Data transmission method based on direct communication

Abstract

The invention discloses a direct communication-based data transmission method, which comprises the following steps that: each of a plurality of terminals initiates an identity authentication request to an aggregation security gateway, the aggregation security gateway constructs a topological connection relationship based on the terminals passing the identity authentication, and the terminals establish connection according to the topological connection relationship to form a communication network; the method comprises the following steps: in a communication network, acquiring a symmetrical communication key file 1 from a key server by two mutually connected terminals through an aggregation security gateway; the sending terminal determines a communication route, processes the service data mes, generates a sending data packet MES and sends the sending data packet MES to the receiving terminal; the receiving terminal carries out decryption and verification operation on the sending data packet MES, after verification is passed, service data mes' are obtained, and service processing operation is executed. A full-link safety guarantee system from identity authentication, connection establishment, secret key management to data transmission is built, and essential improvement of safety is achieved while high communication efficiency is guaranteed.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a data transmission method based on direct communication. Background Technology

[0002] In modern communication systems, terminal devices often need to interact directly to reduce communication latency, improve transmission efficiency, and alleviate the load on central nodes. In direct terminal communication, devices can establish connections directly without relying on a central node for data forwarding, thus building a flexible and efficient distributed network.

[0003] Especially in small-scale network scenarios, the number of participating terminals is limited, and direct connection between terminals can meet the communication needs within the network. However, in the direct connection communication mode, ensuring the security and reliability of data transmission and efficiently managing keys and routing become urgent problems to be solved. Existing direct connection communication methods usually lack a unified key distribution mechanism and identity authentication system, which can easily lead to complex key management, cumbersome authentication processes, and difficulty in maintaining communication continuity and security in dynamically changing network topologies.

[0004] Therefore, it is necessary to propose a data transmission method suitable for direct terminal network scenarios, which can achieve efficient and reliable communication between terminals while ensuring identity trust and key security. Summary of the Invention

[0005] Purpose of the invention: This application provides a data transmission method based on direct communication to solve the problems mentioned in the background art.

[0006] Technical Solution: This invention provides a data transmission method based on direct communication, wherein the participants in the method include an aggregated security gateway, a key server, and multiple terminals; the method includes the following steps:

[0007] Step 1: Each of the multiple terminals initiates an authentication request to the aggregated security gateway. The aggregated security gateway constructs a topology connection relationship based on the terminals that have passed authentication. Each terminal establishes a connection according to the topology connection relationship to form a communication network.

[0008] Step 2: In the communication network, two interconnected terminals obtain the symmetric communication key file file1 from the key server via the aggregated security gateway;

[0009] Step 3: The sending terminal, acting as the sender, determines the communication route, processes the service data mes, generates a transmission data packet MES, and sends it to the receiving terminal, acting as the receiver. The receiving terminal performs decryption and verification operations on the transmission data packet MES. After successful verification, it obtains the service data mes' and performs the service processing operation.

[0010] As an improvement to the present invention, the specific process of step 1 includes:

[0011] Step 1-1: Each terminal obtains a hash value H1 and hash value parameters based on its own device identity DID and its own network access code RID; generates an initial access request req1, and sends the initial access request req1 to the aggregated security gateway; wherein, the initial access request req1 carries the device identity DID, network access code RID, hash value H1, hash value parameters, and its own network IP;

[0012] Steps 1-2: The aggregated security gateway receives the first access request req1 from each terminal and establishes an association table locally based on the information carried in the first access request req1; the aggregated security gateway forwards the first access request req1 from each terminal to the key server, the key server performs the authentication operation, and obtains the authentication result of each terminal;

[0013] Steps 1-3: The key server sends the authentication results of each terminal to the aggregated security gateway; the aggregated security gateway establishes a topology connection relationship for the terminals that have passed authentication based on the authentication results, fills the topology connection relationship into the association table, and sends the topology connection relationship to the terminals that have passed authentication.

[0014] Steps 1-4: Each terminal that receives the topology connection relationship establishes a direct connection relationship based on the topology connection relationship to form a communication network.

[0015] As an improvement of the present invention, both the key server and each terminal locally store a symmetric root key file file0. In step 1-1, the specific process of obtaining the hash value H1 and the hash value parameters is as follows:

[0016] The terminal generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the local root key file file0. It records the index idx-s1 of the input random number s1 in the root key file file0. The string consisting of the coefficients of each term in the irreducible polynomial p1(x), excluding the highest term, is denoted as str1. The terminal then uses the irreducible polynomial p1(x) and the input random number s1 to generate the first hash function h. p1,s1 Input the device identification DID and network access code RID into the first hash function h p1,s1 The hash value H1=h is obtained. p1,s1(DID, RID); Record hash value parameters: string str1, index idx-s1 of the input random number s1.

[0017] As an improvement to the present invention, in steps 1-2, the specific process by which the key server performs the authentication operation to obtain the authentication results of each terminal is as follows:

[0018] Upon receiving the initial access request req1, the key server parses it to obtain the device identity DID', network access code RID', hash value H1', ​​string str1', index idx-s1', and network IP'. Based on the index idx-s1', the key server retrieves the input random number s1' from the local root key file file0. Finally, the key server generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the device identity DID' and network access code RID' into the hash function h p1’,s1’ Calculate the authentication hash value H1''=h p1’,s1’ (DID', RID'); Compare whether the hash value H1' obtained from parsing is consistent with the calculated authentication hash value H1'': if they are consistent, the authentication result is successful; otherwise, the authentication result is unsuccessful.

[0019] As an improvement of the present invention, in steps 1-3, the aggregated security gateway sends an instruction to the terminal whose authentication result is failed to re-execute step 1-1. The terminal that receives the authentication result as failed executes step 1-1 again and initiates a new first access request req1' to the aggregated security gateway.

[0020] As an improvement to the present invention, the specific process of step 2 is as follows:

[0021] Step 2-1: Either of the two interconnected terminals generates a key acquisition request req2 and sends it to the aggregated security gateway; wherein, the key acquisition request req2 carries the device identity DID, network access code RID, network IP and the peer IP of the other terminal; the aggregated security gateway forwards the key acquisition request req2 to the key server;

[0022] Step 2-2: Based on the key acquisition request req2, the key server selects a communication key file file1 from the local machine, obtains an encryption key k1 from the root key file file0, records the key index idx-k1 of the encryption key k1 in the root key file file0, and performs an encryption operation on the communication key file file1 using the encryption key k1 to obtain the ciphertext enc(file1) = file1⊕k1 of the communication key file file1; the key server sends the key index idx-k1 and the ciphertext enc(file1) to the aggregated security gateway;

[0023] Steps 2-3: Based on the network IP and peer IP in the key acquisition request req2, the aggregated security gateway forwards the key index idx-k1 and the ciphertext enc(file1) to the two corresponding terminals; at the same time, it fills the key index idx-k1 and the ciphertext enc(file1) into the terminal information corresponding to the association table and updates the association table.

[0024] Steps 2-4: The two terminals obtain the key index idx-k1' and the ciphertext enc(file1)'. Based on the key index idx-k1', they obtain the decryption key k1' from the local root key file file0. They then use the decryption key k1' to perform a decryption operation on the ciphertext enc(file1)' to obtain the communication key file file1.

[0025] As an improvement to the present invention, the specific process of step 3 is as follows:

[0026] Step 3-1: The service data mes includes a frame header and data content cont, wherein the frame header includes the destination IP; the sending terminal obtains the destination IP to be transmitted from the frame header in the service data mes, determines the communication route of the receiving terminal corresponding to the destination IP, and establishes a link with the receiving terminal according to the communication route;

[0027] Step 3-2: After the link is established, the sending terminal encrypts the data content (cont) in the service data (mes) to obtain the ciphertext (enc(cont)); the sending terminal calculates the checksum based on the frame header and the ciphertext (enc(cont)) to obtain the checksum (check); the sending terminal performs a data framing operation based on the ciphertext (enc(cont)) and the checksum (check) to obtain the transmission data packet (MES); the sending terminal sends the transmission data packet (MES) to the receiving terminal according to the destination IP in the frame header.

[0028] Step 3-3: The receiving terminal receives the transmitted data packet MES, performs a decryption operation to obtain the service data mes', performs a verification operation on the service data mes', and performs a service processing operation on the service data mes' if the verification is successful; otherwise, it directly discards the decrypted service data mes'.

[0029] As an improvement to the present invention, in step 3-1:

[0030] The specific process for determining the communication route of the receiving terminal corresponding to the destination IP is as follows:

[0031] The sending terminal internally parses the destination IP in the frame header of the service data (mess) and checks whether the destination IP exists in the received topology connection relationship:

[0032] If so, the sending terminal determines the communication route based on the destination IP, and establishes a connection with the receiving terminal corresponding to the destination IP based on the communication route;

[0033] Otherwise, the sending terminal redetermines the communication route based on the destination IP, re-establishes the link with the receiving terminal corresponding to the destination IP based on the redetermined communication route, and converts the re-established link into a topology message and sends it to the aggregation security gateway. The aggregation security gateway updates the locally stored topology connection relationship to a second topology connection relationship based on the topology message, updates the updated second topology connection relationship to the association table, and updates and distributes it to all terminals in the communication network. Among them, the sending terminal and the receiving terminal that re-establish the link perform step 2 to obtain a new communication key file.

[0034] As an improvement to the present invention, in step 3-2:

[0035] The specific process of performing encryption on the data content cont in the business data mes is as follows:

[0036] The sending terminal selects encryption key k2 from the communication key file file1, records the key index idx-k2 of encryption key k2 in the communication key file file1, and uses encryption key k2 to perform encryption operation on the data content cont to obtain the ciphertext of the data content enc(cont)=cont⊕k2;

[0037] The specific process of calculating the checksum and obtaining the checksum "check" is as follows:

[0038] The sending terminal calculates the checksum of the frame header, key index idx-k2, encryption key k2, and data content cont to obtain the checksum check.

[0039] The specific process of performing data framing operations to obtain the MES data packet is as follows:

[0040] The sending terminal combines the frame header, key index idx-k2, checksum, and encrypted data content enc(cont) to obtain the MES data packet.

[0041] As an improvement to the present invention, in step 3-3:

[0042] The specific process of performing a decryption operation to obtain business data mes' and then performing a verification operation on business data mes' is as follows:

[0043] The receiving terminal receives and parses the transmitted data packet MES to obtain the frame header 'header', key index idx-k2', checksum 'check', and encrypted data content enc(cont)'. Based on the key index idx-k2', it obtains the decryption key k2' from the communication key file file1. Using the decryption key k2', it performs a decryption operation on the encrypted data content enc(cont)' to obtain the plaintext data content cont'. The frame header 'header' and the data content cont' constitute the service data mes'. The terminal calculates the checksum 'check'' of the frame header 'header', key index idx-k2', decryption key k2', and data content cont'. It compares the calculated checksum 'check'' with the parsed checksum 'check'' value. If they match, the verification passes; otherwise, the verification fails.

[0044] Beneficial effects:

[0045] 1. Terminals participating in direct communication complete authentication by performing hash calculations based on their unique device identity and network access code. This method is computationally efficient and responds quickly, ensuring the real-time nature of the authentication process. More importantly, due to the uniqueness of the device identity and network access code and the irreversible nature of the hash algorithm, the generated hash value is immutable, eliminating the possibility of identity impersonation and tampering from the source, and building a solid and reliable initial security barrier for the entire direct communication network.

[0046] 2. This invention introduces an aggregated security gateway as the core of topology management, which builds a global topology connection relationship based on terminals that have passed identity authentication and generates an association table. This design enables terminals to establish connections according to clear topology guidelines, avoiding the blind trial connections and invalid links common in direct connection networking, effectively reducing network resource overhead and connection establishment latency, thereby optimizing the utilization of system resources and improving networking and communication efficiency.

[0047] 3. The factory-preset root key file file0 is used only to securely obtain the communication key file file1, effectively isolating the long-term fixed root key from the short-term communication key. Even if the root key file is accidentally leaked during device manufacturing or storage, it cannot be directly used to eavesdrop on or tamper with the current communication data, greatly reducing systemic security risks. The issuance of communication keys is strictly bound to the network topology: when the network topology changes due to terminal additions, departures, or link changes, the communication key file will be updated synchronously. This means that the security policy can be dynamically adjusted with the network status, ensuring that the communication process is carried out under the protection of the new key after any topology change, achieving continuous and dynamic protection of communication data security.

[0048] 4. During the data transmission phase, the receiving terminal performs strict verification operations on the data packets: it verifies and calculates the complete data unit, including the frame header, encryption key and its index, and ciphertext, which can simultaneously verify the integrity of the data, the correctness of the key, and the legality of the message structure. Any tampering with core data or key parameters during transmission will be effectively identified. Thus, based on efficient data verification, the security and reliability of the communication process are further enhanced, effectively defending against data tampering and replay attacks. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A schematic diagram illustrating the connections between the parties involved in the method of this application;

[0051] Figure 2 This is a flowchart illustrating the method described in this application;

[0052] Figure 3 This is an exemplary schematic diagram of the topological connection relationship in this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] This invention provides a data transmission method based on direct communication. The method is based on the premise that each terminal in the communication network has a pre-installed root key file (file0). This root key file (file0) can be obtained from a key server or distributed offline at the factory (e.g., via USB flash drive). The key server also stores this root key file (file0). The key server may include network elements such as a root key center and a key center to perform the distribution of different key files; for example, the root key center is used to distribute root key files, and the key center is used to distribute communication key files.

[0055] Each terminal possesses its own Device Identifier (DID), Network Access Code (RID), network IP address, and subnet mask, among other terminal identification information. The Device Identifier (DID) is a unique identifier acquired by each device at the factory; the Network Access Code (RID) is a unique code obtained by each device within the communication network during its construction.

[0056] like Figure 1 As shown, the participants in the data transmission method based on direct communication described in this invention include: an aggregated security gateway, a key server, and multiple terminals (e.g., n terminals).

[0057] like Figure 2 As shown, the data transmission method based on direct communication provided by the present invention includes the following steps:

[0058] Step 1: Each of the multiple terminals initiates an authentication request to the aggregated security gateway. The terminals that pass authentication build a communication network based on the topology connection relationship constructed by the aggregated security gateway.

[0059] Specifically, step 1 includes:

[0060] Step 1-1: At this point, each terminal to be connected to form a communication network is still in an unconnected state; each terminal obtains a hash value H1 and hash value parameters based on its own device identity (DID) and its own network access code (RID); generates an initial access request (req1) and sends the initial access request (req1) to the aggregated security gateway; wherein, the initial access request (req1) carries the device identity (DID), network access code (RID), hash value H1, hash value parameters, and its own network IP; in other embodiments of the present invention, the initial access request (req1) may also carry terminal identity information such as a mask for further identity authentication to ensure the legitimacy of the terminal identity.

[0061] More specifically, taking the i-th terminal (where 1≤i≤n) as an example, this step is illustrated as follows:

[0062] The i-th terminal calculates the hash value H1 and records the hash value parameters:

[0063] The i-th terminal generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the local root key file file0. It records the index idx-s1 of the input random number s1 in the root key file file0. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate the first hash function h. p1,s1 Input the device identity (DIDi) and network access code (RIDi) into the first hash function h. p1,s1 The hash value H1=h is obtained. p1,s1 (DIDi, RIDi); Records hash value parameters: string str1, index idx-s1 of the input random number s1.

[0064] The first access request req1 generated by the i-th terminal carries the device identity DIDi, network access code RIDi, hash value H1, hash value parameters (string str1, index idx-s1 of input random number s1), and its own network IPi; in other embodiments of the present invention, the first access request req1 may also carry terminal identity information such as the mask of the i-th terminal.

[0065] It is understandable that each of the multiple terminals will perform this step, and the hash value calculated and the hash value parameters recorded by each terminal may be different.

[0066] Step 1-2: The aggregated security gateway receives the first access request req1 from each terminal and establishes an association table locally based on the information carried by the first access request req1, as shown in Table 1 below. This association table is used to indicate the information of all terminals and network elements connected to the aggregated security gateway.

[0067] Table 1

[0068] Terminal Number Device Identity Network access code Network IP Hash value Hash value parameter mask peer IP other 1 DID1 RID1 IP1 H1 str1, idx-s1 mask1 -- … … … … … … … … -- … n DIDn RIDn IPn Hn strn, idx-sn maskn -- …

[0069] At this point, the peer IP field in the association table is blank.

[0070] The aggregated security gateway forwards the initial access request req1 from each terminal to the key server, which authenticates the request and obtains the authentication result for each terminal. In this step, the purpose of authentication is to confirm that both the initiator and the receiver of the initial access request are legitimate devices.

[0071] Taking the i-th terminal as an example, the specific authentication process includes:

[0072] Upon receiving the initial access request req1, the key server parses it to obtain the device identity DIDi', network access code RIDi', hash value H1', ​​hash value parameters (string str1', index idx-s1'), and network IPi'. Based on the index idx-s1', the key server retrieves the input random number s1' from the local root key file file0. Finally, the key server generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the device identity DIDi' and network access code RIDi' into the hash function h p1’,s1’ Calculate the authentication hash value H1''=h p1’,s1’ (DIDi', RIDi'); Compare whether the hash value H1' obtained from the parsing is consistent with the calculated authentication hash value H1'': if they are consistent, the authentication result is successful; otherwise, the authentication result is unsuccessful.

[0073] The key server performs the above authentication operations on all terminals.

[0074] Steps 1-3: After authentication by the key server, the authentication results of each terminal are sent to the aggregated security gateway; the aggregated security gateway constructs the topological connection relationship between each terminal based on the legitimate terminal, that is, the terminal whose authentication result is successful.

[0075] The aggregated security gateway can also send an instruction to terminals that fail authentication to re-execute step 1-1. Terminals that receive the authentication failure instruction need to re-execute step 1-1 and initiate a new initial access request req1' to the aggregated security gateway again. The purpose of this step is to reduce system misjudgments and the waste of idle terminals, thereby improving the data processing efficiency of the communication system of this invention.

[0076] Similarly, after all n terminals have completed their access (note that if the terminal's network IP changes, it must be accessed again to update the terminal's network IP), the aggregated security gateway will then have the network IP, device identity DID, and network access code RID of all legitimate terminals in the communication network.

[0077] The aggregation security gateway constructs a topology connection relationship between various terminals based on legitimate terminals, including: the aggregation security gateway obtains the peer information to be communicated from the legitimate terminals. For example, the first terminal can establish a connection with the second terminal, the third terminal, the sixth terminal, and the tenth terminal. In the above association table, the peer IP corresponding to the first terminal should be filled in as IP2, IP3, IP6, and IP10. The topology connection relationship is as follows: Figure 3As shown; the purpose of this step is to reduce the establishment of invalid links. For example, two terminals that will not communicate in foreseeable subsequent communication (e.g., terminal 1 and terminal 5) will not establish a direct topology connection in this step, thereby reducing the complexity of the network between terminals and reducing the management workload of the aggregated security gateway. The aggregated security gateway constructs a topology connection based on the peer information and sends the constructed topology connection to each legitimate terminal; it should be noted that the transmission of the topology connection can be encrypted.

[0078] Steps 1-4: Each terminal receiving the topology connection relationship establishes a direct connection relationship based on the topology connection relationship to form a communication network. It should be noted that each terminal receiving the topology connection relationship can first decrypt the encrypted topology connection relationship to obtain the plaintext topology connection relationship.

[0079] Step 2: In the communication network, two interconnected terminals obtain the communication key file file1 from the key server via the aggregated security gateway.

[0080] Specifically, step 2 includes:

[0081] Step 2-1: Either of the two interconnected terminals generates a key acquisition request (req2) and sends it to the aggregated security gateway. The key acquisition request (req2) carries the Device Identifier (DID), the Receiving Identifier (RID), its own network IP address, and the peer IP address of the other terminal. Note that the two interconnected terminals in this step refer to all terminals that are paired together in the communication network formed above. Upon receiving the key acquisition request (req2) from this terminal, the aggregated security gateway forwards it to the key server.

[0082] Step 2-2: Based on the key acquisition request req2, the key server selects a communication key file file1 from the local machine, obtains an encryption key k1 from the root key file file0, records the key index idx-k1 of the encryption key k1 in the root key file file0, and performs an encryption operation on the communication key file file1 using the encryption key k1 to obtain the ciphertext enc(file1) = file1⊕k1 of the communication key file file1; the key server sends the key index idx-k1 and the ciphertext enc(file1) to the aggregated security gateway.

[0083] Steps 2-3: Based on the network IP and peer IP in the key acquisition request req2, the aggregated security gateway forwards the key index idx-k1 and the ciphertext enc(file1) to the corresponding two terminals; at the same time, it fills the key index idx-k1 and the ciphertext enc(file1) into the terminal information corresponding to the association table and updates the association table.

[0084] Steps 2-4: The two terminals obtain the key index idx-k1' and the ciphertext enc(file1)'. Based on the key index idx-k1', they obtain the decryption key k1' from the local root key file file0. They then use the decryption key k1' to perform a decryption operation on the ciphertext enc(file1)' to obtain the communication key file file1.

[0085] It is understood that steps 2-1 to 2-4 above describe the method for two directly connected terminals to obtain a communication key. The terms "encryption key k1" and "communication key file file1" in these steps are merely descriptive and do not imply that each terminal obtains the same communication key. In fact, after executing the above steps, all connected terminals will store a symmetrical pair of communication key files. For example, the first and second directly connected terminals store a symmetrical communication key file file12, the first and third terminals store a symmetrical communication key file file13, and so on. The updated association table can be shown in Table 2 below:

[0086] Table 2

[0087] Terminal Number Device Identity Network access code Network IP Hash value Hash value parameter mask peer IP Communication key file key index Communication key file ciphertext 1 DID1 RID1 IP1 H1 str1, idx-s1 mask1 IP2, idx-k12 enc(file12) 1 DID1 RID1 IP1 H1 str1, idx-s1 mask1 IP3 idx-k13 enc(file13) 1 DID1 RID1 IP1 H1 str1, idx-s1 mask1 IP6 idx-k16 enc(file16) 1 DID1 RID1 IP1 H1 str1, idx-s1 mask1 IP10 idx-k110 enc(file110) … … … … … … … … … … n DIDn RIDn IPn Hn strn, idx-sn maskn … … …

[0088] Step 3: The sending terminal, acting as the sender, selects a communication link based on the destination IP of the receiving terminal and implements encrypted data transmission.

[0089] The sending terminal determines the communication route, processes the service data mes, generates a sending data packet MES, and sends it to the receiving terminal, which is the receiver. The receiving terminal performs decryption and verification operations on the sending data packet MES. After the verification is successful, it obtains the service data mes' and performs the service processing operation.

[0090] Specifically, step 3 includes:

[0091] Step 3-1: The service data mes includes a frame header and data content cont, wherein the frame header includes the destination IP; the sending terminal obtains the destination IP to be transmitted from the frame header in the service data mes, determines the communication route of the receiving terminal corresponding to the destination IP, and establishes a link with the receiving terminal according to the communication route.

[0092] Specifically, after a communication network is formed, all terminals in the network can use the entire network. Each terminal can connect to multiple other terminals, meaning each terminal can connect to multiple terminals corresponding to peer IPs. If, at this point, one terminal generates service data `mes`, denoted as the sending terminal, and this service data `mes` can be, for example, file data or audio / video data; with all terminals located in the same communication network, as long as the sending terminal and the receiving terminal have established a link—that is, the destination IP carried in the header of the service data `mes` is one of the multiple peer IPs in the topology connection relationship associated with the sending terminal—then the sending terminal can directly communicate with the receiving terminal through the destination IP. Therefore, it is necessary to first confirm whether the sending terminal that generated the service data `mes` and the receiving terminal to which the service data `mes` is to be transmitted have established a link.

[0093] More specifically, the process of confirming whether a connection has been established is as follows: The sending terminal internally parses the service data mes to be sent to the destination IP of the receiving terminal, and checks whether the destination IP exists in the received topology connection relationship, that is, checks whether the destination IP is one of the multiple peer IPs that the sending terminal has already established a connection with:

[0094] If so, it means that the receiving terminal corresponding to the destination IP has already established a link with the sending terminal. The sending terminal determines the communication route according to the destination IP and establishes a link with the receiving terminal corresponding to the destination IP according to the communication route. In the embodiment of the present invention, the module for the terminal to perform communication is a 4G communication chip.

[0095] Otherwise, it means that no route path to the destination IP was found. In this case, the sending terminal needs to redetermine the communication route based on the destination IP, re-establish the link with the receiving terminal corresponding to the destination IP based on the redetermined communication route, and convert the re-established link into a topology message and send it to the aggregation security gateway. The aggregation security gateway updates the existing topology connection relationship locally to a second topology connection relationship based on the topology message, updates the updated second topology connection relationship to the association table, and updates and distributes the updated second topology connection relationship to all terminals in the communication network. It should be noted that the two terminals that re-establish the link need to perform step 2 to obtain a new symmetric communication key file.

[0096] Step 3-2: After the link is established, the sending terminal encrypts the data content (cont) in the service data (mes) to obtain the ciphertext (enc(cont)); the sending terminal calculates the checksum based on the frame header and the ciphertext (enc(cont)) to obtain the checksum (check); the sending terminal performs a data framing operation based on the ciphertext (enc(cont)) and the checksum (check) to obtain the transmission data packet (MES); the sending terminal sends the transmission data packet (MES) to the receiving terminal according to the destination IP in the frame header.

[0097] The specific process for this step is as follows:

[0098] The sending terminal selects encryption key k2 from the communication key file file1, records the key index idx-k2 of encryption key k2 in the communication key file file1, and uses encryption key k2 to perform encryption operation on the data content cont, obtaining the ciphertext enc(cont) = cont⊕k2; the sending terminal calculates the checksum of the frame header, key index idx-k2, encryption key k2 and data content cont, obtaining the checksum check; the sending terminal performs data framing: combining the frame header, key index idx-k2, checksum check and data content ciphertext enc(cont), obtaining the transmission data packet MES; the sending terminal sends the obtained transmission data packet MES to the receiving terminal according to the destination IP in the frame header.

[0099] Step 3-3: The receiving terminal receives the transmitted data packet MES, performs a decryption operation to obtain the service data mes', performs a verification operation on the service data mes', and performs a service processing operation on the service data mes' if the verification is successful; otherwise, it directly discards the decrypted service data mes'.

[0100] The specific process of decryption and verification is as follows:

[0101] The receiving terminal receives and parses the transmitted data packet MES to obtain the frame header 'header', key index idx-k2', checksum 'check', and encrypted data content enc(cont)'. Based on the key index idx-k2', it obtains the decryption key k2' from the communication key file file1. Using the decryption key k2', it decrypts the encrypted data content enc(cont)' to obtain the plaintext data content cont'. The frame header 'header' and the data content cont' constitute the service data mes'. The receiving terminal calculates the checksum 'check'' of the frame header 'header', key index idx-k2', decryption key k2', and data content cont'. It compares the calculated checksum 'check'' with the parsed checksum 'check'. If they match, the verification passes, and the service processing operation is performed on the data content cont' in the decrypted service data mes'. If they do not match, the verification fails, indicating that the service data mes' has been tampered with during encrypted transmission, and the service data mes' should be discarded.

[0102] This invention integrates a series of technological innovations, including tamper-proof authentication using hash calculation, topology connection management, dynamic hierarchical keys, and composite security verification. In the flexible but security-challenged scenario of direct terminal communication, it constructs a full-link, multi-layered security system from identity authentication, connection establishment, key management to data transmission. This system ensures high communication efficiency while achieving a fundamental improvement in security.

Claims

1. A data transmission method based on direct communication, wherein the participants in the method include an aggregated security gateway, a key server, and multiple terminals; characterized in that, The method includes the following steps: Step 1: Each of the multiple terminals initiates an authentication request to the aggregated security gateway. The aggregated security gateway constructs a topology connection relationship based on the terminals that have passed authentication. Each terminal establishes a connection according to the topology connection relationship to form a communication network. Step 2: In the communication network, two interconnected terminals obtain the symmetric communication key file file1 from the key server via the aggregated security gateway; Step 3: The sending terminal, acting as the sender, determines the communication route, processes the service data mes, generates a transmission data packet MES, and sends it to the receiving terminal, acting as the receiver. The receiving terminal performs decryption and verification operations on the transmission data packet MES. After successful verification, it obtains the service data mes' and performs the service processing operation.

2. The data transmission method based on direct communication according to claim 1, characterized in that, The specific process of step 1 includes: Step 1-1: Each terminal obtains a hash value H1 and hash value parameters based on its own device identity DID and its own network access code RID; generates an initial access request req1, and sends the initial access request req1 to the aggregated security gateway; wherein, the initial access request req1 carries the device identity DID, network access code RID, hash value H1, hash value parameters, and its own network IP; Steps 1-2: The aggregated security gateway receives the first access request req1 from each terminal and establishes an association table locally based on the information carried in the first access request req1; the aggregated security gateway forwards the first access request req1 from each terminal to the key server, the key server performs the authentication operation, and obtains the authentication result of each terminal; Steps 1-3: The key server sends the authentication results of each terminal to the aggregated security gateway; the aggregated security gateway establishes a topology connection relationship for the terminals that have passed authentication based on the authentication results, fills the topology connection relationship into the association table, and sends the topology connection relationship to the terminals that have passed authentication. Steps 1-4: Each terminal that receives the topology connection relationship establishes a direct connection relationship based on the topology connection relationship to form a communication network.

3. The data transmission method based on direct communication according to claim 2, characterized in that, The key server and each terminal locally store a symmetric root key file file0. In step 1-1, the specific process of obtaining the hash value H1 and hash value parameters is as follows: The terminal generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the local root key file file0. It records the index idx-s1 of the input random number s1 in the root key file file0. The string consisting of the coefficients of each term in the irreducible polynomial p1(x), excluding the highest term, is denoted as str1. The terminal then uses the irreducible polynomial p1(x) and the input random number s1 to generate the first hash function h. p1,s1 Input the device identification DID and network access code RID into the first hash function h p1,s1 The hash value H1=h is obtained. p1,s1 (DID, RID); Record hash value parameters: string str1, index idx-s1 of the input random number s1.

4. The data transmission method based on direct communication according to claim 3, characterized in that, In steps 1-2, the key server performs authentication operations to obtain the authentication results of each terminal. The specific process is as follows: Upon receiving the initial access request req1, the key server parses and obtains the device identity DID', network access code RID', hash value H1', ​​string str1', index idx-s1', and network IP'; the key server then retrieves the input random number s1' from the local root key file file0 based on the index idx-s1'. The key server generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the device identity DID' and network access code RID' into the hash function h p1’,s1’ Calculate the authentication hash value H1''=h p1’,s1’ (DID', RID'); Compare whether the hash value H1' obtained from parsing is consistent with the calculated authentication hash value H1'': if they are consistent, the authentication result is successful; otherwise, the authentication result is unsuccessful.

5. The data transmission method based on direct communication according to claim 4, characterized in that, In steps 1-3, the aggregated security gateway sends an instruction to the terminal whose authentication result is failed to re-execute step 1-1. The terminal that receives the authentication result as failed re-executes step 1-1 and initiates a new first access request req1' to the aggregated security gateway again.

6. The data transmission method based on direct communication according to claim 1, characterized in that, The specific process of step 2 is as follows: Step 2-1: Either of the two interconnected terminals generates a key acquisition request req2 and sends the key acquisition request req2 to the aggregated security gateway; wherein, the key acquisition request req2 carries the device identity DID, network access code RID, network IP and the peer IP of the other terminal; the aggregated security gateway forwards the key acquisition request req2 to the key server; Step 2-2: Based on the key acquisition request req2, the key server selects a communication key file file1 from the local machine, obtains an encryption key k1 from the root key file file0, records the key index idx-k1 of the encryption key k1 in the root key file file0, and performs an encryption operation on the communication key file file1 using the encryption key k1 to obtain the ciphertext enc(file1) = file1⊕k1 of the communication key file file1; the key server sends the key index idx-k1 and the ciphertext enc(file1) to the aggregated security gateway; Steps 2-3: Based on the network IP and peer IP in the key acquisition request req2, the aggregated security gateway forwards the key index idx-k1 and the ciphertext enc(file1) to the two corresponding terminals; at the same time, it fills the key index idx-k1 and the ciphertext enc(file1) into the terminal information corresponding to the association table and updates the association table. Steps 2-4: The two terminals obtain the key index idx-k1' and the ciphertext enc(file1)'. Based on the key index idx-k1', they obtain the decryption key k1' from the local root key file file0. They then use the decryption key k1' to perform a decryption operation on the ciphertext enc(file1)' to obtain the communication key file file1.

7. The data transmission method based on direct communication according to claim 1, characterized in that, The specific process of step 3 is as follows: Step 3-1: The service data mes includes a frame header and data content cont, wherein the frame header includes the destination IP; the sending terminal obtains the destination IP to be transmitted from the frame header in the service data mes, determines the communication route of the receiving terminal corresponding to the destination IP, and establishes a link with the receiving terminal according to the communication route; Step 3-2: After the link is established, the sending terminal encrypts the data content (cont) in the service data (mes) to obtain the ciphertext (enc(cont)); the sending terminal calculates the checksum based on the frame header and the ciphertext (enc(cont)) to obtain the checksum (check); the sending terminal performs a data framing operation based on the ciphertext (enc(cont)) and the checksum (check) to obtain the transmission data packet (MES); the sending terminal sends the transmission data packet (MES) to the receiving terminal according to the destination IP in the frame header. Step 3-3: The receiving terminal receives the transmitted data packet MES, performs a decryption operation to obtain the service data mes', performs a verification operation on the service data mes', and performs a service processing operation on the service data mes' if the verification is successful; otherwise, it directly discards the decrypted service data mes'.

8. The data transmission method based on direct communication according to claim 7, characterized in that, In step 3-1: The specific process for determining the communication route of the receiving terminal corresponding to the destination IP is as follows: The sending terminal internally parses the destination IP in the frame header of the service data (mess) and checks whether the destination IP exists in the received topology connection relationship: If so, the sending terminal determines the communication route based on the destination IP, and establishes a connection with the receiving terminal corresponding to the destination IP based on the communication route; Otherwise, the sending terminal redetermines the communication route based on the destination IP, re-establishes the link with the receiving terminal corresponding to the destination IP based on the redetermined communication route, and converts the re-established link into a topology message and sends it to the aggregation security gateway. The aggregation security gateway updates the locally stored topology connection relationship to a second topology connection relationship based on the topology message, updates the updated second topology connection relationship to the association table, and updates and distributes it to all terminals in the communication network. Among them, the sending terminal and the receiving terminal that re-establish the link perform step 2 to obtain a new communication key file.

9. The data transmission method based on direct communication according to claim 7, characterized in that, In step 3-2: The specific process of performing encryption on the data content cont in the business data mes is as follows: The sending terminal selects encryption key k2 from the communication key file file1, records the key index idx-k2 of encryption key k2 in the communication key file file1, and uses encryption key k2 to perform encryption operation on the data content cont to obtain the ciphertext of the data content enc(cont)=cont⊕k2; The specific process of calculating the checksum and obtaining the checksum "check" is as follows: The sending terminal calculates the checksum of the frame header, key index idx-k2, encryption key k2, and data content cont to obtain the checksum check. The specific process of performing data framing operations to obtain the MES data packet is as follows: The sending terminal combines the frame header, key index idx-k2, checksum, and ciphertext of data content enc(cont) to obtain the MES data packet.

10. The data transmission method based on direct communication according to claim 9, characterized in that, In step 3-3: The specific process of performing a decryption operation to obtain business data mes' and then performing a verification operation on business data mes' is as follows: The receiving terminal receives and parses the transmitted data packet MES to obtain the frame header 'header', key index idx-k2', checksum 'check', and encrypted data content enc(cont)'. Based on the key index idx-k2', it obtains the decryption key k2' from the communication key file file1. Using the decryption key k2', it performs a decryption operation on the encrypted data content enc(cont)' to obtain the plaintext data content cont'. The frame header 'header' and the data content cont' constitute the service data mes'. The terminal calculates the checksum 'check'' of the frame header 'header', key index idx-k2', decryption key k2', and data content cont'. It compares the calculated checksum 'check'' with the parsed checksum 'check'' value. If they match, the verification passes; otherwise, the verification fails.

Images