Information encryption transmission method, electronic device, and storage medium

Abstract

The present application relates to, but is not limited to, the technical field of network security, and provides an information encryption transmission method, an electronic device, and a storage medium, applied to a service network comprising a terminal device, a control end device, a gateway device, and a service end device. The method comprises: a terminal device sends a ciphertext identifier request message to a control end device (S110); the terminal device receives a target ciphertext identifier returned by the control end device on the basis of the ciphertext identifier request message (S120); and the terminal device sends to a gateway device a target service request message carrying the target ciphertext identifier (S130), wherein the gateway device determines, according to a locally stored identifier mapping table, a target plaintext identifier corresponding to the target ciphertext identifier and a forwarding policy corresponding to the target plaintext identifier, and forwards the target service request message to a service end device, so that, according to the locally stored identifier mapping table, the service end device determines the target plaintext identifier corresponding to the target ciphertext identifier carried by the target service request message, so as to return a target service to the terminal device.

Description

Information encryption transmission method, electronic device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on the Chinese patent application with application number 202310790235.4 and application date June 29, 2023, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby introduced into this application as a reference. Technical Field

[0003] The embodiments of the present application relate to, but are not limited to, the field of network security technology, and in particular to an information encryption transmission method, an electronic device, and a storage medium. Background Art

[0004] In modern communications, network identifiers may contain a variety of privacy information that is strongly related to users. For example, in a computing power network, a service identifier contains information about the category of services accessed by users. Attackers obtain plaintext identifiers through routing hijacking, packet capture, and other means, thereby knowing the user's current behavior based on the plaintext identifier and stealing the user's privacy. To further protect user privacy, related technologies usually encrypt the plaintext identifier on the terminal device in the service network, and the server decrypts the encrypted plaintext identifier, thereby improving the privacy of the service identifier during network transmission. Although this method has a simple mechanism and is easy to implement, the plaintext identifier will also be used as the basis for gateway node routing selection, thereby affecting the routing strategy, resulting in complex routing forwarding and low efficiency. Therefore, there is an urgent need for a method of information encryption transmission that can reduce the impact on routing strategies while improving transmission security.

[0005] Summary of the Invention

[0006] Embodiments of the present application provide an information encryption transmission method, an electronic device, and a storage medium.

[0007] In the first aspect, an embodiment of the present application provides an information encryption transmission method, which is applied to a terminal device in a service network, wherein the service network also includes a control device, a gateway device and a server device, and the method includes: the terminal device sends a ciphertext identification request message to the control device; the terminal device receives a target ciphertext identification returned by the control device based on the ciphertext identification request message; the terminal device sends a target service request message to the gateway device, and the target service request message carries the target ciphertext identification, so that the gateway device determines the target plaintext identification corresponding to the target ciphertext identification according to a locally stored identification mapping table, and forwards the target service request message to the server device according to a forwarding strategy corresponding to the target plaintext identification.

[0008] In the second aspect, an embodiment of the present application provides an information encryption transmission method, which is applied to a gateway device in a service network, wherein the service network also includes a terminal device, a control device and a server device, and the method includes: the gateway device receives an identification mapping table sent by the control device; the gateway device receives a target service request message sent by the terminal device, and the target service request message carries a target ciphertext identifier; the gateway device determines a target plaintext identifier corresponding to the target ciphertext identifier according to the identification mapping table; the gateway device determines a corresponding forwarding strategy according to the target plaintext identifier; the gateway device forwards the target service request message to the server device according to the forwarding strategy, so that the server device determines the target plaintext identifier corresponding to the target ciphertext identifier carried in the target service request message according to the locally stored identification mapping table, and returns the target service to the terminal device according to the target plaintext identifier.

[0009] In a third aspect, an embodiment of the present application provides an information encryption transmission method, which is applied to a control-end device in a service network, wherein the service network also includes a terminal device, a gateway device and a server-end device, and the method includes: the control-end device receives a ciphertext identification request message sent by the terminal device; the control-end device returns a corresponding target ciphertext identification to the terminal device based on the ciphertext identification request message; the control-end device sends an identification mapping table to the gateway device, so that after the gateway device receives a target service request message carrying the target ciphertext identification sent by the terminal device, it determines a target plaintext identification corresponding to the target ciphertext identification according to the identification mapping table, and forwards the target service request message to the server-end device according to a forwarding policy corresponding to the target plaintext identification; the control-end device sends an identification mapping table to the server-end device, so that after the server-end device receives a target service request message carrying the target ciphertext identification forwarded by the gateway device, it determines a target plaintext identification corresponding to the target ciphertext identification carried in the target service request message according to the identification mapping table, and returns a target service to the terminal device based on the target plaintext identification.

[0010] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement: the information encryption transmission method as described in any of the first aspects; or, the information encryption transmission method as described in any of the second aspects; or, the information encryption transmission method as described in any of the third aspects.

[0011] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements: an information encryption transmission method as described in any one of the first aspects; or, an information encryption transmission method as described in any one of the second aspects; or, an information encryption transmission method as described in any one of the third aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] FIG1 is a schematic diagram of a network structure of a service network according to an embodiment of the present application using an information encryption transmission method;

[0013] FIG2 is a flow chart of an embodiment of a method for encrypting and transmitting information applied to a terminal device according to an embodiment of the present application;

[0014] FIG3 is a flow chart of an embodiment of an information encryption transmission method applied to a gateway device according to an embodiment of the present application;

[0015] FIG4 is an interaction diagram of another embodiment of a service network using the information encryption transmission method provided in one embodiment of the present application;

[0016] FIG5 is a flow chart of an embodiment of an information encryption transmission method applied to a control terminal device according to an embodiment of the present application;

[0017] FIG6 is a flow chart of an embodiment of an information encryption transmission method applied to a server device according to an embodiment of the present application;

[0018] FIG7 is another interaction diagram of another embodiment of a service network using the information encryption transmission method provided in one embodiment of the present application;

[0019] FIG8 is a schematic diagram of the hardware structure of a device corresponding to the information encryption transmission method provided in an embodiment of the present application.

[0020] Reference numerals:

[0021] Terminal device 100, gateway device 200, server device 300, control device 400, computing network element device 500, processor 601, memory 602. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0023] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart.

[0024] In the embodiments of the present application, words such as "further," "exemplarily," or "optionally" are used to indicate examples, illustrations, or descriptions and should not be interpreted as being more preferred or advantageous over other embodiments or designs. The use of words such as "further," "exemplarily," or "optionally" is intended to present related concepts in a concrete manner.

[0025] Before further describing the embodiments disclosed in the present application in detail, the nouns and terms involved in the embodiments disclosed in the present application are explained. The nouns and terms involved in the embodiments disclosed in the present application are subject to the following interpretations.

[0026] Plain text, in a communication system, refers to an unencrypted bit stream, such as text, bitmap, digitized voice, or digitized video image.

[0027] It should be noted that in modern communications, network identifiers may contain a variety of privacy information that is strongly related to users. For example, in a computing power network, a service identifier contains information about the category of services accessed by users. Attackers obtain plaintext identifiers through routing hijacking, packet capture, etc., and thus know the user's current behavior based on the plaintext identifier and steal the user's privacy. To further protect user privacy, related technologies usually encrypt the plaintext identifier in the terminal device 100 in the service network, and the server decrypts the encrypted plaintext identifier, thereby improving the privacy of the service identifier during network transmission. Although this method has a simple mechanism and is easy to implement, the plaintext identifier will also serve as the basis for routing selection by the gateway node; and the encryption and decryption scheme has the problem that the encrypted plaintext identifier cannot be parsed at the intermediate node. Therefore, the use of plaintext identifier encryption will affect the routing strategy, resulting in complex routing forwarding and low efficiency. Therefore, there is an urgent need for a method of information encryption transmission that can reduce the impact on routing strategy while improving transmission security.

[0028] As shown in Figure 1, an embodiment of the present application provides a service network, which includes a terminal device 100, a control device 400, a gateway device 200 and a service device 300.

[0029] The terminal device 100 sends a ciphertext identification request message to the control device 400 and receives the target ciphertext identification returned by the control device 400 according to the ciphertext identification request message, and sends a target service request message to the gateway device 200, wherein the target service request message carries the target ciphertext identification.

[0030] The control terminal device 400 receives the ciphertext identification request message sent by the terminal device 100 and returns the corresponding target ciphertext identification to the terminal device 100 according to the ciphertext identification request message.

[0031] The gateway device 200 receives the identification mapping table sent by the control end device 400; and receives the target service request message sent by the terminal device 100, and determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identification mapping table; determines the corresponding forwarding strategy according to the target plaintext identifier; and forwards the target service request message to the server device 300 according to the forwarding strategy.

[0032] The server device 300 receives the identification mapping table sent by the control device 400 and the target service request message sent by the gateway device 200, determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identification mapping table, and returns the target service to the terminal device 100 according to the target plaintext identifier.

[0033] Therefore, by sending a ciphertext identification request message to the control terminal device 400, the target ciphertext identification can be obtained, so that the target service request message is in an encrypted state during network transmission, thereby improving network transmission security. At the same time, in the gateway device 200, the target ciphertext identification and the corresponding plaintext identification are associated through the identification mapping table, so that the gateway device 200 can forward based on the plaintext identification, thereby achieving decoupling of transmission security and routing policy when the target service request message is in an encrypted state. Therefore, compared with related technologies, the embodiments of the present application can improve transmission security while reducing the impact on routing policy.

[0034] It should be noted that in some embodiments, after a network connection is established between the terminal device 100, the control device 400, the gateway device 200, and the server device 300, the control device 400 will proactively send the identification mapping table to the server device 300 and the gateway device 200. In some embodiments, the identification mapping table is proactively requested by the gateway device 200 and the server device 300.

[0035] It should be noted that the identification mapping table can be updated periodically or passively according to setting update rules.

[0036] It should be noted that the encrypted identification request message is used to obtain from the controller the encrypted identification corresponding to the plaintext identification of the target service requested from the server device 300. The plaintext identification is used by the server device 300 as the basis for providing the service; the encrypted identification request message includes, but is not limited to, the terminal identification. In some embodiments, the encrypted identification request message also includes service information of the target service requested by the control device 400, so that the plaintext identification can be determined based on the service information.

[0037] It should be noted that the target plaintext identifier is used to look up the plaintext identifier of the required target service from the identifier mapping table.

[0038] It should be noted that the target service request message is a message used to request the server device 300 to provide a target service.

[0039] It can be understood that Figure 2 is a flow chart of an embodiment of the information encryption transmission method of the terminal device 100 applied to the service network of the present application. The service network also includes a control terminal device 400, a gateway device 200 and a service terminal device 300. As shown in Figure 2, the method includes steps S110 to S130.

[0040] Step S110 : The terminal device 100 sends a ciphertext identification request message to the control terminal device 400 .

[0041] Step S120: The terminal device 100 receives the target ciphertext identifier returned by the control terminal device 400 according to the ciphertext identifier request message.

[0042] In step S130, the terminal device 100 sends a target service request message to the gateway device 200. The target service request message carries a target ciphertext identifier, so that the gateway device 200 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the locally stored identifier mapping table, and forwards the target service request message to the server device 300 according to the forwarding strategy corresponding to the target plaintext identifier.

[0043] Therefore, by sending a ciphertext identification request message to the control terminal device 400, the target ciphertext identification can be obtained, so that the target service request message is in an encrypted state during network transmission, thereby improving network transmission security. At the same time, in the gateway device 200, the target ciphertext identification and the corresponding plaintext identification are associated through the identification mapping table, so that the gateway device 200 can forward based on the plaintext identification, thereby achieving decoupling of transmission security and routing policy when the target service request message is in an encrypted state. Therefore, compared with related technologies, the embodiments of the present application can improve transmission security while reducing the impact on routing policy.

[0044] It should be noted that the server device 300 determines the target plaintext identifier corresponding to the target ciphertext identifier carried in the target service request message based on the identifier mapping table, and returns the target service to the terminal device 100 based on the target plaintext identifier. The identifier mapping table can be a mapping table that is sent by the control device 400 to the server device 300 and stored locally, or it can be a mapping table that is actively requested during verification. In one example, the present application uses a locally stored mapping table to determine the target plaintext identifier.

[0045] It should be noted that the target plaintext identifier is unknown to the terminal device 100, and the control end device 400 can determine the target plaintext identifier based on the ciphertext identifier request message of the terminal device 100. If the terminal device 100 and the plaintext identifier have a one-to-one mapping relationship, the ciphertext identifier request message carries the information of the terminal device 100 so that the control end device 400 can determine the target plaintext identifier, or the ciphertext identifier request message carries service information so that the control end device 400 can determine the plaintext identifier.

[0046] It should be noted that, in some embodiments, the identifier mapping table is used to record the relationship between the plaintext identifier and the ciphertext identifier at different times. In other embodiments, the identifier mapping table is used to record the time relationship between the plaintext identifier and the ciphertext identifier of different terminals, wherein the ciphertext identifier has a unique relationship with the time when the plaintext identifier and the ciphertext identifier are issued. In other embodiments, the identifier mapping table is used to record the relationship between the plaintext identifier, the ciphertext identifier, and the ciphertext identifier index. In other embodiments, the identifier mapping table is used to record the relationship between the plaintext identifier, the ciphertext identifier, and the security level, so the plaintext identifier can be determined based on the identifier mapping table in this application.

[0047] In some embodiments, an identifier mapping table is used to record the mapping relationship between plaintext identifiers and ciphertext identifiers at different times as an example. It is assumed that the identifier mapping table is as shown in Table 1 below.

[0048] Table 1

[0049] Wherein, T1, T2, ..., Tn represent the time when the ciphertext identifier is updated. Therefore, if the ciphertext identifier request message in step S110 is triggered within the time [T1, T2), the control end device 400 will return the ciphertext identifier updated at time T1 (i.e., SID11) as the target ciphertext identifier to the terminal device 100. If the ciphertext identifier request message is sent at time T2, and the plaintext identifier is SID2, SID22 is returned as the target ciphertext identifier.

[0050] In some embodiments, an identification mapping table is used to record the mapping relationship between the plaintext identification and the issuance time of the ciphertext identification of different terminal devices 100 as an example. It is assumed that the identification mapping table is as shown in Table 2 below.

[0051] Table 2

[0052] Among them, the column SIDi is the plaintext identifier, and the column Ts' is the time when the computing network element device 500 sends the corresponding plaintext identifier to the ciphertext. The ciphertext identifier is calculated by the first function, such as the first function F(SID, msk||f(Ts')), F is a periodic function used to encrypt the plaintext identifier SID, msk is the root key generated by the computing network element device 500, f is an arbitrary function, and Ts' is the time when the ciphertext identifier SID' is sent. At this time, the ciphertext identifiers belonging to the same plaintext identifier at different sending times are different. At this time, the gateway device 200 can obtain the expected plaintext identifier through the inverse function of the first function, and then compare it with the identifier mapping table to determine whether the decrypted expected plaintext identifier is the real plaintext identifier, and then forward the routing strategy according to the real plaintext identifier.

[0053] In some embodiments, an identification mapping table is used to record plaintext identification, ciphertext identification, and security level as an example. It is assumed that the identification mapping table is shown in Table 3 below.

[0054] Table 3

[0055] For example, for plaintext identifier SID2, since its security level is 2, which is higher than the security level of plaintext identifier SID1, the number of ciphertext identifiers for SID2 is also higher than that for SID1. Therefore, different numbers of ciphertext identifiers can be set for different levels, further improving transmission reliability while reducing overhead.

[0056] In some embodiments, an identifier mapping table is used to record the relationship between a plaintext identifier, a ciphertext identifier, and a ciphertext identifier index as an example. Assume that the identifier mapping table is as shown in Table 4.

[0057] Table 4

[0058] Each plaintext entry has multiple ciphertext identifiers, and each ciphertext identifier corresponds to a ciphertext identifier index. In one example, taking a row of data as an example, P11 represents the index of the ciphertext identifier SID11 whose plaintext identifier is SID1. SID11, SID12, ..., SID1n all represent ciphertext identifiers whose plaintext identifier is SID1.

[0059] It is understandable that the identification mapping table is generated by the control end device 400 , or the identification mapping table is generated by the computing network element device 500 and sent to the control end device 400 .

[0060] It should be noted that the identification mapping table is centrally managed by the control end device 400 so that the mapping tables of the gateway device 200 and the server end device 300 are of the same source, thereby improving the security of network transmission.

[0061] It should be noted that by having the identifier mapping table generated by the computing network element device 500, more complex ciphertext identifiers can be generated, thereby further improving the security of network transmission.

[0062] It is understandable that the identification mapping table is sent by the control-end device 400 to the gateway device 200 and the server-end device 300 .

[0063] It should be noted that the way in which the control device 400 sends the identification mapping table can be selectively set according to actual needs, such as selecting periodic timing to send it to the gateway device 200 and the server device 300 and sending it to the gateway device 200 and the server device 300 when the identification mapping table changes.

[0064] 3 , FIG3 is a flow chart of an embodiment of the information encryption transmission method of the present application applied to the gateway device 200 in the service network. The service network also includes a terminal device 100, a control device 400 and a service device 300. The method includes steps S210 to S250.

[0065] Step S210 : The gateway device 200 receives the identification mapping table sent by the control terminal device 400 .

[0066] Step S220: The gateway device 200 receives the target service request message sent by the terminal device 100. The target service request message carries a target ciphertext identifier.

[0067] Step S230: The gateway device 200 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table.

[0068] Step S240: The gateway device 200 determines a corresponding forwarding strategy according to the target plaintext identifier.

[0069] In step S250, the gateway device 200 forwards the target service request message to the server device 300 according to the forwarding strategy, so that the server device 300 determines the target plaintext identifier corresponding to the target ciphertext identifier carried by the target service request message according to the locally stored identifier mapping table, and returns the target service to the terminal device 100 according to the target plaintext identifier.

[0070] Therefore, by sending a ciphertext identification request message to the control terminal device 400, the target ciphertext identification can be obtained, so that the target service request message is in an encrypted state during network transmission, thereby improving network transmission security. At the same time, in the gateway device 200, the target ciphertext identification and the corresponding plaintext identification are associated through the identification mapping table, so that the gateway device 200 can forward based on the plaintext identification, thereby achieving decoupling of transmission security and routing policy when the target service request message is in an encrypted state. Therefore, compared with related technologies, the embodiments of the present application can improve transmission security while reducing the impact on routing policy.

[0071] It should be noted that the identification mapping table sent by the control terminal device 400 and received by the gateway device 200 can be directly generated by the control terminal device 400 or generated by the computing network element device 500 and sent to the control terminal device 400, that is, forwarded by the control terminal device 400.

[0072] It is understandable that the identifier mapping table includes at least one plaintext identifier and at least one ciphertext identifier corresponding to each plaintext identifier.

[0073] The gateway device 200 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including:

[0074] The gateway device 200 searches the identifier mapping table for a plaintext identifier corresponding to the target ciphertext identifier, and uses the found plaintext identifier as the target plaintext identifier.

[0075] In some embodiments, as shown in Table 1, Table 3, and Table 4, the identifier mapping table includes at least one plaintext identifier and at least one ciphertext identifier corresponding to each plaintext identifier.

[0076] It is understandable that the identifier mapping table includes at least one plaintext identifier, at least one ciphertext identifier corresponding to each plaintext identifier, and indexes between the plaintext identifiers and the ciphertext identifiers that have corresponding relationships.

[0077] The gateway device 200 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including:

[0078] The gateway device 200 determines the index corresponding to the target ciphertext identifier, searches for the plaintext identifier corresponding to the target ciphertext identifier in the identifier mapping table according to the index, and uses the found plaintext identifier as the target plaintext identifier.

[0079] In one example, as shown in Table 4, the identifier mapping table includes at least one plaintext identifier, at least one ciphertext identifier corresponding to each plaintext identifier, and an index between the plaintext identifiers and the ciphertext identifiers that have a corresponding relationship.

[0080] It should be noted that the forwarding efficiency of the gateway device 200 can be improved by adding indexes. In some embodiments, taking the system networking shown in Figure 4 as an example, the gateway device 200 includes an ingress gateway (SAN Ingress gateway node) and an egress gateway (SAN egress gateway node). When the identifier mapping table contains indexes between plaintext identifiers and ciphertext identifiers with corresponding relationships, the ingress gateway determines the corresponding plaintext identifier based on the target plaintext identifier and forwards the index to the egress gateway. The egress gateway can then search and determine the plaintext identifier from the stored identifier mapping table based on the index, thereby improving the forwarding efficiency.

[0081] It is understandable that the identifier mapping table includes at least one terminal identifier, at least one plaintext identifier corresponding to each terminal identifier, and a first time point corresponding to the terminal identifier, the first time point indicating the time point when the control terminal device 400 sends the encrypted identifier to the terminal device 100; the target service request message carries the terminal identifier corresponding to the terminal device 100.

[0082] The gateway device 200 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including:

[0083] The gateway device 200 uses the time point of receiving the target service request message as the second time point;

[0084] The gateway device 200 determines the first time point from the identifier mapping table according to the terminal identifier carried in the target service request message, and determines the time interval between the second time point and the first time point;

[0085] When the time interval is within the preset time interval threshold, the gateway device 200 calculates the decryption key according to the first time point and the target ciphertext identifier;

[0086] The gateway device 200 searches the identifier mapping table for the corresponding target plaintext identifier according to the decryption key.

[0087] In one example, as shown in Table 2, the identity mapping table includes at least one terminal identity, at least one plaintext identity corresponding to each terminal identity, and a first time point corresponding to the terminal identity.

[0088] It is understandable that, when the time interval is greater than the time interval threshold, the gateway device 200 discards the target service request message.

[0089] It should be noted that when the identification mapping table is a time-related mapping table, as shown in Table 1 and Table 2, when the time interval is greater than the time interval threshold, it indicates that it is a replay message, and therefore the target service request message can be discarded.

[0090] In some embodiments, assuming that the time when the gateway device 200 receives the message is recorded as Ts", the time interval △t = Ts"-Ts' is calculated; Ts' is the sending time corresponding to the target ciphertext identifier in the target service request message (that is, the corresponding first time point). If 0<△t<△T, △T is the key update period, the first packet is considered legal and can be forwarded; if △t>△T, it is considered to be a replayed message and needs to be discarded.

[0091] 5 , FIG5 is a flow chart of an embodiment of the information encryption transmission method of the present application for a control terminal device 400 applied in a service network. The service network also includes a terminal device 100, a gateway device 200 and a service terminal device 300. The method includes steps S310 to S340.

[0092] Step S310 : The control terminal device 400 receives the encrypted identification request message sent by the terminal device 100 .

[0093] Step S320: The control terminal device 400 returns the corresponding target ciphertext identifier to the terminal device 100 according to the ciphertext identifier request message.

[0094] In step S330, the control end device 400 sends an identification mapping table to the gateway device 200, so that after the gateway device 200 receives the target service request message carrying the target ciphertext identifier sent by the terminal device 100, it determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identification mapping table, and forwards the target service request message to the server device 300 according to the forwarding strategy corresponding to the target plaintext identifier.

[0095] In step S340, the control-end device 400 sends an identification mapping table to the server-end device 300, so that after the server-end device 300 receives the target service request message carrying the target ciphertext identifier forwarded by the gateway device 200, it determines the target plaintext identifier corresponding to the target ciphertext identifier carried in the target service request message according to the identification mapping table, and returns the target service to the terminal device 100 according to the target plaintext identifier.

[0096] Therefore, by sending a ciphertext identification request message to the control terminal device 400, the target ciphertext identification can be obtained, so that the target service request message is in an encrypted state during network transmission, thereby improving network transmission security. At the same time, in the gateway device 200, the target ciphertext identification and the corresponding plaintext identification are associated through the identification mapping table, so that the gateway device 200 can forward based on the plaintext identification, thereby achieving decoupling of transmission security and routing policy when the target service request message is in an encrypted state. Therefore, compared with related technologies, the embodiments of the present application can improve transmission security while reducing the impact on routing policy.

[0097] It is understandable that the identification mapping table is generated by the control end device 400 , or the identification mapping table is generated by the computing network element device 500 and sent to the control end device 400 .

[0098] The process of generating the identification mapping table includes at least one of the following:

[0099] According to the preset update time interval, the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, and each ciphertext identifier corresponds to a specific time point;

[0100] or,

[0101] According to the preset security level, the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, and the number of ciphertext identifiers of plaintext identifiers with a high security level is greater than the number of ciphertext identifiers of plaintext identifiers with a low security level;

[0102] or,

[0103] According to the preset indexing rules, the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, and the index between the plaintext identifier and the ciphertext identifier with corresponding relationship is set;

[0104] or,

[0105] According to the terminal identifier corresponding to the terminal device 100, at least one plaintext identifier corresponding to the terminal identifier is set in the identifier mapping table, and the first time point corresponding to the terminal identifier is set. The first time point indicates the time point when the control terminal device 400 sends the ciphertext identifier to the terminal device 100. The ciphertext identifier is calculated based on the plaintext identifier corresponding to the terminal device 100 and the first time point.

[0106] In some embodiments, as described in Table 1, the identifier mapping table sets an update time interval △T, takes T as the initial time of the update, and calculates the ciphertext identifiers corresponding to SID1, SID2, ..., SIDi at different times, so that the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, and each ciphertext identifier corresponds to a specific time point.

[0107] In some embodiments, an index is created for each service using a different ciphertext identifier. This yields an identifier mapping table as shown in Table 4, where the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, as well as the index between corresponding plaintext identifiers and ciphertext identifiers. For example, for SID1, each of its multiple ciphertext identifiers SID11, SID12, ..., SID1n has an index corresponding to it (specifically, the index of SID11 is P11). For SID2, each of its corresponding ciphertext identifiers SID21, SID22, ..., SID2n has an index corresponding to it.

[0108] In some embodiments, a level is set for each service based on the privacy level of the service. At this time, an identifier mapping table as shown in Table 3 can be obtained, so that the ciphertext identifier corresponding to each plaintext identifier is set in the identifier mapping table, and the number of ciphertext identifiers of plaintext identifiers with high security levels is greater than the number of ciphertext identifiers of plaintext identifiers with low security levels.

[0109] In some embodiments, the computing device determines the initial time Ts and the root key msk for issuing the ciphertext identifier. When receiving the ciphertext identifier request message, the target ciphertext identifier is calculated as SID' = F(SID, msk||f(Ts')), where F is a periodic function used to encrypt the plaintext SID, msk is the root key generated by the computing network element device 500, f is an arbitrary function, and Ts' is the time when the system issues SID'. At this point, an identifier mapping table as shown in Table 2 can be obtained, so that at least one plaintext identifier corresponding to the terminal identifier is set in the identifier mapping table, and the first time point corresponding to the terminal identifier is set.

[0110] It should be noted that setting different security levels to determine the number of ciphertext SIDs is used to reduce the maintenance cost of the identity mapping table. At the same time, for some services with low privacy requirements, no additional overhead can be added.

[0111] It is understandable that the service identification request message carries the terminal identification of the terminal device 100 .

[0112] The control terminal device 400 returns the corresponding target ciphertext identifier to the terminal device 100 according to the ciphertext identifier request message, including:

[0113] The control terminal device 400 searches the identifier mapping table for a ciphertext identifier corresponding to the terminal identifier, and uses the found ciphertext identifier as the target ciphertext identifier.

[0114] In another embodiment, the control terminal device 400 calculates the target plaintext identifier and the target ciphertext identifier corresponding to the first time point through a preset first function, and the first time point represents the time point when the control terminal device 400 sends the ciphertext identifier to the terminal device 100.

[0115] It should be noted that the first function is used to encrypt the plaintext identifier according to the root key and the first time point to obtain the target ciphertext identifier. The root key is generated by the control terminal device 400.

[0116] In one embodiment, the first function is F(SID, msk||f(Ts')), where F is a periodic function used to encrypt the plaintext SID; msk is a root key generated by the computing network element device 500, f is an arbitrary function, and Ts' is a first time point. Then, there is an identification mapping table as shown in Table 2. At this time, for the gateway device 200, the number of key iterations r can be calculated; r=(Ts'-T) / △T, △T is the key update period; T is the initial time of the key update set by the computing network element device 500; and the corresponding relationship between ID-Ts' is searched according to the identification mapping table, and the target ciphertext identification SID" is calculated, and SID"=F r -1 (SID', msk||f(Ts'), that is, use msk||f(Ts') as the key to decrypt SID', and the decryption parameter is the number of iterations r for decryption, so that the decrypted plaintext identifier can be used to execute the corresponding routing forwarding strategy.

[0117] 6 , FIG6 is a flow chart of an embodiment of an information encryption transmission method for a server device 300 applied to a service network. The service network further includes a terminal device 100 , a control device 400 and a gateway device 200 . The method includes steps S410 to S450 .

[0118] Step S410 : The server device 300 receives the identification mapping table sent by the control device 400 .

[0119] Step S420: The server device 300 receives the target service request message sent by the gateway device 200. The target service request message carries the target ciphertext identifier.

[0120] Step S430: The server device 300 determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table.

[0121] Step S440: The server device 300 determines the target plaintext identifier corresponding to the target ciphertext identifier carried in the target service request message according to the locally stored identifier mapping table.

[0122] Step S450: The server device 300 returns the target service to the terminal device 100 according to the target plaintext identifier.

[0123] In some embodiments, the system shown in Figures 4 and 7 is used as an example for explanation below, where the gateway device 200 includes a SAN Ingress gateway node and a SAN egress gateway node, and the computing network element device 500 and the control end device 400 constitute a computing network module. The information encryption transmission method is as follows.

[0124] Example 1, as shown in Figure 4, taking the identification mapping tables shown in Table 1 and Table 3 as an example

[0125] S1. The network computing module sends the identification mapping table to the gateway device 200, and the gateway device 200 stores the identification mapping table locally.

[0126] S2. The terminal device 100 sends a ciphertext identification request message to the computing network module to obtain the ciphertext identification corresponding to the service information;

[0127] S3. The computing network module searches the ciphertext service identifier SID1n corresponding to the service identifier SID1 of the service information according to the identifier mapping table, and sends it to the terminal device 100.

[0128] S4. The terminal device 100 uses SID1n to apply for the target service IP from the server device 300;

[0129] S5. The SAN ingress gateway node searches for the service identifier SID1 corresponding to SID1n in the locally stored mapping table and forwards the packet to the SAN egress gateway node according to the corresponding routing forwarding policy. The forwarded packet still carries the ciphertext SID1n.

[0130] S6. The SAN egress gateway node searches the locally stored mapping table for the service identifier SID1 corresponding to SID1n and forwards the message to the server device 300 according to the corresponding routing forwarding policy. The forwarded message still carries the ciphertext SID1n.

[0131] S7. The server device 300 returns the required target service IP.

[0132] Example 2, as shown in Figure 4, takes the identification mapping table shown in Table 4 as an example

[0133] S1. The network computing module sends the identification mapping table to the gateway device 200, and the gateway node stores the identification mapping table locally;

[0134] S2. The terminal device 100 sends a ciphertext identification request message to the computing network module to obtain the ciphertext identification corresponding to the service information;

[0135] S3. The computing network module searches the ciphertext service identifier SID1n corresponding to the service identifier SID1 of the service information according to the identifier mapping table, and sends it to the terminal device 100.

[0136] S4. The terminal device 100 uses SID1n to apply for the target service IP from the server device 300;

[0137] S5. The SAN ingress gateway node searches for the service identifier SID1 corresponding to SID1n in the locally stored identifier mapping table and forwards the packet to the SAN egress gateway node according to the corresponding routing forwarding policy. The forwarded packet still carries the ciphertext SIDn.

[0138] S6. The SAN egress gateway node searches the locally stored mapping table for the service identifier SID1 corresponding to SID1n according to the index P1n of the service identifier SID1, and forwards the message to the server device 300 according to the corresponding routing forwarding policy; the forwarded message still carries the ciphertext SID1n.

[0139] S7. The server device 300 returns the required target service IP;

[0140] Example 3, referring to FIG7, taking the identification mapping table shown in Table 2 as an example

[0141] S1. The network computing module sends the system initial time Ts and root key msk to the gateway device 200;

[0142] S2. The terminal sends a ciphertext identification request message carrying the terminal identification ID to the computing network module to apply for service information;

[0143] S3. The computing network module calculates the ciphertext SID11 and sends it to the terminal device 100; SID11 = F(SID1, msk|| f(Ts1')), where F is a periodic function determined by the computing network module and used to encrypt the plaintext SID1, msk is a root key generated by the computing network module, f is an arbitrary function, and Ts1' is the time when the computing network module sends SID11;

[0144] S4. The network computing module generates a correspondence between the terminal identifier id1, SID11, and the corresponding SID11 delivery time Ts1′ and sends them to the SAN Ingress gateway node and the SAN Ingress gateway node.

[0145] S5. The terminal device 100 uses SID11 to apply for the target service IP from the server, and carries the terminal identification id1;

[0146] S6. The time when the SAN Ingress gateway node receives the message is counted as Ts”, and the time interval △t is calculated as Ts”-Ts1’. If 0<△t<△T, and △T is the key update period, the first packet is considered to be legal, and the sequence goes to step S9. If △t>△T, it is considered that the replayed message is discarded. Among them, Ts1’ is obtained based on the terminal identifier id1 and the identifier mapping table.

[0147] S7, SAN Ingress gateway node calculates the number of key iterations r; r = (Ts1'-T) / △T, △T is the key update period; according to the identifier mapping table in Table 2, calculate the plaintext identifier SID", where SID" = F r -1 (SID', msk||f(Ts'), that is, use msk||f(Ts') as the key to decrypt SID', and the decryption parameter is the number of iterations r; T is the initial time, which is initially set by the computing network module. After that, the key is updated every △T starting from T.

[0148] S8. The SAN Ingress gateway node searches the ID-SID mapping table for the SID that is the same as SID ", and executes the corresponding policy based on the SID.

[0149] S9, the SAN egress gateway node calculates the number of key iterations r; r = (Ts'-T) / △T, △T is the key update period; the SAN egress gateway node searches for the corresponding relationship between ID and Ts' according to the mapping table shown in Table 2, and calculates the plaintext identifier SID", SID" = F r -1 (SID',msk||f(Ts'), means using msk||f(Ts') as the key to decrypt SID', and the decryption parameter is the number of iterations r;

[0150] S10. The SAN egress gateway node searches Table 2 for SID1 that is the same as SID1 and executes the corresponding policy based on SID1.

[0151] S11. The server device 300 returns the required target service IP.

[0152] An embodiment of the present application further provides an electronic device, including:

[0153] One or more processors 601;

[0154] The memory 602 stores one or more programs. When the one or more programs are executed by the one or more processors 601, the one or more processors 601 implement the following:

[0155] Such as the information encryption transmission method applied to the terminal device 100 in the service network; or

[0156] Such as the information encryption transmission method applied to the gateway device 200 in the service network; or

[0157] Such as the information encryption transmission method of the control terminal device 400 applied to the service network; or

[0158] For example, the information encryption transmission method of the server device 300 is applied in the service network.

[0159] The memory 602 is a non-transient network system that can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 602 may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 602 may optionally include a memory 602 remotely located relative to the processor 601, and these remote memories 602 may be connected to the processor 601 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0160] The memory 602 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 602 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 602 and is called by the processor 601 to execute the methods of the embodiments of this application.

[0161] The processor 601 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0162] In some embodiments, as shown in FIG6 , the electronic device further includes:

[0163] Input / output interface, used to realize information input and output;

[0164] Communication interface, used to realize communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0165] A bus that transmits information between various components of the device (e.g., processor 601, memory 602, input / output interfaces, and communication interfaces);

[0166] The processor 601 , the memory 602 , the input / output interface and the communication interface can be connected to each other in communication within the device via a bus.

[0167] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions for executing:

[0168] Such as the information encryption transmission method applied to the terminal device 100 in the service network; or

[0169] Such as the information encryption transmission method applied to the gateway device 200 in the service network; or

[0170] Such as the information encryption transmission method of the control terminal device 400 applied to the service network; or

[0171] For example, the information encryption transmission method of the server device 300 is applied in the service network.

[0172] An embodiment of the present application further provides a computer program product, including a computer program or computer instructions, wherein the computer program or computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the computer device performs the following operations:

[0173] Such as the information encryption transmission method applied to the terminal device 100 in the service network; or

[0174] Such as the information encryption transmission method applied to the gateway device 200 in the service network; or

[0175] Such as the information encryption transmission method of the control terminal device 400 applied to the service network; or

[0176] For example, the information encryption transmission method of the server device 300 is applied in the service network.

[0177] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0178] According to the above embodiment of the present application, at least the following beneficial effects are achieved: by sending a ciphertext identification request message to the control end device, the target ciphertext identification can be obtained, so that the target service request message is in an encrypted state during network transmission, thereby improving network transmission security. At the same time, in the gateway device, the target ciphertext identification and the corresponding plaintext identification are associated through the identification mapping table, so that the gateway device can forward based on the plaintext identification, thereby achieving decoupling of transmission security and routing strategy when the target service request message is in an encrypted state. Therefore, compared with related technologies, the embodiment of the present application can improve transmission security while reducing the impact on routing strategy.

[0179] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0180] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division between physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVDs) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0181] As used in this specification, the terms "component," "module," "system," and the like are used to refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, or a computer. By way of illustration, both an application running on a computing device and a computing device may be a component. One or more components may reside in a process or execution thread, and a component may be located on a single computer or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may communicate, for example, through a local or remote process based on signals having one or more data packets [e.g., data from two components interacting with another component on a local system, a distributed system, or a network, such as the Internet interacting with other systems via signals].

[0182] The above description of some embodiments of the present application with reference to the accompanying drawings does not limit the scope of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present application shall be within the scope of the present application.

Claims

1. An information encryption transmission method, applied to a terminal device in a service network, wherein the service network further includes a control terminal device, a gateway device and a service terminal device, and the method comprises: The terminal device sends a ciphertext identification request message to the control terminal device; The terminal device receives the target ciphertext identifier returned by the control terminal device according to the ciphertext identifier request message; The terminal device sends a target service request message to the gateway device, and the target service request message carries the target ciphertext identifier, so that the gateway device determines the target plaintext identifier corresponding to the target ciphertext identifier according to the locally stored identifier mapping table, and forwards the target service request message to the server device according to the forwarding strategy corresponding to the target plaintext identifier.

2. An information encryption transmission method, applied to a gateway device in a service network, wherein the service network also includes a terminal device, a control device and a service device, and the method comprises: The gateway device receives the identification mapping table sent by the control terminal device; The gateway device receives a target service request message sent by the terminal device, wherein the target service request message carries a target ciphertext identifier; The gateway device determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table; The gateway device determines a corresponding forwarding strategy according to the target plaintext identifier; The gateway device forwards the target service request message to the server device according to the forwarding strategy, so that the server device determines the target plaintext identifier corresponding to the target ciphertext identifier carried by the target service request message according to the locally stored identifier mapping table, and returns the target service to the terminal device according to the target plaintext identifier.

3. The method according to claim 2, wherein: The identifier mapping table includes at least one plaintext identifier and at least one ciphertext identifier corresponding to each plaintext identifier; The gateway device determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including: The gateway device searches the identifier mapping table for a plaintext identifier corresponding to the target ciphertext identifier, and uses the found plaintext identifier as the target plaintext identifier.

4. The method according to claim 2, wherein: The identifier mapping table includes at least one plaintext identifier, at least one ciphertext identifier corresponding to each of the plaintext identifiers, and an index between the plaintext identifiers and the ciphertext identifiers having a corresponding relationship; The gateway device determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including: The gateway device determines the index corresponding to the target ciphertext identifier, searches the identifier mapping table for a plaintext identifier corresponding to the target ciphertext identifier according to the index, and uses the found plaintext identifier as the target plaintext identifier.

5. The method according to claim 2, wherein: The identifier mapping table includes at least one terminal identifier, at least one plaintext identifier corresponding to each terminal identifier, and a first time point corresponding to the terminal identifier, wherein the first time point indicates a time point when the control terminal device sends a ciphertext identifier to the terminal device; The target service request message carries the terminal identifier corresponding to the terminal device; The gateway device determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, including: The gateway device uses the time point when the target service request message is received as the second time point; The gateway device determines the first time point from the identifier mapping table according to the terminal identifier carried in the target service request message, and determines the time interval between the second time point and the first time point; When the time interval is within a preset time interval threshold range, the gateway device calculates a decryption key according to the first time point and the target ciphertext identifier; The gateway device searches the identifier mapping table for the corresponding target plaintext identifier according to the decryption key.

6. The method according to claim 5, wherein: When the time interval is greater than the time interval threshold, the gateway device discards the target service request message.

7. An information encryption transmission method, applied to a control terminal device in a service network, wherein the service network also includes a terminal device, a gateway device and a service terminal device, and the method comprises: The control terminal device receives the ciphertext identification request message sent by the terminal device; The control terminal device returns the corresponding target ciphertext identifier to the terminal device according to the ciphertext identifier request message; The control end device sends an identifier mapping table to the gateway device, so that after the gateway device receives the target service request message carrying the target ciphertext identifier sent by the terminal device, it determines the target plaintext identifier corresponding to the target ciphertext identifier according to the identifier mapping table, and forwards the target service request message to the server device according to the forwarding strategy corresponding to the target plaintext identifier; The control-end device sends an identification mapping table to the server-end device, so that after the server-end device receives the target service request message carrying the target ciphertext identifier forwarded by the gateway device, it determines the target plaintext identifier corresponding to the target ciphertext identifier carried by the target service request message according to the identification mapping table, and returns the target service to the terminal device according to the target plaintext identifier.

8. The method according to claim 7, wherein: The identification mapping table is generated by the control terminal device, or the identification mapping table is generated by a computing network element device and sent to the control terminal device; The generation process of the identification mapping table includes at least one of the following: According to a preset update time interval, the ciphertext identifier corresponding to each of the plaintext identifiers is set in the identifier mapping table, and each of the ciphertext identifiers corresponds to a specific time point; or, According to a preset security level, the ciphertext identifiers corresponding to the plaintext identifiers are set in the identifier mapping table, and the number of ciphertext identifiers of the plaintext identifiers with a high security level is greater than the number of ciphertext identifiers of the plaintext identifiers with a low security level; or, According to a preset index rule, the ciphertext identifier corresponding to each of the plaintext identifiers is set in the identifier mapping table, and an index between the plaintext identifiers and the ciphertext identifiers having a corresponding relationship is set; or, According to the terminal identifier corresponding to the terminal device, at least one plaintext identifier corresponding to the terminal identifier is set in the identifier mapping table, and a first time point corresponding to the terminal identifier is set. The first time point indicates the time point when the control end device sends the ciphertext identifier to the terminal device. The ciphertext identifier is calculated based on the plaintext identifier corresponding to the terminal device and the first time point.

9. The method according to claim 8, wherein: The service identification request message carries the terminal identification of the terminal device; The control end device returns the corresponding target ciphertext identifier to the terminal device according to the ciphertext identifier request message, including: The control terminal device searches the identifier mapping table for the ciphertext identifier corresponding to the terminal identifier, and uses the found ciphertext identifier as the target ciphertext identifier; or, The control terminal device calculates the target plaintext identifier and the target ciphertext identifier corresponding to a first time point through a preset first function, where the first time point represents the time point when the control terminal device sends the ciphertext identifier to the terminal device.

10. An electronic device comprising: one or more processors; A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement: The information encryption transmission method as claimed in claim 1; or The information encryption transmission method according to any one of claims 2 to 6; or An information encryption transmission method as described in any one of claims 7 to 9.

11. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the program implements: The information encryption transmission method as claimed in claim 1; or The information encryption transmission method according to any one of claims 2 to 6; or An information encryption transmission method as described in any one of claims 7 to 9.

Images