A method and system for secondary encryption in a full link tls encrypted channel

Abstract

The application discloses a kind of secondary encryption in full-link TLS encryption channel, and the method specifically includes establishing TLS communication link;Using current system time generates first key, as AES-256-GCM algorithm key, after the data needing transmission is encrypted by AES-256-GCM algorithm and the key, second ciphertext is obtained after using custom algorithm secondary encryption;Send to receiving party, after receiving second ciphertext, custom algorithm decryption;Using current system time generates second key, using AES-256-GCM algorithm and second key as key to decrypt first plaintext, if decryption is not successful, change the time of generating second key to regenerate second key decryption, if decryption is not successful, discard second ciphertext and prompt error.The application realizes dynamic key, decryption fault tolerance, improves security, does not need unified management key, as long as keeping time relatively consistent, time difference can be dynamically controlled.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and specifically to a method and system for performing secondary encryption in a full-link TLS encrypted channel. Background Technology

[0002] Modern internet and systems with high security standards commonly use the TLS protocol for encrypted data transmission over the network, and establish TLS connections using RSA private keys of 2048 bits or more, or even more advanced ECDSA private keys of 256 bits or more.

[0003] Although the TLS protocol is very secure, it still has certain security risks in extreme situations, such as the private key files of the communicating parties being stolen through cyberattacks or the server room being physically hijacked. Therefore, when designing a high-security system, it is necessary to consider security fallback measures for extreme situations.

[0004] It is not uncommon to perform secondary encryption on data for high-level confidentiality. For example, Chinese patent document CN116455556A, entitled "An Interactive Method for Secondary Encryption of Data Transmission," includes: (1) encrypting client data and encrypting client browsing data once; (2) performing secondary encryption on transmitted data, agreeing on the secondary encryption key and time; (3) the server performs key judgment, judging the key and time; (4) monitoring transmitted data, realizing monitoring of browsing data duration; (5) verifying the key, performing sequential verification of the primary key and the secondary key; (6) the receiving end decrypts and restores the data, and restores the data after successful verification. Although the data is encrypted twice, the key is still transmitted through a public link, which still poses a risk of interception, allowing the data transmission to be intercepted or tampered with without being noticed by either party. Summary of the Invention

[0005] The purpose of this invention is to propose a method for secondary encryption in a full-link TLS encrypted channel to solve one or more technical problems existing in the prior art, and at least provide a beneficial option or create conditions.

[0006] To achieve the above technical objectives, the technical solution of the present invention is as follows:

[0007] Step 1: The sender and receiver of the data communication establish a TLS communication link;

[0008] Step 2: Generate a first key using the sender's current system time. The first key is used as the key for the AES-256-GCM algorithm. The sender uses the AES-256-GCM algorithm and the key to encrypt the data to be transmitted to obtain the first ciphertext.

[0009] Step 3: The first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext;

[0010] Step 4: The second ciphertext is sent to the receiver through the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext.

[0011] Step 5: Generate a second key using the receiver's current system time. Use the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, regenerate the second key according to predefined rules and try to decrypt again. If decryption fails, discard the second ciphertext.

[0012] Furthermore, in step 1, the sub-steps for the sender and receiver of data communication to establish a TLS communication link are as follows:

[0013] The sender and receiver of data communication use standard RSA or ECDSA private keys and certificates to establish a standard TLS communication link.

[0014] Preferably, the standard TLS communication link is established on the TCP transport protocol.

[0015] Preferably, after establishing the standard TLS communication link, the sender and receiver of the data communication exchange the data transmission format.

[0016] Further, in step 2, a first key is generated using the sender's current system time. This first key serves as the key for the AES-256-GCM algorithm. The sub-step where the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext is as follows:

[0017] The first key is generated using the sender's current system time. The sender's current system time is obtained by using the API provided by the sender's operating system. If the length of the sender's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0018] Furthermore, the first key serves as the key for the AES-256-GCM algorithm, the Initialization Vector uses a fixed value, and the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext.

[0019] Furthermore, the first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext.

[0020] Furthermore, the second ciphertext is sent to the receiver via the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext.

[0021] Preferably, the custom algorithm is ChaCha20-Poly1305 or RC4.

[0022] Preferably, the custom algorithm is a private algorithm.

[0023] The ChaCha20-Poly1305 algorithm is a new generation of stream encryption algorithm. Its pure software performance is higher than that of the AES algorithm, so that the additional encryption and decryption process will not consume a lot of CPU usage, while ensuring security.

[0024] Further, in step 5, a second key is generated using the receiver's current system time. The first plaintext is decrypted using the AES-256-GCM algorithm and the second key. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails again, the second ciphertext is discarded. The sub-steps are as follows:

[0025] The second key is generated using the receiver's current system time. The receiver's current system time is obtained by using the API provided by the receiver's operating system. The Initialization Vector uses a fixed value. The second key is used as the key to decrypt the first plaintext using the AES-256-GCM algorithm. If the length of the receiver's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0026] If decryption is successful and the obtained data is not garbled, then decryption is successful. If decryption fails or the decrypted data is garbled, then the receiver's current system time is moved forward by one interval, a second key is regenerated, and the first plaintext is decrypted again. If decryption fails or the decrypted data is garbled, then an error is reported, and the second ciphertext is discarded.

[0027] Preferably, the first interval is 1 minute.

[0028] An error could be attributed to a middleman tampering with the data during transmission, or to a data transmission failure.

[0029] The first interval can be used to control the tolerance of the time difference between the sender and receiver. The local time of both parties may have a certain error due to time correction issues, but in general, periodic NTP time correction is performed, and setting a time error of 1 minute is sufficient for this method to work perfectly.

[0030] Preferably, the decrypted data is garbled, meaning it does not conform to the data transmission format.

[0031] Preferably, when using the AES-256-GCM algorithm for decryption, an error is reported with an overwhelming probability when the key is incorrect. However, it is not impossible to detect a erroneous result without reporting an error. There is a probability that an erroneous key without reporting an error will be encountered when traversing all keys. In this case, the receiver may not be able to identify it (for example, some embedded platforms have insufficient processing power, insufficient RAM, insufficient ROM space to place the detection code, and high real-time requirements make it unsuitable to deploy too much judgment logic). By pre-agreeing on the data format, a simple verification can be performed on the decrypted data. For example, if the data format of a certain field is int, but a non-int value is obtained after processing, or the length of a certain field is inconsistent, it can be determined that a decryption error has occurred.

[0032] Preferably, the current system time of the sender and the current system time of the receiver are truncated to the minute, in the format yyyymmddhhm'm', where yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

[0033] Preferably, all undefined variables in this invention, if not explicitly defined, can be manually set thresholds.

[0034] Sender and receiver;

[0035] The sender includes:

[0036] Basic communication module: used to establish a TLS communication link, which is used to communicate with the receiver and send a second ciphertext;

[0037] First encryption module: Used to generate a first key using the sender's current system time, and use the first key as the key for the AES-256-GCM algorithm to encrypt the data to be transmitted to obtain the first ciphertext;

[0038] Secondary encryption module: used to encrypt the first ciphertext a second time using a custom algorithm to obtain the second ciphertext;

[0039] The recipient includes:

[0040] Basic communication module: used to establish a TLS communication link, which is used to communicate with the sender and receive the second ciphertext;

[0041] First-level decryption module: After receiving the second ciphertext, it decrypts it using a custom algorithm to obtain the first plaintext;

[0042] Secondary decryption module: Generates a second key using the receiver's current system time, and uses the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails, the second ciphertext is discarded.

[0043] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for secondary encryption in a full-link TLS encrypted channel provided in the first aspect of the present invention.

[0044] Fourthly, the present invention provides an electronic device, comprising: a memory storing a computer program thereon; and a processor for executing the computer program in the memory to implement the steps of the method for secondary encryption in a full-link TLS encrypted channel provided by the present invention.

[0045] AES-256 encryption and secondary encryption are performed again on the TLS link, combining the characteristics of both high-strength public and high-strength private algorithms. This ensures the system can still provide a security safety net even if the entire system is compromised but the source code is not leaked. The dynamically changing key technology and the unique time-based decryption fault-tolerance technology further enhance the security of the encryption. Even if the entire system is compromised, attackers cannot attempt brute-force cracking using a quantum computer. The dynamically changing key technology significantly reduces management and maintenance costs. The system does not need to uniformly manage constantly changing keys; all machines only need to maintain relatively consistent time, and the tolerance for time differences can be dynamically controlled. Attached Figure Description

[0046] Figure 1 A flowchart illustrating a method for performing secondary encryption in a full-link TLS encrypted channel provided by the present invention;

[0047] Figure 2 This is a schematic block diagram of a system architecture for secondary encryption in a full-link TLS encrypted channel, according to an embodiment of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. The specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0049] It should also be understood that the following embodiments are only used to further illustrate the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-essential improvements and adjustments made by those skilled in the art based on the above description of the present invention are within the scope of protection of the present invention. The specific process parameters, etc., in the following examples are merely examples within a suitable range; that is, those skilled in the art can make appropriate selections within the appropriate range based on the description herein, and are not intended to be limited to the specific values ​​in the examples below.

[0050] The following exemplifies a method for performing secondary encryption in a full-link TLS encrypted channel provided by the present invention.

[0051] like Figure 1 The diagram shows a flowchart of a method for performing secondary encryption in a full-link TLS encrypted channel. The following section will combine... Figure 1 This invention describes a method for performing secondary encryption in a full-link TLS encrypted channel, comprising the following steps:

[0052] Step 1: The sender and receiver of the data communication establish a TLS communication link;

[0053] Step 2: Generate a first key using the sender's current system time. The first key is used as the key for the AES-256-GCM algorithm. The sender uses the AES-256-GCM algorithm and the key to encrypt the data to be transmitted to obtain the first ciphertext.

[0054] Step 3: The first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext;

[0055] Step 4: The second ciphertext is sent to the receiver through the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext.

[0056] Step 5: Generate a second key using the receiver's current system time. Use the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, regenerate the second key according to predefined rules and try to decrypt again. If decryption fails, discard the second ciphertext.

[0057] In one embodiment, the sender and receiver of data communication establish a standard TLS communication link using standard RSA or ECDSA private keys and certificates.

[0058] The standard TLS communication link is established on the TCP transport protocol.

[0059] After establishing the standard TLS communication link, the sender and receiver of the data communication exchange data in JSON format.

[0060] The first key is generated using the sender's current system time. The sender's current system time is obtained by using the API provided by the sender's operating system. If the length of the sender's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0061] The following is a Python example program that extracts the current system time, concatenates it with a salt field, and outputs it as a key that meets the length requirement:

[0062] import datetime

[0063] # Get current time

[0064] now = datetime.datetime.now()

[0065] # Format the output by combining the year, month, day, hour, and minute into a single integer.

[0066] time_formatted = int(now.strftime("%Y%m%d%H%M"))

[0067] #Set a fixed salt value

[0068] salt="AABBCCDDEEFFGGHHIIJJ"

[0069] # Concatenate the value of key

[0070] key= f"{time_formatted}{salt}"

[0071] #Debug output

[0072] print(key)

[0073] If the key is 32 bits and the date is 16 bits, then the length of the custom salt is 20 bits.

[0074] Furthermore, the first key serves as the key for the AES-256-GCM algorithm, the Initialization Vector uses a fixed value, and the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext.

[0075] Furthermore, the first ciphertext is encrypted a second time using the ChaCha20-Poly1305 algorithm to obtain the second ciphertext.

[0076] Furthermore, the second ciphertext is sent to the receiver via the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the ChaCha20-Poly1305 algorithm to obtain the first plaintext.

[0077] The ChaCha20-Poly1305 algorithm is a new generation of stream encryption algorithm. Its pure software performance is higher than that of the AES algorithm, so that the additional encryption and decryption process will not consume a lot of CPU usage, while ensuring security.

[0078] The second key is generated using the receiver's current system time. The receiver's current system time is obtained by using the API provided by the receiver's operating system. The Initialization Vector uses a fixed value. The second key is used as the key to decrypt the first plaintext using the AES-256-GCM algorithm. If the length of the receiver's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0079] If decryption is successful and the obtained data is not garbled, then decryption is successful. If decryption fails or the decrypted data is garbled, then the receiver's current system time is moved forward by 1 minute, a second key is regenerated, and the first plaintext is decrypted again. If decryption fails or the decrypted data is garbled, then an error is reported, and the second ciphertext is discarded.

[0080] An error could be attributed to a middleman tampering with the data during transmission, or to a data transmission failure.

[0081] The first interval can be used to control the tolerance of the time difference between the sender and receiver. The local time of both parties may have a certain error due to time correction issues, but in general, periodic NTP time correction is performed, and setting a time error of 1 minute is sufficient for this method to work perfectly.

[0082] For devices that have not been updated for a long time, such as those lacking an NTP module, set the first interval to 10 minutes.

[0083] Preferably, the decrypted data is garbled, meaning it does not conform to the data transmission format.

[0084] Preferably, when using the AES-256-GCM algorithm for decryption, an error is reported with an overwhelming probability when the key is incorrect. However, it is not impossible to detect a erroneous result without reporting an error. There is a probability that an erroneous key without reporting an error will be encountered when traversing all keys. In this case, the receiver may not be able to identify it (for example, some embedded platforms have insufficient processing power, such as no hardware-accelerated encryption and decryption functions, limited RAM space, insufficient ROM space to place detection code, and high real-time requirements, so it is not advisable to deploy too much judgment logic). By pre-agreeing on the data format, a simple verification can be performed on the decrypted data. For example, if the data format of a certain field is int, but a non-int value is obtained after processing, or the length of a certain field is inconsistent, it can be determined that a decryption error has occurred.

[0085] Preferably, the current system time of the sender and the current system time of the receiver are truncated to the minute, in the format yyyymmddhhm'm', where yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

[0086] Preferably, all undefined variables in this invention, if not explicitly defined, can be manually set thresholds.

[0087] like Figure 2 The diagram shown is a schematic block diagram of a system architecture for secondary encryption in a full-link TLS encrypted channel according to an embodiment of the present invention.

[0088] This invention provides a system for performing secondary encryption in a full-link TLS encrypted channel, the system comprising:

[0089] Sender and receiver;

[0090] The sender includes:

[0091] Basic communication module: used to establish a TLS communication link, which is used to communicate with the receiver and send a second ciphertext;

[0092] First encryption module: Used to generate a first key using the sender's current system time, and use the first key as the key for the AES-256-GCM algorithm to encrypt the data to be transmitted to obtain the first ciphertext;

[0093] Secondary encryption module: used to encrypt the first ciphertext a second time using a custom algorithm to obtain the second ciphertext;

[0094] The recipient includes:

[0095] Basic communication module: used to establish a TLS communication link, which is used to communicate with the sender and receive the second ciphertext;

[0096] First-level decryption module: After receiving the second ciphertext, it decrypts it using a custom algorithm to obtain the first plaintext;

[0097] Secondary decryption module: Generates a second key using the receiver's current system time, and uses the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails, the second ciphertext is discarded.

[0098] The system described above, which performs secondary encryption in a full-link TLS encrypted channel, can run on computing devices such as desktop computers, laptops, PDAs, and cloud servers. The system that can run on this system may include, but is not limited to, processors and memory. Those skilled in the art will understand that the example described is merely an illustration of a system performing secondary encryption in a full-link TLS encrypted channel and does not constitute a limitation on such a system. It may include more or fewer components, or a combination of certain components, or different components. For example, the system may also include input / output devices, network access devices, buses, etc.

[0099] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the system operating under the described system for secondary encryption in a full-link TLS encrypted channel, connecting various parts of the system through various interfaces and lines.

[0100] The memory can be used to store the computer program and / or modules. The processor implements various functions of the system for secondary encryption in a full-link TLS encrypted channel by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include random access memory (RAM), and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0101] Although the invention has been described in considerable detail and particularly with regard to several of the described embodiments, it is not intended to limit itself to any of these details or embodiments or any particular embodiment, thereby effectively covering the intended scope of the invention. Furthermore, the invention has been described above with respect to embodiments foreseeable by the inventors in order to provide a useful description, and non-substantial modifications to the invention that have not yet been foreseen may still represent equivalent modifications.

[0102] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0103] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention.

Claims

1. A method of secondary encryption in a full link TLS encrypted channel, characterized by, The method comprises the following steps: Step 1, the sender and the receiver of the data communication establish a TLS communication link; Step 2, a first key is generated using the current system time of the sender, the first key is used as the key of the AES-256-GCM algorithm, the sender encrypts the data to be transmitted through the AES-256-GCM algorithm and the key to obtain the first ciphertext; Step 3, the first ciphertext is encrypted again using a custom algorithm to obtain the second ciphertext; Step 4, the second ciphertext is sent to the receiver through the TLS communication link, and the receiver decrypts the second ciphertext through the custom algorithm to obtain the first plaintext; Step 5, a second key is generated using the current system time of the receiver, the first plaintext is decrypted using the AES-256-GCM algorithm and the second key as the key, if the decryption is unsuccessful, the second key is regenerated according to a predefined rule for decryption, and if the decryption is unsuccessful, the second ciphertext is discarded.

2. The method of claim 1, wherein, In step 1, the sub-step of establishing a TLS communication link by the sender and the receiver of the data communication is that the sender and the receiver of the data communication establish a standard TLS communication link using a standard RSA or ECDSA private key and a certificate.

3. The method of claim 2, wherein, The standard TLS communication link is established on the TCP transmission protocol.

4. The method of claim 1, wherein, In step 2, a first key is generated using the current system time of the sender, the first key is used as the key of the AES-256-GCM algorithm, the sender encrypts the data to be transmitted through the AES-256-GCM algorithm and the key to obtain the first ciphertext, and the sub-step is: A first key is generated using the current system time of the sender, the current system time of the sender is obtained through an API provided by the operating system of the sender, and if the length of the current system time of the sender does not meet the length requirement of the key of the AES-256-GCM algorithm, a custom salt is used to fill the key to the required length; The first key is used as the key of the AES-256-GCM algorithm, the initialization vector uses a fixed value, and the sender encrypts the data to be transmitted through the AES-256-GCM algorithm and the key to obtain the first ciphertext.

5. The method of claim 1, wherein, The current system time of the sender and the current system time of the receiver are truncated to minutes, and the format is yyyymmddhhm'm', wherein yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

6. The method of claim 1, wherein, In step 5, a second key is generated using the current system time of the receiver, the first plaintext is decrypted using the AES-256-GCM algorithm and the second key as the key, if the decryption is unsuccessful, the second key is regenerated according to a predefined rule for decryption, and if the decryption is unsuccessful, the second ciphertext is discarded, and the sub-step is: The second key is generated using the current system time of the receiver, the current system time of the receiver is obtained by an API provided by the operating system of the receiver, the initialization vector uses a fixed value, the first plaintext is decrypted using the second key as the key of the AES-256-GCM algorithm, and if the length of the current system time of the receiver does not meet the length requirement of the key of the AES-256-GCM algorithm, a custom salt is used to fill to the length required by the key; If the decryption is successful and the obtained data is not garbled, the decryption is successful, if the decryption fails or the decrypted data is garbled, the second key is regenerated after the current system time of the receiver is moved forward by the first interval, and the first plaintext is decrypted again, If the decryption fails or the decrypted data is garbled, the second key is regenerated after the current system time of the receiver is moved backward by the first interval, and the first plaintext is decrypted again, if the decryption fails or the decrypted data is garbled, an error is reported, and the second ciphertext is discarded.

7. The method of claim 6, wherein, The first interval is 1 minute.

8. A system for secondary encryption in a full link TLS encrypted channel, characterized in that, The system comprises: a sender and a receiver; The sender comprises: a basic communication module, which is configured to establish a TLS communication link, and the TLS communication link is configured to communicate with the receiver and send the second ciphertext; a one-time encryption module, which is configured to generate a first key using the current system time of the sender, and encrypt data to be transmitted using the first key as the key of the AES-256-GCM algorithm to obtain the first ciphertext; a two-time encryption module, which is configured to perform two-time encryption on the first ciphertext using a custom algorithm to obtain the second ciphertext; The receiver comprises: a basic communication module, which is configured to establish a TLS communication link, and the TLS communication link is configured to communicate with the sender and receive the second ciphertext; a one-time decryption module, which is configured to receive the second ciphertext, and perform decryption through a custom algorithm to obtain the first plaintext; a two-time decryption module, which is configured to generate a second key using the current system time of the receiver, and decrypt the first plaintext using the second key as the key of the AES-256-GCM algorithm, if the decryption is not successful, the second key is regenerated through a predefined rule to perform decryption, and if the decryption is not successful, the second ciphertext is discarded.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the method for performing two-time encryption in the full-link TLS encryption channel according to any one of claims 1-7.

10. An electronic device, comprising: comprise: a memory, on which a computer program is stored; a processor, configured to execute the computer program in the memory to implement the steps of the method for performing two-time encryption in the full-link TLS encryption channel according to any one of claims 1-7.

Images