Data encryption transmission method and device and storage medium

Abstract

The invention discloses a data encryption transmission method and device and a storage medium. Relates to the field of data transmission, and comprises the following steps: determining a virtual IP address of a first terminal, a data message to be transmitted by the first terminal and a destination IP address carried by the data message, the virtual IP address of the first terminal being an IP address pre-allocated in the same virtual network; under the condition that the destination IP address is the virtual IP address in the same virtual network, determining a second terminal for receiving the data message according to the destination IP address; and under the condition that the ciphertext channel exists between the first terminal and the second terminal, the first terminal sends the data message to the second terminal through the ciphertext channel. Through application of the data encryption transmission method and device, the problem that the stability of data encryption transmission is poor due to the risk of a single point of failure when encryption transmission is carried out by relying on central side gateway equipment in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of data transmission, and more specifically, to a data encryption transmission method, apparatus, and storage medium. Background Technology

[0002] With the deepening development of the information society, secure data transmission has become a focus of attention across all industries, especially in enterprise applications, remote work, and financial transactions. Traditional data encryption transmission solutions mostly rely on centralized architectures, with SSL (Secure Sockets Layer) / TLS (Transport Layer Security) protocols paired with central gateway devices being the most common. These devices, acting as the network's entry and exit points, undertake crucial functions such as encrypting and decrypting data, authenticating terminal identities, and managing network policies. However, their deployment and maintenance bring significant cost and efficiency issues. While central gateway devices can provide stable security, their high cost and the need for specialized teams for installation, configuration, and maintenance lead to high overall operational costs. Furthermore, since all encryption and decryption requests must pass through the central gateway, the flexibility of the network architecture is limited, making it difficult to quickly adapt to new terminal access requirements. Most importantly, the central gateway is the key to the entire encrypted transmission network; if it fails or is attacked, the entire network's data transmission will be severely affected, or even completely interrupted, creating a significant single point of failure and impacting the stability of encrypted data transmission.

[0003] There is currently no effective solution to the problem that relying on central gateway devices for encrypted transmission in related technologies poses a single point of failure risk, resulting in poor stability of encrypted data transmission. Summary of the Invention

[0004] The main objective of this application is to provide a data encryption transmission method, apparatus, and storage medium to solve the problem in related technologies that rely on central-side gateway equipment for encrypted transmission, which poses a risk of single point of failure and results in poor stability of data encryption transmission.

[0005] To achieve the above objectives, according to one aspect of this application, a data encryption transmission method is provided. The method includes: determining a virtual IP address of a first terminal, a data packet to be transmitted by the first terminal, and a destination IP address carried in the data packet, wherein the virtual IP address of the first terminal is a pre-assigned IP address within the same virtual network; if the destination IP address is also a virtual IP address within the same virtual network, determining a second terminal to receive the data packet based on the destination IP address; and if an encrypted channel exists between the first terminal and the second terminal, sending the data packet through the encrypted channel to the second terminal via the first terminal.

[0006] Optionally, the method further includes: if there is no encrypted channel between the first terminal and the second terminal, determining whether there is a correspondence between the first terminal and the second terminal according to the correspondence table of the first terminal; if there is a correspondence between the first terminal and the second terminal, establishing an encrypted channel between the first terminal and the second terminal; and sending the data packet to the second terminal through the encrypted channel via the first terminal.

[0007] Optionally, before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried in the data packet, the method further includes: pre-allocating a virtual IP address to the first terminal; when the first terminal accesses the network, sending the virtual IP address of the first terminal to terminals in the network via broadcast; and when a terminal in the network receives the virtual IP address of the first terminal, recording the virtual IP address of the first terminal in a correspondence table of terminals in the network.

[0008] Optionally, if there is an encrypted channel between the first terminal and the second terminal, the first terminal sending a data packet to the second terminal through the encrypted channel includes: sending the data packet to the second terminal through the encrypted channel; and if the second terminal receives the data packet, writing the data packet to the virtual network card through the second terminal and sending a response packet to the first terminal.

[0009] Optionally, when there is a corresponding relationship between the first terminal and the second terminal, establishing a encrypted channel between the first terminal and the second terminal includes: sending a connection request to the second terminal through the first terminal; receiving the connection request through the second terminal, and establishing a encrypted channel according to the connection request.

[0010] Optionally, receiving a connection request through the second terminal and establishing a ciphertext channel according to the connection request includes: receiving a connection request through the second terminal and parsing the connection information in the connection request, wherein the connection information includes an encryption algorithm type; determining the encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establishing a ciphertext channel according to the encryption strategy.

[0011] Optionally, when there is a ciphertext channel between the first terminal and the second terminal, after the first terminal sends a data packet to the second terminal through the ciphertext channel, the method further includes: if it is detected that the ciphertext channel has not performed data interaction for a continuous preset time, determining that the ciphertext channel is in an idle state and closing the ciphertext channel.

[0012] To achieve the above objectives, according to another aspect of this application, a data encryption transmission apparatus is provided. The apparatus includes: a first determining unit, configured to determine a virtual IP address of a first terminal, a data packet to be transmitted by the first terminal, and a destination IP address carried in the data packet, wherein the virtual IP address of the first terminal is a pre-assigned IP address within the same virtual network; a receiving unit, configured to determine a second terminal to receive the data packet based on the destination IP address if the destination IP address is a virtual IP address within the same virtual network; and a first sending unit, configured to send the data packet through the encrypted channel from the first terminal to the second terminal if an encrypted channel exists between the first terminal and the second terminal.

[0013] Optionally, the device further includes: a second determining unit, configured to determine whether a correspondence exists between the first terminal and the second terminal based on a correspondence table of the first terminal when no ciphertext channel exists between the first terminal and the second terminal; an establishing unit, configured to establish a ciphertext channel between the first terminal and the second terminal when a correspondence exists between the first terminal and the second terminal; and a second sending unit, configured to send data packets through the ciphertext channel to the second terminal via the first terminal.

[0014] Optionally, the device further includes: an allocation unit, configured to pre-allocate a virtual IP address to the first terminal before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried in the data packet; a third sending unit, configured to send the virtual IP address of the first terminal to terminals in the network via broadcast when the first terminal accesses the network; and a recording unit, configured to record the virtual IP address of the first terminal in a correspondence table of terminals in the network when a terminal in the network receives the virtual IP address of the first terminal.

[0015] Optionally, the first sending unit includes: a first sending module, used to send data packets to the second terminal via an encrypted channel; and a second sending module, used to write the data packets into a virtual network card through the second terminal when the second terminal receives the data packets, and to send a response message to the first terminal.

[0016] Optionally, the establishment unit includes: a request module for sending a connection request to a second terminal through a first terminal; and an establishment module for receiving the connection request through the second terminal and establishing an encrypted channel according to the connection request.

[0017] Optionally, the establishment module includes: a receiving submodule, used to receive a connection request through the second terminal and parse the connection information in the connection request, wherein the connection information includes an encryption algorithm type; and an establishment submodule, used to determine the encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establish a ciphertext channel according to the encryption strategy.

[0018] Optionally, the device further includes a shut-down unit, configured to, when there is an encrypted channel between the first terminal and the second terminal, after the first terminal sends a data packet to the second terminal through the encrypted channel, determine that the encrypted channel is in an idle state and shut down the encrypted channel if it is detected that the encrypted channel has not performed data interaction for a continuous preset time.

[0019] According to another aspect of this application, a computer-readable storage medium is provided, which includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform any data encryption transmission method.

[0020] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include methods for performing any data encryption transmission method.

[0021] According to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the data encryption transmission method described above.

[0022] In this embodiment, by determining the virtual IP address of the first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried in the data packet, wherein the virtual IP address of the first terminal is a pre-allocated IP address within the same virtual network; when the destination IP address is a virtual IP address within the same virtual network, the second terminal receiving the data packet is determined based on the destination IP address; and when there is an encrypted channel between the first terminal and the second terminal, the data packet is sent from the first terminal to the second terminal through the encrypted channel, thus solving the technical problem in related technologies where relying on a central gateway device for encrypted transmission poses a risk of single point of failure, resulting in poor stability of encrypted data transmission. In this application, by pre-assigning a preset virtual IP address to each terminal and operating them in the same virtual network, the terminals can communicate directly without relying on the central gateway device for data encryption and routing each time. When the first terminal with the virtual IP address needs to send a data packet to the second terminal, if the second terminal's IP address is also a virtual IP address in the same virtual network, it is checked whether there is already an encrypted channel between the first and second terminals. If so, the data packet is sent to the second terminal through the encrypted channel. Data transmission no longer depends on the central device, avoiding the risk of single point of failure and achieving the technical effect of improving the stability of encrypted data transmission. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a data encryption transmission method is shown.

[0025] Figure 2 This is a flowchart of a data encryption transmission method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of a data encryption transmission device provided according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] It should be noted that all relevant information (including but not limited to data information, network configuration, etc.) and data (including but not limited to data used for transmission, network configuration data, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0031] Example 1

[0032] According to an embodiment of this application, a method embodiment for encrypted data transmission is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a data encryption transmission method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0034] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data encryption transmission method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned data encryption transmission method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0037] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0038] Under the aforementioned operating environment, this application provides the following: Figure 2 The data encryption transmission method shown. Figure 2 This is a flowchart of a data encryption transmission method according to Embodiment 1 of this application.

[0039] Step S201: Determine the virtual IP address of the first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried by the data packet, wherein the virtual IP address of the first terminal is an IP address pre-assigned within the same virtual network.

[0040] Optionally, the aforementioned virtual IP address refers to a network identifier assigned to the first terminal. It does not belong to a real device in the physical network, but is a logical address used for communication in a virtual network environment. The aforementioned data packet is the basic unit of network communication, containing fields such as source address, destination address, and the actual data content transmitted. The aforementioned destination IP address refers to the IP address of the data receiver specified in the data packet, used to guide data routing within the network.

[0041] Step S202: If the destination IP address is a virtual IP address within the same virtual network, determine the second terminal to receive the data packet based on the destination IP address.

[0042] Optionally, the same virtual network refers to a logical network space jointly formed by the virtual network cards of various terminals, where member terminals can directly exchange encrypted data. The destination IP address is a virtual IP address within the same virtual network, meaning that the first terminal can directly transmit data with the second terminal without needing to go through a central gateway for forwarding.

[0043] Step S203: If there is an encrypted channel between the first terminal and the second terminal, the data packet is sent from the first terminal to the second terminal through the encrypted channel.

[0044] Optionally, the ciphertext channel refers to an encrypted communication connection established between the first terminal and the second terminal. It can be an encrypted tunnel based on protocols such as SSL / TLS, used to protect data during transmission from eavesdropping and tampering. Data packets are encrypted and sent through this ciphertext channel. After receiving the encrypted data, the second terminal uses the corresponding decryption key to decrypt the data packets, completing the encrypted data transmission.

[0045] The data encryption transmission method provided in this application determines the virtual IP address of a first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried in the data packet. The virtual IP address of the first terminal is a pre-assigned IP address within the same virtual network. When the destination IP address is also a virtual IP address within the same virtual network, the second terminal receiving the data packet is determined based on the destination IP address. When an encrypted channel exists between the first terminal and the second terminal, the data packet is sent from the first terminal to the second terminal via the encrypted channel. This solves the technical problem in related technologies where encryption transmission relies on a central gateway device, which poses a single point of failure risk and leads to poor stability in data encryption transmission. In this application, by pre-assigning a preset virtual IP address to each terminal and operating them in the same virtual network, the terminals can communicate directly without relying on the central gateway device for data encryption and routing each time. When the first terminal with the virtual IP address needs to send a data packet to the second terminal, if the second terminal's IP address is also a virtual IP address in the same virtual network, it is checked whether there is already an encrypted channel between the first and second terminals. If so, the data packet is sent to the second terminal through the encrypted channel. Data transmission no longer depends on the central device, avoiding the risk of single point of failure and achieving the technical effect of improving the stability of encrypted data transmission.

[0046] To improve the security and stability of data transmission, optionally, the data encryption transmission method provided in this application embodiment further includes:

[0047] The first step, in the absence of a ciphertext channel between the first terminal and the second terminal, is to determine whether there is a correspondence between the first terminal and the second terminal based on the correspondence table of the first terminal.

[0048] Optionally, the mapping table records the correspondence between the virtual IP addresses of other terminals in the virtual network and their actual physical locations (such as MAC addresses, real IP addresses, etc.). This table is dynamically updated to ensure that the latest reachability information of all terminals is accurate. When the first terminal needs to send a data packet to the second terminal, but a encrypted channel has not yet been established between them, the first terminal first queries its local mapping table to check if a corresponding record exists for the second terminal. If it exists, it means that both parties are known at the virtual network level, and they can further attempt to establish a encrypted channel; if it does not exist, it may mean that the second terminal has not yet joined the virtual network or is temporarily offline.

[0049] The second step is to establish a encrypted channel between the first terminal and the second terminal, provided that there is a corresponding relationship between the first terminal and the second terminal.

[0050] Optionally, after confirming the correspondence between the first terminal and the second terminal, both parties can begin the process of establishing a ciphertext channel, including negotiation of encryption protocols, generation and exchange of keys, authentication, and other steps, to ensure that the ciphertext channel to be established is secure.

[0051] The third step is to send the data packet to the second terminal through the encrypted channel via the first terminal.

[0052] Optionally, after the ciphertext channel is established, the first terminal can encrypt the data packets to be sent and then send them to the second terminal through the ciphertext channel. The content of the data packets is converted into ciphertext, and only the second terminal with the correct decryption key can restore it to the original data.

[0053] In summary, through the above steps, from data verification before sending to the establishment of encrypted channels and the transmission of encrypted data, secure, stable and efficient data transmission is achieved, overcoming problems such as single points of failure and communication delays that may be encountered in encrypted transmission in traditional centralized architectures.

[0054] To improve the flexibility and stability of data transmission, optionally, in the data encryption transmission method provided in this application embodiment, before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried in the data packet, the method further includes:

[0055] The first step is to pre-assign a virtual IP address to the first terminal.

[0056] Optionally, before the first terminal joins the virtual network, it will be assigned a unique virtual IP address. This virtual IP address will become the basis for the terminal to be identified and communicate in the network, so that the first terminal has a clear identity in the network.

[0057] The second step is to send the virtual IP address of the first terminal to other terminals in the network via broadcast, provided that the first terminal is connected to the network.

[0058] Alternatively, broadcasting is a mechanism for widely transmitting information, enabling information to reach every corner of the network, and all terminals listening to the broadcast can receive the virtual IP address information of the first terminal.

[0059] The third step is to record the virtual IP address of the first terminal in the network's terminal mapping table when the terminal in the network receives the virtual IP address of the first terminal.

[0060] Optionally, after receiving the virtual IP address information broadcast by the first terminal, other terminals in the network will add the virtual IP address of the first terminal to the corresponding relationship table, so that in subsequent communications, they can quickly locate the actual physical terminal based on the virtual IP address, thereby achieving accurate data transmission.

[0061] In summary, through the above steps, pre-allocating virtual IP addresses gives each terminal a unique identity in the network. Then, the virtual IP address of the new terminal is announced to all terminals in the network via broadcast. Finally, by updating the correspondence table of each terminal in the network, each terminal can quickly respond to the addition of a new terminal, which enhances the dynamic adaptability and decentralized characteristics of the virtual network and contributes to the efficiency and security of data transmission.

[0062] To improve the stability and security of data transmission, optionally, in the data encryption transmission method provided in this application embodiment, when there is a ciphertext channel between the first terminal and the second terminal, the first terminal sending the data packet to the second terminal through the ciphertext channel includes:

[0063] The first step is to send the data packet to the second terminal via an encrypted channel.

[0064] Optionally, when the encrypted channel between the first terminal and the second terminal has been established, the first terminal will encrypt the data packets to be transmitted. The encryption process is carried out according to the encryption algorithm and key agreed upon in advance. After encryption, the data packets are sent to the second terminal through the encrypted channel.

[0065] The second step involves the second terminal receiving the data packet, writing the data packet into the virtual network card, and sending the response packet to the first terminal.

[0066] Optionally, after receiving the encrypted data packet, the second terminal can decrypt it using the same key negotiated with the first terminal to restore the original data. Then, the second terminal writes the decrypted data packet to the virtual network interface card, completing the data reception process. Simultaneously, the second terminal also generates a response packet and sends it back to the first terminal via the encrypted channel to confirm the data packet reception status.

[0067] In summary, by establishing a ciphertext channel directly between the first and second terminals for encrypted data transmission through the above steps, the reliance on a centralized gateway is avoided, reducing network complexity and potential single points of failure.

[0068] To improve the flexibility of data transmission, optionally, in the data encryption transmission method provided in this application embodiment, when there is a corresponding relationship between the first terminal and the second terminal, establishing a ciphertext channel between the first terminal and the second terminal includes:

[0069] The first step is to send a connection request from the first terminal to the second terminal.

[0070] Optionally, if the first terminal recognizes a corresponding relationship with the second terminal, and a ciphertext channel has not yet been established between the two, the first terminal will proactively send a connection request to the second terminal. The connection request contains preliminary information required for the establishment of the ciphertext channel, such as the identifier of the first terminal, the preference for encryption algorithms, and the key exchange method.

[0071] The second step is to receive the connection request through the second terminal and establish an encrypted channel based on the connection request.

[0072] Optionally, after receiving a connection request from the first terminal, the second terminal will negotiate an encryption algorithm and key with the first terminal. Once an encryption protocol is reached, a ciphertext channel will be established between the first and second terminals. Subsequently, the first and second terminals can transmit data through this ciphertext channel, ensuring the security and integrity of the data.

[0073] In summary, by following the steps outlined above, compared to traditional centralized network encryption transmission technologies that rely on a central server or gateway for key management and information transmission, this method reduces the risk of single points of failure and improves the flexibility of data transmission by directly initiating connection requests and establishing encrypted channels between terminals.

[0074] Optionally, in the data encryption transmission method provided in this application embodiment, receiving a connection request through a second terminal and establishing a encrypted channel according to the connection request includes:

[0075] The first step is to receive the connection request through the second terminal and parse the connection information in the connection request, which includes the encryption algorithm type.

[0076] Optionally, when the second terminal receives a connection request sent by the first terminal, it will first parse the connection information in the connection request, including identifying the encryption algorithm type suggested by the first terminal.

[0077] The second step is to determine the encryption strategies for the first and second terminals based on the encryption algorithm type, and then establish a ciphertext channel based on the encryption strategies.

[0078] Optionally, after parsing the encryption algorithm type in the connection request, the second terminal can determine the encryption strategy based on the obtained information, such as selecting the key length and deciding whether to use a message authentication code to enhance data integrity protection. Then, the second terminal can collaboratively establish a ciphertext channel with the first terminal according to the determined encryption strategy.

[0079] In summary, by following the steps described above, there is no need to rely on a central device. Terminals automatically send connection requests to each other and establish encrypted channels based on the connection requests, which improves the flexibility of data transmission and avoids the risk of single point of failure.

[0080] To improve resource utilization efficiency, optionally, in the data encryption transmission method provided in the embodiments of this application, when there is a ciphertext channel between the first terminal and the second terminal, after the first terminal sends the data packet to the second terminal through the ciphertext channel, the method further includes: when it is detected that the ciphertext channel has not performed data interaction for a continuous preset time, determining that the ciphertext channel is in an idle state and closing the ciphertext channel.

[0081] Optionally, the aforementioned preset time is used to determine whether the data transmission channel is idle. The selection of the preset time can comprehensively consider network latency, the periodicity of normal communication, and the balance between security and resource consumption. If no data interaction is detected in the encrypted channel within the preset time, it will be considered to be in an idle state. Then, the system can automatically close this encrypted channel, releasing the associated computing and network resources. The encrypted channel can be closed after both the first and second terminals confirm, preventing interruption of ongoing communication. When data needs to be transmitted again, the first terminal can re-initiate a connection request to re-establish the encrypted channel with the second terminal. Through the above steps, unnecessary resource consumption can be reduced, and the overall resource utilization efficiency of the system can be improved.

[0082] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0083] Example 2

[0084] This application also provides a data encryption transmission device. It should be noted that the data encryption transmission device of this application can be used to execute the data encryption transmission method provided in this application. The data encryption transmission device provided in this application is described below.

[0085] According to embodiments of this application, an apparatus for implementing the above-described data encryption transmission method is also provided, such as... Figure 3 As shown, the device includes: a first determining unit 301, a receiving unit 302, and a first transmitting unit 303.

[0086] Specifically, the first determining unit 301 is used to determine the virtual IP address of the first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried by the data packet, wherein the virtual IP address of the first terminal is an IP address pre-allocated within the same virtual network;

[0087] The receiving unit 302 is used to determine the second terminal for receiving data packets based on the destination IP address when the destination IP address is a virtual IP address within the same virtual network.

[0088] The first sending unit 303 is used to send a data packet through the encrypted channel from the first terminal to the second terminal when there is an encrypted channel between the first terminal and the second terminal.

[0089] The data encryption transmission device provided in this application embodiment determines the virtual IP address of a first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried in the data packet through a first determining unit 301. The virtual IP address of the first terminal is a pre-allocated IP address within the same virtual network. When the destination IP address is a virtual IP address within the same virtual network, the receiving unit 302 determines the second terminal to receive the data packet based on the destination IP address. When there is an encrypted channel between the first terminal and the second terminal, the first sending unit 303 sends the data packet to the second terminal through the encrypted channel via the first terminal. This solves the problem in related technologies where encryption transmission relies on a central gateway device, which poses a single point of failure risk and leads to poor stability of encrypted data transmission. This achieves the technical effect of improving the stability of encrypted data transmission.

[0090] Optionally, in the data encryption transmission apparatus provided in the embodiments of this application, the apparatus further includes: a second determining unit, configured to determine whether there is a correspondence between the first terminal and the second terminal according to a correspondence table of the first terminal when there is no ciphertext channel between the first terminal and the second terminal; an establishing unit, configured to establish a ciphertext channel between the first terminal and the second terminal when there is a correspondence; and a second sending unit, configured to send data packets through the ciphertext channel to the second terminal via the first terminal.

[0091] Optionally, in the data encryption transmission apparatus provided in the embodiments of this application, the apparatus further includes: an allocation unit, configured to pre-allocate a virtual IP address to the first terminal before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried in the data packet; a third sending unit, configured to send the virtual IP address of the first terminal to terminals in the network via broadcast when the first terminal accesses the network; and a recording unit, configured to record the virtual IP address of the first terminal in a correspondence table of terminals in the network when a terminal in the network receives the virtual IP address of the first terminal.

[0092] Optionally, in the data encryption transmission device provided in this application embodiment, the first sending unit 303 includes: a first sending module, used to send data packets to a second terminal through an encrypted channel; and a second sending module, used to write the data packets into a virtual network card through the second terminal when the second terminal receives the data packets, and send a response message to the first terminal.

[0093] Optionally, in the data encryption transmission device provided in this application embodiment, the establishment unit includes: a request module, used to send a connection request to a second terminal through a first terminal; and an establishment module, used to receive the connection request through the second terminal and establish an encrypted channel according to the connection request.

[0094] Optionally, in the data encryption transmission device provided in this application embodiment, the establishment module includes: a receiving submodule, used to receive a connection request through a second terminal and parse the connection information in the connection request, wherein the connection information includes an encryption algorithm type; and an establishment submodule, used to determine the encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establish a ciphertext channel according to the encryption strategy.

[0095] Optionally, in the data encryption transmission device provided in the embodiments of this application, the device further includes: a closing unit, used to determine that the ciphertext channel is idle and close the ciphertext channel after the first terminal sends a data packet to the second terminal through the ciphertext channel when it is detected that the ciphertext channel has not performed data interaction for a continuous preset time when there is a ciphertext channel between the first terminal and the second terminal.

[0096] It should be noted that the first determining unit 301, receiving unit 302, and first sending unit 303 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0097] Example 3

[0098] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0099] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0100] In this embodiment, the computer terminal described above can execute the program code for the following steps in the data encryption transmission method: determining the virtual IP address of the first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried by the data packet, wherein the virtual IP address of the first terminal is a pre-allocated IP address within the same virtual network; if the destination IP address is a virtual IP address within the same virtual network, determining the second terminal to receive the data packet based on the destination IP address; if there is an encrypted channel between the first terminal and the second terminal, sending the data packet to the second terminal through the encrypted channel via the first terminal.

[0101] Optionally, the computer terminal described above can execute program code for the following steps in the data encryption transmission method: the method further includes: if there is no ciphertext channel between the first terminal and the second terminal, determining whether there is a correspondence between the first terminal and the second terminal according to the correspondence table of the first terminal; if there is a correspondence between the first terminal and the second terminal, establishing a ciphertext channel between the first terminal and the second terminal; and sending the data packet to the second terminal through the ciphertext channel via the first terminal.

[0102] Optionally, the computer terminal described above can execute the program code for the following steps in the data encryption transmission method: before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried in the data packet, the method further includes: pre-allocating a virtual IP address to the first terminal; when the first terminal accesses the network, sending the virtual IP address of the first terminal to terminals in the network via broadcast; and when a terminal in the network receives the virtual IP address of the first terminal, recording the virtual IP address of the first terminal in the correspondence table of terminals in the network.

[0103] Optionally, the computer terminal described above can execute the program code for the following steps in the data encryption transmission method: when there is an encrypted channel between the first terminal and the second terminal, the first terminal sending a data packet to the second terminal through the encrypted channel includes: sending the data packet to the second terminal through the encrypted channel; when the second terminal receives the data packet, writing the data packet to the virtual network card through the second terminal and sending a response packet to the first terminal.

[0104] Optionally, the computer terminal described above can execute program code for the following steps in the data encryption transmission method: when there is a corresponding relationship between the first terminal and the second terminal, establishing an encrypted channel between the first terminal and the second terminal includes: sending a connection request to the second terminal through the first terminal; receiving the connection request through the second terminal, and establishing an encrypted channel according to the connection request.

[0105] Optionally, the computer terminal described above can execute the program code for the following steps in the data encryption transmission method: receiving a connection request through the second terminal and establishing a ciphertext channel according to the connection request includes: receiving a connection request through the second terminal and parsing the connection information in the connection request, wherein the connection information includes an encryption algorithm type; determining the encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establishing a ciphertext channel according to the encryption strategy.

[0106] Optionally, the computer terminal described above can execute the program code for the following steps in the data encryption transmission method: when there is a ciphertext channel between the first terminal and the second terminal, after the first terminal sends a data packet to the second terminal through the ciphertext channel, the method further includes: when it is detected that the ciphertext channel has not conducted data interaction for a continuous preset time, determining that the ciphertext channel is in an idle state and closing the ciphertext channel.

[0107] Optionally, Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4(Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0108] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the data encryption transmission method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned data encryption transmission method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0109] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the data encryption transmission method.

[0110] This application provides a data encryption transmission scheme. By determining the virtual IP address of a first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried in the data packet, wherein the virtual IP address of the first terminal is a pre-assigned IP address within the same virtual network; when the destination IP address is also within the same virtual network, the second terminal receiving the data packet is determined based on the destination IP address; and when an encrypted channel exists between the first and second terminals, the data packet is sent from the first terminal to the second terminal via the encrypted channel. This solves the technical problem in related technologies where encryption transmission relies on a central gateway device, leading to a single point of failure and poor stability in data encryption transmission, thus improving the stability of data encryption transmission.

[0111] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0112] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0113] Example 4

[0114] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data encryption transmission method provided in Embodiment 1.

[0115] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0116] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: determining the virtual IP address of the first terminal, the data packet to be transmitted by the first terminal, and the destination IP address carried by the data packet, wherein the virtual IP address of the first terminal is a pre-assigned IP address within the same virtual network; if the destination IP address is a virtual IP address within the same virtual network, determining the second terminal to receive the data packet based on the destination IP address; and if there is an encrypted channel between the first terminal and the second terminal, sending the data packet to the second terminal through the encrypted channel via the first terminal.

[0117] Optionally, the storage medium is further configured to store program code for performing the following steps: if there is no encrypted channel between the first terminal and the second terminal, determine whether there is a correspondence between the first terminal and the second terminal according to the correspondence table of the first terminal; if there is a correspondence between the first terminal and the second terminal, establish an encrypted channel between the first terminal and the second terminal; and send the data packet to the second terminal through the encrypted channel via the first terminal.

[0118] Optionally, the storage medium is further configured to store program code for performing the following steps: before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried by the data packet, the method further includes: pre-allocating a virtual IP address to the first terminal; when the first terminal accesses the network, sending the virtual IP address of the first terminal to terminals in the network via broadcast; and when a terminal in the network receives the virtual IP address of the first terminal, recording the virtual IP address of the first terminal in a correspondence table of terminals in the network.

[0119] Optionally, the storage medium is also configured to store program code for performing the following steps: when there is an encrypted channel between the first terminal and the second terminal, the first terminal sending a data packet to the second terminal through the encrypted channel includes: sending the data packet to the second terminal through the encrypted channel; when the second terminal receives the data packet, writing the data packet to the virtual network card through the second terminal and sending a response packet to the first terminal.

[0120] Optionally, the storage medium is also configured to store program code for performing the following steps: when there is a correspondence between the first terminal and the second terminal, establishing an encrypted channel between the first terminal and the second terminal includes: sending a connection request to the second terminal through the first terminal; receiving the connection request through the second terminal, and establishing an encrypted channel according to the connection request.

[0121] Optionally, the storage medium is also configured to store program code for performing the following steps: receiving a connection request through a second terminal and establishing a ciphertext channel according to the connection request includes: receiving a connection request through a second terminal and parsing the connection information in the connection request, wherein the connection information includes an encryption algorithm type; determining the encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establishing a ciphertext channel according to the encryption strategy.

[0122] Optionally, the storage medium is also configured to store program code for performing the following steps: when there is a ciphertext channel between the first terminal and the second terminal, after the first terminal sends a data packet to the second terminal through the ciphertext channel, the method further includes: when it is detected that the ciphertext channel has not performed data interaction for a continuous preset time, determining that the ciphertext channel is in an idle state and closing the ciphertext channel.

[0123] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing the steps of a data encryption transmission method.

[0124] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0125] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0127] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0129] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0130] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for data encryption transmission, characterized in that, The method comprises: determining a virtual IP address of a first terminal, a data packet to be transmitted by the first terminal, and a destination IP address carried by the data packet, wherein the virtual IP address of the first terminal is an IP address pre-assigned in a same virtual network; in a case where the destination IP address is a virtual IP address in the same virtual network, determining a second terminal receiving the data packet according to the destination IP address; in a case where there is a cipher channel between the first terminal and the second terminal, sending the data packet by the first terminal to the second terminal through the cipher channel.

2. The method of claim 1, wherein, The method further comprises: in a case where there is no cipher channel between the first terminal and the second terminal, determining whether there is a corresponding relationship between the first terminal and the second terminal according to a corresponding relationship table of the first terminal; in a case where there is a corresponding relationship between the first terminal and the second terminal, establishing the cipher channel between the first terminal and the second terminal; sending the data packet by the first terminal to the second terminal through the cipher channel.

3. The method of claim 1, wherein, Before determining the virtual IP address of the first terminal, the data packet of the first terminal, and the destination IP address carried by the data packet, the method further comprises: pre-assigning a virtual IP address to the first terminal; in a case where the first terminal accesses a network, sending the virtual IP address of the first terminal to terminals in the network in a broadcast form; in a case where the terminals in the network receive the virtual IP address of the first terminal, recording the virtual IP address of the first terminal into a corresponding relationship table of the terminals in the network.

4. The method of claim 1, wherein, In a case where there is a cipher channel between the first terminal and the second terminal, the first terminal sending the data packet to the second terminal through the cipher channel comprises: sending the data packet to the second terminal through the cipher channel; in a case where the second terminal receives the data packet, writing the data packet into a virtual network card by the second terminal, and sending a response packet to the first terminal.

5. The method of claim 2, wherein, In a case where there is a corresponding relationship between the first terminal and the second terminal, establishing the cipher channel between the first terminal and the second terminal comprises: sending a connection request by the first terminal to the second terminal; receiving the connection request by the second terminal, and establishing the cipher channel according to the connection request.

6. The method of claim 5, wherein, Receiving the connection request by the second terminal, and establishing the cipher channel according to the connection request comprises: receiving the connection request by the second terminal, and parsing connection information in the connection request, wherein the connection information comprises an encryption algorithm type; determining an encryption strategy of the first terminal and the second terminal according to the encryption algorithm type, and establishing the cipher channel according to the encryption strategy.

7. The method of claim 1, wherein, After the first terminal sends the data packet to the second terminal through the cipher channel in a case where there is a cipher channel between the first terminal and the second terminal, the method further comprises: In a case where it is monitored that the ciphertext channel does not perform data interaction for a continuous preset time, it is determined that the ciphertext channel is in an idle state, and the ciphertext channel is closed.

8. A data encryption transmission apparatus characterized by comprising: Comprise: The first determination unit is used for determining a virtual IP address of a first terminal, a data message to be transmitted by the first terminal and a destination IP address carried by the data message, wherein the virtual IP address of the first terminal is an IP address pre-assigned in a same virtual network; The receiving unit is used for determining a second terminal receiving the data message according to the destination IP address in a case where the destination IP address is a virtual IP address in the same virtual network; The first sending unit is used for sending the data message to the second terminal through the first terminal via a ciphertext channel in a case where the ciphertext channel exists between the first terminal and the second terminal.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored executable program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the data encryption transmission method in any one of claims 1 to 7 when the executable program is run.

10. An electronic device, comprising: Comprise: The memory stores an executable program; The processor is used for running the program, wherein the program executes the data encryption transmission method in any one of claims 1 to 7 when the program is run.

11. A computer program product comprising computer instructions, characterized in that, The computer instructions are executed by the processor to implement the steps of the data encryption transmission method in any one of claims 1 to 7.

Images