Data transmission method and device and electronic equipment

Abstract

The invention discloses a data transmission method and apparatus, and an electronic device. The method comprises the steps of obtaining a private key component of a key generation center, a private key component of a server and a client identifier; determining a server main private key of the server based on the key generation center private key component, the server private key component and the client identifier; acquiring encrypted service data; wherein the encrypted service data is transmitted to the server through the quantum key encryption channel; and decrypting the encrypted service data based on a quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel and the server main private key to obtain a service data plaintext. According to the method, the server-side main private key is jointly determined by comprehensively utilizing the private key component of the key generation center, the server-side private key component and the mobile terminal identifier, so that the risk that a single private key source is easily attacked and cracked is avoided, and the security of data transmission is improved; and encrypted service data is transmitted through the quantum key encryption channel, so that the quantum aggression resistance of data transmission is further improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data transmission method, apparatus, and electronic device. Background Technology

[0002] With the rapid development of quantum computing technology and mobile internet, the security of mobile data transmission faces the dual challenges of quantum attacks and vulnerabilities in traditional encryption. Currently, there are two main types of encryption and authentication technologies used for secure mobile data transmission and identity verification: one is digital integer authentication based on Public Key Infrastructure (PKI), and the other is identity-based authentication. However, these technologies have significant drawbacks: firstly, traditional PKI schemes rely on a single private key source, which makes them vulnerable to attacks and has weak quantum resistance; secondly, the lack of a dedicated quantum key encryption channel for transmitting core encrypted business data, coupled with the continued transmission of sensitive data through traditional networks, fails to fully leverage the quantum attack resistance advantages of quantum keys, resulting in insufficient data transmission security and failing to meet the high security requirements of mobile devices. Summary of the Invention

[0003] This invention provides a data transmission method, apparatus, and electronic device to improve the security and resistance to quantum attacks of data transmission.

[0004] In one aspect of this invention, a data transmission method is provided, applied to a server, comprising:

[0005] Obtain the private key component from the key generation center, the private key component from the server, and the client identifier;

[0006] The server master private key of the server is determined based on the private key component of the key generation center, the private key component of the server, and the client identifier.

[0007] Acquire encrypted business data; wherein the encrypted business data is transmitted to the server through a quantum key encryption channel;

[0008] The encrypted business data is decrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel and the server master private key to obtain the plaintext business data.

[0009] In one aspect of this invention, a data transmission method is provided, applied to a mobile terminal, comprising:

[0010] Determine the plaintext of the business data and obtain the server's master public key;

[0011] The random number generated by the mobile terminal is used as the session key, and the session key is used to encrypt the plaintext of the business data to obtain the ciphertext of the business data; wherein, the session key is temporarily generated when the mobile terminal and the server transmit data;

[0012] The session key is encrypted using the server's master public key to obtain the ciphertext of the session key;

[0013] The encrypted business data is concatenated with the encrypted session key to obtain the initial encrypted business data;

[0014] When transmitting the initial encrypted service data through the quantum key encryption channel, the initial encrypted service data is encrypted using the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel to obtain encrypted service data.

[0015] In another aspect of the present invention, an electronic device is provided, comprising:

[0016] At least one processor; and

[0017] Memory that is communicatively connected to at least one processor;

[0018] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor to enable at least one processor to perform the data transmission method of any embodiment of the present invention.

[0019] This invention obtains the private key components of a key generation center, the server's private key component, and the mobile terminal identifier. Based on these components, the server's master private key is determined, and encrypted business data is obtained. The encrypted business data is transmitted to the server via a quantum key encryption channel. The encrypted business data is then decrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel and the server's master private key to obtain the plaintext business data. This invention comprehensively utilizes the private key components of the key generation center, the server's private key component, and the mobile terminal identifier to jointly determine the server's master private key, avoiding the risk of vulnerability to attacks from a single private key source and improving data transmission security. Furthermore, transmitting encrypted business data via a quantum key encryption channel further enhances the data transmission's resistance to quantum attacks.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a data transmission method according to Embodiment 1 of the present invention;

[0023] Figure 2 This is a flowchart of another data transmission method provided according to Embodiment 2 of the present invention;

[0024] Figure 3 This is a flowchart of another data transmission method provided according to Embodiment 3 of the present invention;

[0025] Figure 4 A schematic diagram of a data transmission system provided for Embodiment 4 of the present invention;

[0026] Figure 5 A schematic diagram illustrating the initialization process of a data transmission system provided for Embodiment 4 of the present invention;

[0027] Figure 6 A schematic diagram of a process for establishing a quantum key encryption channel is provided for embodiment four of the present invention;

[0028] Figure 7 A schematic diagram of an identity authentication process is provided for embodiment four of the present invention;

[0029] Figure 8 A schematic diagram of a data transmission process provided for Embodiment 4 of the present invention;

[0030] Figure 9 This is a schematic diagram of a data transmission device structure applied to a server according to Embodiment 5 of the present invention;

[0031] Figure 10 This is a schematic diagram of a data transmission device structure for a mobile terminal according to Embodiment Six of the present invention;

[0032] Figure 11 A block diagram of an electronic device for performing a data transmission method is provided according to Embodiment 7 of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0035] Example 1

[0036] Figure 1 This invention provides a flowchart of a data transmission method applied to a server, applicable to scenarios where a server and a mobile device communicate securely. The method can be executed by a data transmission device applied to the server, which can be implemented in hardware and / or software. This data transmission device can be configured in electronic devices such as a semiconductor testing server or a distributed computing cluster composed of multiple servers. Figure 1 As shown, the method includes:

[0037] S110, Obtain the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier.

[0038] Among them, the private key component of the key generation center can be understood as the partial private key data generated by the key generation center, which is used to participate in the synthesis of the server's main private key. Exemplarily, the method for obtaining the private key component of the key generation center may include: obtaining a random number t generated by the key generation center and the main private key S' of the key generation center, and taking the dot product result of the random number t and the main private key S' of the key generation center as the private key component K1 of the key generation center. Exemplarily, the method for obtaining the main private key S' of the key generation center may include: at the key generation center, obtaining the quantum key R issued by the quantum key management terminal; enhancing the uniformity of the quantum key through H = SM3(R), where SM3 is a cryptographic hash algorithm; converting H into an unsigned integer S'; adjusting the modulo range: S'=(S'mod(n - 1))+1 to ensure that S' strictly falls within [1, n - 1], where n is the upper limit parameter of the preset private key value range; processing anti-modulo deviation through the rejection sampling method: if S'>=n, discard it and re-apply for the quantum key R from the quantum key management terminal and reprocess until S'<n; taking the S' processed as above as the main private key S' of the key generation center.

[0039] Furthermore, in the embodiment of the present invention, when the private key component of the key generation center is transmitted from the key generation center to the server, a private key generated by a post-quantum cryptography (PQC) algorithm or other anti-quantum attack algorithms can be used to encrypt the private key component of the key generation center, and the server obtains the encrypted private key component of the key generation center. After the server receives the encrypted private key component of the key generation center, it can use the public key corresponding to the post-quantum cryptography (PQC) algorithm or other anti-quantum attack algorithms pre-stored in the server to decrypt the encrypted private key component of the key generation center to obtain the original private key component of the key generation center.

[0040] The server private key component can be understood as the private key data independently generated by the server, which can be pre-stored in its own configuration file or memory, and this private key data participates in the synthesis of the server's main private key together with the private key component of the key generation center. Exemplarily, the method for obtaining the server private key component may include: obtaining a random number r generated by the mobile terminal; in the preset password library, extracting the generator parameter P1 in the SM9 algorithm parameter set; taking the dot product operation result of the generator parameter and the random number r as the server private key component K2.

[0041] The mobile terminal identifier can be understood as an information identifier used to uniquely identify the identity of the mobile terminal. Exemplarily, the mobile terminal identifier may include: the mobile terminal device serial number or the user account code, etc.

[0042] Specifically, the server obtains the private key component generated by the key generation center. When the private key component is transmitted from the key generation center to the server, it can be encrypted using the private key corresponding to a preset PQC algorithm or other quantum attack-resistant algorithm. The server obtains the encrypted private key component. The server then decrypts the encrypted private key component using the public key corresponding to the private key to obtain the original private key component generated by the key generation center. Alternatively, the server can generate its own private key component or obtain a pre-generated private key component stored in its local storage module. Regarding the mobile device identifier, the server can receive the mobile device identifier actively sent by the mobile device when establishing the initial communication connection with the mobile device, or the server can obtain the mobile device identifier by reading its own local storage module.

[0043] S120. Determine the server's master private key based on the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier.

[0044] The server-side master private key can be understood as a private key used by the server to decrypt data. It is determined by the private key component of the key generation center, the server-side private key component, and the mobile device identifier. For example, the server-side master private key is denoted as K. The server-side master private key K can be obtained in the following way: K = K1 + [H(ID)]・K2, where ID is the mobile device identifier, and [H(ID)] is the identifier hash value after hashing the mobile device identifier ID.

[0045] Specifically, the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier are obtained. The results based on the association of the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier can be queried in the preset mapping relationship or rules, and the structure is determined as the server master private key; or, according to a specific algorithm, the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier are all used as input parameters of a specific algorithm to obtain the server master private key.

[0046] S130. Obtain encrypted business data; wherein, the encrypted business data is transmitted to the server through a quantum key encryption channel.

[0047] In this context, encrypted business data can be understood as ciphertext data that has undergone encryption processing. Encrypted business data cannot be directly read; transmitting encrypted data prevents it from being illegally stolen or tampered with during transmission. Furthermore, in this embodiment of the invention, a quantum key encryption channel can be pre-built between the server and the mobile terminal, through which the server obtains the encrypted business data.

[0048] A quantum key distribution channel can be understood as a communication channel that uses quantum keys to encrypt and transmit data. Quantum key encryption algorithms are used to encrypt the transmitted data. Quantum key distribution channels are resistant to quantum attacks, ensuring the absolute security of current communications.

[0049] Specifically, the encrypted service data transmitted from the mobile terminal via a quantum key encryption channel is acquired. For example, in this embodiment of the invention, the encrypted service data is the service data encrypted via a quantum key encryption channel. That is, the service data ultimately output by the mobile terminal is encrypted service data that has not been encrypted via the quantum key encryption channel. However, an encryption process can also exist on the mobile terminal. For example, the mobile terminal can output a session key, which can be used to encrypt the plaintext service data to obtain ciphertext service data, and the session key can also be encrypted to obtain ciphertext session key. The ciphertext service data and the ciphertext session key can be transmitted from the mobile terminal to the server via the quantum key encryption channel. When transmitting the ciphertext service data and the ciphertext session key via the quantum key encryption channel, the quantum key encryption / decryption algorithm corresponding to the quantum key encryption channel can be used to jointly encrypt the ciphertext service data and the ciphertext session key to obtain encrypted service data.

[0050] S140. Based on the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel and the server master private key, the encrypted business data is decrypted to obtain the plaintext business data.

[0051] A quantum key encryption / decryption algorithm can be understood as an algorithm used to encrypt and / or decrypt data transmitted in a quantum key encryption channel. For example, a quantum key encryption / decryption algorithm may include at least the SM4 algorithm. The quantum key encryption / decryption algorithm specifies the rules for how to encrypt data transmitted in a quantum key encryption channel using a quantum key and how to decrypt the encrypted data using the corresponding private key.

[0052] Plaintext business data refers to the raw business data obtained after the server decrypts the encrypted business data. This raw business data can be directly read and processed by the server. The server obtains the plaintext business data to perform subsequent business logic processing and / or data storage operations.

[0053] Specifically, the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel can be used to decrypt the encrypted business data to obtain the encrypted business data on the mobile device. Then, the server's master private key is used to decrypt the encrypted business data on the mobile device to obtain the plaintext business data. It is understandable that the server's master private key has a corresponding server master public key. When encrypting data on the mobile device, the server's master public key must first be obtained, and then used to encrypt the data.

[0054] This invention involves obtaining a private key component from a key generation center, a private key component from the server, and a mobile terminal identifier. Based on these components, the server's master private key is determined, and encrypted business data is obtained. The encrypted business data is transmitted to the server via a quantum key encryption channel. The encrypted business data is then decrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel and the server's master private key to obtain the plaintext business data. This invention comprehensively utilizes the private key components from the key generation center, the server, and the mobile terminal identifier to jointly determine the server's master private key, avoiding the risk of vulnerability to attacks from a single private key source and improving data transmission security. Furthermore, transmitting encrypted business data via a quantum key encryption channel further enhances the data transmission's resistance to quantum attacks.

[0055] Furthermore, this embodiment of the invention optimizes the data transmission method applied to the server. Specifically, it adds a verification step for the mobile terminal before obtaining encrypted business data, including:

[0056] A1. Obtain the mobile device's signature value and the time when the mobile device requests login to the server.

[0057] The mobile signature value can be understood as a string obtained by the mobile device signing specific data with the server's master private key, which is used to prove the validity of the mobile device's identity.

[0058] The request generation time can be understood as the timestamp generated when the mobile device initiates a login request to the server. It's used to prevent replay attacks and ensure the timeliness of the login request. The server can verify the validity of the request generation time based on a preset time window. If valid, the subsequent process can continue. For example, the preset time window is a fixed time length. Methods for verifying the request generation time based on this preset time window include: when the server receives a login request from the mobile device, it checks the request generation time carried in the login request to determine if it falls within the current preset fixed time window. If so, the time verification passes.

[0059] Specifically, the system obtains the mobile signature value transmitted from the mobile device to the server. This mobile signature value is a string obtained by the mobile device signing specific data with the server's master private key. For example, this specific data can be concatenated data formed by combining the request generation time with the server's challenge code. The system also obtains the login request generated when the mobile device requests to log in to the server. This login request can be parsed to obtain the request generation time.

[0060] A2. Obtain the server challenge code; the server challenge code is randomly generated by the server when the mobile device requests to log in to the server.

[0061] The server-side challenge code can be understood as a string randomly generated by the server when a mobile device requests login. This server-side challenge code is unique and valid only in a single login process. It is used to ensure the uniqueness of login requests and prevent attackers from reusing historical requests.

[0062] Specifically, after the server receives the login request generated by the mobile device, it triggers a randomly generated string, which serves as the server-side challenge code. The server-side challenge code is unique and valid only during a single login process. In other words, the server generates a random challenge code each time the mobile device logs in.

[0063] A3. Verify the request generation time based on a preset time window to obtain the time verification result.

[0064] The preset time window can be understood as a time range pre-set by the server. For example, the preset time window can be 5 minutes or 30 seconds, which is used to determine the timeliness of the request generation time and prevent replay attacks.

[0065] The time verification result can be understood as a judgment of whether the request generation time is within a preset time window. It is used to reject expired login requests and to determine whether the mobile device can interact with the server. For example, the time verification result can include: verification passed and verification failed. When the time verification result is "verification passed," it indicates that the mobile device can interact with the server; if the time verification result is "verification failed," it indicates that the mobile device cannot interact with the server.

[0066] Specifically, a pre-set time window is obtained. When the server receives a login request from a mobile client, it checks the request generation time carried in the login request and determines whether the request generation time is within the current pre-set fixed time window. This determination result is used as the time verification result for the request generation time.

[0067] A4. If the time verification result is successful, the login time requested is concatenated with the server challenge code to obtain the concatenated data from the server.

[0068] The server-side concatenated data can be understood as a string of data obtained by combining the mobile client's request generation time with the server-side challenge code in a specific order. The server-side concatenated data time verification result is generated when the verification passes, and is used to determine whether the mobile client can log in to the server.

[0069] Specifically, the time verification result can include at least two results: verification passed and verification failed. Only when the time verification result is verification passed can subsequent steps be performed. For example, the login request time is concatenated with the server challenge code to obtain the server concatenated data. This server concatenated data is used to determine whether the mobile terminal can log in to the server, along with the server master private key, server master public key, and mobile terminal signature value.

[0070] A5. Obtain the server's master public key corresponding to the server's master private key, and determine the login request result based on the server's master private key, server's master public key, server's concatenated data, and mobile terminal's signature value; wherein, the login request result is used to indicate whether the mobile terminal can log in to the server.

[0071] Among them, the server master public key is a public key generated by pairing with the server master private key. After obtaining the server master private key, the server master public key corresponding to the server master private key can be calculated through a specified algorithm.

[0072] A login request result can be understood as a judgment result indicating whether the mobile device can log in to the server. For example, the login request result can include: "Login Allowed" and "Inactive Login". Only when the login request result is "Login Allowed" can the mobile device communicate with the server, and only then can the server enter the stage of receiving encrypted business data.

[0073] Specifically, after obtaining the server's master private key, the corresponding server master public key can be calculated using a preset algorithm. The calculated server master public key can be stored in a local storage module or configuration file in advance. The server master public key can be obtained by reading the local storage module or configuration file. The server master private key can be used to sign the server-side concatenated data, and the server master public key can be used to verify the signed data. The verification result is then compared with the mobile terminal's signature value to finally determine whether the login request result is allowed or denied. This login request result directly determines whether the mobile terminal can communicate with the server.

[0074] A6. When the login request result is "Login Allowed", receive encrypted business data through the quantum key encryption channel.

[0075] Specifically, when the login request result is "login allowed", the mobile device can communicate with the server. During the communication between the mobile device and the server, the server can receive encrypted business data transmitted from the mobile device through a key encryption channel.

[0076] In this embodiment of the invention, by authenticating the mobile terminal, data is only received when the login request result is "allowed," ensuring that only mobile terminals with compliant identities can transmit data with the server.

[0077] Furthermore, this embodiment of the invention further refines step A5, specifically detailing the steps for determining the login request result, including:

[0078] A51. Use the server's master private key to sign the concatenated data on the server to obtain the server-signed data.

[0079] Among them, the server-side signature data refers to the string obtained by the server using its own server master private key to perform a signature operation on the concatenated data. It serves as the basis data for server-side signature verification and can be used to prove that the concatenated data has not been tampered with and comes from a compliant server.

[0080] Specifically, to obtain the server's master private key, a preset encryption and decryption algorithm can be used, and the server's concatenated data can be signed using the server's master private key to obtain the server's signed data.

[0081] A52. Use the server's master public key to verify the server's signature data and obtain the server's verification result.

[0082] The server-side signature verification result refers to the string obtained by the server using its master public key to decrypt the server-side signature data and then comparing it with the mobile terminal's signature value to determine whether the mobile terminal can log in to the server and communicate with it.

[0083] Specifically, the server master public key corresponding to the server master private key is obtained. The server signature data can be decrypted using a preset encryption and decryption algorithm and the server master public key to restore the string corresponding to the server concatenated data. This string is then used as the server signature verification result.

[0084] A53. Compare the server-side signature verification result with the mobile terminal signature value. If the signature verification result is exactly the same as the mobile terminal signature value, the login request result is "Login Allowed"; otherwise, the login request result is "Login Denied".

[0085] Specifically, the server-side signature verification result is compared with the mobile terminal signature value character by character. If the two are completely identical in byte length and character content, the login request result is determined to be allowed; otherwise, the login request result is determined to be denied.

[0086] Example 2

[0087] Figure 2 The flowchart of another data transmission method is provided for Embodiment 2 of the present invention. The embodiments of the present invention are refinements of the above embodiments, specifically refining the specific steps of determining the server master private key and decrypting encrypted business data.

[0088] like Figure 2As shown, another data transmission method may include the following specific steps:

[0089] S210. Obtain the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier.

[0090] S220. Perform hash processing on the mobile terminal identifier to obtain the identifier hash value of the mobile terminal identifier.

[0091] The identifier hash value refers to the string obtained by hashing the mobile identifier. It is used to standardize the mobile identifier so that it can be used for subsequent dot multiplication with the server's private key component.

[0092] Specifically, the mobile device identifier is obtained, and hashing the mobile device identifier yields a fixed-length, irreversible string, which can be used as the identifier's hash value. Hash processing the mobile device identifier converts mobile device identifiers of different formats into a unified data format, facilitating subsequent dot-multiplication operations with the server's private key component. For example, this embodiment of the invention does not impose restrictions on the hash algorithm used for hash processing.

[0093] S230. Obtain the result of the dot product operation between the identifier hash value and the server private key component.

[0094] Specifically, the identifier hash value and the server private key component are multiplied by a dot product to obtain the result of the dot product operation.

[0095] S240. The sum of the dot product result and the private key component of the key generation center is used as the server's master private key.

[0096] Specifically, the result of the dot product operation is added to the private key component of the key generation center to obtain the accumulated value, which is then used as the server's master private key.

[0097] S250. Obtain encrypted business data, and use quantum key encryption and decryption algorithm to decrypt the encrypted business data to obtain session key ciphertext and business data ciphertext.

[0098] The session key ciphertext can be understood as the ciphertext data obtained after encrypting the session key. The session key ciphertext cannot be read directly and is used to protect the security of the session key during transmission.

[0099] Business data ciphertext refers to the ciphertext data obtained by encrypting the original business data plaintext using a session key. Business data ciphertext cannot be read directly and is used to protect the information of the original business data plaintext. It can only be decrypted into business data plaintext using the corresponding session key.

[0100] Specifically, the server obtains encrypted business data and uses the quantum key encryption and decryption algorithm corresponding to the quantum channel encryption channel to decrypt the encrypted business data, obtaining the session key ciphertext and the business data ciphertext.

[0101] S260. Use the server's master private key to decrypt the ciphertext of the session key to obtain the session key.

[0102] The session key can be understood as a symmetric key used to decrypt encrypted business data. The session key is time-sensitive, valid only within a single data transmission session, ensuring the timeliness and security of business data decryption and avoiding security risks associated with long-term use of fixed keys. The session key can be randomly generated by the mobile device.

[0103] Specifically, obtain the server's master private key, and use the server's master private key to decrypt the session key ciphertext to obtain the session key.

[0104] S270. Use the session key to decrypt the ciphertext of the business data to obtain the plaintext of the business data.

[0105] Specifically, after decrypting the session key from the ciphertext of the session key, the session key is then used to decrypt the ciphertext of the business data to obtain the plaintext of the business data.

[0106] In this embodiment of the invention, the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier are obtained. The mobile terminal identifier is hashed to obtain the identifier hash value. The dot product of the identifier hash value and the server private key component is obtained. The sum of the dot product result and the private key component of the key generation center is used as the server master private key. Encrypted business data is obtained. The encrypted business data is decrypted using a quantum key encryption and decryption algorithm to obtain the session key ciphertext and the business data ciphertext. The session key ciphertext is decrypted using the server master private key to obtain the session key. The business data ciphertext is decrypted using the session key to obtain the business data plaintext. This invention standardizes the mobile terminal identifier, avoiding computational failures caused by inconsistent mobile terminal identifier lengths and enhancing data tamper resistance. By fusing the identifier hash value, server-side private key component, and key generation center private key component to determine the server-side master private key, it prevents other terminals from knowing the server-side master private key, thus avoiding the problem of encrypted business data being tampered with and / or decrypted improperly. This ensures that only the server can correctly decrypt encrypted business data, improving data transmission security. Furthermore, obtaining plaintext business data through three-layer decryption further enhances data transmission security.

[0107] Example 3

[0108] Figure 3This is a flowchart illustrating a data transmission method applied to a mobile terminal according to Embodiment 3 of the present invention. This embodiment is applicable to scenarios where a server and a mobile terminal communicate securely. The method can be executed by a data transmission device applied to the mobile terminal. This data transmission device can be implemented in hardware and / or software, and can be configured in electronic devices such as a semiconductor testing server or a distributed computing cluster composed of multiple servers. Figure 3 As shown, the method includes:

[0109] S310. Determine the plaintext of the business data and obtain the server's master public key.

[0110] In this context, plaintext business data can be understood as data initiated by the mobile device and intended to be transmitted to the server. Plaintext business data can be directly read by the server. After reading the plaintext business data, the server can perform subsequent operations, such as data processing and analysis or information tracking.

[0111] Specifically, the mobile device can determine the plaintext of the business data to be transmitted based on actual business needs. The mobile device can send a request to the server to obtain the server's master public key. After verifying the identity of the mobile device, the server can transmit the server's master public key to the mobile device through a quantum key encryption channel.

[0112] S320. Use the random number generated by the mobile terminal as the session key, and use the session key to encrypt the plaintext of the business data to obtain the ciphertext of the business data; wherein, the session key is temporarily generated when the mobile terminal and the server transmit data.

[0113] Specifically, the mobile device can generate a random number based on a preset random number generation algorithm, and set this random number as the session key for this data transmission session. This session key is only valid for the current session and will be automatically destroyed after the session ends. The business data plaintext can be processed using this session key to obtain the business data ciphertext.

[0114] S330. Use the server's master public key to encrypt the session key to obtain the ciphertext of the session key.

[0115] Specifically, the session key is encrypted using the server's master public key to obtain the ciphertext of the session key.

[0116] S340. Concatenate the ciphertext of the business data with the ciphertext of the session key to obtain the initial encrypted business data.

[0117] The initial encrypted business data refers to the data set obtained by the mobile terminal concatenating the business data ciphertext and the session key ciphertext according to preset rules. This data set contains two layers of ciphertext, namely the session key ciphertext and the business data ciphertext.

[0118] Specifically, a preset concatenation rule is obtained, and the ciphertext of the business data is concatenated with the ciphertext of the session key according to the preset concatenation rule to obtain the initial encrypted business data. For example, in this embodiment of the invention, the initial encrypted business data can also be subjected to integrity verification to ensure that the data is not corrupted during the concatenation process.

[0119] S350. When transmitting initial encrypted service data through the quantum key encryption channel, the initial encrypted service data is encrypted using the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel to obtain encrypted service data.

[0120] Specifically, when the initial encrypted business data is transmitted from the mobile terminal to the server through the quantum key encryption channel using the quantum key encryption algorithm, the initial encrypted business data is re-encrypted using the quantum key encryption algorithm to obtain the encrypted business data.

[0121] In this embodiment of the invention, the plaintext of the business data is determined, and the server's master public key is obtained. A random number generated by the mobile device is used as a session key, and the plaintext of the business data is encrypted using the session key to obtain ciphertext of the business data. The session key is temporarily generated during data transmission between the mobile device and the server. The session key is encrypted using the server's master public key to obtain ciphertext of the session key. The ciphertext of the business data is concatenated with the ciphertext of the session key to obtain initial encrypted business data. When transmitting the initial encrypted business data through a quantum key encryption channel, the initial encrypted business data is encrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain encrypted business data. This embodiment of the invention enhances the security of data transmission by using three layers of encryption to encrypt the plaintext of the business data.

[0122] Furthermore, this embodiment of the invention optimizes the data transmission method applied to mobile terminals. Specifically, it supplements the specific steps for obtaining the mobile terminal signature value, including: obtaining the request generation time of the mobile terminal login request; wherein, the mobile terminal login request is generated when the mobile terminal requests to log in to the server; obtaining the server challenge code fed back by the server after receiving the mobile terminal login request; concatenating the server challenge code with the request generation time to obtain the mobile terminal concatenated data; obtaining the server master private key, and using the server master private key to sign the mobile terminal concatenated data to obtain the mobile terminal signature value.

[0123] Specifically, when a mobile device requests login to the server, the time at which the mobile device generates the login request is obtained; this time is the request generation time. The mobile device sends the login request to the server. After receiving the login request, the server will send back a server challenge code to the mobile device. On the mobile device, the server challenge code and the request generation time are concatenated according to preset concatenation rules to form the mobile device's concatenated data. The server's master private key transmitted by the server can be obtained through a quantum key encryption channel. The server's master private key is used to perform a signature operation on the mobile device's concatenated data to obtain a string, which is the mobile device's signature value.

[0124] Example 4

[0125] Figure 4 A schematic diagram of a data transmission system provided for Embodiment 4 of the present invention; Figure 5 A schematic diagram illustrating the initialization process of a data transmission system provided for Embodiment 4 of the present invention; Figure 6 A schematic diagram of a process for establishing a quantum key encryption channel is provided for embodiment four of the present invention; Figure 7 A schematic diagram of an identity authentication process is provided for embodiment four of the present invention; Figure 8 This is a schematic diagram of a data transmission process provided for Embodiment 4 of the present invention.

[0126] The embodiments of the present invention are optimizations of the above embodiments. Specifically, they supplement a data transmission system, an initialization process for the data transmission system, a process for establishing a quantum key encryption channel, and a process for communication between a mobile terminal and another mobile terminal.

[0127] like Figure 4 As shown, the data transmission system includes: a quantum key management terminal (QKD), a quantum cryptography generation center (KGC), a server, and a mobile terminal. The QKD is connected to the KGC via optical fiber and can distribute quantum keys using the BB84 protocol. The KGC integrates functional modules such as key lifecycle management, QKD access, SM9 cryptographic operations, quantum key encryption channels, and session key management. The KGC connects to the QKD to obtain quantum keys and provides the private key component of the key generation center to the server. The server has capabilities such as SM9 cryptographic operations, quantum key encryption and decryption, encrypted business data processing, channel conversion, Kyber key pair encryption and decryption, session key management, and identity authentication. The server obtains the private key component of the key generation center from the KGC to generate its own server master private key and performs encrypted business data transmission and "identity authentication interaction" with the mobile terminal, serving as the core node for secure processing and transmission of business data. The mobile terminal is equipped with a cryptographic operation unit (supporting SM9 cryptographic operations), Kyber key pair encryption and decryption, and quantum key encryption channels. The mobile terminal performs encrypted business data transmission and identity authentication with the server, serving as the terminal carrier for secure access and interaction of user-side data.

[0128] As Figure 5 shown, the initialization of the data transmission system includes: KGC initialization, server initialization, and mobile device initialization. Among them, the KGC initialization process is as follows: (1) The Key Generation Center (KGC) generates a Kyber key pair; (2) The Key Generation Center requests quantum keys from the Quantum Key Management Terminal (QKD); (3) QKD gives the quantum key R to KGC through the BB84 protocol; (4) KGC enhances the uniformity of the quantum key through H = SM3(R), eliminates possible correlations in the QKD output, and ensures cryptographic strength; (5) Convert the digest result H into an unsigned integer S'; (6) Modulo adjustment range: S' = (S' mod (n - 1)) + 1, ensuring that S' strictly falls within [1, n - 1]; where n is the upper limit parameter of the preset private key value range; (7) Process anti-modulo deviation through the rejection sampling method: If S' >= n, discard it and reapply to QKD for R and reprocess until S' < n; (8) The S' processed through the above can be used as the main private key S' of the key generation center; (9) Use the main private key S' of the key generation center and generate an encrypted public master key using the SM9 algorithm.

[0129] The server initialization process is as follows: (1) The business server generates a Kyber key pair; (2) The business server submits the server identifier to the KGC center, triggering KGC to apply to QKD for the private key component of the key generation center; (3) KGC applies to QKD for the private key component of the key generation center; (4) KGC generates a partial private key component of the key generation center K1 = [t]·S'ds, where t is the key of KGC (a random number) and S' is the main private key S' of the key generation center; (5) KGC encrypts the private key component with the public key in the Kyber key pair submitted by the server and returns it to the business server; (6) The server generates a server private key component K2 = [r]·P1, where r is the key of the user and P1 is the generator of G1; (7) The business server decrypts the private key component K1 and calculates the server main private key K = K1 + [H(ID)]·K2, where H(ID) is the hash value of the mobile device identifier, that is, the identifier hash value; where t and r are the random values respectively held by the Key Generation Center (KGC) and the user (mobile device); (8) The business server generates the server public master key corresponding to the server main private key; (9) Store the encrypted main private key with the main key.

[0130] The mobile terminal initialization process includes: (1) the mobile terminal generates a Kyber key pair; (2) the mobile terminal initiates an initialization request to the cryptographic operation unit; (3) the cryptographic operation unit submits the initialization request data to KGC; (4) KGC requests the mobile terminal key generation center private key component K1 from QKD; (5) KGC generates a partial key generation center private key component K1 = [t]·ds, where t is KGC's key and S' is KGC's master private key; (6) KGC encrypts K1 with the public key of the Kyber key pair submitted by the mobile terminal and returns it to the cryptographic operation unit; (7) the mobile terminal calls the cryptographic operation unit to generate the mobile terminal private key component K2 = [r]·P1, where r is the user's key and P1 is the generator of G1; (8) the mobile terminal calls the cryptographic operation unit to decrypt K1 and calculate the complete mobile terminal master private key K = K1 + [H(ID)]·K2, where H(ID) is the hash value of the mobile terminal identifier; (9) the cryptographic operation unit generates the encryption master public key.

[0131] like Figure 6 As shown, the decrypted quantum key is used to encrypt data packets when the mobile device communicates with the server, thereby establishing a quantum key encryption channel.

[0132] like Figure 7 As shown, the authentication process for mobile client login to the server is as follows: 1. The mobile client requests to log in to the business system and obtains the request generation time S1; 2. The mobile client obtains the server challenge code Q returned by the server after receiving the mobile client login request; 3. The cryptographic unit requests the signature challenge code from the mobile client; 4. The cryptographic unit generates a timestamp S1 for preventing replay attacks; 5. The cryptographic unit concatenates the timestamp S1 and the server challenge code Q to obtain the concatenated data M from the mobile client; 6. The cryptographic unit obtains the server's master private key and uses the server's master private key to sign the concatenated data M from the mobile client to obtain the mobile client signature value; 7. The mobile client signature value and timestamp S1 are returned; 8. The mobile client sends the timestamp S1 and the mobile client signature value to the business system server; 9. The business system server obtains the timestamp S1 and verifies whether the timestamp is within the valid time window; where S1 is the request generation time when the mobile client requests to log in to the server; 10. The business system server synthesizes the concatenated data M2 from the server. S1|Q; The server's master public key signs the concatenated data on the server to obtain the server's signed data. 11. The business system server uses the server's master public key to verify the server's signed data. 12. The server returns the signature verification result and determines whether to allow mobile terminal (APP) login based on the server's signature verification result.

[0133] like Figure 8As shown, the secure communication process between the mobile terminal and the server is as follows: 1. The mobile terminal (APP) calls the cryptographic operation unit to request encryption of plaintext business data; 2. The cryptographic operation unit generates a session key (symmetric key); 3. The session key is used to encrypt the plaintext business data to obtain ciphertext business data, using the SM4 encryption algorithm; 4. The server's master public key is obtained, and the session key is encrypted using the server's master public key to obtain ciphertext session key, using the SM9 encryption algorithm; 5. When transmitting the ciphertext business data and the ciphertext session key using a quantum key encryption channel, the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel is used for link encryption, i.e. The process involves: 1. Encrypting the business data ciphertext and session key ciphertext using the quantum key negotiated between the mobile app (APP) and the server, obtaining encrypted business data using the SM4 encryption algorithm; 2. Returning the encrypted business data; 3. Submitting the encrypted business data to the server; 4. The server using the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel to decrypt the data, obtaining the session key ciphertext and business data ciphertext; 5. Decrypting the session key ciphertext using the server's master private key, obtaining the session key; 6. The server using the session key to decrypt the business data ciphertext, obtaining the plaintext business data; 7. Data integrity verification.

[0134] In this embodiment of the invention, when mobile terminal A and mobile terminal B communicate securely, a link encryption process needs to be performed on the server side, such as... Figure 8 The diagram shows the detailed process of secure communication between mobile device A and mobile device B.

[0135] Example 5

[0136] Figure 9 This is a schematic diagram of a data transmission device provided in Embodiment 5 of the present invention, applied to a server. For example... Figure 9 As shown, the data transmission device includes: an identifier acquisition module 410, a private key determination module 420, a data acquisition module 430, and a data decryption module 440;

[0137] The identifier acquisition module 410 is used to acquire the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier.

[0138] The private key determination module 420 is used to determine the server's master private key based on the private key component of the key generation center, the server's private key component, and the mobile terminal identifier.

[0139] The data acquisition module 430 is used to acquire encrypted business data; wherein, the encrypted business data is transmitted to the server through a quantum key encryption channel;

[0140] The data decryption module 440 is used to decrypt encrypted business data based on the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel and the server master private key to obtain the plaintext of the business data.

[0141] Optionally, the data transmission device in this embodiment of the invention further includes: a time acquisition unit, used to acquire the mobile terminal signature value and the request generation time when the mobile terminal requests the login server to generate the login request;

[0142] The challenge code acquisition unit is used to acquire the server-side challenge code; the server-side challenge code is randomly generated by the server when the mobile device requests to log in to the server.

[0143] The time verification unit is used to verify the request generation time based on a preset time window and obtain the time verification result.

[0144] The data splicing unit is used to splice the login request time with the server challenge code when the time verification result is successful, so as to obtain the server spliced ​​data.

[0145] The result determination unit is used to obtain the server master public key corresponding to the server master private key, and determine the login request result based on the server master private key, the server master public key, the server concatenated data, and the mobile terminal signature value; wherein, the login request result is used to indicate whether the mobile terminal can log in to the server;

[0146] The data receiving unit is used to receive encrypted business data through a quantum key encryption channel when the login request result is "login allowed".

[0147] Optionally, the result determination unit is specifically used to sign the server-side concatenated data using the server's master private key to obtain server-side signed data; to verify the server-side signed data using the server's master public key to obtain server-side verification result; to compare the server-side verification result with the mobile terminal's signature value; if the verification result is exactly the same as the mobile terminal's signature value, the login request result is "login allowed"; otherwise, the login request result is "login prohibited".

[0148] Optionally, the private key determination module 420 is specifically used to perform hash processing on the mobile terminal identifier to obtain the identifier hash value of the mobile terminal identifier; obtain the dot product operation result of the identifier hash value and the server private key component; and use the sum of the dot product operation result and the private key component of the key generation center as the server master private key.

[0149] The data decryption module 440 is specifically used to decrypt encrypted business data using quantum key encryption and decryption algorithms to obtain session key ciphertext and business data ciphertext; to decrypt session key ciphertext using the server master private key to obtain session key; and to decrypt business data ciphertext using session key to obtain business data plaintext.

[0150] The data transmission device provided in the embodiments of the present invention can execute the data transmission method provided in the embodiments of the present invention applied to the server, and has the corresponding beneficial effects of executing the method.

[0151] Example 6

[0152] Figure 10 This is a schematic diagram of a data transmission device provided in Embodiment Six of the present invention, applied to a mobile terminal. Figure 10 As shown, the data transmission device includes: a plaintext determination module 510, a first encryption module 520, a second encryption module 530, a data splicing module 540, and a third encryption module 550;

[0153] Plaintext determination module 510 is used to determine the plaintext of business data and obtain the server's master public key;

[0154] The first encryption module 520 is used to use a random number generated by the mobile terminal as a session key, and to encrypt the plaintext of the business data using the session key to obtain the ciphertext of the business data; wherein, the session key is temporarily generated when the mobile terminal and the server transmit data;

[0155] The second encryption module 530 is used to encrypt the session key using the server's master public key to obtain the session key ciphertext;

[0156] The data splicing module 540 is used to splice the ciphertext of business data with the ciphertext of the session key to obtain the initial encrypted business data;

[0157] The third encryption module 550 is used to encrypt the initial encrypted service data using the quantum key encryption algorithm corresponding to the quantum key encryption channel when transmitting the initial encrypted service data through the quantum key encryption channel, so as to obtain the encrypted service data.

[0158] Optionally, the data transmission device in this embodiment of the invention further includes: a cryptographic operation unit, used to obtain the request generation time of the mobile terminal login request; wherein the mobile terminal login request is generated when the mobile terminal requests to log in to the server; obtain the server challenge code fed back by the server after receiving the mobile terminal login request; concatenate the server challenge code with the request generation time to obtain the mobile terminal concatenated data; obtain the server master private key, and use the server master private key to sign the mobile terminal concatenated data to obtain the mobile terminal signature value.

[0159] The data transmission device provided in the embodiments of the present invention can execute the data transmission method provided in the embodiments of the present invention applied to mobile terminals, and has the corresponding beneficial effects of executing the method.

[0160] Example 7

[0161] Embodiment 7 of the present invention provides an electronic device for performing a data transmission method, a computer-readable medium, and a computer program product.

[0162] Figure 11 A schematic diagram of an electronic device that can be used to implement the data transmission method of any embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown in the embodiments of the present invention, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the embodiments of the present invention described and / or claimed herein.

[0163] like Figure 11 As shown, the electronic device includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from the storage unit 18. The RAM 13 can also store various programs and data required for device operation. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0164] Multiple components in the electronic device are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, optical disk, etc.; and a communication unit 19, such as a network card, modem, wireless transceiver, etc. The communication unit 19 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0165] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data transfer methods.

[0166] In some embodiments, the data transfer method may be implemented as a computer program tangibly contained in a computer-readable medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data transfer method may be performed. Alternatively, in other embodiments, processor 11 may be configured as the data transfer method by any other suitable means (e.g., by means of firmware).

[0167] Various embodiments of the systems and technologies described above in these embodiments of the present invention can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input system, and at least one output system, and transmitting data and instructions to the storage system, the at least one input system, and the at least one output system.

[0168] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing system, such that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0169] In the context of embodiments of the present invention, a computer-readable medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, system, or device. A computer-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable medium may be a machine-readable signal medium. More specific examples of machine-readable media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM or flash memory), optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0170] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display system (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing system (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of systems can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including: sound input, voice input, or tactile input).

[0171] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0172] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system. This addresses the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0173] It should be understood that the various forms of procedures shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0174] The specific embodiments described above do not constitute a limitation on the scope of protection of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data transmission method, characterized in that, Applied to the server side, the method includes: Obtain the private key component from the key generation center, the private key component from the server, and the mobile device identifier; The server master private key is determined based on the private key component of the key generation center, the private key component of the server, and the mobile terminal identifier. Acquire encrypted business data; wherein the encrypted business data is transmitted to the server through a quantum key encryption channel; The encrypted business data is decrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel and the server master private key to obtain the plaintext business data.

2. The method according to claim 1, characterized in that, The step of determining the server's master private key based on the private key component of the key generation center, the server's private key component, and the mobile terminal identifier includes: The mobile device identifier is hashed to obtain the identifier hash value of the mobile device identifier; Obtain the result of the dot product operation between the identifier hash value and the server private key component; The sum of the dot product result and the private key component of the key generation center is used as the server's master private key.

3. The method according to claim 1, characterized in that, The encrypted business data is decrypted using the quantum key encryption algorithm corresponding to the quantum key encryption channel and the server master private key to obtain plaintext business data, including: The encrypted business data is decrypted using the quantum key encryption and decryption algorithm to obtain the session key ciphertext and the business data ciphertext. The session key is obtained by decrypting the ciphertext of the session key using the server's master private key. The ciphertext of the service data is decrypted using the session key to obtain the plaintext of the service data.

4. The method according to claim 1, characterized in that, Before obtaining the encrypted business data, the following steps are included: Obtain the mobile device's signature value and the time when the mobile device requests login to the server; Obtain the server challenge code; wherein the server challenge code is randomly generated by the server when the mobile device requests to log in to the server; The request generation time is verified based on a preset time window to obtain a time verification result. If the time verification result is successful, the login request time is concatenated with the server challenge code to obtain the server concatenated data; Obtain the server master public key corresponding to the server master private key, and determine the login request result based on the server master private key, the server master public key, the server concatenated data, and the mobile terminal signature value; wherein, the login request result is used to indicate whether the mobile terminal can log in to the server; When the login request result is "login allowed", the encrypted service data is received through the quantum key encryption channel.

5. The method according to claim 4, characterized in that, The process of determining the login request result based on the server's master private key, the server's master public key, the server's concatenated data, and the mobile terminal's signature value includes: The server-side concatenated data is signed using the server-side master private key to obtain server-side signed data. The server signature data is verified using the server master public key to obtain the server verification result. Compare the server-side signature verification result with the mobile terminal signature value; If the signature verification result is exactly the same as the mobile terminal signature value, then the login request result is "login allowed"; otherwise, the login request result is "login prohibited".

6. A data transmission method, characterized in that, Applied to mobile devices, the method includes: Determine the plaintext of the business data and obtain the server's master public key; The random number generated by the mobile terminal is used as the session key, and the session key is used to encrypt the plaintext of the business data to obtain the ciphertext of the business data; wherein, the session key is temporarily generated when the mobile terminal and the server transmit data; The session key is encrypted using the server's master public key to obtain the ciphertext of the session key; The encrypted business data is concatenated with the encrypted session key to obtain the initial encrypted business data; When transmitting the initial encrypted service data through the quantum key encryption channel, the initial encrypted service data is encrypted using the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel to obtain encrypted service data.

7. The method according to claim 6, characterized in that, The method further includes: Obtain the request generation time of the mobile login request; wherein, the mobile login request is generated when the mobile device requests to log in to the server; Obtain the server challenge code returned by the server after receiving the mobile login request; The server-side challenge code is concatenated with the request generation time to obtain the mobile concatenated data; Obtain the server's master private key, and use the server's master private key to sign the concatenated data on the mobile device to obtain the mobile device's signature value.

8. A data transmission device, characterized in that, Applied to the server side, including: The identifier acquisition module is used to acquire the private key component of the key generation center, the private key component of the server, and the mobile device identifier. The private key determination module is used to determine the server master private key of the server based on the private key component of the key generation center, the server private key component, and the mobile terminal identifier. A data acquisition module is used to acquire encrypted business data; wherein the encrypted business data is transmitted to the server through a quantum key encryption channel; The data decryption module is used to decrypt the encrypted business data based on the quantum key encryption and decryption algorithm corresponding to the quantum key encryption channel and the server master private key to obtain the plaintext business data.

9. A data transmission device, characterized in that, Applied to mobile devices, including: The plaintext determination module is used to determine the plaintext of business data and obtain the server's master public key. The first encryption module is used to use a random number generated by the mobile terminal as a session key, and to encrypt the plaintext of the business data using the session key to obtain ciphertext of the business data; wherein, the session key is temporarily generated when the mobile terminal and the server transmit data; The second encryption module is used to encrypt the session key using the server's master public key to obtain the session key ciphertext; The data splicing module is used to splice the ciphertext of the business data with the ciphertext of the session key to obtain the initial encrypted business data; The third encryption module is used to encrypt the initial encrypted service data using the quantum key encryption algorithm corresponding to the quantum key encryption channel when transmitting the initial encrypted service data through the quantum key encryption channel, so as to obtain encrypted service data.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data transmission method according to any one of claims 1-7.

Images