data based on the target communication key to obtain the target transmission data.

[0008] According to a fourth aspect of the embodiments of the present specification, a data transmission apparatus applied to a server is provided, comprising: a generation module configured to generate a key based on a key generation condition to obtain a target communication key, wherein the target communication key is a dynamic key; a second encryption module configured to encrypt the target communication key to obtain an encrypted communication key; a second sending module configured to send the encrypted communication key to the client, so that the client encrypts target transmission data based on the encrypted communication key to obtain target encrypted data.

[0009] According to a fifth aspect of the embodiments of the present specification, a data transmission system is provided, comprising a client and a server; the server is configured to generate a key based on a key generation condition to obtain a target communication key, wherein the target communication key is a dynamic key; encrypt the target communication key to obtain an encrypted communication key; and send the encrypted communication key to the client; the client is configured to obtain the encrypted communication key; decrypt the encrypted communication key to obtain the target communication key; encrypt target transmission data by using the target communication key to obtain target encrypted data; and send the target encrypted data to the server; the server is further configured to decrypt the target encrypted data based on the target communication key to obtain the target transmission data.

[0010] According to a sixth aspect of the embodiments of the present specification, a computing device is provided, comprising: a memory and a processor; the memory is configured to store computer programs / instructions, and the processor is configured to execute the computer programs / instructions, and the computer programs / instructions, when executed by the processor, implement the steps of the method provided in the first aspect or the second aspect.

[0011] According to a seventh aspect of the embodiments of the present specification, a computer readable storage medium is provided, which stores computer programs / instructions, which, when executed by a processor, implement the steps of the method provided in the first aspect or the second aspect.

[0012] According to an eighth aspect of the embodiments of the present specification, a computer program product is provided, which includes computer programs / instructions, which, when executed by a processor, implement the steps of the method provided in the first aspect or the second aspect.

[0013] The data transmission method provided in the present specification is applied to a client and includes: obtaining an encrypted communication key sent by a server; decrypting the encrypted communication key to obtain a target communication key, wherein the target communication key is a dynamic key generated by the server based on a key generation condition; encrypting target transmission data using the target communication key to obtain target encrypted data; and sending the target encrypted data to the server, so that the server decrypts the target encrypted data based on the target communication key to obtain the target transmission data. The server sends the encrypted communication key to the client, ensuring the confidentiality and integrity of the target communication key and preventing the target communication key from being illegally obtained or tampered with. Since the target communication key is dynamically generated by the server according to the key generation condition, different keys can be used in different data transmission processes, effectively preventing security risks caused by leakage of fixed keys. Even if an attacker intercepts the key of a certain communication, it cannot be used for subsequent data transmission, significantly improving the security of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 is a flow timing diagram of a data transmission method; Figure 2 is a flow chart of a data transmission method provided in an embodiment of the present specification; Figure 3 is a flow chart of another data transmission method provided in an embodiment of the present specification; Figure 4 is an architectural diagram of a data transmission system provided in an embodiment of the present specification; Figure 5 is a flow timing diagram of a data transmission method provided in an embodiment of the present specification; Figure 6 is a structural schematic diagram of a data transmission device provided in an embodiment of the present specification; Figure 7 is a structural schematic diagram of another data transmission device provided in an embodiment of the present specification; Figure 8 is a structural block diagram of a computing device provided in an embodiment of the present specification. Detailed Implementation

[0015] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0016] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. The term “at least one” as used in one or more embodiments of this specification means “one or more,” and “a plurality of” means “two or more.” The term “comprising” is an open-ended description and should be understood as “including but not limiting,” and may include other content in addition to what has been described.

[0017] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0018] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0019] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0020] Instant Messaging (IM) is an online communication method that enables real-time text communication over the internet. Users can send and receive messages through IM clients, achieving instant two-way communication. In addition to basic text chat functions, IM tools also support voice calls, video conferencing, file transfer, screen sharing, and many other features.

[0021] IM client: refers to the software or application that users use to send and receive instant messages. It can be installed on various devices, such as smartphones, tablets, or computers.

[0022] IM Server: This is the core system running on the server, a software component responsible for managing key functions such as user connections, message passing, user status synchronization, and data storage.

[0023] .so files are shared object files in Linux systems. These shared libraries contain code and data that can be shared among multiple programs, existing in a format that can be loaded into memory at runtime. By using shared libraries, multiple applications can utilize the code in the library simultaneously without each program having its own copy, which helps save system resources and simplify the software update process.

[0024] Plaintext: This refers to information or data that has not undergone any encryption. It is in its raw, directly readable and understandable form, regardless of whether the information was generated directly by humans or by computers. For example, the content of an email, an instant messaging message, or the text in a file is plaintext before encryption.

[0025] Ciphertext is the result of encrypting plaintext using an encryption algorithm. Ciphertext is unreadable unless converted back to plaintext using the correct decryption method or key. The purpose of ciphertext is to protect data from unauthorized access and understanding by third parties, ensuring the security of information during transmission.

[0026] Symmetric encryption algorithms are encryption techniques that use the same key for both encrypting and decrypting data. This means that the sender and receiver must share the same key, which is used to convert plaintext into ciphertext (encryption) and to restore received ciphertext to plaintext (decryption). Symmetric encryption algorithms are widely used in scenarios requiring rapid processing of large amounts of data due to their efficiency. Symmetric encryption algorithms include, but are not limited to, Advanced Encryption Standard (AES), Data Encryption Standard (DES), and Triple DES (3DES).

[0027] Hardware Security Module (HSM): A hardware security module is a physical device specifically designed to protect and manage digital keys and provide a secure environment for strong authentication and encryption. HSMs are typically connected to servers or networks as plug-in cards or external devices, and their primary purpose is to enhance the security of applications and systems.

[0028] A network (IP, Internet Protocol) address is a digital label assigned to each device connected to a computer network that uses the Internet Protocol for communication. IP addresses are used to uniquely identify a device within a network and allow data transfer between devices.

[0029] User authentication credentials (token): A digital token used to verify a user's identity. When a user logs into the client, the server generates a token and returns it to the client. In subsequent requests, the client sends this token to the server as part of the authentication process.

[0030] Taking data transmission in instant messaging scenarios as an example, encrypting instant messaging messages during network transmission is crucial. Encryption ensures that only the communicating parties can read the content of instant messaging messages, preventing the leakage of personal privacy, such as sensitive information like chat logs, photos, and videos, from being accessed by unauthorized third parties. In insecure network environments such as public wireless networks, encryption can prevent attackers from stealing instant messaging messages through man-in-the-middle attacks, ensuring communication security. Many countries and regions have laws and regulations requiring communication service providers to protect user data privacy, and encryption is an important means of meeting these legal requirements. Even if instant messaging messages are intercepted, the content cannot be decrypted without the key, thus effectively preventing unauthorized access. Encryption not only protects the content of instant messaging messages but also protects communication metadata, such as communication time, frequency, and recipients, preventing it from being used to analyze user behavior. Encryption also enhances users' trust in the service, letting them know that their communications are protected and their privacy is respected.

[0031] Fixed-key encryption is a traditional encryption method whose core characteristic is the use of the same key for both encryption and decryption. Fixed-key encryption is typically based on symmetric encryption algorithms, and the same fixed key is used for both encryption and decryption. The fixed key is generated during system initialization and remains unchanged throughout its lifecycle. The fixed key is usually managed through a secure channel (such as an HSM). See also Figure 1 , Figure 1 A flow chart of a data transmission method is shown, in which the server and client interact with each other during data transmission. Client: Encrypts plaintext using a fixed key to obtain ciphertext; sends the ciphertext to the server; Server-side: Use a fixed key to decrypt the ciphertext to obtain the plaintext; Server-side: Encrypt plaintext using a fixed key to obtain ciphertext; send the ciphertext to the client; Client: Uses a fixed key to decrypt the ciphertext to obtain the plaintext.

[0032] However, fixed-key encryption schemes have the following drawbacks: **Key cracking risk:** Crackers can obtain the key by decompiling the client code, thereby gaining access to server data. **Version compatibility issues:** If the key is leaked, the client must update synchronously once the server updates the key; otherwise, the old and new versions will be incompatible. **Data security issues:** If the key is leaked and the server does not update the key, the client's data is insecure. **Difficulty in key replacement:** Once the key is fixed, if it is leaked, the data encryption cannot be changed in real time.

[0033] Based on this, the embodiments of this specification propose a dynamic key encryption scheme, the core feature of which is that the client and server use dynamically generated keys for encryption and decryption during communication. The dynamic key encryption scheme significantly improves data security during network transmission by continuously updating the key. Specifically, the client obtains the encrypted communication key sent by the server; decrypts the encrypted communication key to obtain the target communication key, wherein the target communication key is a dynamic key generated by the server based on key generation conditions; uses the target communication key to encrypt the target transmitted data to obtain the target encrypted data; and sends the target encrypted data to the server, so that the server can decrypt the target encrypted data based on the target communication key to obtain the target transmitted data.

[0034] This specification provides two data transmission methods, and also relates to two data transmission devices, a data transmission system, a computing device, a computer-readable storage medium, and a computer program product, which will be described in detail in the following embodiments.

[0035] See Figure 2 , Figure 2This specification illustrates a flowchart of a data transmission method according to an embodiment of the present invention. The method is applied to a client and specifically includes the following steps: Step 202: Obtain the encrypted communication key sent by the server.

[0036] It should be noted that a client refers to a terminal device or application that initiates a communication request and participates in data interaction. It is responsible for receiving the encrypted communication key issued by the server, decrypting it to obtain the target communication key, and then using the target communication key to encrypt local data before sending it back to the server. Clients can be used in different scenarios, such as IM clients.

[0037] The server is the core computing node that provides communication services. It is responsible for generating the target communication key, distributing the encrypted communication key, receiving encrypted data sent by the client, and decrypting and processing data based on the same target communication key. The server can be used in different scenarios, such as an IM server.

[0038] An encrypted communication key is a key obtained by encrypting the generated target communication key using an encryption algorithm on the server side. It is used to securely transmit the dynamically generated target communication key to the client. The encrypted communication key itself is protected; only the client with the corresponding decryption capabilities can obtain the target communication key.

[0039] In practical applications, there are multiple ways to obtain the encrypted communication key sent by the server. The specific method is chosen based on the actual situation, and this specification does not limit the methods used in this embodiment. In one possible implementation, the client actively requests the key: the client actively sends a key acquisition request to the server. After receiving the request, the server generates a new target communication key, encrypts it to obtain the encrypted communication key, and sends the encrypted communication key to the client. In another possible implementation, the server actively pushes the key: the server periodically or irregularly generates a new target communication key, encrypts it to obtain the encrypted communication key, and actively pushes the encrypted communication key to the client. Even if the client does not actively request it, this ensures that the original communication key stored on the client is periodically changed, preventing data security issues caused by key leakage.

[0040] In one optional embodiment of this specification, the process of the client requesting a key update is described, that is, obtaining the encrypted communication key sent by the server may include the following steps: Send a key acquisition request to the server; Receive the encrypted communication key sent by the server in response to the key acquisition request.

[0041] It should be noted that a key acquisition request is a communication request initiated by the client to the server to request the encrypted communication key required for the current communication. This request may include parameters such as authentication information, device identifier, and session context, allowing the server to verify the client's legitimacy and determine whether to return the encrypted communication key to the client. The key acquisition request can be an unencrypted initial acquisition request or an encrypted acquisition request obtained by encrypting the initial acquisition request; the choice depends on the specific circumstances, and this specification does not impose any limitations on this approach.

[0042] In practical applications, there are various ways for a client to send a key acquisition request to the server, and the specific method chosen depends on the actual situation. This specification does not impose any limitations on these methods in the embodiments. In one possible implementation, the client can send a key acquisition request to the server after each successful connection creation and login. In another possible implementation, the client can send a key acquisition request to the server as needed, such as periodically.

[0043] By applying the solution in the embodiments of this specification, the client actively requests to obtain the key, thereby ensuring timely key updates, reducing the risk of key cracking, and improving communication security.

[0044] In one optional embodiment of this specification, the key acquisition request is an encryption acquisition request; sending the key acquisition request to the server may include the following steps: Based on the client's client identifier and current timestamp, the initial retrieval request is encrypted to obtain an encrypted retrieval request, which is then sent to the server; or, Based on the client identifier, current timestamp, and original communication key, the initial retrieval request is encrypted to obtain an encrypted retrieval request, which is then sent to the server.

[0045] It's important to note that client identifiers are information that uniquely identifies the client, such as device serial numbers, user identifiers (IDs), etc. The current timestamp refers to the time the client initiated the request, typically accurate to the second or millisecond, used to ensure the timeliness of the request and prevent replay attacks. The timestamp can be used as a dynamic parameter in the encryption process to enhance security. The initial retrieval request refers to the basic request generated by the client in its unencrypted state, used to request the key from the server.

[0046] An encrypted retrieval request is a request obtained by encrypting the initial retrieval request using an encryption algorithm. The encryption algorithms used to encrypt the initial retrieval request include, but are not limited to, symmetric encryption algorithms, asymmetric encryption algorithms, hybrid encryption algorithms, etc., and the specific algorithm is selected based on the actual situation. This specification does not impose any limitations on this aspect in the embodiments.

[0047] The original communication key is the communication key currently stored by the client, such as the communication key issued to the client by the server during the initial communication or session establishment. The original communication key has a certain lifespan and can be updated and replaced when needed. If the client currently stores the original communication key, the key retrieval request can be regarded as a key update request, that is, requesting a new key from the server to update the original communication key.

[0048] By applying the scheme of the embodiments in this specification, the client encrypts the initial acquisition request by using the client identifier and the current timestamp, or by further combining it with the original communication key, to generate an encrypted acquisition request, and sends it to the server. This can effectively improve the anti-tampering capability and anti-replay attack capability of the request, and ensure the security and controllability of the communication process.

[0049] Step 204: Decrypt the encrypted communication key to obtain the target communication key, wherein the target communication key is a dynamic key generated by the server based on the key generation conditions.

[0050] It should be noted that after receiving the encrypted communication key from the server, the client can decrypt the encrypted communication key to obtain a new target communication key, and use the target communication key to encrypt data in subsequent communications.

[0051] The target communication key is a communication key dynamically generated by the server according to preset key generation conditions, used for data encryption and decryption operations in the current communication session. The target communication key is time-sensitive, unique, and dynamic, aiming to enhance communication security. A dynamic key refers to a key with a limited lifespan and is not fixed. Unlike traditional static keys, dynamic keys may change for each communication, which can greatly improve system security and resistance to attacks.

[0052] Key generation conditions are a set of parameters or rules used by the server to generate the target communication key. Key generation conditions ensure the uniqueness and unpredictability of each generated target communication key, thereby enhancing system security. Key generation conditions include, but are not limited to, key generation conditions based on communication time, key generation conditions based on security assessment information, and key generation conditions based on geographical location. The specific choice depends on the actual situation, and this specification does not impose any limitations on these selections in the embodiments.

[0053] In one optional embodiment of this specification, the above-described decryption of the encrypted communication key to obtain the target communication key may include the following steps: Based on the client's client identifier and current timestamp, the encrypted communication key is decrypted to obtain the target communication key; or, Based on the client identifier, current timestamp, and original communication key, the encrypted communication key is decrypted to obtain the target communication key.

[0054] It should be noted that if the client stores the original communication key, it can decrypt the encrypted communication key based on the original communication key. The information referenced when decrypting the encrypted communication key is the same as the information referenced by the server when encrypting the target communication key. If the encrypted communication key is obtained by the server encrypting the target communication key based on the client's client identifier and current timestamp, the client can decrypt the encrypted communication key using the client identifier and current timestamp to obtain the target communication key. If the encrypted communication key is obtained by the server encrypting the target communication key based on the client identifier, current timestamp, and the original communication key, the client can decrypt the encrypted communication key using the client identifier, current timestamp, and original communication key to obtain the target communication key.

[0055] By applying the scheme of the embodiments of this specification, the client can decrypt the encrypted communication key by using the client identifier and the current timestamp, or by further combining the original communication key, to obtain the target communication key. The target communication key can be accurately obtained and then used for data encryption in subsequent communications.

[0056] Step 206: Use the target communication key to encrypt the target transmitted data to obtain the target encrypted data.

[0057] It should be noted that the target data to be transmitted is the actual project data that the client needs to send to the server over the network. The target data can be data from different scenarios, such as instant messaging messages in an instant messaging scenario, transaction data in an online payment scenario, game data in a gaming scenario, and so on. The target data must be encrypted before transmission to ensure its confidentiality and integrity.

[0058] Target encrypted data is the result of the client encrypting the target's transmitted data using the target's communication key. Target encrypted data cannot be read or tampered with by a third party until it is correctly decrypted, thus protecting the security of the target's transmitted data during network transmission.

[0059] In practical applications, the encryption algorithm used to encrypt the target transmitted data can be a symmetric encryption algorithm, allowing the server to directly decrypt the encrypted data using the target communication key. For example, AES can be used for data encryption, ensuring high efficiency in both encryption and decryption. When encrypting the target transmitted data using the target communication key, all data packets (including message headers and bodies) can be encrypted with AES, ensuring comprehensive data security. Even if the target communication key is leaked, attackers will find it difficult to decrypt the data because the data packets are fully encrypted. During encryption, the target transmitted data can be divided into blocks (such as 128-bit blocks using AES), resulting in multiple data blocks. Each data block can then be encrypted using the target communication key and the encryption algorithm to obtain the target encrypted data.

[0060] Furthermore, using the target communication key, the target transmitted data can be encrypted in various ways to obtain the encrypted target data. The specific method chosen depends on the actual situation, and this specification does not limit the specific method used in the embodiments. In one possible implementation, the encryption algorithm is integrated with the client code, allowing direct encryption of the target transmitted data using the target communication key based on the encryption algorithm, thus obtaining the encrypted target data. In another possible implementation, the encryption algorithm is separated from the client code. To prevent attackers from obtaining the target communication key by decompiling the client code, the encryption algorithm can be packaged into a .so file (dynamic link library) and used as a plugin.

[0061] In one optional embodiment of this specification, the case where the encryption algorithm is packaged into a .so file and used as a plugin is described. That is, the above-mentioned method of encrypting the target transmitted data using the target communication key to obtain the target encrypted data may include the following steps: Invoke the encryption algorithm plugin to obtain the target encryption algorithm. By using the target communication key and the target encryption algorithm, the target transmitted data is encrypted to obtain the target encrypted data.

[0062] It's important to note that the encryption algorithm plugin is a modular component that encapsulates a specific target encryption algorithm, allowing the client to dynamically load and invoke it at runtime. This plugin makes the target encryption algorithm independent of the client code, facilitating timely maintenance, updates, and enhanced security. The target encryption algorithm is the encryption algorithm logic encapsulated within the encryption algorithm plugin, such as a symmetric encryption algorithm.

[0063] By applying the scheme of the embodiments in this specification, the encryption algorithm is encapsulated into a .so file and used as an encryption algorithm plugin, ensuring that the encryption algorithm is separated from the client code. In this way, even if the client code is decompiled, it is difficult for attackers to obtain the specific implementation of the encryption algorithm and the target communication key. This not only ensures the security of the encryption process, but also facilitates the updating and maintenance of the encryption algorithm. This allows the system to flexibly adapt to different platforms and algorithm requirements, making it suitable for application scenarios with high data security requirements, such as financial payment, instant messaging, digital rights protection, etc., thereby improving the system's flexibility and scalability.

[0064] Step 208: Send the target encrypted data to the server so that the server can decrypt the target encrypted data based on the target communication key to obtain the target transmitted data.

[0065] It should be noted that when the server decrypts the target encrypted data based on the target communication key, it can divide the target encrypted data into blocks (such as 128-bit blocks of AES) to obtain multiple encrypted data blocks. Then, it can use the target communication key and the decryption algorithm corresponding to the encryption algorithm to decrypt each encrypted data block and obtain the target transmitted data.

[0066] When applying the scheme of the embodiments in this specification, the client can obtain the target communication key by actively pushing it from the server or actively pulling it from the client, thus making it applicable to different data transmission scenarios and making the data transmission process more flexible. During the communication process, the client and the server use dynamically generated target communication keys for encryption and decryption, realizing regular key updates and reducing the risk of key cracking. Even if the key is leaked, due to the dynamic updates of the key, it is difficult for attackers to use the leaked key to decrypt a large amount of data, ensuring the security and privacy of data during network transmission.

[0067] See Figure 3 , Figure 3 This specification illustrates a flowchart of another data transmission method provided in one embodiment. This method is applied to a server and specifically includes the following steps: Step 302: Generate a key based on the key generation conditions to obtain the target communication key, wherein the target communication key is a dynamic key.

[0068] In practical applications, the server generates a key based on key generation conditions. There are multiple ways to obtain the target communication key, and the specific method chosen depends on the actual situation. This specification does not limit the specific method used in the embodiments. In one possible implementation, the server can actively generate a key based on key generation conditions to obtain the target communication key. In another possible implementation, the server can respond to a key acquisition request actively sent by the client, generate a key based on key generation conditions, and obtain the target communication key. In this case, if the key acquisition request is an encrypted acquisition request, the server can decrypt the encrypted acquisition request based on the client's identifier and current timestamp; or, it can decrypt the encrypted acquisition request based on the client identifier, current timestamp, and the original communication key. Further, after decryption, the server generates a key based on the key generation conditions to obtain the target communication key.

[0069] In one optional embodiment of this specification, the server can generate a key if the key generation conditions are met. That is, the key generation based on the key generation conditions to obtain the target communication key may include the following steps: Obtain the communication time with the client, and if the communication time meets the key generation conditions, generate the target communication key; or, Obtain the client's security assessment information, and generate the target communication key if the security assessment information meets the key generation conditions.

[0070] It should be noted that communication time refers to the time of the most recent data transmission between the client and the server, and is usually expressed as a timestamp. Key generation can be triggered when the communication time is more than a preset time threshold from the current time.

[0071] Security assessment information refers to data used to evaluate the security status of a client. This information includes, but is not limited to, the trustworthiness of the client's operating environment, the client's security level, and whether the client has engaged in malicious behavior. Key generation can occur when client security is low. Low client security indicates that the original communication key stored on the client may have been leaked; therefore, the key can be proactively updated, i.e., a new encrypted communication key can be generated and sent to the client. Alternatively, key generation can occur when client security is high, thereby preventing insecure clients from participating in the communication.

[0072] By applying the scheme of the embodiments in this specification, before the server generates the target communication key, it determines whether the communication time meets the key generation conditions or whether the client's security assessment information meets the key generation conditions. This realizes dynamic control of the key generation process, effectively prevents frequent or invalid key generation, improves the overall security and controllability of the system, and ensures the confidentiality and integrity of data communication. It is suitable for application scenarios with high security requirements.

[0073] Step 304: Encrypt the target communication key to obtain the encrypted communication key.

[0074] In one optional embodiment of this specification, encrypting the target communication key to obtain the encrypted communication key may include the following steps: Based on the client's client identifier and the current timestamp, the target communication key is encrypted to obtain the encrypted communication key; or, The target communication key is encrypted based on the client identifier, the current timestamp, and the original communication key to obtain the encrypted communication key.

[0075] It should be noted that if the server has not sent the original communication key to the client before, that is, this is the first key exchange with the client, it means that the client does not store the original communication key. In this case, the target communication key can be encrypted based on the client's client identifier and the current timestamp to obtain the encrypted communication key.

[0076] If the server has previously sent the original communication key to the client, meaning this is not the first key exchange with the client, it means that the client has stored the original communication key. In this case, the target communication key can be encrypted based on the client identifier, the current timestamp, and the original communication key to obtain the encrypted communication key.

[0077] By applying the scheme of the embodiments in this specification, the server encrypts the target communication key by using the client identifier and the current timestamp, or by further combining it with the original communication key, to obtain the encrypted communication key. This achieves flexible encryption based on the actual situation, which not only improves the flexibility of encryption but also enhances the security of the target communication key.

[0078] Step 306: Send the encryption communication key to the client so that the client can encrypt the target transmitted data based on the encryption communication key to obtain the target encrypted data.

[0079] In practical applications, there are various ways to send the encrypted communication key to the client, and the specific method chosen depends on the actual situation. This specification does not impose any limitations on this method. In one possible implementation, the server actively pushes the key: the server actively pushes the encrypted communication key to the client. Even if the client does not actively request it, this ensures that the original communication key stored on the client is periodically changed, preventing data security issues caused by key leakage. In another possible implementation, the server responds to the client's key acquisition request by providing the key: the client actively sends a key acquisition request to the server. After receiving the request, the server generates a new target communication key, encrypts it to obtain the encrypted communication key, and sends the encrypted communication key to the client.

[0080] In one optional embodiment of this specification, after the server sends the encrypted communication key to the client, it can bind the target communication key to the client. This allows the server to accurately determine the target communication key corresponding to the target encrypted data upon receiving the target encrypted data from the client, and then decrypt the target encrypted data based on the target communication key to obtain the target transmitted data. Therefore, the server can accurately decrypt target encrypted data sent by different clients even when interacting with multiple clients simultaneously.

[0081] By applying the scheme of the embodiments in this specification, the server dynamically generates the target communication key based on the key generation conditions, encrypts it into an encrypted communication key, and sends it to the client. This enables the client to encrypt the target transmitted data based on the target communication key to form the target encrypted data, thereby realizing the dynamic generation and secure distribution of the key and significantly improving the security and anti-attack capability of the data transmission process.

[0082] In one optional embodiment of this specification, the server may interact with multiple clients and can accurately send the encrypted communication key to the client based on the client's login information. That is, sending the encrypted communication key to the client may include the following steps: In response to a key retrieval request sent by the client, obtain the client's login information; Based on the login information, the encrypted communication key is sent to the client.

[0083] It should be noted that login information refers to a series of identity and status data recorded and managed by the server when a user authenticates and successfully logs in through the client. Login information includes, but is not limited to, user ID, login time, login IP address, login device information, and session token. Through login information, the server can identify the client's identity, bind the server address, perform access control, and distribute keys.

[0084] In practical applications, after receiving a key acquisition request, the server can encrypt the login information and bind the user ID, the login server address, and other relevant information. When the server sends the encrypted communication key or data, it can determine the user ID based on the login information, identify the user's login server through the user ID, forward the encrypted communication key or data to the login server, and finally push it to the user.

[0085] By applying the scheme of the embodiments in this specification, when the server responds to the client's key acquisition request, it obtains the client's login information and protects the sensitive login information with encryption algorithms. Then, it looks up the login server address bound to the user ID, thereby realizing the accurate distribution of encrypted communication keys and the targeted forwarding of data, effectively ensuring the security and accuracy of key distribution.

[0086] See Figure 4 , Figure 4 This specification illustrates an architecture diagram of a data transmission system according to an embodiment of the present specification. The data transmission system may include a client 402 and a server 404. The server-side 404 response is used to generate a key based on the key generation conditions to obtain a target communication key, wherein the target communication key is a dynamic key; encrypt the target communication key to obtain an encrypted communication key; and send the encrypted communication key to the client 402. Client 402 is used to obtain the encrypted communication key; decrypt the encrypted communication key to obtain the target communication key; use the target communication key to encrypt the target transmitted data to obtain the target encrypted data; and send the target encrypted data to the server 404. A 404 error on the server side is also used to decrypt the target's encrypted data based on the target's communication key to obtain the target's transmitted data.

[0087] By applying the scheme of the embodiments in this specification, the client and server use dynamically generated target communication keys for encryption and decryption during communication, which realizes the regular updating of keys, reduces the risk of keys being cracked, and even if the key is leaked, due to the dynamic updating of the key, it is difficult for attackers to use the leaked key to decrypt a large amount of data, thus ensuring the security and privacy of data in network transmission.

[0088] In practical applications, a data transmission system may include multiple clients 402 and a server 404. Multiple clients 402 can establish communication connections through the server 404. In a data transmission scenario, the server 404 is used to provide data transmission services between multiple clients 402. Multiple clients 402 can act as either senders or receivers, communicating through the server 404.

[0089] Users can interact with server 404 through client 402 to receive data sent by other clients 402, or send data to other clients 402. In data transmission scenarios, users can publish encrypted data streams to server 404 through client 402. Server 404 decrypts the data stream, encrypts the decrypted data stream using encryption information agreed upon with other communicating clients, and pushes the encrypted data stream to other communicating clients.

[0090] In this setup, client 402 and server 404 establish a connection via a network. The network provides the medium for the communication link between client 402 and server 404. The network can include various connection types, such as wired or wireless communication links or fiber optic cables. The data transmitted by client 402 may need to undergo encoding, transcoding, compression, or other processing before being published to server 404.

[0091] Client 402 can be a browser, application (APP), or web application such as HyperText Markup Language 5 (H5) application, or a lightweight application (also known as a mini-program), or cloud application, etc. Client 402 can be developed based on the software development kit (SDK) of the corresponding service provided by server 404, such as based on the Real Time Communication (RTC) SDK. Client 402 can be deployed in electronic devices and depends on the device to run or on certain APPs on the device. Electronic devices may have a display screen and support information browsing, such as personal mobile terminals such as mobile phones, tablets, and personal computers. Various other types of applications can also be configured in electronic devices, such as human-computer interaction applications, model training applications, text processing applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0092] A server-side 404 error can include servers providing various services, such as servers providing communication services to multiple clients, servers supporting backend training of models used on clients, and servers processing data sent by clients. It's important to note that a server-side 404 error can be implemented as a distributed server cluster composed of multiple servers, or as a single server. The server can also be a server in a distributed system, or a server integrated with blockchain. Furthermore, the server can be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0093] See Figure 5 , Figure 5 The flowchart of a data transmission method according to an embodiment of this specification is shown. During the data transmission process, the server and the client interact with each other. Client: Generates an encrypted retrieval request based on the client identifier and current timestamp, and sends the encrypted retrieval request to the server; Server: Decrypts the encrypted retrieval request based on the client identifier and current timestamp; Generates a target communication key based on the key generation conditions; Encrypts the target communication key based on the client identifier and current timestamp to obtain an encrypted communication key; Sends the encrypted communication key to the client; Client: Decrypts the encrypted communication key based on the client identifier and current timestamp to obtain the target communication key; or, Server: Generates the target communication key based on the key generation conditions; encrypts the target communication key according to the client identifier and the current timestamp to obtain the encrypted communication key; sends the encrypted communication key to the client; Client: Decrypts the encrypted communication key according to the client identifier and the current timestamp to obtain the target communication key; or, Client: Generates an encrypted acquisition request based on the client identifier, current timestamp, and original communication key, and sends the encrypted acquisition request to the server; Server: Decrypts the encrypted acquisition request based on the client identifier, current timestamp, and original communication key; Generates a target communication key based on the key generation conditions; Encrypts the target communication key based on the client identifier, current timestamp, and original communication key to obtain an encrypted communication key; Sends the encrypted communication key to the client; Client: Decrypts the encrypted communication key based on the client identifier, current timestamp, and original communication key to obtain the target communication key.

[0094] Corresponding to the above-described embodiments of the data transmission method applied to the client, this specification also provides embodiments of the data transmission apparatus. Figure 6 A schematic diagram of a data transmission apparatus according to one embodiment of this specification is shown. Figure 6 As shown, the device is used on a client side and includes: The acquisition module 602 is configured to acquire the encrypted communication key sent by the server; The decryption module 604 is configured to decrypt the encrypted communication key to obtain the target communication key, wherein the target communication key is a dynamic key generated by the server based on the key generation conditions; The first encryption module 606 is configured to encrypt the target transmitted data using the target communication key to obtain the target encrypted data; The first sending module 608 is configured to send target encrypted data to the server so that the server can decrypt the target encrypted data based on the target communication key to obtain the target transmitted data.

[0095] Optionally, the acquisition module 602 is further configured to send a key acquisition request to the server and receive an encrypted communication key sent by the server in response to the key acquisition request.

[0096] Optionally, the key acquisition request is an encrypted acquisition request; the acquisition module 602 is further configured to encrypt the initial acquisition request based on the client's client identifier and the current timestamp to obtain an encrypted acquisition request, and send the encrypted acquisition request to the server; or, to encrypt the initial acquisition request based on the client identifier, the current timestamp, and the original communication key to obtain an encrypted acquisition request, and send the encrypted acquisition request to the server.

[0097] Optionally, the decryption module 604 is further configured to decrypt the encrypted communication key based on the client's client identifier and the current timestamp to obtain the target communication key; or, based on the client identifier, the current timestamp, and the original communication key, decrypt the encrypted communication key to obtain the target communication key.

[0098] Optionally, the first encryption module 606 is further configured to call the encryption algorithm plugin, obtain the target encryption algorithm, and use the target communication key and the target encryption algorithm to encrypt the target transmitted data to obtain the target encrypted data.

[0099] By applying the scheme in the embodiments of this specification, the server sends an encrypted communication key to the client, ensuring the confidentiality and integrity of the target communication key and preventing it from being illegally obtained or tampered with. Since the target communication key is dynamically generated by the server according to the key generation conditions, different data transmission processes may use different keys, effectively preventing security risks caused by the leakage of a fixed key. Even if an attacker intercepts the key of a certain communication, it cannot be used for all subsequent data transmissions, significantly improving the security of data transmission.

[0100] The above is an illustrative scheme of a data transmission device according to this embodiment. It should be noted that the technical solution of this data transmission device belongs to the same concept as the technical solution of the data transmission method applied to the client described above. For details not described in detail in the technical solution of the data transmission device, please refer to the description of the technical solution of the data transmission method applied to the client described above.

[0101] Corresponding to the above-described embodiments of data transmission methods applied to the server, this specification also provides embodiments of data transmission apparatus. Figure 7 A schematic diagram of another data transmission apparatus provided in one embodiment of this specification is shown. Figure 7 As shown, this device is used on the server side and includes: The generation module 702 is configured to generate a key based on key generation conditions to obtain a target communication key, wherein the target communication key is a dynamic key; The second encryption module 704 is configured to encrypt the target communication key to obtain an encrypted communication key; The second sending module 706 is configured to send an encrypted communication key to the client, so that the client can encrypt the target transmitted data based on the encrypted communication key to obtain the target encrypted data.

[0102] Optionally, the generation module 702 is further configured to obtain the communication time with the client, and generate a target communication key if the communication time meets the key generation conditions; or, obtain the client's security assessment information, and generate a target communication key if the security assessment information meets the key generation conditions.

[0103] Optionally, the second encryption module 704 is further configured to encrypt the target communication key based on the client's client identifier and the current timestamp to obtain an encrypted communication key; or, to encrypt the target communication key based on the client identifier, the current timestamp, and the original communication key to obtain an encrypted communication key.

[0104] Optionally, the second sending module 706 is further configured to, in response to a key acquisition request sent by the client, acquire the client's login information; and, based on the login information, send the encrypted communication key to the client.

[0105] By applying the scheme of the embodiments in this specification, the server dynamically generates the target communication key based on the key generation conditions, encrypts it into an encrypted communication key, and sends it to the client. This enables the client to encrypt the target transmitted data based on the target communication key to form the target encrypted data, thereby realizing the dynamic generation and secure distribution of the key and significantly improving the security and anti-attack capability of the data transmission process.

[0106] The above is an illustrative scheme of a data transmission device according to this embodiment. It should be noted that the technical solution of this data transmission device belongs to the same concept as the technical solution of the data transmission method applied to the server described above. For details not described in detail in the technical solution of the data transmission device, please refer to the description of the technical solution of the data transmission method applied to the server described above.

[0107] Figure 8 This specification illustrates a structural block diagram of a computing device according to one embodiment. The components of the computing device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0108] The computing device 800 also includes an access device 840, which enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 840 may include one or more of any type of wired or wireless network interface (e.g., Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Networks (WLAN) interface, a Wi-MAX (World Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0109] In one embodiment of this specification, the above-described components of the computing device 800 and Figure 8 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 8 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0110] The computing device 800 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 800 can also be a mobile or stationary server.

[0111] The processor 820 is used to execute computer programs / instructions, which, when executed by the processor, implement the steps of the above-described data transmission method.

[0112] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the above-described data transmission method belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the above-described data transmission method.

[0113] An embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the above-described data transmission method.

[0114] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium and the technical solution of the above-described data transmission method belong to the same concept, and all details not described in detail in the technical solution of the storage medium can be found in the description of the technical solution of the above-described data transmission method.

[0115] An embodiment of this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described data transmission method.

[0116] The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the above-described data transmission method belong to the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the above-described data transmission method.

[0117] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0118] Computer instructions include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in computer-readable media can be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0119] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0120] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0121] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A data transmission method, characterized in that, Applied to the client side, including: Obtain the encrypted communication key sent by the server; The encrypted communication key is decrypted to obtain the target communication key, wherein the target communication key is a dynamic key generated by the server based on the key generation conditions; Using the target communication key, the target transmitted data is encrypted to obtain the target encrypted data; The target encrypted data is sent to the server so that the server can decrypt the target encrypted data based on the target communication key to obtain the target transmitted data.

2. The method according to claim 1, characterized in that, The step of obtaining the encrypted communication key sent by the server includes: Send a key acquisition request to the server; Receive the encrypted communication key sent by the server in response to the key acquisition request.

3. The method according to claim 2, characterized in that, The key acquisition request is an encrypted acquisition request; Sending a key acquisition request to the server includes: The initial acquisition request is encrypted based on the client's client identifier and the current timestamp to obtain the encrypted acquisition request, and then the encrypted acquisition request is sent to the server. or, The initial acquisition request is encrypted based on the client identifier, the current timestamp, and the original communication key to obtain the encrypted acquisition request, which is then sent to the server.

4. The method according to claim 1, characterized in that, The step of decrypting the encrypted communication key to obtain the target communication key includes: Based on the client's client identifier and current timestamp, the encrypted communication key is decrypted to obtain the target communication key; or, The encrypted communication key is decrypted based on the client identifier, the current timestamp, and the original communication key to obtain the target communication key.

5. The method according to claim 1, characterized in that, The step of encrypting the target transmitted data using the target communication key to obtain the target encrypted data includes: Invoke the encryption algorithm plugin to obtain the target encryption algorithm. The target transmitted data is encrypted using the target communication key and the target encryption algorithm to obtain the target encrypted data.

6. A data transmission method, characterized in that, Applied to the server side, including: A key is generated based on the key generation conditions to obtain a target communication key, wherein the target communication key is a dynamic key; The target communication key is encrypted to obtain an encrypted communication key; The encrypted communication key is sent to the client so that the client can encrypt the target transmitted data based on the encrypted communication key to obtain the target encrypted data.

7. The method according to claim 6, characterized in that, The key generation based on key generation conditions to obtain the target communication key includes: Obtain the communication time with the client, and if the communication time meets the key generation conditions, generate the target communication key; or, Obtain the security assessment information of the client, and generate the target communication key if the security assessment information meets the key generation conditions.

8. The method according to claim 6, characterized in that, The step of encrypting the target communication key to obtain an encrypted communication key includes: The target communication key is encrypted based on the client's client identifier and current timestamp to obtain the encrypted communication key; or, The target communication key is encrypted based on the client identifier, the current timestamp, and the original communication key to obtain the encrypted communication key.

9. A data transmission system, characterized in that, Including both client and server sides; The server is configured to generate a target communication key based on key generation conditions, wherein the target communication key is a dynamic key; encrypt the target communication key to obtain an encrypted communication key; and send the encrypted communication key to the client. The client is configured to: obtain the encrypted communication key; decrypt the encrypted communication key to obtain the target communication key; encrypt the target transmitted data using the target communication key to obtain the target encrypted data; and send the target encrypted data to the server. The server is also used to decrypt the target encrypted data based on the target communication key to obtain the target transmitted data.

10. A computing device, characterized in that, include: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions, which, when executed by the processor, implement the steps of the method according to any one of claims 1 to 8.

Images