Data encryption transmission method, system and device and computer program product
By combining symmetric and asymmetric encryption, along with the cryptographic block chaining mode and keystore management, the problem of low encryption efficiency during data transmission is solved, achieving efficient and secure data transmission.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-04-03
Smart Images
Figure CN121792129A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security, and more specifically, to a data encryption transmission method, system, apparatus, and computer program product. Background Technology
[0002] With the advent of the digital age, information technology has experienced explosive growth, and data transmission has become an indispensable part of modern communication and business activities. However, the openness and complexity of networks have also brought unprecedented challenges to data security. The continuous innovation of hacking techniques and cybercrime methods makes traditional data protection measures increasingly inadequate to cope with emerging threats.
[0003] In related technologies, data transmission encryption techniques lack flexibility and adaptability when handling different types of data, resulting in inconsistent encryption effectiveness. For example, encryption strategies for text data may not be suitable for image or video data, limiting the practical application of encryption schemes. In scenarios with large data volumes or high real-time requirements, the speed of encryption algorithms becomes a bottleneck, affecting the timeliness of data transmission and business processing efficiency. The complexity of key management and distribution leads to reduced system security and increases the likelihood of attacks.
[0004] There is currently no effective solution to the problem of low encryption efficiency in the data transmission process of related technologies. Summary of the Invention
[0005] The main objective of this application is to provide a data encryption transmission method, system, device, and computer program product to solve the problem of low encryption efficiency in the data transmission process in related technologies.
[0006] To achieve the above objectives, according to one aspect of this application, a data encryption transmission method is provided. The method includes: acquiring target data to be encrypted and determining the data type of the target data; determining a target symmetric encryption key based on the data type; performing preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext; acquiring an asymmetric key pair; encrypting the target symmetric encryption key using the public key in the asymmetric key pair to obtain an encrypted symmetric key; and sending the encrypted symmetric key and the preliminary ciphertext to a data receiving end, wherein the data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the preliminary ciphertext using the target symmetric encryption key to obtain the target data.
[0007] Optionally, the initial encryption of the target data using the target symmetric encryption key to obtain the initial ciphertext includes: dividing the target data into blocks according to a preset data block size to obtain N data blocks; obtaining a random initialization vector, performing an XOR operation on the initialization vector and the first data block to obtain the first operation result, encrypting the first operation result using the target symmetric encryption key to obtain the first ciphertext block; performing an XOR operation on the first ciphertext block and the second data block to obtain the second operation result, encrypting the second operation result using the target symmetric encryption key to obtain the second ciphertext block; and so on, until the (N-1)th ciphertext block and the Nth plaintext data block are XORed to obtain the Nth operation result, encrypting the Nth operation result using the target symmetric encryption key to obtain the Nth ciphertext block; and combining the N ciphertext blocks to obtain the initial ciphertext.
[0008] Optionally, the method further includes: storing the target symmetric encryption key and asymmetric key pair in a key storage area corresponding to the data type in a key library, wherein the key library stores the symmetric encryption key and asymmetric encryption key generated during each data transmission; verifying the identity and permissions of the accessing user when a key library access request is detected; and allowing the accessing user to access the key library if the accessing user has the permission to access the key library and the authentication is successful.
[0009] Optionally, before determining the target symmetric encryption key based on the data type, the method further includes: detecting whether the current time has reached the key update cycle; if the current time has reached the key update cycle, regenerating the symmetric encryption key and the asymmetric key pair to obtain the updated target symmetric encryption key and the updated asymmetric key pair; performing preliminary encryption on the target data based on the updated target symmetric encryption key to obtain the updated preliminary ciphertext; and encrypting the target symmetric encryption key based on the public key in the updated asymmetric key pair to obtain the encrypted symmetric key.
[0010] Optionally, sending the encrypted symmetric key and preliminary ciphertext to the data receiving end includes: determining the target transmission protocol based on the data type, network environment, and transmission distance of the target data; determining the target transmission path based on the network topology and bandwidth of the receiving end and the sending end; and transmitting the encrypted symmetric key and preliminary ciphertext based on the target transmission protocol and the target transmission path.
[0011] Optionally, determining the target symmetric encryption key based on the data type includes: when the data type is non-sensitive data, determining a key with a first preset number of bits as the target symmetric encryption key; when the data type is sensitive data, determining a key with a second preset number of bits as the target symmetric encryption key, wherein the second preset number of bits is greater than the first preset number of bits.
[0012] Optionally, obtaining the target data to be encrypted includes: extracting initial data from a relational database using a structured query statement, and extracting initial data from an IoT sensor using the sensor's communication protocol; formatting the initial data to obtain target data with the target encoding format and target field order.
[0013] According to another aspect of this application, a data encryption transmission system is provided. The system includes: a key store for generating symmetric encryption keys and asymmetric key pairs at key update cycles; a data sender that performs preliminary encryption on target data to be sent using the symmetric encryption key to obtain preliminary ciphertext, encrypts the symmetric encryption key using the public key in the asymmetric key pair to obtain an encrypted symmetric key, and sends the encrypted symmetric key and the preliminary ciphertext to a data receiver; and a data receiver that decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the symmetric encryption key, and decrypts the preliminary ciphertext using the symmetric encryption key to obtain the target data.
[0014] To achieve the above objectives, according to another aspect of this application, a data encryption transmission apparatus is provided. The apparatus includes: an acquisition unit for acquiring target data to be encrypted and determining the data type of the target data; a first encryption unit for determining a target symmetric encryption key based on the data type and performing preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext; a second encryption unit for acquiring an asymmetric key pair and encrypting the target symmetric encryption key using the public key in the asymmetric key pair to obtain an encrypted symmetric key; and a sending unit for sending the encrypted symmetric key and the preliminary ciphertext to a data receiving end, wherein the data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the preliminary ciphertext using the target symmetric encryption key to obtain the target data.
[0015] In this embodiment, the following steps are taken: First, the target data to be encrypted is acquired, and its data type is determined. Based on the data type, a target symmetric encryption key is determined. The target data is then initially encrypted using this symmetric encryption key to obtain preliminary ciphertext. Next, an asymmetric key pair is acquired, and the target symmetric encryption key is encrypted using the public key in the asymmetric key pair to obtain the encrypted symmetric key. Finally, the encrypted symmetric key and the preliminary ciphertext are sent to a data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key. This decryption of the preliminary ciphertext using the target symmetric encryption key yields the target data. This combination of symmetric and asymmetric encryption enhances the security and efficiency of data transmission. Symmetric encryption algorithms, due to their high efficiency, are used for data encryption, while asymmetric encryption algorithms are used for encrypting the symmetric key, ensuring secure key transmission. This achieves the goals of improving data transmission efficiency, effectively preventing key leakage, and enhancing data confidentiality, thereby improving encryption efficiency during data transmission and solving the technical problem of low encryption efficiency in data transmission. Attached Figure Description
[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:
[0017] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data encryption transmission method is shown.
[0018] Figure 2 This is a flowchart of a data encryption transmission method provided according to an embodiment of this application;
[0019] Figure 3 This is a schematic diagram of a data encryption transmission device provided according to an embodiment of this application;
[0020] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation
[0021] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0023] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.
[0024] Example 1
[0025] According to an embodiment of this application, a method embodiment for encrypted data transmission is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0026] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a data encryption transmission method is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as MCU (Microcontroller Unit) or FPGA (Field-Programmable Gate Array), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a USB (Universal Serial Bus) port (which may be included as one of the ports of a BUS (Business Bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.
[0027] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).
[0028] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data encryption transmission method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned data encryption transmission method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0029] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.
[0030] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).
[0031] Under the above operating environment, this application provides a method for encrypted data transmission. Figure 2 This is a flowchart of a data encryption transmission method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes:
[0032] Step S201: Obtain the target data to be encrypted and determine the data type of the target data.
[0033] In step S201, data to be transmitted is accurately collected from various data sources. These data sources can include various types such as internal enterprise databases, personal mobile devices, and IoT sensors. During data collection, appropriate collection strategies are adopted based on the interface type and data format of the data source. After data collection, the data type is identified, such as text data, image data, and audio data, to determine the data type of the target data and subsequently select the appropriate encryption algorithm and key length.
[0034] Step S202: Determine the target symmetric encryption key based on the data type, and perform preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext.
[0035] In step S202, a self-developed hybrid encryption algorithm is employed, combining the efficiency of symmetric encryption algorithms with the security advantages of asymmetric encryption algorithms. The data is then rapidly encrypted using a symmetric encryption algorithm. First, based on the classification results of the target data, an appropriate symmetric encryption key length is selected for different data types. For example, a 128-bit key can be chosen for general text data, while a 256-bit key is chosen for important business confidential data to enhance encryption security. Then, the classified data is divided into blocks of fixed size, and each block is encrypted using the selected symmetric encryption key to generate preliminary ciphertext. During the encryption process, a cipher block chaining mode is used. By introducing an initialization vector, the randomness of encryption is increased, preventing identical plaintext blocks from resulting in identical ciphertext blocks, further improving encryption security.
[0036] Step S203: Obtain an asymmetric key pair, and encrypt the target symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key.
[0037] In step S203, after symmetric encryption is completed, to ensure the security of the symmetric encryption key during transmission, an asymmetric encryption algorithm is used to encrypt the target symmetric encryption key used by the symmetric encryption algorithm. First, the system generates a pair of asymmetric keys: a public key and a private key. The public key can be publicly distributed, while the private key is strictly kept secret by the data sender. When encrypting the symmetric key, the receiver's public key is used to encrypt the symmetric encryption key, generating an encrypted symmetric key. The encrypted symmetric key is then transmitted along with the initial ciphertext.
[0038] Step S204: The encrypted symmetric key and the initial ciphertext are sent to the data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key. The target symmetric encryption key is then used to decrypt the initial ciphertext to obtain the target data.
[0039] In step S204, the encrypted symmetric key and the initial ciphertext are transmitted accurately to the data receiving end according to a predetermined transmission protocol and path. After receiving the data, the data receiving end uses its private key to decrypt the symmetric encryption key, and then uses the same symmetric key to decrypt the initial ciphertext, thereby obtaining the original target data.
[0040] The data encryption transmission method provided in this application involves: acquiring target data to be encrypted and determining the data type of the target data; determining a target symmetric encryption key based on the data type; performing preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext; acquiring an asymmetric key pair; encrypting the target symmetric encryption key using the public key in the asymmetric key pair to obtain an encrypted symmetric key; and sending the encrypted symmetric key and the preliminary ciphertext to a data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and then decrypts the preliminary ciphertext using the target symmetric encryption key to obtain the target data. This combination of symmetric and asymmetric encryption enhances the security and efficiency of data transmission. Symmetric encryption algorithms, due to their high efficiency, are used for data encryption, while asymmetric encryption algorithms are used for encrypting the symmetric key, ensuring secure key transmission. This achieves the goals of improving data transmission efficiency, effectively preventing key leakage, and enhancing data confidentiality, thereby improving encryption efficiency during data transmission and solving the technical problem of low encryption efficiency in data transmission.
[0041] To increase the randomness of encryption, a ciphertext block chaining mode is used to chain ciphertext blocks. Optionally, in the data encryption transmission method provided in this application embodiment, the preliminary encryption of target data using a target symmetric encryption key to obtain preliminary ciphertext includes: dividing the target data into blocks according to a preset data block size to obtain N data blocks; obtaining a random initialization vector, performing an XOR operation between the initialization vector and the first data block to obtain a first operation result, encrypting the first operation result using the target symmetric encryption key to obtain a first ciphertext block; performing an XOR operation between the first ciphertext block and the second data block to obtain a second operation result, encrypting the second operation result using the target symmetric encryption key to obtain a second ciphertext block; until the (N-1)th ciphertext block is XORed with the Nth plaintext data block to obtain the Nth operation result, encrypting the Nth operation result using the target symmetric encryption key to obtain the Nth ciphertext block; and combining the N ciphertext blocks to obtain the preliminary ciphertext.
[0042] In some embodiments, before data encryption, the target data is first divided into fixed-size blocks, such as 128 bits or 256 bits, depending on the symmetric encryption algorithm used. Blocking facilitates processing by the encryption algorithm and also facilitates block transmission over the network. The initialization vector is a randomly generated vector used in conjunction with the first data block. The use of the initialization vector increases the randomness of the encryption process; even identical plaintext will not generate identical ciphertext, thus improving encryption security. The XOR operation is a binary operation widely used in cryptography because it is reversible and can increase the randomness of encrypted data. After performing an XOR operation between the initialization vector and the first data block, the result is then encrypted using the target symmetric encryption key to produce the first ciphertext block.
[0043] After generating the first ciphertext block, it is XORed with the second plaintext block, and the result is then encrypted using the target symmetric encryption key to produce the second ciphertext block. This process continues until all data blocks are encrypted. For each subsequent data block, the previous ciphertext block is XORed with the current plaintext block, and then encrypted using the target symmetric encryption key to obtain the current ciphertext block. This process is repeated until all data blocks have been processed. After all data blocks have been processed, all generated ciphertext blocks are combined to form a complete preliminary ciphertext.
[0044] This embodiment increases the randomness of the encryption process by using a cipher block chaining mode, so that even if the same plaintext is transmitted in different data transmissions, the same ciphertext will not be generated, thus improving the security of data transmission.
[0045] The keys generated during the encrypted transmission process are stored in a key library. Optionally, in the data encrypted transmission method provided in this application embodiment, the method further includes: storing the target symmetric encryption key and asymmetric key pair in the key library corresponding to the data type, wherein the key library stores the symmetric encryption key and asymmetric encryption key generated during each data transmission; verifying the identity and permissions of the accessing user when a key library access request is detected; and allowing the accessing user to access the key library if the accessing user has the permission to access the key library and the authentication is successful.
[0046] In some embodiments, the system generates a new target symmetric encryption key for each data transmission. This key is stored in a key store, in a key storage area corresponding to the data type. For example, the key generated when processing text data would be stored in the key storage area for the text data type. Similarly, asymmetric key pairs (containing a public key and a private key) are also stored in the key store, but unlike symmetric keys, asymmetric key pairs are typically long-term valid to protect the symmetric key during transmission.
[0047] When the system detects an access request to the keystore, it triggers further access control procedures. After the access request is triggered, the system verifies the identity and permissions of the requesting user. Username and password verification: ensures the user's identity is genuine. Permission check: verifies whether the user has permission to access specific types of keys or keys in specific areas. For example, only security administrators may have access to the area storing encryption keys for sensitive data. If the user has permission to access the keystore and authentication is successful, the system will allow the user to access the keystore. This access control mechanism ensures that only verified users can access the keys, significantly reducing the risk of unauthorized access.
[0048] This embodiment effectively protects the security of encryption keys through a key store, while ensuring the compliance and security of key usage through an access control mechanism.
[0049] The generated key is updated periodically. Optionally, in the data encryption transmission method provided in this application embodiment, before determining the target symmetric encryption key based on the data type, the method further includes: detecting whether the current time has reached the key update cycle; if the current time has reached the key update cycle, regenerating the symmetric encryption key and the asymmetric key pair to obtain the updated target symmetric encryption key and the updated asymmetric key pair; performing preliminary encryption on the target data based on the updated target symmetric encryption key to obtain the updated preliminary ciphertext; and encrypting the target symmetric encryption key based on the public key in the updated asymmetric key pair to obtain the encrypted symmetric key.
[0050] In some embodiments, a key update cycle is preset and dynamically set according to the data type, transmission frequency, or security level requirements. For example, for data transmission containing sensitive financial information, the key update cycle can be set to one week; while for ordinary text data, it can be set to one month. When the system is running, it continuously monitors whether the current time has reached the time point of the next key update cycle. When the system detects that the current time has reached the key update cycle, it will trigger the key update process. A new target symmetric encryption key is generated. The length and type of this key are determined according to the data type and the latest security policy. Subsequently, the system generates a new asymmetric key pair, including the updated public key and private key. The update of the asymmetric key pair is to ensure the key security during data transmission; even if the old key pair may have been intercepted or deciphered, the new key pair can still protect the data security.
[0051] The target data to be transmitted is initially encrypted using the updated target symmetric encryption key. This step follows the same process as the initial encryption, ensuring data confidentiality. To protect the updated symmetric key during transmission, the system uses the public key from the updated asymmetric key pair to encrypt the updated target symmetric encryption key. This process ensures that even if the initial ciphertext is intercepted, the symmetric key cannot be decrypted without the corresponding private key, thus preventing data decryption.
[0052] This embodiment can significantly improve the security of data transmission by regularly updating the encryption key, ensuring stable system operation and efficient data transmission.
[0053] During data transmission, a target transmission protocol and target transmission path are selected as needed. Optionally, in the data encryption transmission method provided in this application embodiment, sending the encrypted symmetric key and preliminary ciphertext to the data receiving end includes: determining the target transmission protocol based on the data type, network environment, and transmission distance of the target data; determining the target transmission path based on the network topology and bandwidth of the receiving end and the sending end; and transmitting the encrypted symmetric key and preliminary ciphertext based on the target transmission protocol and transmission path.
[0054] In some embodiments, regarding the transmission protocol, a suitable transmission protocol is selected based on factors such as the data type, transmission distance, and network environment. For example, for data with high real-time requirements, a high-speed transmission protocol is selected to ensure reliable data transmission; for large amounts of data that do not have high real-time requirements but require efficient transmission, the User Datagram Protocol (UDP) is selected.
[0055] Regarding transmission paths, the optimal path is selected based on network topology and bandwidth. Network monitoring tools can be used to monitor network parameters such as bandwidth, latency, and packet loss rate in real time, dynamically adjusting the transmission path. During transmission, the transmission status is monitored in real time, and integrity checks and sequence verification are performed on the transmitted data by adding checksums and sequence numbers. If any transmission anomalies are detected, such as packet loss or data corruption, retransmission or error correction will be performed promptly to ensure that the data is accurately transmitted to the target receiving end.
[0056] This embodiment ensures the security and integrity of data transmission by intelligently and efficiently transmitting encrypted data to the data receiving end.
[0057] Selecting the corresponding target symmetric encryption key according to different data types. Optionally, in the data encryption transmission method provided in this application embodiment, determining the target symmetric encryption key based on the data type includes: when the data type is non-sensitive data, determining a key with a first preset number of bits as the target symmetric encryption key; when the data type is sensitive data, determining a key with a second preset number of bits as the target symmetric encryption key, wherein the second preset number of bits is greater than the first preset number of bits.
[0058] In some embodiments, the type of target data is first identified before encryption. The data type can be determined by the data's content, format, or metadata. For example, personally identifiable information (such as ID card numbers or bank card numbers) and financial data are generally considered sensitive data, while ordinary text information or publicly available data are considered non-sensitive data. For non-sensitive data, a smaller, first preset key of a certain length is used as the target symmetric encryption key. Common choices include 128-bit or 192-bit keys, which provide sufficient security but require relatively low computational resources. For sensitive data, a larger, second preset key of a certain length is used as the target symmetric encryption key. For example, a 256-bit key provides very high security strength, resisting all current conventional encryption attacks.
[0059] This embodiment determines the target symmetric encryption key length based on data type, which can optimize the encryption process of non-sensitive data while protecting sensitive data, thereby improving the overall efficiency of data transmission.
[0060] Optionally, in the data encryption transmission method provided in this application embodiment, obtaining the target data to be encrypted includes: extracting initial data from a relational database through a structured query statement, and extracting initial data from an IoT sensor through the sensor's communication protocol; formatting the initial data to obtain target data with a target encoding format and target field order.
[0061] For example, for relational databases, data is extracted according to preset rules using structured query statements; for IoT sensors, data sent by the sensors is received and parsed in real time according to the sensors' communication protocols. After data collection, preliminary formatting is performed, standardizing the data's encoding format, field order, etc., to meet the requirements of subsequent encryption processing. Simultaneously, the data is categorized according to its type (e.g., text data, image data, audio data) and purpose (e.g., trade secrets, personal privacy data), providing a more targeted basis for subsequent encryption processing.
[0062] This embodiment effectively extracts data from diverse data sources and performs necessary formatting, laying a solid foundation for subsequent encryption and transmission. By standardizing data formats and field order, the system can better adapt to different data types and application scenarios, improving the reliability and efficiency of data processing.
[0063] According to another embodiment of this application, a data encryption transmission system is provided. The system includes:
[0064] A key store is used to generate symmetric encryption keys and asymmetric key pairs every key update cycle.
[0065] Specifically, the keystore is the core component ensuring data encryption security, responsible for generating, storing, distributing, and updating various keys used in the encryption process. For symmetric encryption keys, a high-strength key is generated using a random number generator, based on the requirements of the encryption algorithm and the security level. The random number generator employs a hardware random number generator (such as a physical noise-based random number generator) or a rigorously tested software random number algorithm to ensure that the generated keys possess sufficient randomness and unpredictability. For asymmetric key pairs, public and private keys of appropriate length are generated according to parameter settings. Furthermore, to enhance key security, the key generation parameters and algorithms are updated periodically.
[0066] The keystore uses secure storage media, such as encrypted hard drives or security chips, to encrypt and store the keys. Keys are managed hierarchically, categorized and stored according to different types of data transmission tasks, with strict access permissions. Only authorized users or programs can access the keystore, and access requires authentication, such as username and password verification, and digital certificate verification.
[0067] During data transmission, the keystore securely distributes the encryption keys to relevant parties based on the identities of the sender and receiver. For symmetric encryption keys, they are encrypted using asymmetric encryption before being sent to the receiver. For asymmetric key pairs, the public key is distributed to the appropriate users or system components based on their roles and permissions. To prevent key breaches or leaks, the keys used in the encryption process are updated regularly. The update cycle is set according to the importance and security level of the data; for critical business confidential data, keys are updated weekly or even daily; for general public data, keys can be updated monthly or quarterly. A smooth transition is employed during key updates to ensure the continuity and security of data transmission during the key update process.
[0068] The data sending end first encrypts the target data to be sent using a symmetric encryption key to obtain preliminary ciphertext. Then, it encrypts the symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key. Finally, it sends the encrypted symmetric key and the preliminary ciphertext to the data receiving end.
[0069] Specifically, before sending data, the data sender generates a symmetric encryption key based on the data's sensitivity level. This key is used to initially encrypt the target data. Using the generated symmetric encryption key, the target data is encrypted to obtain preliminary ciphertext. To ensure the security of the symmetric key during transmission, the data sender uses the public key from an asymmetric key pair to further encrypt the initially generated symmetric encryption key. The asymmetric key pair is generated by the data receiver, and the sender obtains the receiver's public key. The data sender packages the preliminary ciphertext and the encrypted symmetric key together and then sends them to the data receiver via a secure transmission protocol and path.
[0070] At the data receiving end, the private key in the asymmetric key pair is used to decrypt the encrypted symmetric key to obtain the symmetric encryption key. The symmetric encryption key is then used to decrypt the initial ciphertext to obtain the target data.
[0071] Specifically, when the data receiving end receives a data packet, it first uses the private key from its asymmetric key pair to decrypt the encrypted symmetric key. The private key decryption process is based on the inverse operation of the asymmetric encryption algorithm, converting the encrypted symmetric key ciphertext back into the original symmetric encryption key plaintext. Once the symmetric encryption key is successfully decrypted, the receiving end uses this symmetric key to decrypt the initial ciphertext transmitted in the data packet. The initial ciphertext is obtained by the data sending end using a symmetric encryption algorithm and a symmetric encryption key to initially encrypt the target data.
[0072] The data encryption transmission system in this embodiment, through the use of hybrid encryption algorithms, ensures both encryption speed and security, enabling faster and more secure data transmission. The simplified key management process reduces the complexity of key management and minimizes the risk of data leakage due to key management errors. Simultaneously, the system's excellent adaptability to different data types ensures reliable encryption protection for all types of data during transmission, effectively guaranteeing the confidentiality, integrity, and availability of data transmission.
[0073] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.
[0074] Example 2
[0075] This application also provides a data encryption transmission device. It should be noted that the data encryption transmission device of this application can be used to execute the data encryption transmission method provided in this application. The data encryption transmission device provided in this application will be described below.
[0076] According to an embodiment of this application, an apparatus for implementing the above-described data encryption transmission method is also provided. Figure 3 This is a schematic diagram of a data encryption transmission device provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes:
[0077] Acquisition unit 301 is used to acquire the target data to be encrypted and determine the data type of the target data;
[0078] The first encryption unit 302 is used to determine the target symmetric encryption key based on the data type, and to perform preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext.
[0079] The second encryption unit 303 is used to obtain an asymmetric key pair and encrypt the target symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key.
[0080] The sending unit 304 is used to send the encrypted symmetric key and the initial ciphertext to the data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the initial ciphertext using the target symmetric encryption key to obtain the target data.
[0081] The data encryption transmission device provided in this application embodiment acquires target data to be encrypted by an acquisition unit 301 and determines the data type of the target data; a first encryption unit 302 determines a target symmetric encryption key based on the data type and performs preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext; a second encryption unit 303 acquires an asymmetric key pair and encrypts the target symmetric encryption key using the public key in the asymmetric key pair to obtain an encrypted symmetric key; a sending unit 304 sends the encrypted symmetric key and the preliminary ciphertext to a data receiving end, wherein the data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the preliminary ciphertext using the target symmetric encryption key to obtain the target data. The combination of symmetric and asymmetric encryption enhances the security and efficiency of data transmission. Symmetric encryption algorithms are used for data encryption due to their high efficiency, while asymmetric encryption algorithms are used for encrypting the symmetric key, ensuring the secure transmission of the key. This achieves the goal of improving data transmission efficiency, effectively preventing key leakage, and enhancing data confidentiality, thereby realizing the technical effect of improving encryption efficiency during data transmission and solving the technical problem of low encryption efficiency during data transmission.
[0082] Optionally, in the data encryption transmission device provided in this application embodiment, the first encryption unit 302 includes: a block segmentation module, used to segment the target data into blocks according to a preset data block size to obtain N data blocks; an acquisition module, used to acquire a random initialization vector, perform an XOR operation on the initialization vector and the first data block to obtain a first operation result, and encrypt the first operation result with a target symmetric encryption key to obtain a first ciphertext block; a first encryption module, used to perform an XOR operation on the first ciphertext block and the second data block to obtain a second operation result, and encrypt the second operation result with a target symmetric encryption key to obtain a second ciphertext block; a second encryption module, used to perform an XOR operation on the (N-1)th ciphertext block and the Nth plaintext data block to obtain the Nth operation result, and encrypt the Nth operation result with a target symmetric encryption key to obtain the Nth ciphertext block; and a combination module, used to combine the N ciphertext blocks to obtain preliminary ciphertext.
[0083] Optionally, in the data encryption transmission apparatus provided in this application embodiment, the apparatus further includes: a storage unit, used to store the target symmetric encryption key and asymmetric key pair in a key library corresponding to the data type, wherein the key library stores the symmetric encryption key and asymmetric encryption key generated each time data is transmitted; a verification unit, used to verify the identity and permissions of the accessing user when a key library access request is detected; and an access unit, used to allow the accessing user to access the key library if the accessing user has the permission to access the key library and the authentication is successful.
[0084] Optionally, in the data encryption transmission apparatus provided in this application embodiment, the apparatus further includes: a detection unit, used to detect whether the current time has reached the key update cycle; a generation unit, used to regenerate the symmetric encryption key and the asymmetric key pair when the current time has reached the key update cycle, to obtain the updated target symmetric encryption key and the updated asymmetric key pair; a third encryption unit, used to perform preliminary encryption on the target data based on the updated target symmetric encryption key, to obtain the updated preliminary ciphertext; and a fourth encryption unit, used to encrypt the target symmetric encryption key based on the public key in the updated asymmetric key pair, to obtain the encrypted symmetric key.
[0085] Optionally, in the data encryption transmission apparatus provided in this application embodiment, the sending unit 304 includes: a first determining module, used to determine the target transmission protocol based on the data type, network environment and transmission distance of the target data; a second determining module, used to determine the target transmission path based on the network topology and bandwidth of the receiving end and the sending end; and a transmission module, used to transmit the encrypted symmetric key and preliminary ciphertext based on the target transmission protocol and the target transmission path.
[0086] Optionally, in the data encryption transmission device provided in the embodiments of this application, the first encryption unit 302 includes: a third determining module, used to determine a key of a first preset number of bits as the target symmetric encryption key when the data type is non-sensitive data; and a fourth determining module, used to determine a key of a second preset number of bits as the target symmetric encryption key when the data type is sensitive data, wherein the second preset number of bits is greater than the first preset number of bits.
[0087] Optionally, in the data encryption transmission device provided in this application embodiment, the acquisition unit 301 includes: an extraction module, used to extract initial data from a relational database through a structured query statement, and to extract initial data from an IoT sensor through a sensor communication protocol; and a sorting module, used to sort the initial data to obtain target data with a target encoding format and a target field order.
[0088] It should be noted that the aforementioned acquisition unit 301, first encryption unit 302, second encryption unit 303, and sending unit 304 correspond to steps S201 to S204 in Embodiment 1. The four units and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the aforementioned modules or units can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These modules or units can also run as part of a device in the computer terminal 10 provided in Embodiment 1.
[0089] Example 3
[0090] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.
[0091] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0092] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: acquiring the target data to be encrypted and determining the data type of the target data; determining the target symmetric encryption key based on the data type and performing preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext; acquiring an asymmetric key pair and encrypting the target symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key; sending the encrypted symmetric key and the preliminary ciphertext to the data receiving end, wherein the data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the preliminary ciphertext using the target symmetric encryption key to obtain the target data.
[0093] The processor can also access information and applications stored in the memory via a transmission device to execute the following steps: Divide the target data into N blocks according to a preset data block size; obtain a random initialization vector; XOR the initialization vector with the first data block to obtain the first result; encrypt the first result using the target symmetric encryption key to obtain the first ciphertext block; XOR the first ciphertext block with the second data block to obtain the second result; encrypt the second result using the target symmetric encryption key to obtain the second ciphertext block; repeat this process until the (N-1)th ciphertext block is XORed with the Nth plaintext data block to obtain the Nth result; encrypt the Nth result using the target symmetric encryption key to obtain the Nth ciphertext block; combine the N ciphertext blocks to obtain the initial ciphertext.
[0094] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: storing the target symmetric encryption key and asymmetric key pair into the key storage area corresponding to the data type in the key library, wherein the key library stores the symmetric encryption key and asymmetric encryption key generated during each data transmission; verifying the identity and permissions of the accessing user when a key library access request is detected; and allowing the accessing user to access the key library if the accessing user has the permission to access the key library and the authentication is successful.
[0095] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: detect whether the current time has reached the key update cycle; if the current time has reached the key update cycle, regenerate the symmetric encryption key and the asymmetric key pair to obtain the updated target symmetric encryption key and the updated asymmetric key pair; perform preliminary encryption on the target data based on the updated target symmetric encryption key to obtain the updated preliminary ciphertext; encrypt the target symmetric encryption key based on the public key in the updated asymmetric key pair to obtain the encrypted symmetric key.
[0096] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the target transmission protocol based on the data type, network environment and transmission distance of the target data; determine the target transmission path based on the network topology and bandwidth of the receiving end and the sending end; and transmit the encrypted symmetric key and preliminary ciphertext based on the target transmission protocol and the target transmission path.
[0097] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the data type is non-sensitive data, determine the key of the first preset number of bits as the target symmetric encryption key; when the data type is sensitive data, determine the key of the second preset number of bits as the target symmetric encryption key, wherein the second preset number of bits is greater than the first preset number of bits.
[0098] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: extract initial data from the relational database through a structured query statement, and extract initial data from the Internet of Things sensor through the sensor's communication protocol; format the initial data to obtain target data with target encoding format and target field order.
[0099] This application provides a scheme for obtaining target data to be encrypted, determining the data type of the target data, determining a target symmetric encryption key based on the data type, initially encrypting the target data with the target symmetric encryption key to obtain preliminary ciphertext, obtaining an asymmetric key pair, encrypting the target symmetric encryption key with the public key in the asymmetric key pair to obtain an encrypted symmetric key, and sending the encrypted symmetric key and preliminary ciphertext to a data receiving end. The data receiving end decrypts the encrypted symmetric key with the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the preliminary ciphertext with the target symmetric encryption key to obtain the target data. By combining symmetric and asymmetric encryption, the security and efficiency of data transmission are enhanced. Symmetric encryption algorithms, due to their high efficiency, are used for data encryption, while asymmetric encryption algorithms are used for encrypting the symmetric key, ensuring the secure transmission of the key. This achieves the goals of improving data transmission efficiency, effectively preventing key leakage, and enhancing data confidentiality, thereby realizing the technical effect of improving encryption efficiency during data transmission and solving the technical problem of low encryption efficiency during data transmission.
[0100] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.
[0101] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.
[0102] Example 4
[0103] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data encryption transmission method provided in Embodiment 1.
[0104] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.
[0105] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing the steps of a data encryption transmission method.
[0106] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0107] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0108] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.
[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0110] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0111] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0112] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A method for encrypted data transmission, characterized in that, include: Obtain the target data to be encrypted and determine the data type of the target data; Based on the data type, a target symmetric encryption key is determined, and the target data is initially encrypted using the target symmetric encryption key to obtain preliminary ciphertext. Obtain an asymmetric key pair, and encrypt the target symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key; The encrypted symmetric key and the initial ciphertext are sent to the data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key. The target symmetric encryption key is then used to decrypt the initial ciphertext to obtain the target data.
2. The method according to claim 1, characterized in that, The target data is initially encrypted using the target symmetric encryption key to obtain preliminary ciphertext, which includes: The target data is divided into N data blocks according to a preset data block size; Obtain a random initialization vector, perform an XOR operation between the initialization vector and the first data block to obtain the first operation result, and encrypt the first operation result using the target symmetric encryption key to obtain the first ciphertext block; The first ciphertext block and the second data block are XORed to obtain the second result. The second result is then encrypted using the target symmetric encryption key to obtain the second ciphertext block. The process continues until the (N-1)th ciphertext block and the Nth plaintext data block are XORed to obtain the Nth result. The Nth result is then encrypted using the target symmetric encryption key to obtain the Nth ciphertext block. The initial ciphertext is obtained by combining N ciphertext blocks.
3. The method according to claim 1, characterized in that, The method further includes: The target symmetric encryption key and the asymmetric key pair are stored in the key storage area corresponding to the data type in the key library, wherein the key library stores the symmetric encryption key and the asymmetric encryption key generated during each data transmission; Upon detecting a keystore access request, verify the identity and permissions of the accessing user; If the user has permission to access the keystore and their authentication is successful, the user is allowed to access the keystore.
4. The method according to claim 1, characterized in that, Before determining the target symmetric encryption key based on the data type, the method further includes: Check if the current time has reached the key update cycle; If the current time reaches the key update cycle, the symmetric encryption key and asymmetric key pair are regenerated to obtain the updated target symmetric encryption key and the updated asymmetric key pair; The target data is initially encrypted based on the updated target symmetric encryption key to obtain the updated preliminary ciphertext. The target symmetric encryption key is encrypted using the public key in the updated asymmetric key pair to obtain the encrypted symmetric key.
5. The method according to claim 1, characterized in that, Sending the encrypted symmetric key and the initial ciphertext to the data receiving end includes: The target transmission protocol is determined based on the data type, network environment, and transmission distance of the target data. The target transmission path is determined based on the network topology and bandwidth of the receiving and transmitting ends. The encrypted symmetric key and the initial ciphertext are transmitted based on the target transmission protocol and the target transmission path.
6. The method according to claim 1, characterized in that, Determining the target symmetric encryption key based on the data type includes: When the data type is non-sensitive data, the key with the first preset number of bits is determined as the target symmetric encryption key; When the data type is sensitive data, the key with a second preset number of bits is determined as the target symmetric encryption key, wherein the second preset number of bits is greater than the first preset number of bits.
7. The method according to claim 1, characterized in that, Obtaining the target data to be encrypted includes: Initial data is extracted from relational databases using structured query statements and from IoT sensors using sensor communication protocols. The initial data is formatted to obtain target data with the target encoding format and target field order.
8. A data encryption transmission system, characterized in that, include: A key store is used to generate symmetric encryption keys and asymmetric key pairs every key update cycle. The data sending end first encrypts the target data to be sent using the symmetric encryption key to obtain preliminary ciphertext, then encrypts the symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key, and sends the encrypted symmetric key and the preliminary ciphertext to the data receiving end. The data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the symmetric encryption key, and then decrypts the initial ciphertext using the symmetric encryption key to obtain the target data.
9. A data encryption transmission device, characterized in that, include: An acquisition unit is used to acquire the target data to be encrypted and determine the data type of the target data. The first encryption unit is used to determine a target symmetric encryption key based on the data type, and to perform preliminary encryption on the target data using the target symmetric encryption key to obtain preliminary ciphertext. The second encryption unit is used to obtain an asymmetric key pair and encrypt the target symmetric encryption key using the public key in the asymmetric key pair to obtain the encrypted symmetric key. A sending unit is configured to send the encrypted symmetric key and the initial ciphertext to a data receiving end, wherein the data receiving end decrypts the encrypted symmetric key using the private key in the asymmetric key pair to obtain the target symmetric encryption key, and decrypts the initial ciphertext using the target symmetric encryption key to obtain the target data.
10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the data encryption transmission method according to any one of claims 1 to 7.