A data security transmission method and device based on TPUNB communication, a terminal device, and a storage medium

Abstract

This invention discloses a data security transmission method, apparatus, terminal device, and storage medium based on TPUNB communication, belonging to the field of communications. The method is applicable to the central node of an IoT communication terminal network; both the terminal node and the central node have preset initial keys. The method includes: decrypting routing lookup information broadcast by the terminal node according to the initial key; determining the target domain network number to which the terminal node belongs and determining the corresponding target domain key according to the decrypted routing forwarding identifier; encrypting the target domain key and the terminal address ID to be assigned according to the initial key to generate key allocation ciphertext and sending it to the terminal node; decrypting the key confirmation ciphertext sent by the terminal node according to the target domain key, encrypting and generating a key confirmation reply ciphertext and sending it to the terminal node; and decrypting the service ciphertext after the terminal node iteratively encrypts the data to be transmitted to obtain the original data to be transmitted. By implementing this invention, the problem of decreased transmission integrity in existing technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a data security transmission method, apparatus, terminal equipment, and storage medium based on TPUNB communication. Background Technology

[0002] In scenarios involving power system operation and maintenance, emergency repairs, and emergency restoration, a large amount of business data exhibits characteristics of low bandwidth and long-distance short messages, such as primary equipment status information, telemetry values ​​from inspection points, and environmental alarms in temporary work areas. Only kbps-level bandwidth is required to meet transmission needs, but coverage distances of several kilometers or more are required. Simultaneously, emergency sites often face environments without operator coverage or network access, placing stringent demands on the networking capabilities of communication networks.

[0003] Currently, Low-Power Wide-Area Internet of Things (LPWAN) technology has become the mainstream physical carrier for temporary communication systems in power emergencies. LoRa technology is a typical LPWAN technology, characterized by long-range communication and ultra-low power consumption, employing a traditional FSK modulation-derived spread spectrum scheme. However, the complex environment of power emergency sites makes communication links susceptible to electromagnetic interference from high-voltage equipment and terrain obstructions, resulting in poor stability. Existing solutions lack a robust key verification mechanism during key distribution. The central node cannot confirm whether the terminal node has accurately received and decrypted the target key, and the terminal node cannot verify the legitimacy of the key sent by the central node. This leads to issues such as key transmission errors and key tampering, failing to effectively guarantee the security of key distribution in power emergency scenarios and reducing the integrity and accuracy of data transmission. Summary of the Invention

[0004] This invention provides a data security transmission method, apparatus, terminal device, and storage medium based on TPUNB communication, which can effectively solve the problem of packet loss risk in existing communication technologies, resulting in a decrease in data transmission integrity and accuracy.

[0005] One embodiment of the present invention provides a data security transmission method based on TPUNB communication, applicable to the central node of an Internet of Things (IoT) communication terminal network; the IoT communication terminal network further includes several terminal nodes; both the terminal nodes and the central node are preset with an initial key; the terminal nodes and the central node transmit data through a TPUNB communication link; The secure data transmission method based on TPUNB communication includes: The terminal node receives routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; The routing lookup information is decrypted using the initial key. The target domain network number to which the terminal node belongs is determined based on the routing forwarding identifier of the decrypted routing lookup information. The target domain key corresponding to the target domain network number is then determined from the preset domain network key table. The target domain key and the terminal address ID to be assigned are encrypted according to the initial key to generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node can decrypt the key allocation ciphertext according to the initial key to obtain the target domain key and generate key confirmation ciphertext. The system receives a key confirmation ciphertext sent by a terminal node, decrypts the key confirmation ciphertext according to the target domain key, and verifies the consistency of the information. If the verification is successful, the system encrypts and generates a key confirmation reply ciphertext according to the target domain key and sends it to the terminal node. This allows the terminal node to iteratively encrypt the data to be transmitted according to the target domain key after receiving the key confirmation reply ciphertext, generate business ciphertext, and transmit it to the central node. The ciphertext of the service is decrypted using the target domain key to obtain the original data to be transmitted.

[0006] Furthermore, the terminal node iteratively encrypts the data to be transmitted based on the target domain key to generate business ciphertext, including: The data to be transmitted is divided into several data blocks to be encrypted according to a preset first bit unit, and the target domain key is converted into several key arrays according to a preset second bit unit; wherein the preset second bit unit is greater than the preset first bit unit. Extract several rows from the key array as the round key for each round of encryption; wherein the number of bits in each row of the round key is equal to the number of bits in each row of the data block to be encrypted; The current intermediate ciphertext is encrypted using the current round key. The current intermediate ciphertext is then XORed with the current round key. An S-box nonlinear transformation is performed on the XOR result column-wise. The transformed result is then cyclically shifted left by a preset number of bits. The current intermediate ciphertext is updated and used as the current intermediate ciphertext for the next round. The first encrypted intermediate ciphertext is the first data block to be encrypted. After the current round key is transformed by the S-box and generalized transformation, it is bitwise XORed with the fixed round parameters corresponding to the current round to update the current round key. The updated current round key is used as the current round key for the next round until the preset number of iterations is reached, and the final ciphertext corresponding to each data block to be encrypted is obtained. The final ciphertext corresponding to all data blocks to be encrypted is concatenated according to the data block segmentation order to generate the business ciphertext.

[0007] Furthermore, when dividing the data to be transmitted into several data blocks to be encrypted according to a preset first bit unit, if the number of bits in the last data block to be encrypted is less than the preset first bit unit, the last data block to be encrypted is padded to complete it.

[0008] Furthermore, the preset domain network key table includes the target domain network number and the target domain key; The construction of the pre-defined domain network key table includes: Divide the area where the IoT communication terminal network is located into several domain networks, and assign a target network number to each domain network. Randomly generate several target domain keys, and associate each target domain network number with each target domain key as a set of related entries; An entry retrieval index is created for each associated entry, and a domain network key table is constructed based on the entry retrieval index and the corresponding associated entries.

[0009] Further, the target domain key and the terminal address ID to be allocated are encrypted according to the initial key to generate key allocation ciphertext, including: The target domain key and the address ID to be assigned are concatenated in plaintext to obtain plaintext data; The plaintext data is iteratively encrypted using the initial key to generate key-allocated ciphertext.

[0010] Furthermore, it also includes: After the preset update time, update the target domain key in the preset domain network key table, and use the updated target domain key as the first key; The first key is encrypted according to the target domain key, and the encrypted first key is broadcast to all terminal nodes in the IoT communication terminal network so that the terminal nodes can receive and decrypt the encrypted first key, use the decrypted first key as the new target domain key, and generate business ciphertext according to the new target domain key.

[0011] Furthermore, the central node of the IoT communication terminal network realizes data transmission and reception through the state machine in the microcontroller; the microcontroller is connected to the IoT communication terminal network; the state machine of the microcontroller includes standby mode, transmit mode and receive mode; When the central node receives the routing lookup information broadcast by the terminal node, the state machine switches from standby mode to receiving mode; Once the central node receives the original data to be transmitted, the state machine switches from receiving mode to sending mode, and sends the original data to be transmitted to the IoT terminal through the IoT communication terminal network.

[0012] As an improvement to the above solution, another embodiment of the present invention provides a data security transmission device based on TPUNB communication, comprising: The system includes a central node of an IoT communication terminal network; the IoT communication terminal network also includes several terminal nodes; both the terminal nodes and the central node are pre-set with an initial key; the terminal nodes and the central node transmit data through a TPUNB communication link. The central node is used for secure data transmission based on TPUNB communication, including: The routing lookup information receiving module is used to receive routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; The target domain key determination module is used to decrypt the routing lookup information according to the initial key, determine the target domain network number to which the terminal node belongs according to the routing forwarding identifier of the decrypted routing lookup information, and determine the target domain key corresponding to the target domain network number in a preset domain network key table. The key allocation ciphertext generation module is used to encrypt the target domain key and the terminal address ID to be allocated according to the initial key, generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node decrypts the key allocation ciphertext according to the initial key to obtain the target domain key and generates key confirmation ciphertext. The data encryption module is used to receive the key confirmation ciphertext sent by the terminal node, decrypt the key confirmation ciphertext according to the target domain key and verify the consistency of the information. If the verification is successful, it encrypts and generates a key confirmation reply ciphertext according to the target domain key and sends it to the terminal node, so that after receiving the key confirmation reply ciphertext, the terminal node iteratively encrypts the data to be transmitted according to the target domain key to generate business ciphertext and transmits it to the central node. The data decryption module is used to decrypt the business ciphertext according to the target domain key to obtain the original data to be transmitted.

[0013] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a data security transmission method based on TPUNB communication as described in the above embodiments.

[0014] Another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a data security transmission method based on TPUNB communication as described in the above embodiment.

[0015] By implementing this invention, at least the following beneficial effects are achieved: This invention provides a data security transmission method, apparatus, terminal device, and storage medium based on TPUNB communication. The method clearly defines that terminal nodes and central nodes transmit data via a TPUNB communication link, and TPUNB... The technology employs S-FSK modulation, which significantly outperforms traditional FSK in suppressing narrowband strong interference and sudden electromagnetic interference. It effectively distinguishes between useful and interfering signals, avoiding the problem of spread spectrum gain failure when interference frequencies overlap with the channel. This reduces the probability of demodulation failure at the transmission link level and directly lowers the risk of packet loss due to interference. After the terminal node decrypts the target domain key, it generates a key confirmation ciphertext feedback. The central node decrypts this ciphertext using the target domain key and verifies the information consistency. Only after successful verification is an confirmation reply sent, ensuring that the central node can verify that the terminal node has accurately received and decrypted the target domain key. Simultaneously, the terminal node can verify the legitimacy and validity of the target domain key sent by the central node by receiving the confirmation reply ciphertext. This completely solves the shortcomings of existing schemes, such as the lack of verification in key distribution and the inability of both parties to mutually recognize the validity of keys. Routing lookup information, the target domain key, and the terminal address ID to be assigned are all transmitted encrypted using a preset initial key. The key confirmation ciphertext, the key confirmation reply ciphertext, and subsequent service ciphertext are encrypted using the target domain key. The dual-key layered encryption design, combined with the anti-interference advantages of the TPUNB communication link itself, effectively resists electromagnetic interference from high-voltage equipment and signal distortion caused by terrain obstruction at power emergency sites. At the same time, it prevents keys from being tampered with or stolen during transmission, ensuring the security and accuracy of key distribution from the source of transmission and improving the integrity and accuracy of data transmission. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a secure data transmission method based on TPUNB communication according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating the state machine transmission mode provided in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the state machine receiving mode provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of a data security transmission device based on TPUNB communication provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] See Figure 1 To address the issue of packet loss risk in existing communication technologies, which leads to a decrease in data transmission integrity and accuracy, an embodiment of the present invention provides a flowchart illustrating a data security transmission method based on TPUNB communication. This method is applicable to the central node of an IoT communication terminal network; the IoT communication terminal network further includes several terminal nodes; both the terminal nodes and the central node have preset initial keys; the terminal nodes and the central node transmit data via a TPUNB communication link. Specifically, the IoT communication terminal network refers to a dedicated IoT network composed of a central node and several terminal nodes, which uses TPUNB communication technology to achieve data transmission. It supports domain network partitioning and is adapted to scenarios such as power emergency communication; it is also known as a TPUNB IoT private network. The central node is responsible for management functions such as domain network key table construction, key distribution and updating, and data reception and decryption, and is typically deployed on the gateway or server side. Terminal nodes are sensing or communication nodes in the network, such as sensors and portable smart terminals in power emergency scenarios. They support TPUNB communication and can initiate route lookups, receive domain keys, and encrypt and transmit business data. The initial key, denoted as K0, is a shared key pre-agreed upon by the terminal nodes and the central node. It has a length of 80 bits and is used for identity verification and sensitive information encryption during the initialization phase, forming the basis for establishing a trusted link. The TPUNB communication link is a communication link based on domestically developed TPUNB low-power wide-area network technology, using S-FSK modulation and supporting (G) FSK / (G) MSK modulation. It possesses strong anti-interference capabilities and independent intellectual property rights.

[0019] The secure data transmission method based on TPUNB communication includes: S1. Receive routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; Specifically, the routing lookup information represents information initiated by the terminal node to locate the communication path of the central node. It is encrypted with an initial key and then broadcast to ensure that the transmission process is not tampered with. The routing forwarding identifier represents the characteristic information carried in the routing lookup information that identifies the region or group to which the terminal node belongs, such as the geographical area code and device type code. It is the basis for the central node to determine the domain network number.

[0020] Specifically, the central node listens to network broadcasts through the TPUNB communication module (IoT communication terminal network) and receives encrypted route lookup information sent by the terminal nodes. Before sending, the terminal nodes have already used the initial key K0 to perform Rectangle encryption on the route lookup information (including the route forwarding identifier). This establishes the initial communication association between the terminal nodes and the central node, and the encrypted broadcast ensures that the routing information is not illegally stolen or tampered with.

[0021] S2. Decrypt the routing lookup information according to the initial key, determine the target domain network number to which the terminal node belongs according to the routing forwarding identifier of the decrypted routing lookup information, and determine the target domain key corresponding to the target domain network number in the preset domain network key table. Specifically, the target domain network number represents a unique identifier assigned by the central node to the divided independent communication domain, used to achieve domain network isolation and precise key distribution. The target domain key represents a dedicated key generated by the central node for each domain network, denoted as K1, with a length of 80 bits, shared by terminal nodes within the same domain network to achieve secure data isolation within the domain.

[0022] Specifically, the central node invokes the embedded Rectangle decryption algorithm to decrypt the ciphertext using the initial key K0 and extract the routing forwarding identifier. Based on the identifier mapping rules, such as the first four digits of the routing forwarding identifier corresponding to a domain network number, the target domain network number is determined. The local preset domain network key table is then queried to match and obtain the target domain key K1 corresponding to that number. This completes the domain ownership confirmation for the terminal nodes, laying the foundation for subsequent domain-specific key allocation and realizing the core logic of domain network isolation.

[0023] Preferably, the preset domain network key table includes the target domain network number and the target domain key; The construction of the pre-defined domain network key table includes: Divide the area where the IoT communication terminal network is located into several domain networks, and assign a target network number to each domain network. Randomly generate several target domain keys, and associate each target domain network number with each target domain key as a set of related entries; An entry retrieval index is created for each associated entry, and a domain network key table is constructed based on the entry retrieval index and the corresponding associated entries.

[0024] Specifically, a domain network refers to an independent sub-network of IoT communication terminal networks divided according to geographical region, device type, or business scenario. Terminal nodes within each domain network share the same target domain key, achieving cross-domain isolation. The entry retrieval index is a fast query index (such as a hash index) built from the target domain network number and target domain key association entries in the domain network key table. It is used by the central node to quickly locate the corresponding target domain key based on the domain network number.

[0025] Preferably, it further includes: After the preset update time, update the target domain key in the preset domain network key table, and use the updated target domain key as the first key; The first key is encrypted according to the target domain key, and the encrypted first key is broadcast to all terminal nodes in the IoT communication terminal network so that the terminal nodes can receive and decrypt the encrypted first key, use the decrypted first key as the new target domain key, and generate business ciphertext according to the new target domain key.

[0026] Specifically, the preset update time represents the domain key update cycle preset by the central node, which is dynamically adjusted according to the domain network communication frequency. This is used to periodically replace the domain key and improve security. The first key represents the updated target domain key generated by the central node, denoted as K2, with a length of 80 bits and strong randomness and diffusion. The new target domain key represents the first key K2 obtained by the terminal node after decryption, which is used to replace the original target domain key K1 as the key for subsequent encryption.

[0027] S3. Encrypt the target domain key and the terminal address ID to be allocated according to the initial key to generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node can decrypt the key allocation ciphertext according to the initial key to obtain the target domain key and generate key confirmation ciphertext. Specifically, the terminal address ID to be assigned represents a unique identifier assigned by the central node to a newly connected terminal node, used for the terminal node's identification within the network. The key allocation ciphertext represents the ciphertext generated by the central node after encrypting the target domain key and the terminal address ID to be assigned using the initial key, ensuring the security of the domain key and terminal ID transmission. The key confirmation ciphertext represents the confirmation message generated by the terminal node after decrypting the key allocation ciphertext and encrypting it with the target domain key, used to inform the central node that it has successfully received and acquired the target domain key.

[0028] Specifically, the central node concatenates the target domain key K1 and the terminal address ID to be assigned in K1-first, ID-last order to form plaintext data; it then performs 25 rounds of Rectangle iterative encryption on the plaintext using the initial key K0 to generate key allocation ciphertext; and sends it to the corresponding terminal node via the TPUNB communication link. Based on the initial trusted link, the domain-specific key and terminal identity identifier are securely distributed to prevent leakage during domain key transmission.

[0029] Preferably, the target domain key and the terminal address ID to be allocated are encrypted according to the initial key to generate key allocation ciphertext, including: The target domain key and the address ID to be assigned are concatenated in plaintext to obtain plaintext data; The plaintext data is iteratively encrypted using the initial key to generate key-allocated ciphertext.

[0030] Specifically, the central node obtains the target domain key and the terminal address ID to be assigned, and concatenates them in the order of the target domain key and the terminal address ID to form plaintext data. This integrates two core pieces of information requiring secure transmission into a single data unit, simplifying the encryption process and ensuring transmission synchronization. The central node calls the Rectangle encryption algorithm, using the initial key to perform 25 rounds of iterative encryption on the concatenated plaintext data, following the same process as the business ciphertext encryption. If the plaintext data length is not a multiple of 64 bits, the last data block is padded to 64 bits before encryption is performed. This high-strength encryption ensures the security of the target domain key and terminal address ID transmission process, preventing unauthorized theft or tampering.

[0031] S4. Receive the key confirmation ciphertext sent by the terminal node, decrypt the key confirmation ciphertext according to the target domain key and verify the information consistency. If the verification is successful, encrypt and generate the key confirmation reply ciphertext according to the target domain key and send it to the terminal node, so that after receiving the key confirmation reply ciphertext, the terminal node iteratively encrypts the data to be transmitted according to the target domain key to generate the business ciphertext and transmits it to the central node. Specifically, information consistency refers to the core verification standards used by the central node when verifying the key confirmation ciphertext, including that the terminal address ID in the ciphertext matches the assigned ID, the message format conforms to the TPUNB communication protocol, and the integrity check bits are valid. The key confirmation reply ciphertext represents the reply information generated by the central node after verifying the key confirmation ciphertext, encrypted with the target domain key. It is used to inform the terminal node that the key handover was successful and that business data transmission can begin. The business ciphertext represents the ciphertext generated by the terminal node using the target domain key K1 to iteratively encrypt actual business data, such as device status and telemetry values; it is the core data carrier for transmission.

[0032] Specifically, the central node receives the key confirmation ciphertext sent by the terminal node (generated by the terminal node using K1 encryption); it decrypts the ciphertext using the target domain key K1, verifying that the terminal address ID in the ciphertext matches the assigned ID and that the message format is valid; after successful verification, it generates a key confirmation reply ciphertext using K1 encryption and sends it back to the terminal node via the TPUNB link. This completes the two-way key confirmation between the central node and the terminal node, ensuring accurate domain key handover and preventing key loss or errors due to transmission interference.

[0033] Preferably, the terminal node iteratively encrypts the data to be transmitted based on the target domain key to generate business ciphertext, including: The data to be transmitted is divided into several data blocks to be encrypted according to a preset first bit unit, and the target domain key is converted into several key arrays according to a preset second bit unit; wherein the preset second bit unit is greater than the preset first bit unit. Extract several rows from the key array as the round key for each round of encryption; wherein the number of bits in each row of the round key is equal to the number of bits in each row of the data block to be encrypted; The current intermediate ciphertext is encrypted using the current round key. The current intermediate ciphertext is then XORed with the current round key. An S-box nonlinear transformation is performed on the XOR result column-wise. The transformed result is then cyclically shifted left by a preset number of bits. The current intermediate ciphertext is updated and used as the current intermediate ciphertext for the next round. The first encrypted intermediate ciphertext is the first data block to be encrypted. After the current round key is transformed by the S-box and generalized transformation, it is bitwise XORed with the fixed round parameters corresponding to the current round to update the current round key. The updated current round key is used as the current round key for the next round until the preset number of iterations is reached, and the final ciphertext corresponding to each data block to be encrypted is obtained. The final ciphertext corresponding to all data blocks to be encrypted is concatenated according to the data block segmentation order to generate the business ciphertext.

[0034] Preferably, when dividing the data to be transmitted into several data blocks to be encrypted according to a preset first bit unit, if the number of bits in the last data block to be encrypted is less than the preset first bit unit, the last data block to be encrypted is padded to complete it.

[0035] Specifically, padding refers to the operation of adding bits to a block of data to be encrypted that is less than 64 bits, according to preset rules, to bring it to 64 bits. Common rules include 0 padding (all added bits are 0).

[0036] Specifically, the first preset bit unit represents the fixed bit length of the data to be transmitted segmented by the terminal node, adapted to the block length of the Rectangle encryption algorithm, which is 64 bits. The second preset bit unit represents the fixed bit length of the initial key conversion by the terminal node, which is 80 bits, greater than 64 bits, to ensure key security. The data block to be encrypted represents the independent data unit formed by segmenting the data to be transmitted into 64-bit segments; if less than 64 bits, padding is required. The key array represents a two-dimensional array formed by converting the target domain key into 80-bit segments, specifically a 5×16 array, with 16 bits per row, for a total of 5 rows and 80 bits. The round key represents the key used in each round of iterative encryption, generated by extracting the first four rows (4×16 array, 64 bits) from the key array, matching the length of the data block to be encrypted. The intermediate ciphertext represents the temporary ciphertext obtained after each round of encryption, serving as the input for the next round of encryption; the first encryption uses the data block to be encrypted (plaintext). The S-box nonlinear transformation is a nonlinear obfuscation operation that replaces each column of the input data with the corresponding output in the table using a preset S-box transformation table, breaking the linear correlation of the data. The preset left shift operation means performing a fixed-number left shift operation on each row of the intermediate ciphertext after the S-box transformation, specifically: 0 bits for the first row, 1 bit for the second row, 12 bits for the third row, and 13 bits for the fourth row. The generalized transformation refers to the generalized Feistel transformation, a linear diffusion operation that achieves uniform diffusion of key bits through a left shift and XOR operation. The fixed round parameter represents the 5-bit fixed value (denoted as RC[i]) used in each round of key update, where i is the round number (0-24). RC[i] is different in each round, such as RC[0]=0x01, RC[1]=0x02. The number of iterations is the preset number of encryption rounds, which is 25 rounds, to ensure encryption strength.

[0037] Specifically, the data to be transmitted is divided into several blocks of data to be encrypted, each 64 bits long. Blocks shorter than 64 bits are padded according to a preset rule (e.g., zero padding). The 80-bit target field key is converted into a 5×16 key array, such as K1=(c0,c1,c2,c3,c4), with each row containing 16 bits. This adapts to the block length and key format requirements of the Rectangle encryption algorithm, laying the data and key foundation for iterative encryption. The first four rows (c0,c1,c2,c3) are extracted from the 5×16 key array and converted into a 4×16 round key (64 bits), ensuring that the number of bits per row (16 bits) in the round key matches the number of bits per row in the data blocks to be encrypted. A dedicated key is generated for each round of encryption, and encryption security is improved through iterative updates of the round key. During the initial encryption, the plaintext block to be encrypted is used as the initial intermediate ciphertext, and a bitwise XOR operation is performed with the current round key (round key addition). The XOR result is then subjected to an S-box nonlinear transformation (S-box table lookup and replacement) column-wise. A left-shift operation is then performed on the rows by a preset number of bits. The resulting value is used as the intermediate ciphertext for the next round, and this process is repeated until round 25. Through a combination of XOR, nonlinear transformation, and row shifting operations, the correlation of the original data is gradually broken, increasing the confusion and diffusion of the ciphertext. An S-box transformation is performed on the first four rows and first four columns of the key array corresponding to the current round key. A generalized Feistel transformation is performed on the transformed key array. The last five bits of the first row of the key array are extracted and bitwise XORed with the fixed round parameter RC[i] corresponding to the current round. The updated key array is obtained, and the first four rows are extracted as the round key for the next round. Each round of encryption corresponds to a round of key updates, ensuring that different round keys are used in each round to resist security threats such as differential attacks. After 25 iterations, each data block to be encrypted yields its final ciphertext. All final ciphertexts are then concatenated according to the original data segmentation order to form a complete business ciphertext. All encrypted data packets are integrated to form a complete, transmittable ciphertext, ensuring the integrity of data transmission.

[0038] In a preferred embodiment of the present invention, the data to be transmitted in the Internet of Things communication terminal network is encrypted by the Rectangle encryption algorithm with a key length of 80 bits. The specific steps are as follows: Obtain the data to be transmitted, obtain the round key of the first round using the initial key in the key register, and encrypt the data packets to be transmitted. Each round of encryption includes three steps: AddRoundkey, SubColumn, and ShiftRow. The content of the AddRoundkey step is the bitwise exclusive OR of the data to be transmitted or its intermediate state and the round key. The content of the SubColumn step is the S-box transformation. The content of the ShiftRow step is the cyclic shift. After passing through the above three steps, the intermediate state of the data to be encrypted is obtained; after each round of encryption is completed, the key content stored in the key register is updated. The update includes three steps: perform the S-box transformation on the data at the intersection of the first four rows and the first four columns of the key array, then apply a generalized Feistel transformation once, and finally perform the bitwise exclusive OR of the last five bits of the first row of the key data and the fixed round parameter RC to obtain a new 80-bit key, completing the update; after the key register is updated, extract the round key of the next round from the updated register for a new round of encryption. After 25 rounds of iteration, the final ciphertext is obtained.

[0039] As a preferred technical solution, the target domain key K1 is represented as (c0, c1, c2, c3, c4), where c0 represents the first row, c1 represents the second row, and so on. The target domain key is represented as an array of 5×16, a total of 80 bits. The first-round round key M1 is the first four rows (c0, c1, c2, c3) of the target domain key array, and is re-represented as an array of 4×16, a total of 64 bits (m0, m1, m2, m3); obtain a 64-bit data block X0 to be encrypted, represented as an array of 4×16, a total of 64 bits (x0, x1, x2, x3). The intermediate state of the ciphertext after the first-round encryption is represented as follows: X1 = F2(F1(X0⊕M1)); where F2 represents a linear transformation and F1 represents a non-linear transformation.

[0040] As a preferred technical solution, the non-linear transformation is obtained by looking up the S-box transformation table. The input data block is represented as an array of 4 rows. Taking each column as the input of the S-box, look up the S-box transformation table to obtain the output to replace the corresponding column. Finally, a new array is obtained, which means that a F1 non-linear transformation has been performed. The S-box transformation is shown in Table 1: Table 1 As a preferred technical solution, the linear transformation F2 is represented as: F2(Z) = Z <<< r0[i]; where "<<<" represents the cyclic left shift operation, i represents the row number, that is, from the first row to the fourth row, and r[i] represents the number of bits of the cyclic left shift. Specifically, i = 1, 2, 3, 4, and r0 = [0, 1, 12, 13].

[0041] As a preferred technical solution, after the first round of encryption, the key register updates the key array C0 to C1, specifically as follows: C1=F5(F4(F3(C0))); where F5 and F4 are linear transformations, and F3 is a nonlinear transformation.

[0042] As a preferred technical solution, the nonlinear transformation F3 is the same as F1 as the S-box transformation, but it takes the intersection data of the first four rows and the first four columns of the input C0.

[0043] As a preferred technical solution, the linear transformation F4 is a generalized Feistel transformation, expressed as: Where j = 1, 2, 3, 4, 5, This represents the j-th line of input. This represents the j-th line of the output, r1=[8,0,0,12,0]; specifically, .

[0044] As a preferred technical solution, the linear transformation F5 is expressed as: C0,4'|| C0,3'|| C0,2'|| C0,1'||C0,0'=(C0,4|| C0,3|| C0,2|| C0,1|| C0,0)⊕RC[i]; where C0,4|| C0,3|| C0,2|| C0,1|| C0,0 represents the last five bits of the first line of input, i represents the round number (i = 0 to 24), and RC[i] is a 5-bit fixed round parameter, which is different for each round. The value of the fixed round parameter RC[i] updated by the key register is shown in Table 2. Table 2 S5. Decrypt the ciphertext of the service according to the target domain key to obtain the original data to be transmitted.

[0045] Specifically, the central node receives the encrypted business data transmitted by the terminal node via the TPUNB link (generated by the terminal node through iterative encryption using the target domain key); it then calls the Rectangle decryption algorithm to decrypt the encrypted data using the target domain key, restoring the original data to be transmitted, such as power equipment inspection data. This completes the secure reception and decryption of business data, ensuring the integrity and accuracy of core data in scenarios such as power emergencies.

[0046] In a preferred embodiment of the present invention, assuming an emergency power communication scenario, the IoT communication terminal network includes one central node and ten terminal nodes (field sensors). The specific implementation is as follows: The preset initial key is K0 (80 bits, 5×16 array), which is stored by both the terminal nodes and the central node. The TPUNB communication link parameters are configured as follows: frequency 470MHz, transmit power 15dBm, air interface rate 19.2Kbps, and low power mode. The terminal node (numbered T1) needs to transmit device temperature data. It first generates routing lookup information (including the routing forwarding identifier "0001", corresponding to domain network number 1), and broadcasts it after 25 rounds of Rectangle encryption using K0. The central node receives the encrypted routing lookup information, decrypts it using K0 to extract the identifier "0001", determines the target domain network number 1, and queries the preset domain network key table to obtain the target domain key K1. The central node concatenates K1 with the terminal address ID to be assigned to obtain plaintext data, encrypts it using K0 to generate key allocation ciphertext, and sends it to T1 via the TPUNB link. T1 decrypts K0 to obtain K1 and ID, and uses K1 to encrypt and generate a key confirmation ciphertext, which is then sent to the central node. The central node decrypts K1 to verify the ID's consistency and generates a key confirmation reply ciphertext, which is then sent back to T1. Upon receiving the reply, T1 uses the target domain key K1 to perform 25 rounds of iterative encryption on the temperature data "25℃" (i.e., the data to be transmitted, converted to 16 bits of binary), generating the business ciphertext and transmitting it to the central node. The central node decrypts the data using the target domain key K1 to obtain the original temperature data "25℃". Relying on the S-FSK modulation method of the TPUNB communication link, compared to LoRa's FSK-derived spread spectrum scheme, it significantly improves the ability to suppress narrowband strong interference and sudden electromagnetic interference in power emergency sites, reducing demodulation failure and packet loss risks. Through domain network partitioning and target domain key allocation, secure isolation of data within different domain networks is achieved, preventing cross-domain data leakage and improving the overall network's resistance to attacks. Both TPUNB technology and the Rectangle encryption algorithm are domestically developed, posing no risk of technological blockade and meeting the requirements of new power systems for communication security and independent controllability. TPUNB technology features the low-power characteristics of LPWAN, and its encryption and decryption processes for the initial key and target domain key are lightweight, making it suitable for the long-term battery-powered use of terminal nodes in power emergency scenarios. The dual-key layered encryption design, combined with the inherent anti-interference advantages of the TPUNB communication link, effectively resists electromagnetic interference from high-voltage equipment and signal distortion caused by terrain obstruction in power emergency sites. It also prevents keys from being tampered with or stolen during transmission, ensuring the security and accuracy of key distribution from the source of transmission and improving the integrity and accuracy of data transmission.

[0047] Schematic, the central node of the IoT communication terminal network realizes data transmission and reception through the state machine in the microcontroller; the microcontroller is connected to the IoT communication terminal network; the state machine of the microcontroller includes standby mode, transmit mode and receive mode; When the central node receives the routing lookup information broadcast by the terminal node, the state machine switches from standby mode to receiving mode; Once the central node receives the original data to be transmitted, the state machine switches from receiving mode to sending mode, and sends the original data to be transmitted to the IoT terminal through the IoT communication terminal network.

[0048] Specifically, the microcontroller (MCU) represents the core control unit of the central node, embedding a state machine and a Rectangle encryption / decryption algorithm, responsible for parameter configuration and data transmission / reception control of the TPUNB communication module. The state machine, located at the RF layer, is the logic unit within the microcontroller that manages data transmission / reception modes, supporting orderly switching between standby, transmit, and receive modes. Standby mode is the default mode of the state machine; in this mode, the microcontroller communicates with the TPUNB network in a low-power state, only listening for data transmission / reception commands. Transmit mode is the operating mode of the state machine used for transmitting data, including three sub-states: transmission initialization, transmission in progress, and transmission completed. Receive mode is the operating mode of the state machine used for receiving data, including three sub-states: reception initialization, reception in progress, and reception completed. An IoT terminal refers to the terminal node that transmits encrypted business data (such as a power field sensor), i.e., the target terminal that the central node needs to respond with data or commands after receiving the encrypted business data.

[0049] Specifically, after receiving the routing lookup information broadcast by the terminal node, the central node sends an interrupt signal to the microcontroller. The microcontroller responds to the interrupt, switching its state machine from standby mode to receive mode. The data reception process is initiated to ensure the effective reception of data such as routing lookup information, key confirmation ciphertext, and business ciphertext. After the central node decrypts the business ciphertext to obtain the original data to be transmitted, the upper-layer application issues a data transmission command (such as a feedback data reception success command). The microcontroller responds to the command, switching its state machine from receive mode to transmit mode. The data transmission process is initiated to ensure the effective transmission of feedback data or control commands from the central node to the terminal node. The state machine enters the transmission initialization state, loads the data packet string (including data packet length, content, and TPUNB transmission parameters) according to the original data length, and writes it to the transmission buffer; it enters the transmission in progress state, transmitting the data packet to the TPUNB communication network via serial port and sending it; it waits for feedback; if successful, it enters the transmission completion state; if it fails, it enters the timeout state; finally, it switches back to standby mode. This standardized data transmission process ensures the integrity and reliability of transmitted data and adapts to the mode management requirements of low-power scenarios.

[0050] In a preferred embodiment of the present invention, the microcontroller (MCU) is connected to the IoT communication terminal network via a serial port, enabling the microcontroller to configure parameters and control data transmission and reception of the IoT communication terminal network. A state machine is configured within the microcontroller to perform data transmission and reception functions. The antenna is connected to the IoT communication terminal network via an SMA (Single-Mode Amplifier). Upon receiving a data transmission command from the upper layer, the state machine switches from standby mode to transmission mode, encrypts the data, and transmits it through the IoT communication terminal network. Without a data transmission command, the state machine switches to reception mode, receives the data received by the IoT communication terminal network, and decrypts the valid data. This invention is suitable for power emergency communication scenarios using TPUNB technology. It achieves fast encryption and decryption speeds for encrypted data transmission between TPUNB communication device nodes while maintaining high device hardware efficiency and saving hardware resources. Furthermore, it achieves good platform portability and compatibility on embedded microcontrollers. Key management enables domain network isolation within the TPUNB terminal device network, significantly improving the security performance of the TPUNB terminal device node network and effectively reducing the risk of data leakage.

[0051] As a preferred technical solution, the state machine switches to the sending mode, such as... Figure 2 As shown, the specific process includes: the state machine enters the transmit initialization state TX_INIT from the standby state STANDBY, loads the data packet string according to the transmit length, including the data packet length, content, and transmit parameter configuration for the IoT communication terminal network for this transmit, and writes the data packet to be transmitted into the transmit buffer; the state machine enters the transmit in progress state TX_RUNNING, transmits the data packet string to the IoT communication terminal network via serial port and sends it; it waits for the transmit feedback from the IoT communication terminal network. If the transmit is successful, it returns a transmit success flag, and the state machine enters the transmit completion state TX_DONE; if the transmit fails, it returns a transmit timeout flag TX_TIMEOUT, and the state machine enters the standby state. The state machine switches to receive mode, as shown... Figure 3 As shown, the specific steps include: the state machine enters the receive initialization state RX_INIT from the standby state STANDBY, and continuously checks whether the serial port generates a receive completion interrupt. If no interrupt is detected within the set receive time, the interrupt flag returns to 0, indicating a receive timeout. The receive timeout flag RX_TIMEOUT is then returned, and the state machine returns to the standby state STANDBY. If a receive completion interrupt is detected, the interrupt flag returns to 1, and the state machine enters the receive in progress state RX_RUNNING. It checks whether the data packet is a valid data frame. If it is, the data frame is processed, and the unpacked data is passed to the upper layer. The state machine then enters the receive completion state RX_DONE. If it is not, the invalid data frame in the receive buffer is deleted, and the state machine returns to the standby state STANDBY.

[0052] By implementing this embodiment, it is clear that terminal nodes and central nodes transmit data through the TPUNB communication link. TPUNB technology uses S-FSK modulation, which has significantly better suppression capabilities against narrowband strong interference and sudden electromagnetic interference than traditional FSK. It can effectively distinguish between useful signals and interference signals, avoiding the problem of spread spectrum gain failure when interference frequencies overlap with the channel. This reduces the probability of demodulation failure at the transmission link level and directly reduces the risk of packet loss due to interference. After the terminal node decrypts the target domain key, it needs to generate a key confirmation ciphertext feedback. The central node decrypts the ciphertext using the target domain key and verifies the information consistency. Only after successful verification is an confirmation reply sent, ensuring that the central node can verify that the terminal node has accurately received and decrypted the target domain key. At the same time, the terminal node can verify the legality and validity of the target domain key sent by the central node by receiving the confirmation reply ciphertext. This completely solves the defects of existing schemes, such as lack of verification in key distribution and the inability of both parties to mutually recognize the validity of the keys. Routing lookup information, target domain key, and terminal address ID to be assigned are all transmitted encrypted using a preset initial key. Key confirmation ciphertext, key confirmation reply ciphertext, and subsequent service ciphertext are encrypted using the target domain key. The dual-key layered encryption design, combined with the anti-interference advantages of the TPUNB communication link itself, effectively resists electromagnetic interference from high-voltage equipment and signal distortion caused by terrain obstruction at power emergency sites. At the same time, it prevents keys from being tampered with or stolen during transmission, ensuring the security and accuracy of key distribution from the source of transmission and improving the integrity and accuracy of data transmission.

[0053] See Figure 4 This is a schematic diagram of a data security transmission device based on TPUNB communication according to an embodiment of the present invention, comprising: The system includes a central node of an IoT communication terminal network; the IoT communication terminal network also includes several terminal nodes; the terminal nodes and the central node are preset with an initial key; the terminal nodes and the central node transmit data through a TPUNB communication link; The central node is used for secure data transmission based on TPUNB communication, including: The routing lookup information receiving module is used to receive routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; The target domain key determination module is used to decrypt the routing lookup information according to the initial key, determine the target domain network number to which the terminal node belongs according to the routing forwarding identifier of the decrypted routing lookup information, and determine the target domain key corresponding to the target domain network number in a preset domain network key table. The key allocation ciphertext generation module is used to encrypt the target domain key and the terminal address ID to be allocated according to the initial key, generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node decrypts the key allocation ciphertext according to the initial key to obtain the target domain key and generates key confirmation ciphertext. The data encryption module is used to receive the key confirmation ciphertext sent by the terminal node, decrypt the key confirmation ciphertext according to the target domain key and verify the consistency of the information. If the verification is successful, it encrypts and generates a key confirmation reply ciphertext according to the target domain key and sends it to the terminal node, so that after receiving the key confirmation reply ciphertext, the terminal node iteratively encrypts the data to be transmitted according to the target domain key to generate business ciphertext and transmits it to the central node. The data decryption module is used to decrypt the business ciphertext according to the target domain key to obtain the original data to be transmitted.

[0054] Preferably, the terminal node iteratively encrypts the data to be transmitted based on the target domain key to generate business ciphertext, including: The data to be transmitted is divided into several data blocks to be encrypted according to a preset first bit unit, and the target domain key is converted into several key arrays according to a preset second bit unit; wherein the preset second bit unit is greater than the preset first bit unit. Extract several rows from the key array as the round key for each round of encryption; wherein the number of bits in each row of the round key is equal to the number of bits in each row of the data block to be encrypted; The current intermediate ciphertext is encrypted using the current round key. The current intermediate ciphertext is then XORed with the current round key. An S-box nonlinear transformation is performed on the XOR result column-wise. The transformed result is then cyclically shifted left by a preset number of bits. The current intermediate ciphertext is updated and used as the current intermediate ciphertext for the next round. The first encrypted intermediate ciphertext is the first data block to be encrypted. After the current round key is transformed by the S-box and generalized transformation, it is bitwise XORed with the fixed round parameters corresponding to the current round to update the current round key. The updated current round key is used as the current round key for the next round until the preset number of iterations is reached, and the final ciphertext corresponding to each data block to be encrypted is obtained. The final ciphertext corresponding to all data blocks to be encrypted is concatenated according to the data block segmentation order to generate the business ciphertext.

[0055] Preferably, when dividing the data to be transmitted into several data blocks to be encrypted according to a preset first bit unit, if the number of bits in the last data block to be encrypted is less than the preset first bit unit, the last data block to be encrypted is padded to complete it.

[0056] Preferably, the preset domain network key table includes the target domain network number and the target domain key; The construction of the pre-defined domain network key table includes: Divide the area where the IoT communication terminal network is located into several domain networks, and assign a target network number to each domain network. Randomly generate several target domain keys, and associate each target domain network number with each target domain key as a set of related entries; An entry retrieval index is created for each associated entry, and a domain network key table is constructed based on the entry retrieval index and the corresponding associated entries.

[0057] Preferably, the key allocation ciphertext generation module is used to encrypt the target domain key and the terminal address ID to be allocated according to the initial key to generate key allocation ciphertext, including: The target domain key and the address ID to be assigned are concatenated in plaintext to obtain plaintext data; The plaintext data is iteratively encrypted using the initial key to generate key-allocated ciphertext.

[0058] Preferably, it also includes a key update module: The key update module is used to update the target domain key in the preset domain network key table after a preset update time, and use the updated target domain key as the first key. The first key is encrypted according to the target domain key, and the encrypted first key is broadcast to all terminal nodes in the IoT communication terminal network so that the terminal nodes can receive and decrypt the encrypted first key, use the decrypted first key as the new target domain key, and generate business ciphertext according to the new target domain key.

[0059] Preferably, the central node of the IoT communication terminal network realizes data transmission and reception through a state machine within a microcontroller; the microcontroller is connected to the IoT communication terminal network; the state machine of the microcontroller includes a standby mode, a transmit mode, and a receive mode; When the central node receives the routing lookup information broadcast by the terminal node, the state machine switches from standby mode to receiving mode; Once the central node receives the original data to be transmitted, the state machine switches from receiving mode to sending mode, and sends the original data to be transmitted to the IoT terminal through the IoT communication terminal network.

[0060] This invention provides a data security transmission device based on TPUNB communication. It clarifies that terminal nodes and central nodes transmit data via a TPUNB communication link. TPUNB technology employs S-FSK modulation, which significantly outperforms traditional FSK in suppressing narrowband strong interference and sudden electromagnetic interference. It effectively distinguishes between useful and interfering signals, avoiding the problem of spread spectrum gain failure when interference frequencies overlap with the channel. This reduces demodulation failure probability at the transmission link level, directly lowering the risk of packet loss due to interference. After the terminal node decrypts the target domain key, it generates a key confirmation ciphertext feedback. The central node decrypts this ciphertext using the target domain key and verifies information consistency. Only after successful verification does it send an confirmation reply, ensuring the central node can verify that the terminal node has accurately received and decrypted the target domain key. Simultaneously, the terminal node can verify the legitimacy and validity of the target domain key sent by the central node by receiving the confirmation reply ciphertext. This completely solves the shortcomings of existing schemes, such as lack of key distribution verification and the inability of both parties to mutually recognize key validity. Routing lookup information, the target domain key, and the terminal address ID to be assigned are all transmitted using a preset initial key. The key confirmation ciphertext, the key confirmation reply ciphertext, and subsequent service ciphertext are encrypted using the target domain key. The dual-key layered encryption design, combined with the anti-interference advantages of the TPUNB communication link itself, effectively resists electromagnetic interference from high-voltage equipment and signal distortion caused by terrain obstruction at power emergency sites. At the same time, it prevents keys from being tampered with or stolen during transmission, ensuring the security and accuracy of key distribution from the source of transmission and improving the integrity and accuracy of data transmission.

[0061] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0062] Those skilled in the art will understand that, for convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0063] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a data security transmission method based on TPUNB communication as described in the above embodiments. The terminal device may be a desktop computer, laptop, handheld computer, cloud server, or other computing device. The terminal device may include, but is not limited to, a processor and a memory.

[0064] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0065] The memory can be used to store the computer program. The processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device or other volatile solid-state storage device.

[0066] Another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a data security transmission method based on TPUNB communication as described in the above embodiment.

[0067] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0068] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A secure data transmission method based on TPUNB communication, characterized in that, A central node suitable for an Internet of Things (IoT) communication terminal network; the IoT communication terminal network also includes several terminal nodes; both the terminal nodes and the central node are preset with an initial key; the terminal nodes and the central node transmit data through a TPUNB communication link; The secure data transmission method based on TPUNB communication includes: The terminal node receives routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; The routing lookup information is decrypted using the initial key. The target domain network number to which the terminal node belongs is determined based on the routing forwarding identifier of the decrypted routing lookup information. The target domain key corresponding to the target domain network number is then determined from the preset domain network key table. The target domain key and the terminal address ID to be assigned are encrypted according to the initial key to generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node can decrypt the key allocation ciphertext according to the initial key to obtain the target domain key and generate key confirmation ciphertext. The system receives a key confirmation ciphertext sent by a terminal node, decrypts the key confirmation ciphertext according to the target domain key, and verifies the consistency of the information. If the verification is successful, the system encrypts and generates a key confirmation reply ciphertext according to the target domain key and sends it to the terminal node. This allows the terminal node to iteratively encrypt the data to be transmitted according to the target domain key after receiving the key confirmation reply ciphertext, generate business ciphertext, and transmit it to the central node. The ciphertext of the service is decrypted using the target domain key to obtain the original data to be transmitted.

2. The data security transmission method based on TPUNB communication as described in claim 1, characterized in that, The terminal node iteratively encrypts the data to be transmitted based on the target domain key to generate business ciphertext, including: The data to be transmitted is divided into several data blocks to be encrypted according to a preset first bit unit, and the target domain key is converted into several key arrays according to a preset second bit unit; wherein the preset second bit unit is greater than the preset first bit unit. Extract several rows from the key array as the round key for each round of encryption; wherein the number of bits in each row of the round key is equal to the number of bits in each row of the data block to be encrypted; The current intermediate ciphertext is encrypted using the current round key. The current intermediate ciphertext is then XORed with the current round key. An S-box nonlinear transformation is performed on the XOR result column-wise. The transformed result is then cyclically shifted left by a preset number of bits. The current intermediate ciphertext is updated and used as the current intermediate ciphertext for the next round. The first encrypted intermediate ciphertext is the first data block to be encrypted. After the current round key is transformed by the S-box and generalized transformation, it is bitwise XORed with the fixed round parameters corresponding to the current round to update the current round key. The updated current round key is used as the current round key for the next round until the preset number of iterations is reached, and the final ciphertext corresponding to each data block to be encrypted is obtained. The final ciphertext corresponding to all data blocks to be encrypted is concatenated according to the data block segmentation order to generate the business ciphertext.

3. The data security transmission method based on TPUNB communication as described in claim 2, characterized in that, When dividing the data to be transmitted into several data blocks to be encrypted according to a preset first bit unit, if the number of bits in the last data block to be encrypted is less than the preset first bit unit, the last data block to be encrypted will be padded to complete it.

4. The data security transmission method based on TPUNB communication as described in claim 1, characterized in that, The preset domain network key table includes the target domain network number and the target domain key; The construction of the pre-defined domain network key table includes: Divide the area where the IoT communication terminal network is located into several domain networks, and assign a target network number to each domain network. Randomly generate several target domain keys, and associate each target domain network number with each target domain key as a set of related entries; An entry retrieval index is created for each associated entry, and a domain network key table is constructed based on the entry retrieval index and the corresponding associated entries.

5. The data security transmission method based on TPUNB communication as described in claim 1, characterized in that, The target domain key and the terminal address ID to be allocated are encrypted using the initial key to generate key allocation ciphertext, including: The target domain key and the address ID to be assigned are concatenated in plaintext to obtain plaintext data; The plaintext data is iteratively encrypted using the initial key to generate key-allocated ciphertext.

6. The data security transmission method based on TPUNB communication as described in claim 1, characterized in that, Also includes: After the preset update time, update the target domain key in the preset domain network key table, and use the updated target domain key as the first key; The first key is encrypted according to the target domain key, and the encrypted first key is broadcast to all terminal nodes in the IoT communication terminal network so that the terminal nodes can receive and decrypt the encrypted first key, use the decrypted first key as the new target domain key, and generate business ciphertext according to the new target domain key.

7. The data security transmission method based on TPUNB communication as described in claim 1, characterized in that, The central node of the IoT communication terminal network realizes data transmission and reception through the state machine in the microcontroller; the microcontroller is connected to the IoT communication terminal network; the state machine of the microcontroller includes standby mode, transmit mode and receive mode. When the central node receives the routing lookup information broadcast by the terminal node, the state machine switches from standby mode to receiving mode; Once the central node receives the original data to be transmitted, the state machine switches from receiving mode to sending mode, and sends the original data to be transmitted to the IoT terminal through the IoT communication terminal network.

8. A data security transmission device based on TPUNB communication, characterized in that, The system includes a central node of an IoT communication terminal network; the IoT communication terminal network also includes several terminal nodes; both the terminal nodes and the central node are pre-set with an initial key; the terminal nodes and the central node transmit data through a TPUNB communication link. The central node is used for secure data transmission based on TPUNB communication, including: The routing lookup information receiving module is used to receive routing lookup information broadcast by the terminal node; wherein the routing lookup information is generated by the terminal node through encryption using an initial key and includes a routing forwarding identifier; The target domain key determination module is used to decrypt the routing lookup information according to the initial key, determine the target domain network number to which the terminal node belongs according to the routing forwarding identifier of the decrypted routing lookup information, and determine the target domain key corresponding to the target domain network number in a preset domain network key table. The key allocation ciphertext generation module is used to encrypt the target domain key and the terminal address ID to be allocated according to the initial key, generate key allocation ciphertext and send it to the corresponding terminal node, so that the terminal node decrypts the key allocation ciphertext according to the initial key to obtain the target domain key and generates key confirmation ciphertext. The data encryption module is used to receive the key confirmation ciphertext sent by the terminal node, decrypt the key confirmation ciphertext according to the target domain key and verify the consistency of the information. If the verification is successful, it encrypts and generates a key confirmation reply ciphertext according to the target domain key and sends it to the terminal node, so that after receiving the key confirmation reply ciphertext, the terminal node iteratively encrypts the data to be transmitted according to the target domain key to generate business ciphertext and transmits it to the central node. The data decryption module is used to decrypt the business ciphertext according to the target domain key to obtain the original data to be transmitted.

9. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a data security transmission method based on TPUNB communication as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a data security transmission method based on TPUNB communication as described in any one of claims 1 to 7.

Images