Encryption transmission method and device, equipment and storage medium

Abstract

The invention relates to an encryption transmission method and device, equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: acquiring plaintext data to be transmitted, and partitioning the plaintext data to obtain plaintext partitioned data; under the condition of supporting a hardware encryption instruction set, encrypting the plaintext block data by adopting a hardware encryption channel and / or a software encryption channel based on a derived public key in the derived session key pair, and adding an encryption channel identifier in the encrypted ciphertext block data; the encryption channel identifier is used for representing that the adopted encryption channel is a hardware encryption channel or a software encryption channel; and sending the ciphertext block data to a receiving end, so that the receiving end performs decryption by adopting an adaptive hardware decryption mode or software decryption mode based on a derived private key in the derived session key pair to obtain plaintext block data. Encryption is carried out by polling a hardware encryption channel and a software encryption channel, and CPU resources consumed in the data encryption process are effectively relieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to the technical field of data encryption, and specifically to an encrypted transmission method and device, equipment and storage medium. BACKGROUND

[0002] Session Description Protocol (SDP) is used to describe multimedia session parameters, but the session information is transmitted in plaintext, which has security risks. With the growth of real-time communication needs, the industry began to combine external encryption technology in the early 2000s. Secure Real-time Transport Protocol (SRTP) protocol is responsible for media stream encryption, and Transport Layer Security (TLS) technology is used to protect the SDP signaling transmission channel, forming a "protocol-level supplement" solution. In 2013, the International Cloud Security Alliance proposed software-defined perimeter, namely SDP framework, which introduced the concept of zero trust into network access control. This architecture realizes the security model of "connection after authentication" through single packet SPA authorization, dynamic port management and micro-isolation tunnel, and completely changes the defects of traditional network exposed ports. After 2015, more scenarios widely use zero-trust SDP to replace traditional Virtual Private Network (VPN), effectively solving the problems of outsourcing personnel access and sensitive data leakage. By then, SDP encryption has developed from single protocol cooperation to a complete security system integrating identity authentication, dynamic strategy and tunnel encryption.

[0003] Current SDP encryption transmission solutions mainly cover two technical routes: protocol level and architecture level. In protocol-level encryption, the SRTP protocol is used as the core solution to protect media stream content using the Advanced Encryption Standard (AES) encryption algorithm, and key exchange is completed through SDP or SRTP protocol. This solution is widely used in video conference systems and Web Real-Time Communication (WebRTC) standard Voice over Internet Protocol (VoIP) implementations. The encryption of the signaling channel is mainly achieved through the Transport Layer Security (TLS) encapsulation. At the architecture level, the zero-trust SDP solution realizes the "port stealth" protection through the SPA single packet authorization technology. The client sends an encrypted identity token to the hidden port, and only after the verification is passed will the Transmission Control Protocol (TCP) port be dynamically opened to establish an encrypted tunnel. This design effectively resists port scanning and Distributed Denial of Service attack (DDoS) attacks. The dynamic micro-isolation tunnel technology generates temporary access policies based on user roles, device fingerprints, and other information, establishes an encrypted connection using the TLS protocol, and closes the tunnel immediately after the session ends. Through the continuous risk assessment mechanism, the device security state is monitored in real time to dynamically adjust the access rights.

[0004] In SDP encryption transmission technology, the calculation complexity of the encryption algorithm is the core factor that increases the transmission delay. The key agreement of symmetric encryption and asymmetric encryption and the data encryption and decryption process consume CPU resources, and in high-throughput scenarios, CPU instruction sets need to be called frequently. When the number of concurrent connections increases sharply, the encryption task queue accumulation will cause thread competition to intensify, the CPU utilization rate will soar to the bottleneck, and then scheduling delay and context switching overhead will be triggered. For real-time services, this delay will reduce the end-to-end response speed, trigger timeout retransmission, and form a vicious cycle. In addition, the authentication process of SDP may also increase the delay due to multiple network round trips. SUMMARY

[0005] The present application provides an encryption transmission method, device, equipment and storage medium, which realizes encryption through rotating hardware encryption channels and software encryption channels, effectively alleviating the CPU resources consumed in the data encryption process. The technical solution of the present application is as follows:

[0006] In a first aspect of the embodiments of the present application, the encryption transmission method provided by the embodiments of the present application comprises:

[0007] obtaining plaintext data to be transmitted, block the plaintext data to obtain plaintext block data;

[0008] In the case of supporting a hardware encryption instruction set, the plaintext block data is encrypted based on a derived public key in a derived session key pair, using a hardware encryption channel and / or a software encryption channel, and an encryption channel identifier is added in the obtained ciphertext block data; the encryption channel identifier is used to represent that the encryption channel used is the hardware encryption channel or the software encryption channel;

[0009] The ciphertext block data is sent to a receiving end, so that the receiving end decrypts the ciphertext block data based on a derived private key in the derived session key pair, using a hardware decryption mode or a software decryption mode matched with the encryption channel identifier, to obtain the plaintext block data

[0010] The technical scheme provided by the embodiments of the present application at least brings the following beneficial effects:

[0011] By applying the embodiments of the present application, in the case of supporting a hardware encryption instruction set at a sending end, the encryption process not only uses a software encryption channel, but also introduces a hardware encryption channel, effectively alleviating the problem of consuming a large amount of CPU resources in the data encryption process and frequently calling CPU instruction sets in a high-throughput scenario. When the number of concurrent connections surges, the CPU utilization is also effectively reduced, and the scheduling delay and the overhead of context switching are reduced. For services with high real-time requirements, the end-to-end response speed can be accelerated, and the probability of triggering a timeout retransmission can be reduced.

[0012] In combination with the first aspect, as a possible implementation manner, the encrypting the plaintext block data using the hardware encryption channel and / or the software encryption channel comprises: alternately encrypting the plaintext block data using the hardware encryption channel and the software encryption channel based on a round-robin strategy.

[0013] As can be seen, in the embodiments of the present application, the plaintext block data is encrypted, and the hardware encryption channel and the software encryption channel can be alternately used for encryption. Thus, the hardware algorithm and the software algorithm are load balanced, and adaptive switching of the two encryption modes is realized in the SDP architecture.

[0014] In combination with the first aspect, as a possible implementation manner, the method further comprises: monitoring a running state of a hardware module corresponding to the hardware encryption channel; and in the case that the running state meets a preset critical running state, increasing a proportion of encryption using the software encryption channel.

[0015] It can be seen that, in the embodiment of the application, by monitoring the running state of the hardware module corresponding to the hardware encryption channel and dynamically adjusting the proportion of using the hardware encryption channel and the software encryption channel for encryption, the load balancing of the hardware algorithm and the software algorithm is better realized, which can not only relieve the load of the CPU, but also ensure that the dedicated hardware encryption device or chip runs well.

[0016] With reference to the first aspect, as a possible implementation manner, in the case that the hardware encryption instruction set is not supported, the plaintext block data is encrypted by using the software encryption channel based on the derived public key in the derived session key pair.

[0017] With reference to the first aspect, as a possible implementation manner, the derived session key pair is generated based on shared key material under the condition that the sending end and the receiving end satisfy identity authentication; wherein the shared key material is generated according to the temporary private key in the first temporary key pair of any one of the communication parties and the temporary public key in the second temporary key pair of the other party.

[0018] With reference to the first aspect, as a possible implementation manner, the local key is saved in the following manner; the local key includes the derived session key pair and / or the temporary key pair:

[0019] The local key is divided into blocks to obtain local block keys and index serial numbers of the local block keys;

[0020] For each local block key, the index serial number is encrypted by using a first encryption key to obtain a block index value; the local block key and the block index value are encrypted based on a second encryption key to obtain an encrypted block key;

[0021] Each encrypted block key is spliced and written to a disk.

[0022] With reference to the first aspect, as a possible implementation manner, the first encryption key and / or the second encryption key is generated according to the permission information of the local user identity.

[0023] The second aspect of the embodiment of the application provides an encryption transmission device, the device comprising:

[0024] An acquisition module is configured to acquire plaintext data to be transmitted, divide the plaintext data into blocks to obtain plaintext block data;

[0025] The encryption module is configured to, in the case of supporting a hardware encryption instruction set, encrypt the plaintext block data based on a derived public key in a derived session key pair, using a hardware encryption channel and / or a software encryption channel, and add an encryption channel identifier to the encrypted ciphertext block data; the encryption channel identifier is used to indicate that the encryption channel used is the hardware encryption channel or the software encryption channel.

[0026] The sending module is configured to send the ciphertext block data to the receiving end, so that the receiving end decrypts the ciphertext block data based on a derived private key in the derived session key pair, using a hardware decryption method or a software decryption method that matches the encryption channel identifier, to obtain the plaintext block data.

[0027] In combination with the second aspect described above, as a possible implementation manner, the encryption module is specifically configured to encrypt the plaintext block data using the hardware encryption channel and the software encryption channel alternately based on a polling strategy.

[0028] In combination with the second aspect described above, as a possible implementation manner, the device further includes a monitoring module configured to monitor a running state of a hardware module corresponding to the hardware encryption channel; and in the case that the running state meets a preset critical running state, the proportion of using the software encryption channel for encryption is increased.

[0029] In a possible manner, the encryption module is further configured to, in the case of not supporting a hardware encryption instruction set, encrypt the plaintext block data based on a derived public key in the derived session key pair, using the software encryption channel.

[0030] In a possible manner, the derived session key pair is generated based on shared key material under the condition that the sending end and the receiving end meet identity authentication; wherein the shared key material is generated according to a temporary private key in a first temporary key pair of any one of the two communication parties and a temporary public key in a second temporary key pair of the other party.

[0031] In a possible manner, the device further includes a storage module configured to:

[0032] The local key includes the derived session key pair and / or the temporary key pair.

[0033] The local key is divided into local block keys and index serial numbers of the local block keys;

[0034] For each local block key, the index serial number is encrypted using a first encryption key to obtain a block index value; the local block key and the block index value are encrypted based on a second encryption key to obtain an encrypted block key.

[0035] The encrypted sub-keys are spliced and stored.

[0036] In a possible manner, the first encryption key and / or the second encryption key is generated according to permission information of a local user identity.

[0037] In a third aspect, an electronic device is provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the method in the first aspect and any possible implementation thereof.

[0038] In a fourth aspect, a computer-readable storage medium is provided, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method in the first aspect and any possible implementation thereof.

[0039] In a fifth aspect, a computer program product is provided, the computer program product includes computer instructions, when the computer instructions are run on an electronic device, the electronic device performs the method in the first aspect and any possible implementation thereof.

[0040] It should be noted that the technical effects brought by any implementation manner of the second aspect to the fifth aspect can refer to the technical effects brought by the corresponding implementation manner in the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application, and do not constitute an undue limitation on the present application.

[0042] Figure 1 A flowchart of an encryption transmission method provided by an embodiment of the present application;

[0043] Figure 2 A flowchart of generating a pair of derived session keys provided by an embodiment of the present application;

[0044] Figure 3 A flowchart of encrypting and storing a local key provided by an embodiment of the present application;

[0045] Figure 4 A structural diagram of an encryption transmission device provided by an embodiment of the present application;

[0046] Figure 5 A structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order for those skilled in the art to better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings.

[0048] The term "and / or" in this document merely describes an association relationship of associated objects, and indicates that there can be three relationships, for example, A and / or B can represent three cases of A existing alone, A and B existing together, and B existing alone.

[0049] The terms "first" and "second" and the like in the description of the present application and the drawings are used to distinguish different objects or different processing of the same object, and are not used to describe the specific order of the objects.

[0050] In addition, the terms "include" and "have" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device.

[0051] It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the use of "exemplary" or "for example" and the like is intended to present the relevant concept in a specific manner.

[0052] In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, "first", "second" and the like are used to distinguish the same or similar items with basically the same function and role, and those skilled in the art can understand that "first", "second" and the like are not limited in number and execution order.

[0053] As introduced in the background section, the computational complexity of the encryption algorithm is the core factor leading to the increase of transmission delay. The key agreement of symmetric encryption and asymmetric encryption and the data encryption and decryption process consume CPU resources, and in the high throughput scenario, CPU instruction set needs to be frequently called.

[0054] In view of the above technical problems, the present application provides an encryption transmission method, the idea of which is to realize efficient full-link security protection through the cooperative design of the authentication layer, the transmission layer and the storage layer, and to optimize the high consumption of resources caused by key agreement and data encryption and the performance bottleneck that may be caused.

[0055] The encryption transmission method provided by the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0056] Figure 1 A flowchart of the encryption transmission method provided by the embodiment of the present application is shown in FIG. 1. The method is applied to a sending end of encryption transmission, and includes the following steps.

[0057] S101: Obtain plaintext data to be transmitted, and divide the plaintext data into blocks to obtain plaintext block data.

[0058] Since the encryption algorithm usually has a limit on the length of plaintext, the plaintext data is divided into blocks. For example, the plaintext data can be divided into blocks of 128 bytes to obtain the plaintext block data.

[0059] S102: In the case that the CPU of the sending end supports a hardware encryption instruction set, encrypt the plaintext block data based on the derived public key in the derived session key pair by using a hardware encryption channel and a software encryption channel, and add an encryption channel identifier to the encrypted ciphertext block data. The encryption channel identifier is used to indicate whether the encryption channel used is a hardware encryption channel or a software encryption channel.

[0060] In the embodiment of the present application, the derived session key pair can be understood as a temporary key pair. After the identity authentication of the two communication parties, a temporary key pair, i.e., the derived session key pair, is generated based on the shared secret key material, and is valid only during the session. The process of identity authentication of the two communication parties, generation of the shared secret key material, and generation of the derived session key can be referred to below.

[0061] After the derived session key pair is determined, the party that needs to send the encrypted data (i.e., the sending end) can encrypt the plaintext block data based on the derived public key in the derived session key pair.

[0062] Different from the traditional encryption method that only uses a software algorithm for encryption, in the embodiment of the present application, it is first determined whether the CPU of the sending end supports a hardware encryption instruction set. If the CPU supports the hardware encryption instruction set, the hardware encryption channel and the software encryption channel can be combined for encryption during the encryption process.

[0063] The encryption by using the hardware encryption channel refers to the encryption by using a hardware module. Specifically, a special hardware device or chip is used to implement the encryption function, the encryption algorithm is stored in a physically isolated chip, and the external device cannot directly read and modify the encryption algorithm. The encryption process is completed in the hardware.

[0064] For example, the encryption process based on the hardware encryption channel is implemented by loading an Advanced Encryption Standard-Galois / Counter Mode (AES-GCM) hardware acceleration module. The AES-GCM is a mode of AES encryption, corresponding to a special AES instruction set, which can be integrated in a CPU to improve the encryption speed of the AES at the hardware level. Thus, the AES-GCM hardware acceleration module can be understood as a hardware unit integrated in a special chip or processor, which implements parallel acceleration calculation of the AES and the GCM through a physical circuit. The core of the hardware acceleration module is to directly process the encryption algorithm by using the hardware circuit.

[0065] The encryption of the plaintext block data by using the software encryption channel refers to an encryption process implemented by using software and not relying on a special hardware, and the encryption algorithm is used to encrypt the transmitted plaintext data.

[0066] In the embodiments of the present application, the encryption algorithms used in the specific implementation of the hardware encryption channel and the software encryption channel are not limited.

[0067] After the encryption of the plaintext block data based on the hardware encryption channel or the software encryption channel, an encryption channel identifier is added to the encrypted ciphertext block data. The encryption channel identifier is used to represent that the encryption channel used is the hardware encryption channel or the software encryption channel. The length of the encryption channel identifier is not limited, for example, 1 bit or 16 bits can be used.

[0068] S103: The ciphertext block data is sent to the receiving end, so that the receiving end uses the hardware decryption mode or the software decryption mode matched with the encryption channel identifier to decrypt the ciphertext block data based on the derived private key in the derived session key pair, to obtain the plaintext block data.

[0069] After receiving each ciphertext block data, the receiving end can identify, according to the encryption channel identifier carried in the ciphertext block data, whether the ciphertext block data is encrypted by using the hardware encryption channel or the software encryption channel, and then uses the corresponding hardware encryption mode or software encryption mode based on the derived private key in the derived session key pair to decrypt the ciphertext block data.

[0070] By using the embodiments of the present application, in the case that the sending end supports the hardware encryption instruction set, the encryption process not only uses the software encryption channel, but also introduces the hardware encryption channel, which effectively alleviates the problem that a large amount of CPU resources are consumed in the data encryption process and the CPU instruction set needs to be frequently called in a high-throughput scenario. When the concurrent connections surge, the CPU utilization is also effectively reduced, and the scheduling delay and the overhead of context switching are reduced. For services with high real-time requirements, the response speed of the end-to-end can be accelerated, and the probability of triggering the timeout retransmission can be reduced.

[0071] In some embodiments of the present application, the plaintext block data is encrypted by using a hardware encryption channel and / or a software encryption channel, specifically including: alternately using the hardware encryption channel and the software encryption channel to encrypt the plaintext block data based on a polling strategy.

[0072] Polling refers to processing multiple targets in turn according to a preset order. In the embodiments of the present application, the plaintext block data is encrypted, and the hardware encryption channel and the software encryption channel can be alternately used for encryption. Thus, it is beneficial to load balancing of hardware algorithms and software algorithms, and adaptive switching of the two encryption modes is realized.

[0073] In some embodiments of the present application, during the process of encrypted transmission, the running state of the hardware module corresponding to the hardware encryption channel can be monitored. If the running state meets a preset critical running state, the proportion of encryption by using the software encryption channel is increased.

[0074] Specifically, if encryption is frequently performed by using a dedicated hardware, the running state of the corresponding hardware module will deteriorate, for example, the temperature will increase, thereby increasing power consumption and reducing running stability, etc. Therefore, the critical running state can be preset, and if it is detected that the running state of the hardware module corresponding to the hardware encryption channel reaches the critical running state, the proportion of encryption by using the software encryption channel is increased.

[0075] For example, the critical running state can include that the temperature of the hardware module reaches a preset temperature.

[0076] In the case of alternately using the hardware encryption channel and the software encryption channel based on the polling strategy, the proportion of the two is 50%, and if it is detected that the hardware module corresponding to the hardware encryption channel reaches the critical running state, the proportion of encryption by using the software encryption channel is increased, for example, to 75%.

[0077] It can be seen that, in the embodiments of the present application, by monitoring the running state of the hardware module corresponding to the hardware encryption channel and dynamically adjusting the proportion of encryption by using the hardware encryption channel and the software encryption channel, the load balancing of hardware algorithms and software algorithms is better realized, which can not only relieve the load of the CPU, but also ensure that the dedicated hardware encryption device or chip runs well.

[0078] Exemplarily, the AES-GCM and ChaCha20-Poly1305 (a software encryption method) double encryption algorithms can be deployed in parallel in the transport layer, where the AES-GCM algorithm realizes single-instruction-cycle encryption by means of the Advanced Encryption Standard New Instructions (AES-NI) instruction set, and belongs to a hardware encryption channel; the ChaCha20-Poly1305 algorithm avoids side-channel attacks by means of the Addition-Rotation-XOR (ARX) structure, and belongs to a software encryption channel. Both of them can adopt a 128-bit authentication tag to ensure data integrity, while also minimizing the consumption of system resources.

[0079] In some embodiments of the present application, if the CPU of the sending end does not support the hardware encryption instruction set, encryption cannot be performed based on a dedicated hardware encryption device or chip, and therefore, in the process of encrypted transmission, the software encryption channel is adopted to encrypt the plaintext block data based on the derived public key in the derived session key pair.

[0080] In the embodiments of the present application, the derived session key pair belongs to a temporary key pair, is valid only in the transport layer, and is generated after the identity authentication of the communication parties is completed. The authentication process of the communication parties is introduced below, which involves the authentication layer of the SDP encrypted transmission.

[0081] In some embodiments of the present application, the derived session key pair is generated based on the shared key material under the condition that the sending end and the receiving end meet the identity authentication; wherein the shared key material is generated according to the private key in the first temporary key pair of any one of the communication parties and the public key in the second temporary key pair of the other party.

[0082] Exemplarily, referring to Figure 2 , Figure 2 The flowchart for generating the derived session key pair provided in the embodiments of the present application includes the following steps:

[0083] Step S201: Session establishment.

[0084] Step S202: Generating a temporary key pair by using an encryption algorithm.

[0085] Exemplarily, the Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) algorithm is used to generate the temporary key pair. In each session establishment, the communication parties dynamically generate a temporary elliptic curve public-private key pair.

[0086] Step S203: Locally storing the private key.

[0087] Step S204: exchange public keys based on the secure channel. If successful, perform S206; if failed, perform S205.

[0088] Step S205: session termination.

[0089] Step S206: perform elliptic curve point multiplication operation to generate shared key material.

[0090] Specifically, in the temporary key pair, the private key is only kept locally, and the public key is exchanged through a certificate or a secure channel, ensuring the temporary nature of the key and achieving forward security.

[0091] Both parties use the exchanged temporary public key to generate shared key material through elliptic curve point multiplication operation. Specifically, after exchanging public keys, point multiplication operation is performed with the private key and the public key of the other party to generate shared key material. Due to the mathematical properties of the elliptic curve, both parties will obtain the same point, and the coordinates of this point can be used as shared key material.

[0092] Step S207: perform identity verification. If verification fails, perform S205; if verification succeeds, perform S208.

[0093] This step is used to implement identity verification in combination with locally stored private keys. For example, identity verification and short signature can be performed based on the Elliptic Curve Digital Signature Algorithm (ECDSA) algorithm.

[0094] The requester signs the session characteristics using its own private key, and the responder can verify the signature using the requester's public key. If the verification is successful, the identity verification is completed.

[0095] S208: generate a derived session key pair based on the shared key material.

[0096] Both parties of the communication obtain shared key material, and can further generate a key pair using a key derivation algorithm. The key pair is used for session encryption, so it is called a derived session key pair. For example, Password-Based Key Derivation Function 2 (PBKDF2), HMAC-Based Key Derivation Function (HKDF), etc. can be used to generate the key pair.

[0097] S209: destroy the derived session key pair after the session ends.

[0098] It can be seen that, in the embodiment of the application, the short signature is used to reduce the signature verification time through the ECDSA algorithm based on the elliptic curve digital signature in the authentication layer; in order to improve the efficiency of key negotiation, the ECDHE algorithm is used to realize the forward secure key negotiation, and a temporary key pair is generated at each session establishment to resist replay attacks.

[0099] In addition to the authentication of the two parties in communication and the establishment of a secure encrypted channel, secure storage and efficient reading of the key are also an important part of balancing security and efficiency in the process of zero-trust SDP communication. In the embodiment of the application, the key is additionally designed in the storage layer, and the key is not directly stored locally, but is stored after encryption by encryption means.

[0100] Specifically, in one embodiment of the application, the local key is stored in the following manner: the local key includes a derived session key pair and / or a temporary key pair; the local key is divided into blocks to obtain local block keys and index serial numbers of each local block key; for each local block key, the index serial number is encrypted using a first encryption key to obtain a block index value; based on a second encryption key, the local block key and the block index value are encrypted to obtain an encrypted block key; and each encrypted block key is spliced and stored.

[0101] For example, referring to Figure 3 , Figure 3 A flowchart for encrypting and storing the local key is provided in the embodiment of the application.

[0102] First, two independent keys of the encryption mode are initialized. Specifically, the first encryption key (key1) and the second encryption key (key2) are included.

[0103] The first encryption key and the second encryption key can be generated by a secure module of the system or hardware, and can be bound to a trusted element such as a local user identity.

[0104] Subsequently, the local key to be stored is divided into blocks and encrypted by the first encryption key and the second encryption key.

[0105] For example, based on 128-bit block division, local block keys are obtained. For each local block key, an index serial number is generated when the block is divided.

[0106] For each local block key, the index serial number is encrypted using the first encryption key to obtain a block index value. Subsequently, based on the second encryption key, the local block key and the block index value are encrypted to obtain an encrypted block key.

[0107] For example, referring to Figure 3For the index number of the block, an XTS encryption mode with tweak and ciphertext stealing (XTS) encryption algorithm is used to encrypt the index number of the block to obtain a block index value. Then the encryption result of the XTS encryption and 128 blocks are spliced, and then AES encryption is performed to obtain the block ciphertext encrypted with the XTS index, that is, the encrypted block key. The encrypted block key can be spliced and stored on disk.

[0108] When the authentication layer or the transmission layer needs to read the local key, the encrypted block key is decrypted twice, and after decryption, the local key in plaintext can be obtained by splicing according to the index number.

[0109] It can be seen that in the embodiment of the application, the AES-XTS mode is selected for processing static data in the storage layer, and the double key structure effectively resists ciphertext diffusion attack. In the embodiment of the application, the three-layer architecture can be connected through the Transport Layer Security (TLS) protocol: the authentication layer generates the master key after completing identity verification, the transmission layer extends the session key, and finally the storage layer persistently stores the key, forming a complete encryption chain from identity authentication to data storage.

[0110] The above mainly introduces the scheme provided by the embodiment of the application from the perspective of the method. In order to realize the above functions, the encryption transmission device or the electronic device includes the hardware structure and / or software module corresponding to each function. Those skilled in the art should easily realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present text can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is realized in the form of hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0111] The embodiment of the application can divide the functional modules of the encryption transmission device or the electronic device according to the above method, for example, the encryption transmission device or the electronic device can include each functional module corresponding to each functional division, or two or more functions can be integrated in one processing module. The integrated module can be realized in the form of hardware or in the form of a software functional module. It should be noted that the division of the modules in the embodiment of the application is illustrative, and is only a logical functional division. Actual implementation can have another division method.

[0112] Figure 4is a block diagram of an encryption transmission device according to an exemplary embodiment. Referring to Figure 4 The device comprises:

[0113] An acquisition module 401 is configured to acquire plaintext data to be transmitted, block the plaintext data to obtain plaintext block data.

[0114] An encryption module 402 is configured to, in the case of supporting a hardware encryption instruction set, encrypt the plaintext block data based on a derived public key in a derived session key pair, using a hardware encryption channel and / or a software encryption channel, and add an encryption channel identifier to the encrypted ciphertext block data; the encryption channel identifier is used to represent that the encryption channel used is the hardware encryption channel or the software encryption channel.

[0115] A sending module 403 is configured to send the ciphertext block data to a receiving end, so that the receiving end decrypts the ciphertext block data based on a derived private key in the derived session key pair, using a hardware decryption method or a software decryption method that is adapted to the encryption channel identifier, to obtain the plaintext block data.

[0116] In one possible implementation, the encryption module 402 is specifically configured to encrypt the plaintext block data using the hardware encryption channel and the software encryption channel alternately based on a polling strategy.

[0117] In one possible implementation, the device further comprises a monitoring module configured to monitor a running state of a hardware module corresponding to the hardware encryption channel; and in the case that the running state meets a preset critical running state, increase the proportion of encryption using the software encryption channel.

[0118] In one possible implementation, the encryption module is further configured to, in the case of not supporting the hardware encryption instruction set, encrypt the plaintext block data using the software encryption channel based on the derived public key in the derived session key pair.

[0119] In one possible implementation, the derived session key pair is generated based on shared key material under the condition that the sending end and the receiving end meet identity authentication; the shared key material is generated according to a temporary private key in a first temporary key pair of any one of the two communication parties and a temporary public key in a second temporary key pair of the other party.

[0120] In one possible implementation, the device further comprises a storage module configured to:

[0121] save a local key in the following manner; the local key comprises the derived session key pair and / or the temporary key pair:

[0122] The local key is divided into blocks to obtain a local block key and an index number of each local block key;

[0123] For each local block key, the index number is encrypted using a first encryption key to obtain a block index value; and the local block key and the block index value are encrypted based on a second encryption key to obtain an encrypted block key;

[0124] Each encrypted block key is spliced and written to a disk.

[0125] In a possible manner, the first encryption key and / or the second encryption key are generated according to permission information of a local user identity.

[0126] Figure 5 is a block diagram of an electronic device according to an exemplary embodiment. As shown in Figure 5 , the electronic device includes but is not limited to a processor 501 and a memory 502.

[0127] The memory 502 is configured to store executable instructions of the processor 501. It can be understood that the processor 501 is configured to execute the instructions to implement the vehicle back door control method in the above embodiment.

[0128] It should be noted that those skilled in the art can understand that the electronic device structure shown in Figure 5 does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than Figure 5 shown, or combine certain components, or different component arrangements.

[0129] The processor 501 is the control center of the electronic device, which connects each part of the entire electronic device through various interfaces and lines, executes the software programs and / or modules stored in the memory 502, and calls the data stored in the memory 502, to perform various functions of the electronic device and process data, thereby overall monitoring the electronic device. The processor 501 can include one or more processing units. Optionally, the processor 501 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application programs, and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 501.

[0130] The memory 502 can be used to store software programs and various data. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs (such as a determination unit, a processing unit, etc.) required by at least one function module, and the like. In addition, the memory 502 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device or other volatile solid-state memory device.

[0131] In the example embodiments, a computer readable storage medium including instructions, for example, the memory 502 including instructions, is also provided, and the instructions can be executed by the processor 501 of the electronic device to implement the method in the above embodiments.

[0132] Optionally, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, the non-transitory computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0133] In the example embodiments, the embodiments of the present application also provide a computer program product including one or more instructions, which can be executed by the processor of the electronic device to complete the method in the above embodiments.

[0134] It should be noted that the instructions in the above computer readable storage medium or the one or more instructions in the computer program product are executed by the processor of the electronic device to realize each process of the above method embodiments, and can achieve the same technical effects as the above method. To avoid repetition, it will not be described here.

[0135] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is taken as an example for illustration, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0136] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the division of the apparatus embodiments is merely an example, and for example, the division of the modules or units can be different, and for example, multiple modules or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0137] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, i.e., may be located in one place, or may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0138] In addition, each functional unit in the various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0139] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes several instructions to make a device (which can be a single chip, a chip, etc.) or a processor execute all or part of the steps of the various embodiments of the method of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various media that can store program codes.

[0140] The above is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for encrypted transmission, characterized in that, The method, applied to the sending end of encrypted transmission, includes: Obtain the plaintext data to be transmitted, and divide the plaintext data into blocks to obtain plaintext block data; When hardware encryption instruction sets are supported, the plaintext block data is encrypted using a hardware encryption channel and / or a software encryption channel based on the derived public key in the derived session key pair, and an encryption channel identifier is added to the encrypted ciphertext block data; the encryption channel identifier is used to identify whether the encryption channel used is the hardware encryption channel or the software encryption channel. The encrypted block data is sent to the receiving end so that the receiving end can decrypt it using a hardware decryption method or a software decryption method adapted to the encrypted channel identifier based on the derived private key in the derived session key pair, thereby obtaining the plaintext block data.

2. The encrypted transmission method according to claim 1, characterized in that, The encryption of the plaintext block data using hardware encryption channels and / or software encryption channels includes: The plaintext block data is encrypted using a polling strategy, alternating between the hardware encryption channel and the software encryption channel.

3. The encrypted transmission method according to claim 1 or 2, characterized in that, The method further includes: Monitor the operating status of the hardware module corresponding to the hardware encryption channel; When the operating state meets the preset critical operating state, the proportion of encryption using the software encryption channel is increased.

4. The encrypted transmission method according to claim 1, characterized in that, In the absence of a hardware encryption instruction set, the plaintext block data is encrypted using the software encryption channel based on the derived public key in the derived session key pair.

5. The encrypted transmission method according to claim 1, characterized in that, The derived session key pair is generated based on shared key material under the condition that the sending end and the receiving end satisfy identity authentication; wherein, the shared key material is generated based on the temporary private key in the first temporary key pair of either party and the temporary public key in the second temporary key pair of the other party.

6. The encrypted transmission method according to claim 1 or 5, characterized in that, The local key is stored in the following manner; the local key includes the derived session key pair and / or temporary key pair: The local key is divided into blocks to obtain local block keys and the index number of each local block key; For each of the local block keys, the index number is encrypted using the first encryption key to obtain the block index value; Based on the second encryption key, the local block key and the block index value are encrypted to obtain the encrypted block key; The encryption block keys described above are concatenated and then written to disk.

7. The encrypted transmission method according to claim 6, characterized in that, The first encryption key and / or the second encryption key are generated based on the user's local identity and permission information.

8. An encrypted transmission device, characterized in that, The device includes: The acquisition module is used to acquire plaintext data to be transmitted, and to divide the plaintext data into blocks to obtain plaintext block data; An encryption module is used, when supporting a hardware encryption instruction set, to encrypt the plaintext block data using a hardware encryption channel and / or a software encryption channel based on the derived public key in the derived session key pair, and to add an encryption channel identifier to the encrypted ciphertext block data; the encryption channel identifier is used to indicate that the encryption channel used is the hardware encryption channel or the software encryption channel. The sending module is used to send the encrypted block data to the receiving end, so that the receiving end can decrypt the plaintext block data based on the derived private key in the derived session key pair using a hardware decryption method or a software decryption method adapted to the encrypted channel identifier.

9. An electronic device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the method according to any one of claims 1-7.

Images