Method and system for one-way data transmission between physically isolated networks based on a national cryptographic algorithm

Abstract

The application discloses a one-way data transmission method and system between physically isolated networks based on a national secret algorithm, and relates to the technical field of computer information network security. The method comprises the following steps: a sending terminal processes an encryption public key and a random number by using an SM9 algorithm, and displays a key-encapsulated two-dimensional code; a receiving terminal decodes and verifies the key-encapsulated two-dimensional code, and obtains an encapsulated key if the verification is passed; the sending terminal encrypts original data by using an SM4_GCM algorithm, obtains ciphertext, performs RaptorQ encoding on the ciphertext to obtain redundant data fragments, and encodes and processes auxiliary information and the redundant data fragments, and displays a two-dimensional code sequence; the receiving terminal decodes and verifies the two-dimensional code sequence, and obtains decrypted data if the verification is passed; and a hash value of the decrypted data is calculated by using an SM3 algorithm, and data transmission is completed if the hash value is consistent with a hash value of the original data, so that safe, efficient and reliable data transmission can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer information network security, in particular to a one-way data transmission method and system between physically isolated networks based on a national cryptographic algorithm. BACKGROUND

[0002] With the rapid development of information technology, networks have become a core component of social infrastructure. However, in an open network environment, computer systems in critical areas face the significant security risk of sensitive data leakage. For this reason, classified information systems usually adopt a physical isolation strategy to block potential network attack paths. However, in actual business, there is still a need for data exchange between networks of different security levels. Currently, the physical isolation transmission technology based on two-dimensional codes has shown certain real-time advantages in low-speed scenarios, but the existing technology mainly realizes data transmission through two-dimensional code encoding, simple encryption and verification mechanisms, and still has significant security and efficiency defects. For example, some existing technologies use random sequences for data encryption and combine verification algorithms (CRC algorithm and MD5 algorithm) to ensure data integrity, but the transmission process still relies on manual key setting by the user, increasing the operation complexity. Another existing technology improves the transmission bandwidth through color two-dimensional codes, but only performs simple encryption on the data, lacking a threefold protection mechanism for data stream confidentiality, authenticity and integrity; this makes it possible for attackers to inject malicious two-dimensional codes through the transmission channel, implanting viruses into the isolated network, or stealing files by continuously intercepting two-dimensional code streams. In addition, the existing technology generally has a conflict between security and operational convenience, and excessive verification steps reduce the practicality of the system.

[0003] The main problems faced by the existing technology can be summarized as follows: First, key management defects; static keys rely on manual configuration and lack an automatic update mechanism, which not only has the risk of brute force cracking, but also is difficult to adapt to large-scale deployment needs. Second, algorithm coordination deficiency; traditional encryption algorithms and channel coding techniques are designed in a fragmented state, and the multiple utility reuse of coding redundancy cannot be achieved through joint optimization, making it difficult to simultaneously improve data confidentiality, integrity and channel error code resistance reliability. Finally, transmission control contradiction; the feedback-based retransmission mechanism conflicts with the one-way transmission characteristics of physically isolated networks, and it is impossible to detect and recover packet loss through a reverse channel, and the same two-dimensional code will be generated repeatedly, causing waste of transmission resources.

[0004] In summary, how to solve the systematic defects of the existing technology in key management, algorithm coordination and transmission control, and achieve efficient and reliable data transmission under the premise of ensuring security, has become a technical problem to be solved. SUMMARY

[0005] The purpose of the present application is to provide a one-way data transmission method and system between physically isolated networks based on a national secret algorithm, which can realize safe, efficient and reliable data transmission.

[0006] To achieve the above purpose, the present application provides the following solutions.

[0007] In a first aspect, the present application provides a one-way data transmission method between physically isolated networks based on a national secret algorithm, comprising:

[0008] The sending terminal performs key encapsulation and digital signature on the obtained encryption public key of the receiving terminal and the preset random number by using the SM9 algorithm, obtains a key encapsulation two-dimensional code, and displays the key encapsulation two-dimensional code through a display device;

[0009] The receiving terminal obtains the key encapsulation two-dimensional code through a collection device, and performs decoding verification on the key encapsulation two-dimensional code, and if the verification is passed, the encapsulated key is obtained;

[0010] The sending terminal performs encryption processing on the original data by using the SM4_GCM algorithm, and obtains ciphertext with an authentication tag;

[0011] The sending terminal performs RaptorQ encoding on the ciphertext, and obtains redundant data fragments;

[0012] The sending terminal performs encoding processing on the obtained auxiliary information and redundant data fragments, obtains a two-dimensional code sequence, and displays the two-dimensional code sequence through a display device; the auxiliary information includes verification information, and the verification information is a hash value of the original data;

[0013] The receiving terminal obtains the two-dimensional code sequence through a collection device, and performs decoding verification on the two-dimensional code sequence based on the encapsulated key, and if the verification is passed, the decrypted data is obtained;

[0014] The receiving terminal calculates the hash value of the decrypted data by using the SM3 algorithm, and judges whether the hash value of the decrypted data is consistent with the hash value of the original data, and if consistent, the data transmission is completed.

[0015] Optionally, the sending terminal performs key encapsulation and digital signature on the obtained encryption public key of the receiving terminal and the preset random number by using the SM9 algorithm, and obtains a key encapsulation two-dimensional code, specifically comprising:

[0016] The sending terminal performs key encapsulation on the obtained encryption public key of the receiving terminal and the preset random number by using the SM9 algorithm, and obtains an encapsulated key;

[0017] The sending terminal performs digital signature on the encapsulated key by using a preset signature private key, and obtains a signature result;

[0018] The sending terminal encodes the signature result into a key encapsulation two-dimensional code.

[0019] Optionally, the sending terminal uses the SM4_GCM algorithm to encrypt the original data to obtain ciphertext with an authentication tag, specifically including:

[0020] The sending terminal uses the encapsulation key and a preset initial vector value to encrypt the original data, resulting in ciphertext with an authentication tag.

[0021] Optionally, the sending terminal performs RaptorQ encoding on the ciphertext to obtain redundant data fragments, specifically including:

[0022] The sending terminal performs RaptorQ encoding on the ciphertext to obtain encoded data packets; the encoded data packets include multiple original data packets and multiple redundant data packets.

[0023] The encoded data packet is fragmented according to the data capacity of the QR code to obtain redundant data fragments; the data capacity of the QR code is determined based on the obtained QR code version number and error correction level parameters.

[0024] Optionally, the QR code sequence includes auxiliary information QR codes and a data QR code stream; the sending terminal encodes the acquired auxiliary information and redundant data fragments to obtain the QR code sequence, specifically including:

[0025] The sending terminal uses the SM9 algorithm to digitally sign the auxiliary information to obtain the auxiliary information signature; the auxiliary information also includes encryption parameters and metadata, the encryption parameters are the initial vector value and the authentication tag, and the metadata is the size of the original data and the total number of fragments;

[0026] The auxiliary information and its signature are encoded into a QR code.

[0027] Redundant data is fragmented and encoded into a data QR code stream.

[0028] Optionally, the receiving terminal acquires the QR code sequence through the acquisition device and decodes and verifies the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained, specifically including:

[0029] The receiving terminal acquires the QR code sequence through the acquisition device and decodes the QR code sequence based on the encapsulation key to obtain auxiliary information, auxiliary information signature and redundant data fragments;

[0030] The receiving terminal uses a preset encryption public key to verify the signature of the auxiliary information. If the verification is successful, it begins to cache redundant data fragments in sequence.

[0031] When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to restore the ciphertext.

[0032] The receiving terminal decrypts the ciphertext using SM4_GCM based on auxiliary information and verifies the authentication tag. If the verification is successful, the decrypted data is output.

[0033] Optionally, when the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to recover the ciphertext, specifically including:

[0034] When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal constructs a sparse equation system based on the received redundant data fragments.

[0035] The receiving terminal uses Gaussian elimination to solve the sparse equation system and recover the ciphertext.

[0036] Optionally, the redundancy coefficient of RaptorQ coding is dynamically adjusted based on channel quality.

[0037] Optionally, if the receiving terminal fails to verify any of the key encapsulation QR code, auxiliary information signature, or authentication tag, it shall terminate the data transmission.

[0038] Secondly, this application provides a unidirectional data transmission system between physically isolated networks based on national cryptographic algorithms, comprising:

[0039] The transmitting terminal is used to encapsulate and digitally sign the encrypted public key of the receiving terminal and a preset random number using the SM9 algorithm to obtain a key-encapsulated QR code, and then display the key-encapsulated QR code through a display device.

[0040] The receiving terminal is used to acquire the key-encapsulated QR code through the acquisition device, and to decode and verify the key-encapsulated QR code. If the verification is successful, the encapsulated key is obtained.

[0041] The sending terminal is used to encrypt the original data using the SM4_GCM algorithm to obtain ciphertext with an authentication tag;

[0042] The sending terminal is used to perform RaptorQ encoding on the ciphertext to obtain redundant data fragments;

[0043] The transmitting terminal is used to encode the acquired auxiliary information and redundant data fragments to obtain a QR code sequence, and then display the QR code sequence through a display device; the auxiliary information includes verification information, which is the hash value of the original data;

[0044] The receiving terminal is used to acquire the QR code sequence through the acquisition device, and to decode and verify the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained.

[0045] The receiving terminal is used to calculate the hash value of the decrypted data using the SM3 algorithm, and to determine whether the hash value of the decrypted data is consistent with the hash value of the original data. If they are consistent, the data transmission is completed.

[0046] According to the specific embodiments provided in this application, the following technical effects are disclosed:

[0047] This application provides a method for one-way data transmission between physically isolated networks based on Chinese national cryptographic algorithms. The sending terminal utilizes the SM9 algorithm for key encapsulation and digital signature, and transmits the key via a QR code, eliminating the risks associated with traditional manual configuration of static keys. Furthermore, the dynamic generation and transmission of keys enhances the security of the key exchange process. Simultaneously, the SM9 algorithm supports high-security key encapsulation combined with digital signatures, effectively preventing key leakage or brute-force attacks, while ensuring automated key update management and adapting to large-scale deployment needs.

[0048] By using the SM4_GCM algorithm to encrypt the data, combined with authentication tags, the confidentiality and integrity of the data are ensured.

[0049] By using RaptorQ encoding on the ciphertext, redundant data fragmentation can be provided, enabling the receiver to recover the original data through decoding even if some data is lost or corrupted, thereby enhancing fault tolerance and reliability during transmission. Moreover, in this process, redundant data fragmentation is not only used for data recovery, but also achieves multiple-purpose reuse in channel transmission through joint optimization, thus simultaneously improving data confidentiality, integrity, and reliability against channel errors.

[0050] Transmitting data via QR code sequences resolves the fundamental conflict between feedback retransmission mechanisms and one-way transmission. As a data carrier, QR codes avoid packet loss recovery issues caused by the unavailability of the reverse channel in physically isolated network environments.

[0051] In addition, the receiving terminal calculates the hash value of the decrypted data and compares it with the hash value of the original data to ensure that the transmitted data has not been tampered with, thus further guaranteeing the integrity of the data. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1A flowchart illustrating a method for one-way data transmission between physically isolated networks based on national cryptographic algorithms, provided in Embodiment 1 of this application;

[0054] Figure 2 A schematic diagram of a network module for a one-way data transmission system between physically isolated networks based on national cryptographic algorithms, provided in Embodiment 2 of this application;

[0055] Figure 3 A schematic diagram illustrating the working process of a one-way data transmission system between physically isolated networks based on national cryptographic algorithms, provided in Embodiment 2 of this application;

[0056] Figure 4 This is a schematic diagram of the RaptorQ encoding and RaptorQ decoding process provided in Embodiment 2 of this application. Detailed Implementation

[0057] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, this application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] Example 1

[0060] In one exemplary embodiment, such as Figure 1 As shown, a method for unidirectional data transmission between physically isolated networks based on Chinese cryptographic algorithms is provided. This method can be applied to two physically isolated networks. The method is executed by a sending terminal and a receiving terminal, and includes the following steps 101 to 107. Wherein:

[0061] Step 101: The sending terminal uses the SM9 algorithm to encapsulate and digitally sign the encrypted public key of the receiving terminal and a preset random number to obtain a key encapsulation QR code, and displays the key encapsulation QR code through a display device.

[0062] Step 102: The receiving terminal obtains the key encapsulation QR code through the acquisition device, and decodes and verifies the key encapsulation QR code. If the verification is successful, the encapsulation key is obtained.

[0063] Step 103: The sending terminal uses the SM4_GCM algorithm to encrypt the original data to obtain ciphertext with authentication tags.

[0064] Step 104: The sending terminal performs RaptorQ encoding on the ciphertext to obtain redundant data fragments.

[0065] Step 105: The sending terminal encodes the acquired auxiliary information and redundant data fragments to obtain a QR code sequence, and displays the QR code sequence through a display device; the auxiliary information includes verification information, which is the hash value of the original data.

[0066] Step 106: The receiving terminal acquires the QR code sequence through the acquisition device and decodes and verifies the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained.

[0067] Step 107: The receiving terminal uses the SM3 algorithm to calculate the hash value of the decrypted data and determines whether the hash value of the decrypted data is consistent with the hash value of the original data. If they are consistent, the data transmission is completed.

[0068] By implementing steps 101 to 107 above, the transmitting terminal of this application utilizes the SM9 algorithm for key encapsulation and digital signature, and transmits the key via a QR code. This eliminates the risks associated with traditional manual configuration of static keys, and enhances the security of the key exchange process through dynamic key generation and transmission. Simultaneously, the SM9 algorithm supports high-security key encapsulation combined with digital signatures, effectively preventing key leakage or brute-force attacks, while ensuring automated key update management and adaptability to large-scale deployment needs. By using the SM4_GCM algorithm to encrypt data, combined with authentication tags, data confidentiality and integrity are ensured. RaptorQ encoding of the ciphertext provides redundant data fragmentation, enabling the receiver to recover the original data through decoding even if some data is lost or corrupted, thereby enhancing fault tolerance and reliability during transmission. Moreover, in this process, redundant data fragmentation is not only used for data recovery but also achieves multiple-use multiplexing in channel transmission through joint optimization, thus simultaneously improving data confidentiality, integrity, and reliability against channel errors. Transmitting data via QR code sequences resolves the fundamental conflict between feedback retransmission mechanisms and one-way transmission. Using QR codes as data carriers avoids packet loss recovery issues caused by the unavailability of the reverse channel in physically isolated network environments. Furthermore, the receiving terminal calculates the hash value of the decrypted data and compares it with the hash value of the original data to ensure that the transmitted data has not been tampered with, further guaranteeing data integrity.

[0069] Furthermore, the transmitting terminal uses the SM9 algorithm to encapsulate and digitally sign the received terminal's encrypted public key and a preset random number, resulting in a key-encapsulated QR code, specifically including:

[0070] The transmitting terminal uses the SM9 algorithm to encapsulate the received terminal's encrypted public key and a preset random number to obtain the encapsulation key.

[0071] The sending terminal uses a preset signature private key to digitally sign the encapsulation key, thus obtaining the signature result.

[0072] The sending terminal encodes the signature result into a key-encapsulated QR code.

[0073] Furthermore, the sending terminal uses the SM4_GCM algorithm to encrypt the original data, obtaining ciphertext with an authentication tag, specifically including:

[0074] The sending terminal uses the encapsulation key and a preset initial vector value to encrypt the original data, resulting in ciphertext with an authentication tag.

[0075] Furthermore, the sending terminal performs RaptorQ encoding on the ciphertext to obtain redundant data fragments, specifically including:

[0076] The sending terminal performs RaptorQ encoding on the ciphertext to obtain encoded data packets; the encoded data packets include multiple original data packets and multiple redundant data packets.

[0077] The encoded data packet is fragmented according to the data capacity of the QR code to obtain redundant data fragments; the data capacity of the QR code is determined based on the obtained QR code version number and error correction level parameters.

[0078] Furthermore, the QR code sequence includes auxiliary information QR codes and a data QR code stream; the sending terminal encodes the acquired auxiliary information and redundant data fragments to obtain the QR code sequence, specifically including:

[0079] The sending terminal uses the SM9 algorithm to digitally sign the auxiliary information to obtain the auxiliary information signature; the auxiliary information also includes encryption parameters and metadata, the encryption parameters are the initial vector value and the authentication tag, and the metadata is the size of the original data and the total number of fragments.

[0080] The auxiliary information and its signature are encoded into a QR code.

[0081] Redundant data is fragmented and encoded into a data QR code stream.

[0082] Furthermore, the receiving terminal acquires the QR code sequence through the acquisition device and decodes and verifies the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained, specifically including:

[0083] The receiving terminal acquires the QR code sequence through the acquisition device and decodes the QR code sequence based on the encapsulation key to obtain auxiliary information, auxiliary information signature, and redundant data fragments.

[0084] The receiving terminal uses a preset encryption public key to verify the signature of the auxiliary information. If the verification is successful, it begins to cache redundant data fragments in sequence.

[0085] When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to restore the ciphertext.

[0086] The receiving terminal decrypts the ciphertext using SM4_GCM based on auxiliary information and verifies the authentication tag. If the verification is successful, the decrypted data is output.

[0087] Furthermore, when the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to recover the ciphertext, specifically including:

[0088] When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal constructs a sparse equation system based on the received redundant data fragments.

[0089] The receiving terminal uses Gaussian elimination to solve the sparse equation system and recover the ciphertext.

[0090] Furthermore, the redundancy coefficient of RaptorQ coding is dynamically adjusted based on channel quality.

[0091] Furthermore, if the receiving terminal fails to verify any of the key encapsulation QR code, auxiliary information signature, or authentication label, it will terminate data transmission.

[0092] Example 2

[0093] Based on the same inventive concept, this application also provides a unidirectional data transmission system for implementing the aforementioned method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms. The solution provided by this system is similar to the implementation described in the above method; therefore, the specific limitations of one or more unidirectional data transmission system embodiments provided below can be found in the limitations of the unidirectional data transmission method described above, and will not be repeated here.

[0094] In one exemplary embodiment, such as Figure 2As shown, a one-way data transmission system between physically isolated networks based on national cryptographic algorithms is provided. The system includes two physically isolated networks, each primarily containing a computer, a server, and a QR code processing terminal. The computer stores user data, the server manages the QR code processing terminal and acts as a data relay between the computer and the terminal, and the terminal handles data encryption, QR code sequence generation, and decryption. To achieve strict one-way transmission, the QR code processing terminal is divided into a sending terminal and a receiving terminal. The sending and receiving terminals have different hardware. The sending terminal consists of a processor and a high refresh rate display (i.e., a display device). The processor integrates an encryption algorithm module, and the high refresh rate display is dedicated to dynamically displaying the encrypted QR code stream. The receiving terminal consists of a high-speed camera module, a processor, and a status display. The high-speed camera optically captures the screen content of the sending terminal, the processor performs decryption and data reconstruction, and the status display provides feedback on transmission progress and security status. The specific working process of this system mainly includes a system initialization stage, a data preprocessing stage, a data fragmentation and transmission stage, and a data aggregation and decryption stage. The specific working process is as follows: Figure 3 As shown.

[0095] I. System initialization phase.

[0096] Before one-way data transmission, the Key Generation Center (KGC) needs to generate the system parameters, signing private key, signing public key, encryption private key, and encryption public key required for each terminal to run, and write them to the terminal. The KGC is represented by a USB key, and the administrator updates the SM9 key and system parameters to the server and QR code processing terminal. The KGC determines the required system parameters, which mainly include the Curve Identifier (CId), curve parameters, and a large prime-order cyclic subgroup. and and its generators (base points) and Bilinear pair The identifier eid, arrive homomorphism .

[0097] The process of generating the KGC system signing key (i.e., the signing master public key and signing master private key) and the user signing key (i.e., the signing private key) is as follows:

[0098] a) KGC generates random numbers random numbers As the master private key for signing Stored and computed by KGC elements in KGC publicly discloses the signature master public key. and the function identifier generated by the signature master private key , and system parameters.

[0099] b) Assumption Let A be the identifier of user A (corresponding to the terminal where the event occurs), then user A's signing private key. The calculation process is as follows: KGC first calculates... ,in, It is determined by user identification (such as...) ID A ) and the signing master private key (such as Intermediate values ​​generated through hash operations, This is a cryptographic hash function (used to map to integers). Based on The order; if Then it is necessary to go back to the previous step to recalculate the signing master private key and update the signing master public key and the existing user's private key; otherwise, calculate... ,in, This is an intermediate variable used to generate the user-signed private key; finally, it is calculated. .

[0100] The process of generating the KGC system's encryption master key and user encryption keys (i.e., encryption public key and encryption private key) is as follows:

[0101] a) KGC generates random numbers random numbers As the master private key for encryption, and it is required that... , Stored and computed by KGC elements in KGC publicly discloses the cryptographic master public key. and the function identifier for generating the signing private key , and system parameters.

[0102] b) Assumption Let B be the identifier of user B (corresponding to the receiving terminal), then user B's encrypted private key. The calculation process is as follows: KGC first calculates... ,like Then it is necessary to go back to the previous step to recalculate the encryption master private key and update the signing master public key and the existing user's private key; otherwise, calculate... Finally, calculate .

[0103] c) User B's encrypted public key Other users, based on publicly available system parameters, and The calculation yields the following results: The administrator then writes the system parameters, signing private key, signing public key, encryption private key, encryption public key, and other information required for each terminal to run into the corresponding terminal.

[0104] II. Data Preprocessing Stage.

[0105] Terminal A (i.e., the sending terminal) buffers the raw data SD to be sent, then performs a hash operation to obtain the hash value of the data. Terminal A then generates the key used for this round of data transmission, and generates an encrypted random number. And use the stored public key of terminal B (i.e., the receiving terminal) for encryption. Encapsulate encrypted random numbers using the SM9 algorithm (Calculated according to formula (1)), if If not all values ​​are 0, output the encapsulated ciphertext. C ,like If all values ​​are 0, recalculate. The specific formula is shown below:

[0106] (1);

[0107] in, For the encapsulation key, As an intermediate variable, They are bilinear pairs. As an intermediate variable, As an intermediate variable, This is the identifier for user B (corresponding to the receiving terminal). This refers to the key length, which is 128 bits in this system. This is the key derivation function. The key derivation algorithm in this system is the SM3 algorithm. Intermediate variables refer to the temporary calculation results in the signing, encryption, verification and decryption processes.

[0108] Terminal A then processed the ciphertext C To perform the signing, terminal A generates a random signature number. and using the signing private key Calculated according to formula (2), if Then recalculate. After terminal A completes the signature, it will send the ciphertext... C ciphertext signature ( h , S The code is formatted as JSON and then converted into a key-encapsulated QR code for display on the screen. The specific formula is shown below:

[0109] (2);

[0110] in, As an intermediate variable, A cryptographic hash function used for signing. As an intermediate variable, As an intermediate variable, For the signature random number, This is the master public key for signing.

[0111] Terminal B identifies the key-encapsulated QR code and obtains the received encapsulated ciphertext. Then, use the received ciphertext to sign. First, verify the ciphertext signature sent. h , S The validity of ) is tested. and Whether it is true or not, if it is true, it is calculated according to formula (3), the specific formula is as follows:

[0112] (3);

[0113] in, As an intermediate variable, As an intermediate variable, As an intermediate variable, This is the theoretical hash value to be output. As an intermediate variable, This is the theoretical hash value output. If correct, it matches... same.

[0114] Terminal B test If the signature is valid, then the received encapsulated ciphertext is processed. The lockdown has been lifted.

[0115] First, verify. If the condition is not met, an error message will be displayed and the program will exit. Calculations will be performed according to formula (4). If not all values ​​are 0, then the encapsulation key is cached. If all values ​​are 0, an error message will be displayed and the current round of acceptance will be terminated.

[0116] (4);

[0117] in, This is user B's encryption private key, and the private key used for decryption; This is the identifier for user B (corresponding to the receiving terminal).

[0118] Then terminal A uses the key SM4-GCM calculation is performed to obtain additional authentication tags. and the encrypted original data (i.e., ciphertext).

[0119] In this application, the symbol alignment parameter in RaptorQ encoding is set to 8 bytes. The number of original data packets K and the number of redundant data packets M obtained after RaptorQ encoding are calculated according to formula (5).

[0120] (5);

[0121] in, As an intermediate variable, The length of the RaptorQ encoded data fragment. The number of packets after RaptorQ encoding. For the number of redundant data packets, Set the maximum number of QR code symbols that can be carried by the current user (i.e., the data capacity of the QR code). The length of the encrypted data bytes, This refers to the redundancy rate.

[0122] Terminal A then caches the K+M packets obtained after RaptorQ encoding to the hard disk.

[0123] III. Data Fragmentation and Transmission Stage.

[0124] Terminal A uses the initial vector value (IV) generated by SM4-GCM encryption, the authentication tag (TAG), records the size of the original data, the total number of fragments, and the hash value of the original data, and signs the above information using the signing private key to generate an auxiliary information signature. Then, it encodes the auxiliary information and the auxiliary information signature into an auxiliary information QR code and displays it on the screen, notifying Terminal B to prepare a data receiving QR code without feedback. Subsequently, it directly encodes K+M data packets into a data QR code stream and displays it on the screen.

[0125] Terminal B receives the auxiliary information QR code, decodes it, and verifies the validity of the signature. If invalid, it outputs an error message; if valid, it caches the auxiliary information and its signature, preparing to receive the data QR code stream. Terminal B decodes the data QR code on Terminal A's screen in real time and caches the decoded data fragments. It counts the received fragments based on the first 4 bytes of each fragment. ,when At this point, an attempt is made to perform RaptorQ decoding, and the probability of decoding failure is... If decoding fails this time and there are still unused data fragments, continue adding data fragments to try decoding. If there are no more data fragments, an error is reported and the process exits, waiting for the next round of transmission. The RaptorQ encoding and decoding process is as follows: Figure 4 As shown.

[0126] IV. Data Aggregation and Decryption Stage.

[0127] After terminal B successfully decodes, it obtains and using the key calculate ,like = The tag is valid for... Decryption yields data ,like If the attempt fails, an error message will be displayed and decryption will be refused. After successful decryption, terminal B will further process the decrypted data. Perform a hash operation to obtain ,like If the data restoration is successful, terminal B displays a successful transmission instruction QR code and pushes the QR code to the server.

[0128] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms, characterized in that, include: The transmitting terminal uses the SM9 algorithm to encapsulate and digitally sign the encrypted public key of the receiving terminal and a preset random number to obtain a key-encapsulated QR code, and then displays the key-encapsulated QR code through a display device. The receiving terminal obtains the key encapsulation QR code through the acquisition device, and decodes and verifies the key encapsulation QR code. If the verification is successful, the encapsulation key is obtained. The sending terminal uses the SM4_GCM algorithm to encrypt the original data, obtaining ciphertext with an authentication tag; The sending terminal performs RaptorQ encoding on the ciphertext to obtain redundant data fragments; The transmitting terminal encodes the acquired auxiliary information and redundant data fragments to obtain a QR code sequence, and displays the QR code sequence through a display device; the auxiliary information includes verification information, which is the hash value of the original data; The receiving terminal acquires the QR code sequence through the acquisition device and decodes and verifies the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained, which specifically includes: The receiving terminal acquires the QR code sequence through the acquisition device and decodes the QR code sequence based on the encapsulation key to obtain auxiliary information, auxiliary information signature and redundant data fragments; The receiving terminal uses a preset encryption public key to verify the signature of the auxiliary information. If the verification is successful, it begins to cache redundant data fragments in sequence. When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to restore the ciphertext. The receiving terminal decrypts the ciphertext using SM4_GCM based on auxiliary information and verifies the authentication tag. If the verification is successful, it outputs the decrypted data. The receiving terminal uses the SM3 algorithm to calculate the hash value of the decrypted data and determines whether the hash value of the decrypted data is consistent with the hash value of the original data. If they are consistent, the data transmission is completed.

2. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, The transmitting terminal uses the SM9 algorithm to encapsulate and digitally sign the received terminal's encrypted public key and a preset random number, resulting in a key-encapsulated QR code, specifically including: The transmitting terminal uses the SM9 algorithm to encapsulate the received terminal's encrypted public key and a preset random number to obtain the encapsulation key; The sending terminal uses a preset signature private key to digitally sign the encapsulation key, thus obtaining the signature result; The sending terminal encodes the signature result into a key-encapsulated QR code.

3. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 2, characterized in that, The sending terminal uses the SM4_GCM algorithm to encrypt the original data, obtaining ciphertext with an authentication tag, specifically including: The sending terminal uses the encapsulation key and a preset initial vector value to encrypt the original data, resulting in ciphertext with an authentication tag.

4. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, The sending terminal performs RaptorQ encoding on the ciphertext to obtain redundant data fragments, specifically including: The sending terminal performs RaptorQ encoding on the ciphertext to obtain encoded data packets; the encoded data packets include multiple original data packets and multiple redundant data packets. The encoded data packet is fragmented according to the data capacity of the QR code to obtain redundant data fragments; the data capacity of the QR code is determined based on the obtained QR code version number and error correction level parameters.

5. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, The QR code sequence includes auxiliary information QR codes and data QR code streams; The transmitting terminal encodes the acquired auxiliary information and redundant data fragments to obtain a QR code sequence, specifically including: The sending terminal uses the SM9 algorithm to digitally sign the auxiliary information to obtain the auxiliary information signature; the auxiliary information also includes encryption parameters and metadata, the encryption parameters are the initial vector value and the authentication tag, and the metadata is the size of the original data and the total number of fragments; The auxiliary information and its signature are encoded into a QR code. Redundant data is fragmented and encoded into a data QR code stream.

6. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal performs RaptorQ decoding on the redundant data fragments to recover the ciphertext, specifically including: When the number of received redundant data fragments reaches the decoding threshold, the receiving terminal constructs a sparse equation system based on the received redundant data fragments. The receiving terminal uses Gaussian elimination to solve the sparse equation system and recover the ciphertext.

7. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, The redundancy coefficient of RaptorQ coding is dynamically adjusted based on channel quality.

8. The method for unidirectional data transmission between physically isolated networks based on national cryptographic algorithms according to claim 1, characterized in that, Also includes: If the receiving terminal fails to verify any of the key encapsulation QR code, auxiliary information signature, or authentication label, it will terminate data transmission.

9. A one-way data transmission system between physically isolated networks based on national cryptographic algorithms, used to execute the one-way data transmission method between physically isolated networks based on national cryptographic algorithms as described in any one of claims 1 to 8, characterized in that, include: The transmitting terminal is used to encapsulate and digitally sign the encrypted public key of the receiving terminal and a preset random number using the SM9 algorithm to obtain a key-encapsulated QR code, and then display the key-encapsulated QR code through a display device. The receiving terminal is used to acquire the key-encapsulated QR code through the acquisition device, and to decode and verify the key-encapsulated QR code. If the verification is successful, the encapsulated key is obtained. The sending terminal is used to encrypt the original data using the SM4_GCM algorithm to obtain ciphertext with an authentication tag; The sending terminal is used to perform RaptorQ encoding on the ciphertext to obtain redundant data fragments; The transmitting terminal is used to encode the acquired auxiliary information and redundant data fragments to obtain a QR code sequence, and then display the QR code sequence through a display device; the auxiliary information includes verification information, which is the hash value of the original data; The receiving terminal is used to acquire the QR code sequence through the acquisition device, and to decode and verify the QR code sequence based on the encapsulation key. If the verification is successful, the decrypted data is obtained. The receiving terminal is used to calculate the hash value of the decrypted data using the SM3 algorithm, and to determine whether the hash value of the decrypted data is consistent with the hash value of the original data. If they are consistent, the data transmission is completed.

Images