Data transmission method, electronic device, storage medium and program product

Abstract

The invention discloses a data transmission method, electronic equipment, a storage medium and a program product. Comprising the following steps: a terminal device sends an identity certificate and an SM2 temporary public key in a first SM2 temporary key pair to a server, so that the server encrypts a randomly generated first SM4 key by using the SM2 temporary public key to obtain first encrypted data, and the terminal device decrypts the first encrypted data by using an SM2 temporary private key in the first SM2 temporary key pair to obtain second encrypted data; the first SM2 temporary key pair is used for obtaining a first SM4 key, the first SM2 temporary key pair is deleted, then the first SM4 key is used for encrypting target data corresponding to the service request, and the encrypted data is sent to the server. Therefore, the SM4 key required by symmetric encryption is issued to the terminal equipment through asymmetric encryption, the SM4 key is not easy to leak, the specified field is encrypted by using the SM4 key, the field list metadata is carried in the request, decryption is only performed at the service end needing to be used, and the security of data transmission is improved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to data transmission methods, electronic devices, storage media, and program products. Background Technology

[0002] In the digital age, network communication has been deeply integrated into various core scenarios such as office work, financial transactions, enterprise operations, and personal information exchange. As a critical production factor, the security of data during transmission directly affects individual rights, corporate trade secrets, and even public safety. Currently, ensuring secure data transmission has become a core demand in the field of cybersecurity.

[0003] In traditional network communication architectures, the industry commonly uses transport layer security protocols to build a basic security protection system. Examples include TLS (Time To Live) or HTTPS (Hypertext Transfer Protocol Secure). By encrypting the transmission channel between the terminal and the server, the confidentiality of data during transmission over the public network is ensured.

[0004] However, in the interaction link between the terminal and the server, this method's transport layer encryption only covers the public network channel transmission stage and cannot guarantee the security of data before it enters the application layer for processing. Sensitive fields still face the risk of being exposed in plaintext or having their equivalents readily available. Specifically, the terminal environment itself has extremely high uncertainty. Various malicious software and Trojan programs can compromise the terminal security environment through vulnerability intrusion, phishing attacks, and other methods. Once the terminal environment is compromised, attackers can directly obtain unencrypted sensitive data waiting to be transmitted or just received in memory, resulting in low data transmission security. Summary of the Invention

[0005] This invention provides a data transmission method, an electronic device, a storage medium, and a program product for use in data transmission.

[0006] According to one aspect of the present invention, a data transmission method is provided, applied in a terminal device, the method comprising: In response to a login request sent by a user, a first SM2 temporary key pair corresponding to the login request is generated; wherein the login request includes the user's identity credentials; The identity credential and the SM2 temporary public key in the first SM2 temporary key pair are sent to the server so that after the server successfully authenticates the user using the identity credential, it randomly generates the corresponding first SM4 key and encrypts the first SM4 key using the SM2 temporary public key to obtain the first encrypted data, and sends the first encrypted data to the terminal device. After receiving the first encrypted data sent by the server, the first encrypted data is decrypted using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and the first SM2 temporary key pair is deleted. Upon receiving a service request, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain second encrypted data and first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data; Add the second encrypted data and the first encrypted metadata to the business request; The service request is sent to the server so that after receiving the service request, the server can decrypt the second encrypted data using the first encrypted metadata and the current SM4 key to obtain the target data.

[0007] According to one aspect of the present invention, a data transmission method is provided, applied in a server, the method comprising: The terminal device receives the identity credentials corresponding to the user's login request and the SM2 temporary public key in the first SM2 temporary key pair, wherein the first SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request generated when the user sends the login request; After successfully verifying the user using the identity credentials, a corresponding first SM4 key is randomly generated; The first SM4 key is encrypted using the SM2 temporary public key to obtain the first encrypted data; The first encrypted data is sent to the terminal device so that after receiving the first encrypted data, the terminal device can decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and then delete the first SM2 temporary key pair; when a service request is received from a user, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain the second encrypted data and the first encrypted metadata; the second encrypted data and the first encrypted metadata are added to the service request, and the service request is sent to the server, wherein the first encrypted metadata is a field of the encrypted data in the target data; Upon receiving the service request, the second encrypted data is decrypted using the first encrypted metadata and the current SM4 key to obtain the target data.

[0008] According to another aspect of the present invention, a data transmission apparatus is provided, applied in a terminal device, the apparatus comprising: A key generation module is used to generate a first SM2 temporary key pair corresponding to a login request sent by a user; wherein the login request includes the user's identity credentials; The first sending module is used to send the identity credential and the SM2 temporary public key in the first SM2 temporary key pair to the server, so that after the server successfully authenticates the user using the identity credential, it randomly generates the corresponding first SM4 key, encrypts the first SM4 key using the SM2 temporary public key to obtain first encrypted data, and sends the first encrypted data to the terminal device. The first receiving module is configured to receive the first encrypted data sent by the server, decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and delete the first SM2 temporary key pair. The first data encryption module is used to determine the first SM4 key as the current SM4 key when a service request is received, and to encrypt the target data corresponding to the service request using the current SM4 key to obtain second encrypted data and first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data; An add module is used to add the second encrypted data and the first encrypted metadata to the business request; The second sending module is used to send the service request to the server, so that after the server receives the service request, it can use the first encrypted metadata and the current SM4 key to decrypt the second encrypted data to obtain the target data.

[0009] According to another aspect of the present invention, a data transmission apparatus is provided, applied in a sending server, the apparatus comprising: The second receiving module is used to receive the identity credentials corresponding to the user's login request sent by the terminal device and the SM2 temporary public key in the first SM2 temporary key pair, wherein the first SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request generated when the user sends the login request; An identity verification module is used to randomly generate a corresponding first SM4 key after successfully verifying the user using the identity credentials; The second data encryption module is used to encrypt the first SM4 key using the SM2 temporary public key to obtain the first encrypted data; The third sending module is used to send the first encrypted data to the terminal device, so that after receiving the first encrypted data, the terminal device can decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and delete the first SM2 temporary key pair; when receiving a service request sent by the user, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain the second encrypted data and the first encrypted metadata; the second encrypted data and the first encrypted metadata are added to the service request, and the service request is sent to the server, wherein the first encrypted metadata is a field of the encrypted data in the target data; The decryption module is used to decrypt the second encrypted data using the first encrypted metadata and the current SM4 key after receiving the service request, so as to obtain the target data.

[0010] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data transmission method described in any embodiment of the present invention.

[0011] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data transmission method described in any embodiment of the present invention.

[0012] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the data transmission method as described in any embodiment of the present invention.

[0013] In this embodiment of the invention, the terminal device sends the identity credential and the SM2 temporary public key from the first SM2 temporary key pair to the server. The server then uses the SM2 temporary public key to encrypt a randomly generated first SM4 key, obtaining first encrypted data. The terminal device then decrypts the first encrypted data using the SM2 temporary private key from the first SM2 temporary key pair, obtaining the first SM4 key. Finally, the terminal device uses the first SM4 key to encrypt the target data corresponding to the service request and sends the encrypted data to the server. Therefore, in this embodiment, the SM4 key required for symmetric encryption is distributed to the terminal device via asymmetric encryption, making the SM4 key less prone to leakage. Furthermore, in this embodiment, the SM4 key is used to encrypt specified fields, and the request carries a list of field metadata, which is decrypted only at the end service terminal that actually needs to use it. This elevates confidentiality from the "link level" to the "field / session level," improving the security of data transmission.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention; Figure 2 This is a flowchart illustrating a data transmission method according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating a key refresh method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a data transmission device according to an embodiment of the present invention; Figure 5 This is another structural schematic diagram of a data transmission device according to an embodiment of the present invention. Figure 6 This is a schematic diagram of the structure of an electronic device that implements the data transmission method of this invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] Before introducing the data transmission method provided in the embodiments of this application, for ease of understanding, the technical background of the embodiments of this application will be described in detail below.

[0020] In existing technologies, in the interaction link between the terminal and the server, transport layer encryption only covers the public network channel transmission stage and cannot guarantee the security of data before it enters the application layer for processing. Sensitive fields still face the risk of being exposed in plaintext or having their equivalents readily available. Specifically, the terminal environment itself has extremely high uncertainty. Various malicious software and Trojan programs can compromise the terminal security environment through vulnerability intrusion, phishing attacks, and other methods. Once the terminal environment is compromised, attackers can directly obtain unencrypted sensitive data waiting to be transmitted or just received in memory, resulting in low data transmission security.

[0021] In view of this, this application provides a data transmission method in which a terminal device sends the identity credential and the SM2 temporary public key from the first SM2 temporary key pair to a server, so that the server can use the SM2 temporary public key to encrypt a randomly generated first SM4 key to obtain first encrypted data. The terminal device decrypts the first encrypted data using the SM2 temporary private key from the first SM2 temporary key pair to obtain the first SM4 key, and then uses the first SM4 key to encrypt the target data corresponding to the service request, and sends the encrypted data to the server. Thus, in this embodiment, the SM4 key required for symmetric encryption is distributed to the terminal device through asymmetric encryption, so the SM4 key is not easily leaked. Furthermore, in this embodiment, the data of a specified field is encrypted using the SM4 key, and the request carries field list metadata, which is decrypted only at the end service terminal that actually needs to use the data, thus improving confidentiality from the "link level" to the "field / session level," thereby enhancing the security of data transmission.

[0022] Before introducing the data transmission method in this application, we will first introduce the application scenarios of the data transmission method in this application. Figure 1 This is a schematic diagram of an application scenario, from Figure 1 As can be seen from this, the application scenario includes server 110 and terminal device 120. In the implementation embodiment of this application, server 110 can be implemented by a physical server or by a virtual server.

[0023] In one possible application scenario, terminal device 120, in response to a login request sent by a user, generates a first SM2 temporary key pair corresponding to the login request; wherein the login request includes the user's identity credentials. Terminal device 120 then sends the identity credentials and the SM2 temporary public key from the first SM2 temporary key pair to server 110. Upon receiving the identity credentials and the SM2 temporary public key from the first SM2 temporary key pair from the terminal device, server 110 successfully authenticates the user using the identity credentials and then randomly generates a corresponding first SM4 key. Server 110 then encrypts the first SM4 key using the SM2 temporary public key to obtain first encrypted data and sends the first encrypted data to terminal device 120. Upon receiving the first encrypted data from server 110, terminal device 120 decrypts the first encrypted data using the SM2 temporary private key from the first SM2 temporary key pair to obtain the first SM4 key and then deletes the first SM2 temporary key pair. When terminal device 120 receives a service request, it determines the first SM4 key as the current SM4 key and uses the current SM4 key to encrypt the target data corresponding to the service request, obtaining second encrypted data and first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data. Then, terminal device 120 adds the second encrypted data and the first encrypted metadata to the service request and sends the service request to server 110. After receiving the service request, server 110 decrypts the second encrypted data using the first encrypted metadata and the current SM4 key to obtain the target data.

[0024] in, Figure 1 The server 110 and the terminal device 120 can exchange information through a communication network. The communication network can be either wireless or wired.

[0025] For example, server 110 can access the network via cellular mobile communication technology and communicate with terminal device 120, wherein the cellular mobile communication technology includes, for example, 5th generation mobile networks (5G) technology.

[0026] Optionally, server 110 can access the network and communicate with terminal device 120 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0027] Furthermore, the description in this application focuses only on a single server 110 and a single terminal device 120. However, those skilled in the art should understand that the illustrated server 110 and terminal device 120 are intended to illustrate the operation of the server 110 and terminal device 120 involved in the technical solutions of this application, and are not intended to imply any limitation on the number, type, or location of the server 110 and terminal device 120. It should be noted that adding additional modules to or removing individual modules from the illustrated environment will not change the underlying concept of the exemplary embodiments of this application.

[0028] It should be noted that the data transmission method proposed in this application is not only applicable to... Figure 1 The application scenarios shown are also applicable to any device with data transmission capabilities.

[0029] For example, terminal device 120 includes, but is not limited to: large visual screens, tablet computers, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.; the terminal device may have a related client installed, which may be software (e.g., browsers, short video software, etc.), or web pages, mini-programs, etc.

[0030] The data transmission method of this application, in conjunction with the application scenarios described above and with reference to the accompanying drawings, is described below as an exemplary embodiment. It should be noted that the above application scenarios are only shown to facilitate understanding of the methods and principles of this application, and the implementation of this application is not limited in any way in this respect.

[0031] The data transmission method in the embodiments of this application will be described in detail below. Figure 2 A flowchart of a data transmission method provided in an embodiment of the present invention, the method comprising: S210: In response to a login request sent by a user, the terminal device generates a first SM2 temporary key pair corresponding to the login request; wherein the login request includes the user's identity credentials; In this embodiment, the first SM2 temporary key pair can be generated using the national cryptographic SM2 algorithm. The user's identity credentials in this embodiment may include the user's identifier, username, password, etc.

[0032] It should be noted that the embodiments of this application do not limit the method of generating SM2 temporary key pairs, but can be limited according to the specific actual situation.

[0033] S220: The terminal device sends the identity credential and the SM2 temporary public key from the first SM2 temporary key pair to the server; S230: After the server successfully authenticates the user using the identity credentials, it randomly generates a corresponding first SM4 key; In this embodiment, the SM4 key generation algorithm can be used to generate the first SM4 key. This embodiment does not limit the SM4 key generation algorithm.

[0034] In one possible embodiment, the user's identity can be verified as follows: using a pre-set correspondence between identity identifiers and login parameters, a target login parameter corresponding to the user's identity identifier is determined, wherein the login parameter includes a username and a key; if the target username is the same as the username in the identity credential, and the password in the target login parameter is the same as the password in the identity credential, then the user's identity verification is determined to be successful; otherwise, the user's identity verification is determined to be unsuccessful.

[0035] Furthermore, in this embodiment, after the server successfully authenticates the user using the identity credentials, the server generates a token corresponding to the user's login. In this embodiment, the token is stored in correspondence with the first SM4 key. Moreover, in this embodiment, the validity period of the first SM4 key is the same as the validity period of the token.

[0036] S240: The server uses the SM2 temporary public key to encrypt the first SM4 key to obtain the first encrypted data; In this embodiment, the SM2 temporary public key can be input into the SM2 encryption algorithm to encrypt the first SM4 key, thereby obtaining the first encrypted data.

[0037] S250: The server sends the first encrypted data to the terminal device; S260: After receiving the first encrypted data sent by the server, the terminal device decrypts the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and deletes the first SM2 temporary key pair. Accordingly, in this embodiment, the SM2 temporary private key and the first encrypted data in the first SM2 temporary key pair can be input into the SM2 decryption algorithm for decryption to obtain the first SM4 key. Furthermore, in this embodiment, the first SM4 key is stored as a variable.

[0038] S270: When the terminal device receives a service request, it determines the first SM4 key as the current SM4 key, and uses the current SM4 key to encrypt the target data corresponding to the service request to obtain the second encrypted data and the first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data; In this embodiment, the current SM4 key and target data can be input into the SM4 encryption algorithm to obtain second encrypted data. In this embodiment, the target data is the data corresponding to a specified field. The specified field in this embodiment is a user-specified field, meaning the user can actively determine the specified field.

[0039] S280: The terminal device adds the second encrypted data and the first encrypted metadata to the service request; S290: The terminal device sends the service request to the server; S291: After receiving the service request, the server uses the first encrypted metadata and the current SM4 key to decrypt the second encrypted data to obtain the target data; In this embodiment, the user's token can be used to obtain the corresponding current SM4 key. Furthermore, the SM4 decryption algorithm can be used for decryption. For example, the first encrypted metadata, the current SM4 key, and the second encrypted data are input into the SM4 decryption algorithm for decryption to obtain the target data.

[0040] S292: The server obtains response data corresponding to the target data; S293: The server uses the current SM4 key to encrypt the response data to obtain third encrypted data and second encrypted metadata, wherein the second encrypted metadata is the field corresponding to the data encrypted by the server in the response data; In this embodiment, the SM4 encryption algorithm can be used for data encryption. The specific encryption method is similar to that in S260 above, and will not be described in detail here.

[0041] S294: The server sends the third encrypted data and the second encrypted metadata to the terminal device; S295: The terminal device uses the current SM4 key and the second encrypted metadata to decrypt the third encrypted data to obtain response data corresponding to the service request.

[0042] In one possible implementation, the current SM4 key is deleted when the user logs out.

[0043] Therefore, the terminal device sends the identity credential and the SM2 temporary public key from the first SM2 temporary key pair to the server. The server then uses the SM2 temporary public key to encrypt a randomly generated first SM4 key, obtaining first encrypted data. The terminal device then decrypts the first encrypted data using the SM2 temporary private key from the first SM2 temporary key pair, obtaining the first SM4 key. The terminal device then uses the first SM4 key to encrypt the target data corresponding to the service request and sends the encrypted data to the server. Thus, in this embodiment, the SM4 key required for symmetric encryption is distributed to the terminal device via asymmetric encryption, making the SM4 key less prone to leakage. Furthermore, in this embodiment, the SM4 key is used to encrypt specified fields, and the request carries field list metadata, which is decrypted only at the end service terminal that actually needs to use it. This elevates confidentiality from the "link level" to the "field / session level," improving the security of data transmission.

[0044] In this embodiment, the SM4 decryption algorithm can be used to decrypt data, which is the same as the decryption method in S290 above. This embodiment will not be described in detail here.

[0045] The key refresh method in the embodiments of this application will be described below. Figure 3 The flowchart for key refresh can include the following steps: S301: After the terminal device receives the target instruction, it regenerates the second SM2 temporary key pair corresponding to the login request; The target instructions in this embodiment include a key pair regeneration instruction or a page refresh instruction. That is, when the user refreshes the page, the methods in S301-S304 can be executed. The terminal device can also automatically send a page refresh instruction. For example, if the number of times the SM4 key has been used exceeds a specified threshold, a page refresh instruction is triggered. Or, if the current SM4 key is lost, a regeneration instruction will be triggered to regenerate the key.

[0046] In this embodiment, the regeneration of the second SM2 temporary key pair corresponding to the login request needs to be done within the user's token validity period. If the user's token expires or multiple devices simultaneously log in to the same user account and the user is automatically logged out, the terminal device will prompt (or redirect) the user to log in again. At this time, the S201 logic will be re-executed to regenerate a new SM2 temporary key pair for subsequent data transmission. If the user actively logs out and then logs in again, the S201 logic will be executed again to regenerate a new SM2 temporary key pair for subsequent data transmission.

[0047] It should be noted that the method for generating the second SM2 temporary key pair in this embodiment is the same as that in S201, and will not be described again here.

[0048] S302: The terminal device sends the SM2 temporary public key and the user credentials from the second SM2 temporary key pair to the server; S303: The server regenerates a second SM4 key randomly and encrypts the second SM4 key using the SM2 temporary public key in the second SM2 temporary key pair; S304: Send the encrypted second SM4 key to the terminal device; The method for generating the second SM4 key in this embodiment is the same as that in S230 described above, and the method for encrypting the second SM4 key using the SM2 temporary public key in the second SM2 temporary key pair is the same as that in S240 described above. These embodiments will not be repeated here.

[0049] In this embodiment of the application, the SM4 key corresponding to the user's Token is updated, that is, the user's Token is stored in correspondence with the second SM4 key, and the first SM4 key is deleted.

[0050] S305: After receiving the encrypted second SM4 key sent by the server, the terminal device decrypts the encrypted second SM4 key using the SM2 temporary private key in the second SM2 temporary key pair to obtain the second SM4 key, deletes the second SM2 temporary key pair, stores the second SM4 key, and determines the second SM4 key as the current SM4 key.

[0051] In this embodiment, the method of decrypting the encrypted second SM4 key using the SM2 temporary private key in the second SM2 temporary key pair is the same as the decryption method in S250 described above, and will not be repeated in this embodiment.

[0052] Therefore, in this embodiment, the SM4 key is strongly bound to the user token, ensuring that it cannot be reused across users and sessions, forming session domain isolation, limiting the impact of leakage to a single session, and improving data security.

[0053] Based on the same inventive concept, this application also provides a data transmission device for use in terminal equipment. Figure 4 This is a schematic diagram of the data transmission device. Figure 4 As shown, the device 400 includes: The key generation module 410 is used to generate a first SM2 temporary key pair corresponding to the login request sent by the user; wherein the login request includes the user's identity credentials; The first sending module 420 is used to send the identity credential and the SM2 temporary public key in the first SM2 temporary key pair to the server, so that after the server successfully authenticates the user using the identity credential, it randomly generates the corresponding first SM4 key, encrypts the first SM4 key using the SM2 temporary public key to obtain first encrypted data, and sends the first encrypted data to the terminal device. The first receiving module 430 is configured to receive the first encrypted data sent by the server, decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and delete the first SM2 temporary key pair. The first data encryption module 440 is used to determine the first SM4 key as the current SM4 key when a service request is received, and to encrypt the target data corresponding to the service request using the current SM4 key to obtain second encrypted data and first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data; Add module 450, used to add the second encrypted data and the first encrypted metadata to the business request; The second sending module 460 is used to send the service request to the server, so that after the server receives the service request, it can use the first encrypted metadata and the current SM4 key to decrypt the second encrypted data to obtain the target data.

[0054] In one possible embodiment, the first receiving module 430 is further configured to: After sending the service request to the server, the system receives a response request from the server. The response request includes third encrypted data and second encrypted metadata. The third encrypted data is data encrypted by the server using the current SM4 key to encrypt the response data corresponding to the target data, and the second encrypted metadata is a field corresponding to the data encrypted by the server in the response data. The third encrypted data is decrypted using the current SM4 key and the second encrypted metadata to obtain response data corresponding to the service request.

[0055] In one embodiment, the first receiving module 430 is further configured to: Upon receiving the target instruction, a second SM2 temporary key pair corresponding to the login request is regenerated; The SM2 temporary public key in the second SM2 temporary key pair and the user credentials are sent to the server so that the server can randomly regenerate the second SM4 key, encrypt the second SM4 key using the SM2 temporary public key in the second SM2 temporary key pair, and send the encrypted second SM4 key to the terminal device; wherein, the target instruction includes a key pair regeneration instruction or a page refresh instruction; After receiving the encrypted second SM4 key sent by the server, the encrypted second SM4 key is decrypted using the SM2 temporary private key in the second SM2 temporary key pair to obtain the second SM4 key. The second SM2 temporary key pair is deleted, the second SM4 key is stored, and the second SM4 key is determined as the current SM4 key.

[0056] In one possible embodiment, the device further includes: The deletion module 470 is used to delete the current SM4 key when the user logs out.

[0057] This application also provides another data transmission device for use in a server. Figure 5 This is a schematic diagram of the data transmission device. Figure 5 As shown, the device 500 includes: The second receiving module 510 is used to receive the identity credentials corresponding to the user's login request and the SM2 temporary public key in the first SM2 temporary key pair sent by the terminal device, wherein the first SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request generated when the user sends the login request; The identity verification module 520 is used to randomly generate a corresponding first SM4 key after successfully verifying the user using the identity credentials; The second data encryption module 530 is used to encrypt the first SM4 key using the SM2 temporary public key to obtain the first encrypted data; The third sending module 540 is used to send the first encrypted data to the terminal device, so that after receiving the first encrypted data, the terminal device can decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and delete the first SM2 temporary key pair; when receiving a service request sent by a user, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain the second encrypted data and the first encrypted metadata; the second encrypted data and the first encrypted metadata are added to the service request, and the service request is sent to the server, wherein the first encrypted metadata is a field of the encrypted data in the target data; The decryption module 550 is used to decrypt the second encrypted data using the first encrypted metadata and the current SM4 key after receiving the service request, so as to obtain the target data.

[0058] In one possible embodiment, the third sending module 540 is further configured to: After decrypting the second encrypted data using the first encrypted metadata and the current SM4 key to obtain the target data, the response data corresponding to the target data is obtained. The response data is encrypted using the current SM4 key to obtain third encrypted data and second encrypted metadata, wherein the second encrypted metadata is the field corresponding to the data encrypted by the server in the response data; The third encrypted data and the second encrypted metadata are sent to the terminal device so that the terminal device can decrypt the third encrypted data using the current SM4 key and the second encrypted metadata to obtain response data corresponding to the service request.

[0059] In one possible embodiment, the second receiving module 510 is further configured to: If the terminal device receives the SM2 temporary public key and the user credentials from the second SM2 temporary key pair, then the corresponding second SM4 key is randomly generated again; wherein, the second SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request that is regenerated by the terminal device after receiving the target instruction, and the target instruction includes a key pair regeneration instruction or a page refresh instruction; The second SM4 key is encrypted using the SM2 temporary public key in the second SM2 temporary key pair to obtain the encrypted second SM4 key; The encrypted second SM4 key is sent to the terminal device so that the terminal device can decrypt the encrypted second SM4 key using the SM2 temporary private key in the second SM2 temporary key pair. After obtaining the second SM4 key, the second SM2 temporary key pair is deleted, and the second SM4 key is stored. The second SM4 key is then identified as the current SM4 key.

[0060] The data transmission device provided in the embodiments of the present invention can execute the data transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0061] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0062] The information collected is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0063] Provide users with a corresponding entry point to choose whether to agree to or reject the automated decision-making result; if the user chooses to reject, the process will proceed to the expert decision-making process. Figure 6 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0064] like Figure 6As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0065] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0066] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data transfer methods.

[0067] In some embodiments, the data transfer method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data transfer method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data transfer method by any other suitable means (e.g., by means of firmware).

[0068] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0069] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0070] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0071] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0072] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0073] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0074] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0075] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data transmission method, characterized in that, When applied in a terminal device, the method includes: In response to a login request sent by a user, a first SM2 temporary key pair corresponding to the login request is generated; wherein the login request includes the user's identity credentials; The identity credential and the SM2 temporary public key in the first SM2 temporary key pair are sent to the server so that after the server successfully authenticates the user using the identity credential, it randomly generates the corresponding first SM4 key and encrypts the first SM4 key using the SM2 temporary public key to obtain the first encrypted data, and sends the first encrypted data to the terminal device. After receiving the first encrypted data sent by the server, the first encrypted data is decrypted using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and the first SM2 temporary key pair is deleted. Upon receiving a service request, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain second encrypted data and first encrypted metadata, wherein the first encrypted metadata is the field corresponding to the encrypted data in the target data; Add the second encrypted data and the first encrypted metadata to the business request; The service request is sent to the server so that after receiving the service request, the server can decrypt the second encrypted data using the first encrypted metadata and the current SM4 key to obtain the target data.

2. The method according to claim 1, characterized in that, After sending the service request to the server, the method further includes: The server receives a response request, wherein the response request includes third encrypted data and second encrypted metadata; the third encrypted data is data encrypted by the server using the current SM4 key to encrypt the response data corresponding to the target data, and the second encrypted metadata is a field corresponding to the data encrypted by the server in the response data; The third encrypted data is decrypted using the current SM4 key and the second encrypted metadata to obtain response data corresponding to the service request.

3. The method according to claim 1, characterized in that, The method further includes: Upon receiving the target instruction, a second SM2 temporary key pair corresponding to the login request is regenerated; The SM2 temporary public key in the second SM2 temporary key pair and the user credentials are sent to the server so that the server can randomly regenerate the second SM4 key, encrypt the second SM4 key using the SM2 temporary public key in the second SM2 temporary key pair, and send the encrypted second SM4 key to the terminal device; wherein, the target instruction includes a key pair regeneration instruction or a page refresh instruction; After receiving the encrypted second SM4 key sent by the server, the encrypted second SM4 key is decrypted using the SM2 temporary private key in the second SM2 temporary key pair to obtain the second SM4 key. The second SM2 temporary key pair is deleted, the second SM4 key is stored, and the second SM4 key is determined as the current SM4 key.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: When the user logs out, the current SM4 key is deleted.

5. A data transmission method, characterized in that, When applied to a server, the method includes: The terminal device receives the identity credentials corresponding to the user's login request and the SM2 temporary public key in the first SM2 temporary key pair, wherein the first SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request generated when the user sends the login request; After successfully verifying the user using the identity credentials, a corresponding first SM4 key is randomly generated; The first SM4 key is encrypted using the SM2 temporary public key to obtain the first encrypted data; The first encrypted data is sent to the terminal device so that after receiving the first encrypted data, the terminal device can decrypt the first encrypted data using the SM2 temporary private key in the first SM2 temporary key pair to obtain the first SM4 key, and then delete the first SM2 temporary key pair; when a service request sent by a user is received, the first SM4 key is determined as the current SM4 key, and the target data corresponding to the service request is encrypted using the current SM4 key to obtain the second encrypted data and the first encrypted metadata; the second encrypted data and the first encrypted metadata are added to the service request, and the service request is sent to the server, wherein the first encrypted metadata is a field of the encrypted data in the target data; Upon receiving the service request, the second encrypted data is decrypted using the first encrypted metadata and the current SM4 key to obtain the target data.

6. The method according to claim 5, characterized in that, After decrypting the second encrypted data using the first encrypted metadata and the current SM4 key to obtain the target data, the method further includes: Obtain the response data corresponding to the target data; The response data is encrypted using the current SM4 key to obtain third encrypted data and second encrypted metadata, wherein the second encrypted metadata is the field corresponding to the data encrypted by the server in the response data; The third encrypted data and the second encrypted metadata are sent to the terminal device so that the terminal device can decrypt the third encrypted data using the current SM4 key and the second encrypted metadata to obtain response data corresponding to the service request.

7. The method according to claim 5, characterized in that, The method further includes: If the terminal device receives the SM2 temporary public key and the user credentials from the second SM2 temporary key pair, then the corresponding second SM4 key is randomly generated again; wherein, the second SM2 temporary key pair is the SM2 temporary key pair corresponding to the login request that is regenerated by the terminal device after receiving the target instruction, and the target instruction includes a key pair regeneration instruction or a page refresh instruction; The second SM4 key is encrypted using the SM2 temporary public key in the second SM2 temporary key pair to obtain the encrypted second SM4 key; The encrypted second SM4 key is sent to the terminal device so that the terminal device can decrypt the encrypted second SM4 key using the SM2 temporary private key in the second SM2 temporary key pair. After obtaining the second SM4 key, the second SM2 temporary key pair is deleted, and the second SM4 key is stored. The second SM4 key is then identified as the current SM4 key.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data transmission method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the data transmission method according to any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data transmission method according to any one of claims 1-7.

Images