Data generation method, data processing method, data sending method, communication system, electronic terminal and storage medium

Abstract

Disclosed in the present invention are a data generation method, a data processing method, a data sending method, a communication system, an electronic terminal and a storage medium in the technical field of information. The data generation method comprises: using a private key of a data sending end of target data to perform digital signature on a payload field storing a data body, binding a formed payload digital signature and a data sending end identity identifier, and storing same in the target data; and sealing the payload field to generate a payload ciphertext and storing same in the target data, wherein the payload ciphertext can only be unsealed by a specified data receiving end, the data sending end identity identifier is bound with a digital certificate of the data sending end, and the digital certificate of the data sending end can be verified by means of a corresponding certificate chain. The present invention helps information systems to get rid of dependence on a "man-in-the-middle server", thus enhancing information security, reducing information junk in the public eye, establishing a technical foundation for intellectual property protection, and addressing challenges of artificial intelligence to human beings.

Description

Data generation method, processing method, sending method, communication system, electronic terminal and storage medium Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a data generating method, processing method, sending method, communication system, electronic terminal and storage medium. Background Art

[0002] Based on the current TCP / IP communication protocol, in order to clearly identify the data sender and data receiver of the target data, a "middleman server" (hereinafter referred to as "middleman") has to be used. That is, during the user login process, the "middleman" confirms the user's identity through the user's registered account and password. During the information interaction process, the data sender forwards the target data to the data receiver through the "middleman".

[0003] However, the introduction of a "middleman" framework will raise many new technical issues:

[0004] First, the current "middleman" framework system cannot determine the true source of the data received by the current "middleman": Take the increasingly popular artificial intelligence as an example: natural persons, as the owners of artificial intelligence, need to be responsible for the behavior of artificial intelligence devices. However, the current "middleman" framework system increases the difficulty for data receivers to distinguish whether the received information is generated by natural persons or artificial intelligence devices. To a certain extent, it will block human supervision and responsibility for the behavior of artificial intelligence devices, which poses a huge risk. For example: intellectual property is one of the most important assets of mankind. If the original source of intellectual property cannot be effectively authenticated, the interests of the true creators of intellectual property cannot be effectively protected.

[0005] Secondly, the current "middleman" framework presents significant security risks: Due to the interdependence between "middlemen" in the customer service chain, security and reliability issues with any one "middleman" will lead to problems for all associated service providers, multiplying security risks.

[0006] Thirdly, the current "middleman" framework cannot effectively protect customer privacy: when three or more service providers are required to participate at the same time, and each party uses its own server, one service provider will act as the user of another service provider, ultimately forming a customer service chain. Because each service provider has different information requirements for customers, excessive information collection is inevitable;

[0007] Finally, the current "middleman" framework system does not meet the requirements of the Digital Signature Act: the Digital Signature Act requires that the signer is the only holder of the signature secret text. Even if the "middleman" establishes a virtual machine on the cloud corresponding to each user with all files encrypted, if the signing program needs to be run on the virtual machine, it will not meet the requirements of the Digital Signature Act because the memory used by the virtual machine is difficult to meet the physical isolation requirements.

[0008] In addition to the technical issues mentioned above, the current internet presents numerous other challenges in information exchange. For example, messages received by data receivers may undergo multiple copies, summaries, and processing during transmission, rendering them unreliable. This is particularly true when large amounts of data are collected from diverse sources. Without an effective mechanism for verifying the source of messages, users will be unable to distinguish between reliable and fraudulent messages. To address this technical issue, in current communication systems, when a user wants to send target data to another, they must first physically bind it. For example, binding a line to a time slot, binding a frame relay to a frame address, binding an IP address to an IP address, or binding a "middleman" to a server account. While these binding operations help identify the sender and receiver of target data, they reduce the real-time nature and flexibility of communication. However, once disconnected from a trusted publishing server or unbound from the server, the target data becomes a "three-no product": no source, no warranty, and no date. It is foreseeable that the application of these "three-no products" in the fields of artificial intelligence and children's education will create unpredictable risks.

[0009] Humanity is currently experiencing an information explosion, evolving from an era of information scarcity to one of information prosperity and extreme pollution. Reducing information pollution is crucial to the further development of the information society, and technologically tracing the sources of information waste and pollution is fundamental to its healthy development.

[0010] Summary of the Invention

[0011] The purpose of the embodiments of the present invention is to overcome the deficiencies in the prior art and provide a data generation method, processing method, sending method, communication system, electronic terminal and storage medium to achieve traceability of the true source of target data and improve the security and reliability of target data during information interaction.

[0012] To achieve the above objectives, the embodiments of the present invention are implemented by adopting the following technical solutions:

[0013] In a first aspect, an embodiment of the present invention provides a data generation method, comprising:

[0014] Obtaining a data body of target data, and storing the data body in a pre-created payload field in the target data;

[0015] Digitally signing the payload field using a private key of a data sending end of the target data to form a payload digital signature;

[0016] Binding the payload digital signature and the data sender identity identifier to the target data;

[0017] Encrypting the payload field to generate a payload ciphertext and storing the ciphertext in the target data, wherein the payload ciphertext can only be decrypted by a designated data receiving end;

[0018] Among them, the data sending end identity identifier is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; the payload digital signature is used to perform trusted authentication of the payload field and identity authentication of the data sending end.

[0019] In a second aspect, an embodiment of the present invention provides a data processing method, including:

[0020] Receive target data;

[0021] Decrypting the payload ciphertext in the target data to obtain a decrypted payload field;

[0022] Acquire the data body of the target data from the decrypted payload field;

[0023] Reading the data sending end identity identifier and the payload digital signature bound to the data sending end identity identifier in the target data;

[0024] Determining a data sending end of the target data using the data sending end identity identifier;

[0025] Obtaining the digital certificate of the data sending end, performing trust authentication on the payload digital signature using the public key in the digital certificate of the data sending end, and obtaining an authentication result of the trust authentication of the payload field and an authentication result of the identity authentication of the data sending end;

[0026] The digital certificate of the data sending end is verified by the corresponding certificate chain.

[0027] In a third aspect, an embodiment of the present invention provides a data sending method, including:

[0028] Get pre-generated target data;

[0029] Sending the target data to a data receiving end;

[0030] Wherein, the target data is generated using the data generation method described in the first aspect.

[0031] In a fourth aspect, an embodiment of the present invention provides a data generating device, including:

[0032] A first storage module is used to obtain the data body of the target data and store the data body in a pre-created payload field in the target data;

[0033] Digital signature module: used to digitally sign the payload field using the private key of the data sending end of the target data to form a payload digital signature;

[0034] A second storage module is used to bind the payload digital signature and the data sender identity identifier and store them in the target data;

[0035] A first encryption module is configured to encrypt the payload field to generate a payload ciphertext and store the ciphertext in the target data. The payload ciphertext can only be decrypted by a designated data receiving end.

[0036] Among them, the data sending end identity identifier is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; the payload digital signature is used to perform trusted authentication of the payload field and identity authentication of the data sending end.

[0037] In a fifth aspect, an embodiment of the present invention provides a data receiving terminal, including:

[0038] Receiving module: used to receive target data;

[0039] A first decryption module is used to decrypt the payload ciphertext in the target data to obtain the decrypted payload field;

[0040] Data ontology acquisition module: used for acquiring the data ontology of the target data from the decrypted payload field;

[0041] A first reading module is used to read the data sending end identity identifier and the payload digital signature bound to the data sending end identity identifier in the target data;

[0042] A first determining module: configured to determine a data sending end of the target data using the data sending end identity identifier;

[0043] A first trusted authentication module is configured to obtain the digital certificate of the data sending end, perform trusted authentication on the payload digital signature using the public key in the digital certificate of the data sending end, and obtain the authentication result of the trusted authentication of the payload field and the authentication result of the identity authentication of the data sending end;

[0044] The digital certificate of the data sending end is verified by the corresponding certificate chain.

[0045] In a sixth aspect, an embodiment of the present invention provides a data sending end, including:

[0046] The aforementioned data generating device is used to generate target data;

[0047] Target data acquisition module: used to acquire the target data;

[0048] Target data sending module: used for sending the acquired target data to a data receiving end.

[0049] In the seventh aspect, an embodiment of the present invention provides an electronic terminal, comprising a processor and a memory connected to the processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the method described in the first aspect, the second aspect or the third aspect are performed.

[0050] In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect, the second aspect, or the third aspect.

[0051] In a ninth aspect, an embodiment of the present invention provides a communication system, comprising the data receiving end described in the fifth aspect and the data sending end described in the sixth aspect.

[0052] Compared with the prior art, the data generation method, sending method, processing method, communication system, electronic terminal and storage medium provided by the embodiments of the present invention store a payload field of the data body which is encrypted to form a payload ciphertext and is stored in the target data, and the payload ciphertext can only be decrypted by the designated data receiving end, thereby ensuring that the data body of the target data can only be obtained by the authorized data receiving end, thereby improving the security of the target data during transmission and helping to protect customer privacy; at the same time, the target data carries a payload digital signature, and the payload digital signature is bound to the data sending end identity identifier, and the identity of the data sending end can be confirmed through the data sending end identity identifier, and the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain, and the payload digital signature can be authenticated through the public key in the digital certificate of the data sending end, thereby obtaining a trusted authentication result of the payload field and an identity authentication result of the data sending end, thereby achieving traceability of the true source of the target data and improving the reliability of the target data in the information interaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] FIG1 is a schematic flow chart of a data generation method according to an embodiment of the present invention;

[0055] FIG2 is a schematic diagram of a data structure of target data provided according to an embodiment of the present invention;

[0056] 3 is a schematic diagram of a data structure describing a record field according to an embodiment of the present invention;

[0057] FIG4 is a schematic diagram of a data structure of a network data field according to an embodiment of the present invention;

[0058] 5 is a schematic diagram of a data structure of a network processing instruction provided according to an embodiment of the present invention;

[0059] FIG6 is a schematic diagram of the data structure of an encryption key field according to an embodiment of the present invention;

[0060] 7 is a schematic diagram of the data structure of a payload field according to an embodiment of the present invention;

[0061] FIG8 is a schematic diagram of a data structure of a file segment provided according to an embodiment of the present invention;

[0062] FIG9 is a schematic flow chart of a data processing method according to an embodiment of the present invention;

[0063] FIG10 is a schematic interface diagram of target data output display according to an embodiment of the present invention;

[0064] FIG11 is a schematic flow chart of a data sending method according to an embodiment of the present invention;

[0065] FIG12 is a schematic block diagram of a data generating device according to an embodiment of the present invention;

[0066] FIG13 is a schematic block diagram of a data receiving end provided according to an embodiment of the present invention;

[0067] FIG14 is a schematic block diagram of a data transmitting end provided according to an embodiment of the present invention;

[0068] FIG15 is a schematic block diagram of a communication system provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0070] In the embodiments of the present invention, the term "and / or" merely describes the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. Furthermore, in the embodiments of the present invention, the character " / " generally indicates that the associated objects are in an "or" relationship. Furthermore, the terms "first / second" and so on are merely used for descriptive purposes to distinguish between nouns and should not be construed as indicating or implying the importance or quantity of a technical feature.

[0071] It should be noted that the term "target data" in the embodiment of the present invention can be unserialized data or a data packet formed by serializing data. For the convenience of description, in the embodiment of the present invention, the target data is abbreviated as MC (MeCell in English, and can be abbreviated as "MeCell" in Chinese). A target data can contain multiple layers of sub-data. For the convenience of distinction and understanding, each layer is separated by ".", for example: MC is the top layer, and MC.NETDATA is the sub-data NETDATA layer of MC. The term "agent" in the embodiment of the present invention can be an independent application, including artificial intelligence application systems, such as: live video, chatGPT, P2P WEB, trust transactions, banks and other agent applications.

[0072] It should be understood that the target data in the embodiment of the present invention can carry the information that the user needs to exchange, and realize the information exchange between multiple user devices. Each user device has a unique identity, referred to as UID. A user device can be both a data sender and a data receiver during the communication process. When the user device acts as a data sender and is used to send target data, the UID of the user device can be called FROMUID (i.e., the data sender identity). When the user device acts as a data receiver and is used to receive target data, the UID of the user device can be called TOUID (i.e., the data receiver identity). Data exchange between the data sender and the data receiver does not require any other physical binding, which can improve the real-time and flexibility of communication.

[0073] UIDs can be composed of letters, symbols, and / or numbers, and can be coded according to country and region. Currently, users already have unique identities in certain existing communication methods, such as email addresses, phone numbers, social media accounts, trademark names, etc. For ease of description, they are collectively referred to as private identities. Therefore, for ease of use, a unique private identity and UID exchange relationship table can be established in advance, as shown in Table 1:

[0074] Table 1:

[0075] This table is an "N to 1" and "1 to N" table. The so-called "N to 1" means that the user device can authorize the binding of one or more privacy identity identifiers held by it with its own unique UID. After binding, the user device can use the above-mentioned relationship table to find the corresponding UID through any privacy identity identifier. On the contrary, the so-called "1 to N" means that the user device can use the above-mentioned relationship table to find one or more privacy identity identifiers that are pre-authorized to be bound through the unique UID held. The binding process of the relationship table can be regarded as a digital certificate identification process, and finally it can exist in the form of a digital certificate. The digital certificate is an internal certificate of the system and is not disclosed to the public in order to achieve the purpose of protecting user privacy. That is to say, the UID described in the embodiment of the present invention (including the data receiving end identity identifier, the data sending end identity identifier, the modification execution end identity identifier and the decryption authority owner identity identifier) ​​should be bound to the corresponding digital certificate when used, and the digital certificate can pass the verification of the corresponding certificate chain to ensure the authenticity of the UID.

[0076] Example 1:

[0077] FIG1 shows a schematic flow chart of a data generation method according to an embodiment of the present invention, which can be executed by a data transmitting end or by other user equipment other than the data transmitting end. As shown in FIG1 , the data generation method includes:

[0078] Step 101: Obtain the data body MC.BODY of the target data MC, and store the data body in the pre-created payload field MC.PAYLOAD in the target data;

[0079] Here, the data body MC.BODY can be any possible data information such as audio data, video data, text, characters, etc. MC.BODY can be read from the data generation request sent by the user.

[0080] Step 102: digitally sign the payload field using the private key of the data sending end of the target data to form a payload digital signature;

[0081] The payload field can be authenticated through the payload digital signature.

[0082] Step 103: Bind the payload digital signature and the data sender identity identifier and store them in the target data;

[0083] The data sending end identity identifier FROMUID is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; the data receiving end can use the public key of the identified data sending end to perform trusted authentication on the payload digital signature and authenticate the identity of the data sending end. If the trusted authentication is passed, it indicates that the target data is truly derived from the identified data sending end, and the data entity stored in the payload field has not been tampered with during the transmission process; otherwise, it indicates that the source of the target data is unreliable, the data entity may be tampered with, and is not trustworthy.

[0084] Step 104: Encrypt the payload field to generate a payload ciphertext and store it in the target data. The payload ciphertext can only be decrypted by a designated data receiving end.

[0085] It should be noted that, under the premise of no conflict, the data generation method of the embodiment of the present invention can be implemented in a sequence of steps different from that shown in FIG. 1 , for example, step 102 and step 103 can also be performed after step 104 .

[0086] In summary, the target data generated by the data generation method provided by the embodiment of the present invention has its data body stored in the payload field. The payload field is encrypted to form a payload ciphertext and stored in the target data. The payload ciphertext can only be decrypted by the designated data receiving end, thereby ensuring that the data body of the target data can only be obtained by the authorized data receiving end. Accordingly, the unauthorized data receiving end cannot decrypt the payload ciphertext and thus cannot obtain the data body therein, thereby improving the security of the target data during transmission and helping to protect customer privacy. At the same time, the target data carries a payload digital signature, which is bound to the data sender identity identifier. The identity of the data sender can be confirmed through the data sender identity identifier, and the data sender identity identifier is bound to the digital certificate of the data sender, and the digital certificate of the data sender can pass the verification of the corresponding certificate chain. The payload digital signature can be authenticated through the public key in the digital certificate of the data sender, thereby obtaining a trusted authentication result of the payload field and an identity authentication result of the data sender, thereby achieving traceability of the true source of the target data and improving the reliability of the target data in the information interaction process. Using the target data structure generated by the embodiments of the present invention for information exchange can eliminate reliance on "middleman" frameworks, improve the security and reliability of information communication and storage, reduce information spam, and increase the signal-to-noise ratio of information exchange. Embodiments of the present invention can be applied in the field of intellectual property, helping to establish an effective intellectual property protection system and safeguard the interests of authentic creators. They can also be applied in the field of artificial intelligence to distinguish whether received target data originates from a natural person or an artificial intelligence device, addressing the challenges posed by artificial intelligence to humanity.

[0087] In step 104, the method for encrypting the payload field may include encrypting the payload field using a master key or the public key of the data receiving end. When the payload field is encrypted using the master key, the master key is encrypted to generate a master key ciphertext and then stored in the target data.

[0088] There can be only one master key. If there are multiple data receiving terminals, a corresponding master key ciphertext can be generated for each data receiving terminal. Each data receiving terminal can only decrypt its own corresponding master key ciphertext. It should be noted that the master key can be empty, indicating that the master key is not used to encrypt the payload field, and the data receiving terminal can directly read the contents of the payload field.

[0089] See Figure 2, which is a data structure diagram of the target data provided by an embodiment of the present invention. The master key can be stored in the encryption key field, and the payload digital signature MC.SIGN.FROMUID.SIGN and the data sender identity MC.SIGN.FROMUID.FROMUI can be stored in the digital signature field MC.SIGN pre-created in the target data.

[0090] In actual applications, the target data MC may be forwarded by multiple data senders and thus signed by multiple data senders. For this purpose, the digital signature field can store a list containing multiple data sender identities and corresponding multiple payload digital signatures. The corresponding format can be recorded as: MC.SIGN.FROMUID_i, MC.SIGN.FROMUID_i.SIGN.

[0091] To prevent the data receiver from repeatedly authenticating the data sender after receiving the target data, in one embodiment of the present invention, an authentication status field STATUS can be created in the target data to store the authentication result of the trusted authentication of the payload digital signature. Specifically, this authentication status field can be stored in the payload field; of course, this authentication status field can also be stored in the digital signature field MC.SIGN.

[0092] As an embodiment of the present invention, encrypting the master key to form a master key ciphertext may include:

[0093] Obtain the digital certificate of the data receiving end;

[0094] The master key is encrypted using the public key in the digital certificate of the data receiving end to form a master key ciphertext.

[0095] There may be multiple data receiving terminals. Although there is only one master key, a corresponding master key ciphertext will be generated for each data receiving terminal using the public key in the data receiving terminal's digital certificate. In order to enable the data receiving terminal to more conveniently obtain the master key ciphertext that matches itself, in one embodiment of the present invention, the data generation method further includes: binding the data receiving terminal identity identifier with the corresponding master key ciphertext and storing it in the target data. In this case, the data receiving terminal identity identifier is bound to the data receiving terminal's digital certificate, and the data receiving terminal's digital certificate can pass the verification of the corresponding certificate chain. The data receiving terminal can obtain the corresponding master key ciphertext by querying the pre-configured data receiving terminal identity identifier, and decrypt the master key ciphertext using its private key to obtain the master key.

[0096] If the data sender doesn't have the data receiver's digital certificate locally, the master key can be encrypted using a public certificate. This public certificate can be stored locally on the data sender or from a remote public certificate server. Before use, the public certificate must be verified against a root certificate or certificate chain. Only public certificates that pass verification can be used to encrypt the master key.

[0097] Referring to Figure 6, when there are multiple data receiving terminals, a relationship mapping table containing a digital receiving terminal identity and the corresponding master key ciphertext can be created for each data receiving terminal, forming multiple asymmetric encryption tables. After receiving the target data, the data receiving terminal can only decrypt its own asymmetric encryption table using its own private key to obtain the master key. It should be noted that the data receiving terminal identity TOUID described here can also be a group ID. In this case, the corresponding master key can be encrypted using the group key. In this case, a description record MC.SEALEDKEY.DESC can be added to the encryption key field MC.SEALEDKEY, and the group ID can be stored in MC.SEALEDKEY.DESC. The data receiving terminal will use this group ID to obtain the group key from the local group ID and group key relationship mapping table and use the group key to decrypt the master key ciphertext. The master key can also be encrypted using a shared key or a session key. The encryption form of the master key can be selected according to the needs of the application scenario.

[0098] Continuing to refer to FIG2 , in one embodiment of the present invention, the target data further includes a network data field MC.NETDATA. To this end, the data generation method further includes: creating a network data field in the target data. Referring to FIG4 , the network data field can be used to store the data sender identity FROMUID and the data sender agent FROMAGENT, and can also be used to store the data receiver identity TOUID and the data receiver agent TOAGENT. It can also be used to store the data identifier CELLID that identifies the target data, and can also be used to store multiple information such as priority PRORITY. However, it should be noted that the network data field described in the embodiment of the present invention can be one or multiple, and the various types of information stored in the network data field can be stored simultaneously in one network data field or separately in multiple network data fields. It should also be noted that the various types of information stored in the network data field can be stored directly in the network data field MC.NETDATA, or a new, lower-level field can be created within MC.NETDATA. As shown in Figure 5 , in the case of multiple data receivers, a data receiver instruction field MC.NETDATA.TOINSRT can be created within MC.NETDATA, and multiple data receiver identities TOUID can be stored in MC.NETDATA.TOINSRT. The data sender can then send the target data MC one by one based on the data receiver identities TOUID stored in MC.NETDATA.TOINSRT. In this case, neither the data sender nor the data receiver requires a middleman server to establish a link, thus eliminating reliance on the existing "middleman" framework. Even if a data receiver encounters security or reliability issues, it will not affect the normal reception of the target data by other data receivers, significantly reducing security risks during data transmission. In this case, the digital signature only needs to be held by the user device itself; no other user devices need to hold or run the digital signature program, thus meeting the requirements of the digital signature law.

[0099] MC.NETDATA.TOINSRT may also contain other instructions, such as the method for sending the target data to each data receiving end, which may be email, text message, or social media. It should be understood that the present invention is not limited to this, and the sending method may also be any other available network communication method. The data receiving end identity may also be stored in other fields, such as the extended options field MC.NETDATA.OPT within the network data field.

[0100] Here, the data sending end agent FROMAGENT is used to record the agent that compiles and generates the target data. The data receiving end identity is used to identify the identity of the data receiving end that receives the target data. The data receiving end agent TOAGENT is used to record the agent that receives and processes the target data. The target data generated by the embodiment of the present invention can be received by a single data receiving end, multiple data receiving ends and the public. To this end, in one embodiment of the present invention, the data sending end identity and / or the data receiving end identity can be an identity or a list containing multiple identities. When there are multiple data sending end identities, the target data may be compiled and generated by multiple data sending ends, or the target data may be forwarded via multiple data sending ends. When there are multiple data receiving end identities, the target data will be sent to each data receiving end one by one.

[0101] The data identifier CELLID can be a unique random character or random string. After receiving the target data, the data receiving end can use the CELLID to determine whether the target data is repeated with other received target data, thereby avoiding repeated reception of the same target data.

[0102] The priority level PRORITY can be used to determine whether the data receiving end should feedback a receipt to the data sending end and the information required for the receipt. For example, the priority level can be divided into three levels: low, medium, and high. When low priority information is stored in MC.NETDATA.PRORITY, the data receiving end may not feedback a receipt to the data sending end after receiving the target data. When medium priority information is stored in MC.NETDATA.PRORITY, the data receiving end may feedback the data identifier MC.NETDATA.CELLID to the data sending end after receiving the target data. When high priority information is stored in MC.NETDATA.PRORITY, the data receiving end may feedback the data identifier MC.NETDATA.CELLID and a hash value carrying the digital signature of the data receiving end to the data sending end after receiving the target data. The hash value can be obtained by performing a hash calculation on the target data MC, or by performing a hash calculation on MC.NETDATA or MC.PAYLOAD, or by performing a hash calculation on MC.NETDATA and MC.PAYLOAD. MC.NETDATA.PRORITY can be represented by a numerical value, with lower numerical values ​​generally indicating higher priority. Of course, MC.NETDATA.PRORITY can also be represented by characters or strings. Regardless of the representation method, the data sender should agree on a priority rule with the data receiver in advance so that the data receiver can provide a receipt and the required information after receiving the target data according to the data sender's expectations.

[0103] As an embodiment of the present invention, MC.NETDATA may also include other information, such as: adding a network instruction MC.NETDATA.NETINSRT in MC.NETDATA to store the processing instructions that the network needs to execute on the target data; and adding a description record MC.NETDATA.DESC in MC.NETDATA, which may be used for the data structure of MC.NETDATA.

[0104] Referring to FIG. 3 , in one embodiment of the present invention, the data generation method further includes: adding data transmission information to the target data. This data transmission information may be stored in the target data's description record field MC.DESC. Specifically, the data transmission information may include one or both of a data transmission type MC.DESC.TRANSPORTTYPE and a data communication protocol MC.DESC.PROTOCOL required to be supported by the data receiving end. During the target data transmission process, the data receiving end can be identified by the data receiving end identifier TOUID, without relying on any physical medium. To this end, the data transmission type of the target data must be specified before transmission. Optionally, the data transmission type may include any of Bluetooth, mobile data communication, WiFi, wireless frequency digital communication, block code scanning communication, acoustic digital communication, infrared digital communication, laser digital communication, high-energy ray digital communication, and optical image data exchange, but the present invention is not limited thereto. The target data transmission medium may include BNET instant messaging, email, text message, etc. After receiving the target data, the data receiving end first verifies the data communication protocol carried in the target data. If the data receiving end does not support the data communication protocol, subsequent processing operations are terminated. The default value of the data communication protocol may be "BROADI".

[0105] To better protect the security of target data during network transmission, in one embodiment of the present invention, the encryption key field storing the master key ciphertext can be encrypted using a network key. Descriptive information used to obtain the network key is stored in a pre-created description record field MC.DESC within the target data (see Figure 2). Furthermore, the network data field MC.NETDATA can also be encrypted using the network key NETKEY.

[0106] There are multiple possible key types for the network key NETKEY. Optionally, the key type of NETKEY can be any one of a session key, a shared key, and a public key. Therefore, in one embodiment of the present invention, the data processing method further includes: adding the key type MC.DESC.KEYTYPE of the network key to the description record field of the target data.

[0107] When the key type is a session key, the description information should also include a session identifier, Session ID. As shown in Figure 3, the session identifier can be stored in the key data field MC.DESC.KEYDATA of the description record field. The data receiving end can locally search for the session key body, Session KEY, that matches the Session ID based on the Session ID. The Session KEY then serves as the obtained NETKEY for decrypting the relevant fields. The mapping relationship between the Session ID and Session KEY can be presented in a table. When the data receiving end logs into the Session communication system, a record containing the Session ID and Session KEY is automatically generated and stored in the Session ID / Session KEY table locally on the data receiving end.

[0108] When the key type is a shared key, the description information should also include the key name KEYNAME. Continuing with Figure 3, the key name can be directly stored in MC.DESC.KEYNAME. On the data receiving end, the key name KEYNAME and the shared key's key body, Shared Key, can be pre-stored in the KEYNAME / Shared Key table. The data receiving end can retrieve the Shared Key based on MC.DESC.KEYNAME. In this case, the Shared Key serves as the obtained NETKEY and is used to decrypt the relevant fields.

[0109] When the key type is a public key, the data receiver must possess the corresponding private key. Therefore, the description information may include the data receiver's identity. Also referring to Figure 3 , the data receiver's identity (TOUID) may be stored in MC.DESC.KEYDATA. The user can use the TOUID to identify the local private key that matches the public key. In this case, the local private key serves as the obtained NETKEY, used to decrypt the relevant fields.

[0110] It should be understood that the key type can also be stored in fields other than the MC.DESC field in the target data. For example, the user can pre-create an extension field in the target data to store the key type. It should be noted that the key type may also be empty. If the obtained NETKEY or key type is empty, it indicates that the target data is not encrypted using the network key. After receiving the target data, the data receiving end can directly read MC.NETDATA, MC.SIGN, and MC.SEALEDKEY.

[0111] Referring to Figures 7 and 8 , in one embodiment of the present invention, the data generation method further includes: adding a file segment FILEBLOCK to the payload field, adding one or more target files MCFILE to the file segment, and storing the data body BODY in the target files. The number of target files can be the same as the number of data bodies; in this case, each target file can store a corresponding data body.

[0112] In order to track the modification traces of the target data during transmission, in one embodiment of the present invention, the data generation method further includes: adding modification information to the target file, the modification information including a modification record, an identity identifier of the modification record execution end bound to the modification record, and a digital signature of the modification execution end. Referring to Figure 8, the modification record can be stored in the pre-created file modification field MCFILETRAIL in the target file, and the identity identifier of the modification record execution end and the digital signature of the modification execution end can be stored in the digital signature field SIGN in the target file. The modification record is used to record the modification traces of the target data during data transmission. The identity identifier of the modification execution end is used to identify the modification execution end that formed the modification record. The identity identifier of the modification execution end is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain. Since the data sending end is not necessarily the execution end that modifies the target data, the identity identifier of the modification execution end is not necessarily the same as the identity identifier of the data sending end in the aforementioned network data field. The digital signature of the modification execution end is used to authenticate the identity of the modification execution end. The target data may undergo multiple modifications during the transmission process. Therefore, the modification record, the modification execution end identity and the modification execution end digital signature should have a relevant record corresponding to each modification behavior. If the modification execution end identity authentication is passed, it indicates that the modification traces stored in the modification record are true and credible; if the modification execution end identity and / or the modification execution end digital signature is empty, or the modification execution end identity authentication fails, it indicates that the target data may have been illegally modified during the transmission process, and the current target data is unreliable. Applying the target data generated by this embodiment to the current open Internet will help the public identify false news, trace the source of false news, and thus determine the responsibility of the publisher of false news. To a certain extent, it will help reduce information garbage in the public eye and improve the signal-to-noise ratio during information transmission.

[0113] When the target data faces multiple data receiving terminals, the information required by each data receiving terminal may be different. To avoid excessive information collection, corresponding data entities can be constructed according to the needs of the data receiving terminals and each data entity can be stored in its own target file. In this case, there are multiple target files. To ensure that each target file can only be read by authorized data receiving terminals, decryption permission information is added to the target file in an embodiment of the present invention. This decryption permission information can be stored in the permission field PRIVILEGE of the target file as shown in Figure 8. The decryption permission information can include the identity of the decryption permission holder and the corresponding private key ciphertext. The decryption permission holder identity is used to identify the decryption permission holder. The decryption permission holder identity is bound to the digital certificate of the decryption permission holder, and the digital certificate of the decryption permission holder can be verified by the corresponding certificate chain; the private key ciphertext can only be decrypted by the decryption permission holder. More specifically, the private key is encrypted using the public key of the decryption permission holder. The decryption permission holder can only decrypt the private key ciphertext using the private key to obtain the private key. The private key can be used to decrypt and obtain the data entity.

[0114] Optionally, as an embodiment of the present invention, the data generation method further includes adding file attributes to the target file, wherein the file attributes include one or more of the target file name, target file type, target file size, and target file creation time. As another variation of this embodiment, the file attributes may also be stored in the file segment or in an extended option field OPT in the payload field, but each file attribute should be bound to its corresponding target file.

[0115] In one embodiment of the present invention, the target file may also store a target file processing instruction MC.PAYLOAD.FILEBLOCK.FILE_i.INSRT. After obtaining the target file, the data receiving end may perform subsequent processing on the target file according to the processing instruction. Similarly, the target file processing instruction may also be stored in the file segment or in an extension field within the payload field. Each target file processing instruction should be bound to its corresponding target file.

[0116] A data identifier, CELLID, may also be added to the payload field. The data identifier MC.PAYLOAD.CELLID in the payload field should be identical to the data identifier MC.NETDATA.CELLID in the aforementioned network data field. The purpose of adding the data identifier CELLID to the payload field is to maintain the independence and integrity of the payload field in certain application scenarios, and to provide a unique identifier.

[0117] Optionally, as an embodiment of the present invention, a function module field and a function module field may be added to the payload field. The function module for processing the target data may be determined based on the content recorded in the function module field, and the function module for further processing the target data may be determined based on the content recorded in the function module field. After the data receiving end receives the target data, the function call sequence is: AGENT (agent) -> CMD (function module) -> CH (function module).

[0118] For example, for banking:

[0119] Agent = Bank, Functional Module = Payment, Function Module = Query All Payment Records;

[0120] Intelligent entity = bank, functional module = payment, function module = query the latest payment records.

[0121] For example, for car remote control:

[0122] Intelligent agent = car remote control, functional module = monitoring, function module = in-car environment;

[0123] Intelligent agent = car remote control, functional module = safety, function module = opening the car door.

[0124] In FIG7 , the timestamp TIMESTAMP in the payload field can be used to record the creation time of the payload field. Optionally, a payload processing instruction MC.PAYLOAD.INSTR can also be added to the payload field. After obtaining the payload field, the data receiving end can perform further processing operations on the payload field based on MC.PAYLOAD.INSTR.

[0125] It should be noted that the above embodiments are only some of the embodiments of the present invention, rather than all of the embodiments. The above-mentioned various information carried by the target data can be stored in other allowed fields under the premise of meeting the encryption requirements. For example: the permission field PRIVILEGE used to store decryption permission information in Figure 8 can also be stored in the FILEBLOCK in Figure 7, or in the extended option field OPT pre-created in MC.PAYLOAD. For another example: the file modification field MCFILETRAIL in Figure 8 can also be stored in the FILEBLOCK in Figure 7, or in the extended field OPT pre-created in MC.PAYLOAD. If the target file MCFILE does not exist in the file segment FILEBLOCK, the data body BODY in Figure 8 can also be directly stored in the file segment FILEBLOCK shown in Figure 7. At the same time, a spare field can also be created in any of the aforementioned fields to meet the needs of subsequent field expansion. For example: OPT in Figures 4 and 7 can be used as a spare field. For the network data field, encryption key field, payload field and target file, description records, management permissions, and / or processing instructions can be added therein according to actual needs, wherein the description record can be used to store the data structure of the corresponding field; the management permission can be used to limit the data receiving end's reading and / or processing permissions for the field; the processing instruction can be used to control the data receiving end to perform further processing operations on the field according to the processing instructions of each field after receiving the target data.

[0126] It should be understood that the flowchart shown in Figure 1 only shows the logical order of the method described in this embodiment. Under the premise of no conflict, in other possible embodiments of the present invention, the steps shown or described may be completed in an order different from that shown in Figure 1.

[0127] The data generation method provided in this embodiment can be applied to an electronic terminal and can be executed by a data generation device. The data generation device can be implemented by software and / or hardware. The data generation device can be integrated into an electronic terminal, for example: any smartphone, tablet computer or computer device with communication function.

[0128] The target data generated by the embodiments of the present invention can be applied to multiple fields such as advertising, sales, orders, contracts, transactions, payments, financial products, notifications, medical uses, emergency needs, remote control, software upgrades, management, monitoring, and identity recognition.

[0129] In summary, the target data generated according to the embodiment of the present invention only needs to rely on two user devices, the data receiving end and the data sending end, to realize data exchange. It does not need to rely on any third party, avoids the introduction of a "middleman server", and the digital signature only needs to be held by the signatory, meeting the requirements of the current digital signature law; by adding the data sending end identity identifier and the payload digital signature in the target data, it is possible to clarify the true source of the target data and the fact that the data body has not been tampered with during transmission. By adding the data receiving end identity identifier and the master key that can only be decrypted and obtained by the data receiving end that is granted the permission to read the payload field in the target data, it is possible to clarify the destination of the data and ensure that the data body carried in the target data can only be obtained by the authorized data receiving end. When a transaction requires the participation of multiple parties, each party is independent of each other and can interact with the target data between two user devices. There is no mutual dependence mechanism between the parties, which is more conducive to tracing the source of the target data and illegal tampering encountered during transmission.

[0130] Example 2:

[0131] This embodiment provides a data processing method that can be applied to a data receiving end to process target data generated by the data generation method described in the first embodiment. Referring to FIG9 , the data processing method includes the following steps:

[0132] Step 201: Receive target data MC;

[0133] Here, MC can be generated using the data generation method described in Example 1. The target data includes an encryption key field MC.SEALEDKEY and a payload field MC.PAYLOAD. MC.SEALEDKEY stores the master key MASTERKEY. MC.PAYLOAD stores the MC data body BODY, which is encrypted by MASTERKEY.

[0134] Step 202: decrypt the payload ciphertext in the target data to obtain a decrypted payload field;

[0135] It should be understood that not every data receiving end can decrypt the payload ciphertext. The data receiving ends here are limited to those that are granted permission to read the payload field. For unauthorized data receiving ends, they cannot decrypt the payload ciphertext and thus cannot obtain the data entity stored in the payload field.

[0136] Step 203: Obtain the data body of the target data from the decrypted payload field;

[0137] Step 204: Read the data sender identity identifier and the payload digital signature bound to the data sender identity identifier in the target data;

[0138] Step 205: Determine the data sending end of the target data using the data sending end identity identifier;

[0139] Step 206: Obtain the digital certificate of the data sender, perform trust authentication on the payload digital signature using the public key in the digital certificate of the data sender, and obtain the authentication result of the trust authentication of the payload field and the authentication result of the identity authentication of the data sender;

[0140] The digital certificate of the data sending end is verified by the corresponding certificate chain.

[0141] In summary, the data body is stored in the encrypted payload field, which can prevent the data body from being illegally tampered with during the transmission process and ensure the authenticity and reliability of the data body; the data receiving end can use the data sending end identity to determine the data sending end of the target data and trace the true source of the target data; the public key of the data sending end is used to perform trusted authentication on the payload digital signature. If the trusted authentication passes, it indicates that the target data currently received is truly derived from the data sending end, and the data body has not been tampered with during the transmission process. If the trusted authentication fails, it indicates that the source of the received target data is unreliable and may be false information. Here, the data sending end identity and the payload digital signature can be stored in the digital signature field of the target data.

[0142] In step 202, the decryption of the payload ciphertext in the target data includes decrypting the payload ciphertext using a master key or a private key of a data receiving end; wherein the master key is obtained by decrypting the master key ciphertext stored in the target data.

[0143] To ensure that only the data receiving end that is granted permission to read the payload field can obtain the matching master key, the master key can be encrypted using the public key in the data receiving end's digital certificate, or using a public certificate. Correspondingly, decrypting the master key ciphertext in the target data can specifically include the following steps:

[0144] The master key ciphertext is decrypted using the private key of the data receiving end.

[0145] It should be understood that if the master key ciphertext is obtained by encrypting the master key through a group key, a shared key, or a session key, then, correspondingly, decrypting the master key ciphertext in the target data includes decrypting the master key ciphertext using a group key, a shared key, or a session key.

[0146] The master key ciphertext can be stored in the encryption key field. If there are multiple data receivers for the target data, multiple master key ciphertexts will be configured in the encryption key field accordingly. To enable each data receiver to more quickly obtain the master key, the identity of each data receiver can be added to the encryption key field and bound to the corresponding master key ciphertext. In actual application, the data receiver can use its own identity to query and obtain the corresponding master key ciphertext.

[0147] To further improve the security of target data during network transmission, the target data received by the data receiving end can also be encrypted using a network key. For example, the encryption key field is encrypted using the network key. In this case, before decrypting the master key ciphertext in the target data, the encryption key field storing the master key ciphertext in the target data needs to be decrypted. Specifically, the following steps may be included:

[0148] Obtaining description information in the target data, and obtaining a network key according to the description information;

[0149] The encryption key field in the target data is decrypted using the network key.

[0150] Here, the description information can be stored in the description record field MC.DESC of the target data, but it is worth noting that the network key NETKEY is not directly stored in MC.DESC. The description information is only an intermediate information for obtaining the network key. Specifically, the description information can include the key type KEYTYPE of the network key. The key type of the network key includes any one of a session key, a shared key and a public key.

[0151] When the key type of the network key is a session key, the description information should also include a session identifier, which is used to obtain the key body of the session key. Based on this, decrypting the encryption key field in the target data using the network key specifically includes:

[0152] Acquire a key type of the network key from the description information;

[0153] In response to the key type being a session key, a session identifier is obtained from the description record, and a key body of the session key is determined using the session identifier; here, the key body of the session key is the network key to be obtained.

[0154] When the key type of the network key is a shared key, the description information should also include a key name, which is used to obtain the key body of the shared key. On this basis, decrypting the encryption key field in the target data using the network key may specifically include:

[0155] Acquire a key type of the network key from the description information;

[0156] In response to the key type of the network key being a shared key, a key name is obtained from the description record, and the key body of the shared key is determined using the key name; here, the key body of the shared key is the network key to be obtained.

[0157] When the key type of the network key is a public key, the description information also includes a data receiving end identity identifier, and the data receiving end identity identifier is used to determine a local private key that matches the public key. Based on this, decrypting the encryption key field in the target data using the network key may specifically include:

[0158] Acquire a key type of the network key from the description information;

[0159] In response to the key type of the network key being a public key, the data receiving end identity is obtained from the description record, and the data receiving end identity is used to determine a local private key that matches the public key; here, the local private key is the network key to be obtained.

[0160] It should be noted that if the network key NETKEY or the key type of the network key is empty, it indicates that the target data is not encrypted using the network key, and the data receiving end can directly read the encryption key field.

[0161] Digital signatures can be applied to network data, payload data, network data plus payload data, or any combination of these. A common method is to sign both the network data and payload data, with an additional signature applied to the payload data. Signing both the network data and payload data clarifies the source of the information and ensures its consistency with the original. Signing the payload data separately facilitates its use and preservation.

[0162] Optionally, after the payload digital signature is authenticated as trusted using the public key of the data sending end, the authentication result of the payload digital signature is stored in the authentication status field in the target data. In order to avoid the data receiving end from repeatedly authenticating the payload digital signature after receiving the target data, before the payload digital signature is authenticated as trusted using the public key of the data sending end, the authentication result of the trusted authentication can be directly obtained by reading the authentication status field in the target data. If there is no authentication result in the authentication status field, the operation step of authenticating the payload digital signature is executed; otherwise, the operation step is no longer executed. Referring to Figure 10, the payload digital signature that has passed identity authentication can be displayed in the form of a watermark.

[0163] Optionally, after obtaining the data body of the target data from the decrypted payload field, the data processing method further includes:

[0164] Obtaining the priority of the target data;

[0165] Whether to feed back a receipt and the information required to be included in the receipt to the data sending end of the target data is determined according to the priority.

[0166] The priority may be stored in a network data field of the target data. If the network data field is encrypted using a network key, then the method for obtaining the priority in the target data may include the following steps:

[0167] decrypting the network data field in the target data using the network key;

[0168] The priority is obtained from the decrypted network data field.

[0169] The priority level can be divided into multiple levels according to actual application needs, and corresponding receipt requirements can be proposed for each level. In one embodiment of the present invention, the priority level can be divided into low, medium, and high levels. In this case, the determination of whether to feedback a receipt to the data sending end of the target data and the information required to be included in the receipt based on the priority level can specifically include the following steps:

[0170] In response to the obtained priority being low, not feeding back a receipt to the data sending end;

[0171] In response to the obtained priority being medium, sending a data identifier of the target data to the data sending end;

[0172] In response to the obtained priority being high, sending the data identifier of the target data and a hash value carrying the digital signature of the data receiving end to the data sending end, the hash value being obtained by performing a hash calculation on the target data or a network data field and / or a payload field in the target data;

[0173] Here, the data identifier is a character or string pre-stored in the network data field and / or the payload field, and is used to uniquely identify the target data.

[0174] Similarly, if the network data field, digital signature field, and encryption key field in the received target data are encrypted as a whole using the same network key, the network data field, digital signature field, and encryption key field can be decrypted synchronously with reference to the aforementioned decryption operation steps for performing the encryption key field using the network key. If the network data field, digital signature field, and encryption key field in the received target data are encrypted separately using different network keys, the network data field and digital signature field can be decrypted separately with reference to the aforementioned decryption operation steps for performing the encryption key field using the network key, with the difference being that the encryption key field is replaced with the network data field or the digital signature field.

[0175] During the transmission process, the target data may be modified and forwarded by multiple data receiving terminals. In order to track the modification traces of the target data during the transmission process and the corresponding modification execution terminal, each data receiving terminal should leave traceable modification information after modifying the target data. The modification information may include the modification record, the identity identifier of the modification execution terminal, and the digital signature of the modification execution terminal. The modification information can be automatically generated when the target data is modified, or it can be manually created by the modification execution terminal. Therefore, in order to track the modification behavior of the received target data during the transmission process, the data processing method also includes:

[0176] Reading modification records in the target data, and using the modification records to track modification traces of the target data during the transmission process;

[0177] Reading the modification execution end identity in the target data, and using the modification execution end identity to identify the modification execution end that formed the modification record;

[0178] The digital signature of the modification execution end in the target data is read, and the identity of the modification execution end is authenticated using the digital signature of the modification execution end.

[0179] The modification record, modification execution end identity and modification execution end digital signature can be stored in the payload field together with the data body. The modification execution end identity is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain. If the received target data only has a modification record, but lacks the corresponding modification execution end identity and / or modification execution end digital signature, it indicates that the currently received target data may have been illegally tampered with and the target data is unreliable. The modification record can be displayed in the form of a hyperlink, such as the Watermark index.html shown in Figure 10.

[0180] After receiving the target data, the data receiving end should first verify whether it supports the corresponding data communication protocol. The data communication protocol can be stored in the unencrypted description record field MC.DESC. To this end, in one embodiment of the present invention, the data processing method further includes:

[0181] Acquiring a data communication protocol in the target data;

[0182] In response to the data receiving end not supporting the data communication protocol, exiting the data processing method.

[0183] In one embodiment of the present invention, the data processing method further includes:

[0184] Obtaining the file segment in the payload field;

[0185] In response to the file segment being an HTML file, the data body in the file segment is loaded according to the browser's needs, see index.html in FIG10 .

[0186] Generally, the file segment contains one or more target files, each of which stores the corresponding data body according to the needs of the data receiving end. When the target file does not exist in the file segment, the data body can also be directly stored in the file segment. To avoid excessive information collection, the data body in the target data can be encrypted using a dedicated key. After encryption, the dedicated key forms a dedicated key ciphertext that can only be decrypted by those with decryption permission. Accordingly, obtaining the data body of the target data from the decrypted payload field can also include:

[0187] Reading the private key ciphertext and the decryption authority owner identity in the payload field;

[0188] Determining the decryption authority owner using the decryption authority owner identity identifier;

[0189] Decrypting the private key ciphertext using the private key of the decryption authority owner to obtain the private key;

[0190] Decrypting the data body using the dedicated key, thereby obtaining the data body in the file segment or target file;

[0191] The identity identifier of the decryption authority owner is bound to the digital certificate of the decryption authority owner, and the digital certificate of the decryption authority owner can pass the verification of the corresponding certificate chain.

[0192] Furthermore, the data processing method further includes: obtaining file attributes of the target file and displaying the file attributes in a watermark manner. Here, the file attributes may include one or more of the target file name, target file type, target file size, and target file creation time.

[0193] Since the target data may also include a target file processing instruction for instructing the data receiving end to perform subsequent processing operations on the target file, in one embodiment of the present invention, the data processing method further includes:

[0194] Obtaining a target file processing instruction in the payload field;

[0195] Perform corresponding processing operations on the target file according to the target file processing instruction.

[0196] Furthermore, the payload field of the target data may also include a function module field and a function module field. Therefore, the embodiment of the present invention may further include:

[0197] Obtaining the function module field and the function module field in the payload field;

[0198] Calling the function module in the function module field to process the target data;

[0199] The function module in the function module field is called to further process the target data processed by the function module.

[0200] The function module for processing the target data can be determined based on the content stored in the function module field. The function module for further processing the target data can also be determined based on the content stored in the function module field. After the data receiving end receives the target data, the function call sequence is: AGENT (agent) -> CMD (function module) -> CH (function module).

[0201] For example, for banking:

[0202] Agent = Bank, Functional Module = Payment, Function Module = Query All Payment Records;

[0203] Intelligent entity = bank, functional module = payment, function module = query the latest payment records.

[0204] For example, for car remote control:

[0205] Intelligent agent = car remote control, functional module = monitoring, function module = in-car environment;

[0206] Intelligent agent = car remote control, functional module = safety, function module = opening the car door.

[0207] Example 3:

[0208] The data sending method according to the embodiment of the present invention may be executed by a data sending end, as shown in FIG11 , and includes the following steps:

[0209] Get pre-generated target data;

[0210] Sending the target data to a data receiving end;

[0211] The target data may be generated using the data generation method described in Example 1. Specific generation steps may be found in Example 1 and Figures 2 to 8 , which will not be detailed here for simplicity.

[0212] The target data contains a specified data transmission type. Therefore, before sending the target data to the data receiving end, the data sending method further includes:

[0213] Reading the data transmission type stored in the target data;

[0214] The target data is sent to the data receiving end according to the data transmission type.

[0215] Optionally, the data transmission type can be any of Bluetooth, mobile data communication, WiFi, wireless frequency band digital communication, block code scanning communication, acoustic wave digital communication, infrared digital communication, laser digital communication, high-energy ray digital communication, and optical image data exchange, but the present invention is not limited thereto. The target data can be transmitted via a MetaNet, email, text message, social media, or the like. The MetaNet is a public network specifically built for forwarding Metas, based on the Meta's FROMUID, TOUID, and corresponding digital signature. The MetaNet provides terminals with a session establishment process based on digital signature authentication, providing them with a session ID and session key.

[0216] In one embodiment of the present invention, before sending the target data to the data receiving end, the data receiving end identity identifier and the data receiving end agent in the target data are obtained; the data receiving end is identified according to the data receiving end identity identifier; and in response to the data receiving end agent being in an activated state, the target data is sent to the data receiving end.

[0217] It can be seen that the data sender can send target data to the data receiver without relying on any third party or being bound to any physical medium. The target data can be exchanged directly between two user devices, which improves the real-time and flexibility of communication. At the same time, it can ensure the security and reliability of the target data during transmission and better protect customer privacy.

[0218] Example 4:

[0219] The data generating device provided in this embodiment may be an independent user equipment or integrated into a data transmitting end. Referring to FIG12 , the data generating device mainly includes:

[0220] A first storage module is used to obtain the data body of the target data and store the data body in a pre-created payload field in the target data;

[0221] The data body may be stored in a file segment pre-created in the payload field or in a target file pre-created in the file segment.

[0222] Digital signature module: used to digitally sign the payload field using the private key of the data sending end of the target data to form a payload digital signature;

[0223] A second storage module is used to bind the payload digital signature and the data sender identity identifier and store them in the target data;

[0224] The data sending end identity identifier FROMUID is used to identify the identity of the data sending end that sends the target data; the data receiving end can authenticate the payload digital signature through the public key of the identified data sending end. If the trusted authentication is passed, it indicates that the target data truly comes from the identified data sending end, and the data entity stored in the payload field has not been tampered with during the transmission process; otherwise, it indicates that the source of the target data is unreliable, the data entity may be tampered with, and is not trustworthy.

[0225] A first encryption module is configured to encrypt the payload field to generate a payload ciphertext and store the ciphertext in the target data. The payload ciphertext can only be decrypted by a designated data receiving end.

[0226] Among them, the data sending end identity identifier is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; the payload digital signature is used to perform trusted authentication of the payload field and identity authentication of the data sending end.

[0227] In summary, the target data generated by the data generation device provided by the embodiment of the present invention has its data body stored in the payload field. The payload field is encrypted to form a payload ciphertext and is stored in the target data. The payload ciphertext can only be decrypted by the designated data receiving end, thereby ensuring that the data body of the target data can only be obtained by the authorized data receiving end. Accordingly, the unauthorized data receiving end cannot decrypt the payload ciphertext and thus cannot obtain the data body therein, which improves the security of the target data during transmission and helps to protect customer privacy. At the same time, the target data carries a payload digital signature, which is bound to the data sender identity identifier. The identity of the data sender can be confirmed through the data sender identity identifier, and the data sender identity identifier is bound to the digital certificate of the data sender, and the digital certificate of the data sender can pass the verification of the corresponding certificate chain. The payload digital signature can be authenticated through the public key in the digital certificate of the data sender, thereby obtaining a trusted authentication result of the payload field and an identity authentication result of the data sender, thereby achieving traceability of the true source of the target data and improving the reliability of the target data in the information interaction process. Using the target data structure generated by the embodiments of the present invention for information exchange can eliminate reliance on "middleman" frameworks, improve the security and reliability of information communication and storage, reduce information spam, and increase the signal-to-noise ratio of information exchange. Embodiments of the present invention can be applied in the field of intellectual property, helping to establish an effective intellectual property protection system and safeguard the interests of authentic creators. They can also be applied in the field of artificial intelligence to distinguish whether received target data originates from a natural person or an artificial intelligence device, addressing the challenges posed by artificial intelligence to humanity.

[0228] The first encryption module can be used to encrypt the payload field using a master key or the public key of the data receiving end. When using master key encryption, the master key is encrypted by the second encryption module to generate a master key ciphertext, which is then stored in the target data. It is understood that the master key ciphertext can only be decrypted by the designated data receiving end.

[0229] Optionally, the second encryption module is specifically configured to:

[0230] Obtaining a digital certificate of the data receiving end;

[0231] Encrypting the master key using the public key in the digital certificate of the data receiving end to generate the master key ciphertext, and binding the master key ciphertext to the data receiving end identity identifier and storing it in the target data;

[0232] The data receiving terminal identity is used to identify the identity of the data receiving terminal that receives the target data. The data receiving terminal can obtain the corresponding master key ciphertext through the pre-configured data receiving terminal identity query and decrypt the master key ciphertext using its private key to obtain the master key.

[0233] When the data sending end does not have the digital certificate of the data receiving end locally, the master key can also be encrypted using the public certificate. In this case, the second encryption module is specifically used to:

[0234] Obtain a public certificate by accessing the local storage space of the data sender or a public certificate server or blockchain, and verifying the public certificate using a root certificate or a certificate chain;

[0235] The master key is encrypted using a verified public certificate.

[0236] In practical applications, a corresponding master key encryption method can also be selected based on the application scenario of the target data. For example, when the data receiving end is identified as a group ID, the corresponding master key can be encrypted using a group key. Therefore, the second encryption module can also be configured to encrypt the master key using a group key, a shared key, or a session key.

[0237] Referring to FIG6 , when there are multiple data receiving terminals, a relationship mapping table containing a digital receiving terminal identity and a corresponding master key ciphertext can be created for each data receiving terminal to form multiple asymmetric encryption tables. Correspondingly, the data generating device further includes:

[0238] The first binding module is used to bind the master key ciphertext and the data receiving terminal identity through a relationship mapping table.

[0239] To avoid repeated authentication of the payload field, optionally, the data generating device further includes:

[0240] The first creation module is configured to create an authentication status field (STATUS) in the target data. The authentication status field is configured to store the authentication result of the trusted authentication of the payload digital signature. When the authentication result is stored in the authentication status field, the authentication result can be directly read without further trusted authentication of the payload digital signature.

[0241] A network data field is also created in the target data, see Figure 4. This network data field can be used to store the data sending end identity FROMUID and the data sending end intelligent agent FROMAGENT, and can also be used to store the data receiving end identity TOUID and the data receiving end intelligent agent TOAGENT. It can also be used to store the data identifier CELLID that identifies the target data, and can also be used to store multiple information such as priority PRORITY. However, it should be noted that the network data field described in the embodiment of the present invention can be one or more, and the various types of information stored in the network data field can be stored simultaneously in one network data field or separately in multiple network data fields. Therefore, the data generation device also includes:

[0242] A third storage module is used to store the data sending end identity and / or the data sending end agent in the pre-created network data field in the target data;

[0243] and / or,

[0244] A fourth storage module: configured to store the data receiving end identity and / or the data receiving end agent in a pre-created network data field in the target data;

[0245] and / or,

[0246] Data identification storage module: used for storing the data identification identifying the target data into the payload field and / or the pre-created network data field in the target data;

[0247] and / or,

[0248] Priority storage module: used to store the priority in the pre-created network data field in the target data, and the priority is used to indicate whether the data receiving end feeds back a receipt to the data sending end of the target data and the information required to be included in the receipt.

[0249] The data sending end agent is used to record the agent that compiles and sends the target data. The data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data. The data receiving end agent is used to record the agent that receives and processes the target data. The data sending end identity identifier and / or the data receiving end identity identifier are a single identity identifier or a list of multiple identity identifiers. The data identifier is a unique random character or string. After receiving the target data, the data receiving end can use the CELLID to determine whether the target data is the same as other received target data, thereby avoiding repeated reception of the same target data.

[0250] The priority level PRORITY can be used to determine whether the data receiving end should feedback a receipt to the data sending end and the information required for the receipt. For example, the priority level can be divided into three levels: low, medium, and high. When low priority information is stored in MC.NETDATA.PRORITY, the data receiving end may not feedback a receipt to the data sending end after receiving the target data. When medium priority information is stored in MC.NETDATA.PRORITY, the data receiving end may feedback the data identifier MC.NETDATA.CELLID to the data sending end after receiving the target data. When high priority information is stored in MC.NETDATA.PRORITY, the data receiving end may feedback the data identifier MC.NETDATA.CELLID and a hash value carrying the digital signature of the data receiving end to the data sending end after receiving the target data. The hash value can be obtained by performing a hash calculation on the target data MC, or by performing a hash calculation on MC.NETDATA or MC.PAYLOAD, or by performing a hash calculation on MC.NETDATA and MC.PAYLOAD. MC.NETDATA.PRORITY can be represented by a numerical value, with lower numerical values ​​generally indicating higher priority. Of course, MC.NETDATA.PRORITY can also be represented by characters or strings. Regardless of the representation method, the data sender should agree on a priority rule with the data receiver in advance so that the data receiver can provide a receipt and the required information after receiving the target data according to the data sender's expectations.

[0251] In order to further improve the security of the target data during transmission, the network data field in the target data may be encrypted. Therefore, the data generating device further includes:

[0252] A third encryption module: configured to encrypt the network data field using a network key;

[0253] Description information storage module: used for storing description information used to obtain the network key in a description record field pre-created in the target data.

[0254] 6 , the master key ciphertext and the data receiving terminal identity identifier may be bound and stored in the pre-created encryption key field in the target data. Therefore, the data generating device further includes:

[0255] A fifth storage module is configured to bind the master key ciphertext and the data receiving terminal identity identifier and store the binding in the pre-created encryption key field in the target data;

[0256] A fourth encryption module: configured to encrypt the encryption key field using a network key;

[0257] At this time, the aforementioned description information storage module can also be used to store the description information used to obtain the network key in a description record field pre-created in the target data.

[0258] It should be noted that the network key used to encrypt the encryption key field and the network data field is not stored in the description record field. The description information in the description record field includes the key type of the network key, and the key type of the network key includes any one of a session key, a shared key, and a public key.

[0259] Optionally, when the key type of the network key is a session key, the description information further includes a session identifier, and the session identifier is used to obtain a key body of the session key.

[0260] Optionally, when the key type of the network key is a shared key, the description information further includes a key name, and the key name is used to obtain a key body of the shared key.

[0261] Optionally, when the key type of the network key is a public key, the description information further includes a data receiving end identity identifier, and the local private key matching the key body of the public key is determined through the data receiving end identity identifier in the description information.

[0262] During the transmission process, the target data can be identified by the data receiving end identity identifier TOUID, without relying on any physical medium. In order to clarify the data transmission type of the target data, the data transmission type MC.DESC.TRANSPORTTYPE can also be added to the description record field, as shown in Figure 3. At this time, the data generation device also includes:

[0263] The sixth storage module is configured to store the data transmission type in the target data.

[0264] Optionally, the data transmission type includes any one of Bluetooth, mobile data communication, WiFi, wireless frequency band digital communication, block code scanning communication, acoustic wave digital communication, infrared digital communication, laser digital communication, high-energy ray digital communication, and optical image data exchange. The target data can be transmitted via a BNET instant messaging network, email, or text message.

[0265] After receiving the target data, the data receiving end first checks the data communication protocol carried in the target data. If the data receiving end does not support the data communication protocol, the subsequent processing operation is terminated. The default value of the data communication protocol may be "BROADI". Therefore, the data generating device further includes:

[0266] The seventh storage module is used to store the data communication protocol required to be supported by the data receiving end of the target data in the target data.

[0267] The data transmitter may send target data to multiple data receivers. The data received by each data receiver may not be exactly the same. To ensure that each data receiver receives only the data it requests and avoid excessive information collection, a dedicated key can be used to encrypt each data entity. After encryption, the dedicated key can only be decrypted and obtained by the designated data receiver. In this case, the data generation device also includes:

[0268] A fifth encryption module: configured to encrypt the data body using a dedicated key;

[0269] A sixth encryption module is used to encrypt the private key using the public key of the decryption authority owner to form a private key ciphertext;

[0270] An eighth storage module is used to bind the private key ciphertext with the decryption authority owner's identity identifier and store the resultant in the payload field.

[0271] The decryption authority holder's identity identifier is used to identify the decryption authority holder; the decryption authority holder's identity identifier is bound to the decryption authority holder's digital certificate, and the decryption authority holder's digital certificate can be verified by the corresponding certificate chain. The private key ciphertext can only be decrypted by the decryption authority holder. More specifically, the private key is encrypted using the decryption authority holder's public key. The decryption authority holder can only decrypt the private key ciphertext using the private key to obtain the private key. The private key can be used to decrypt and obtain the data body.

[0272] A file segment is created in the payload field, and one or more target files can be created in the file segment. The data body can be stored in the target file. The target data can also carry target data processing instructions for controlling the data receiving end of the target data to perform corresponding processing operations on the target file. Therefore, the data generation device also includes:

[0273] Instruction storage module: used for storing the target file processing instruction in the payload field.

[0274] Optionally, the data generating device may further include:

[0275] File attribute storage module: used for storing the file attributes of the target file in the payload field, wherein the file attributes include one or more of the target file name, target file type, target file size and target file creation time.

[0276] In order to track the modification traces of the target data during the transmission process and confirm the identity of the modification execution end, after the target data is modified, modification information should be added to the target data. The modification information at least includes: a modification record, an identity identifier of the modification execution end bound to the modification record, and a digital signature of the modification execution end. The modification record is used to record the modification traces of the target data during data transmission; the identity identifier of the modification execution end is used to identify the identity of the modification execution end that forms the modification record, and the identity identifier of the modification execution end is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain; the digital signature of the modification execution end is formed after the modification execution end digitally signs the modification record, and is used to authenticate the modification record. At this time, the data generation device also includes:

[0277] Modification information storage module: used to store the modification information of the target data in the payload field.

[0278] Optionally, the data generating device further includes:

[0279] The field addition module is used to add a function module field and a function module field to the payload field. The function module field is used to identify the function module that processes the target data, and the function module field is used to identify the function module within the function module that further processes the target data. After the data receiving end receives the target data, the function call sequence is: AGENT (agent) -> CMD (function module) -> CH (function module).

[0280] For example, for banking:

[0281] Agent = Bank, Functional Module = Payment, Function Module = Query All Payment Records;

[0282] Intelligent entity = bank, functional module = payment, function module = query the latest payment records.

[0283] For example, for car remote control:

[0284] Intelligent agent = car remote control, functional module = monitoring, function module = in-car environment;

[0285] Intelligent agent = car remote control, functional module = safety, function module = opening the car door.

[0286] In summary, the target data generated by the data generating device provided by the embodiment of the present invention only needs to rely on two user devices, the data receiving end and the data sending end, to realize data exchange, without relying on any third party, avoiding the introduction of a "middleman server", and the digital signature only needs to be held by the signer, meeting the requirements of the current digital signature law; by adding the data sending end identity identifier and the payload digital signature to the target data, the true source of the target data can be clarified, and by adding the data receiving end identity identifier and storing the data body in the payload ciphertext that can only be decrypted by the designated data receiving end, the data destination can be clarified, and it can be ensured that the target data can only be obtained by the authorized data receiving end; when a transaction requires the participation of multiple parties, the parties are independent of each other, and there is no mutual dependence mechanism, which facilitates tracing the tampering behavior encountered by the target data during transmission.

[0287] The data generating device provided in this embodiment can be used to implement the method described in Example 1. For technical features that are not fully explained in this embodiment, please refer to Example 1. To simplify the description, they are not repeated here.

[0288] Embodiment 5:

[0289] This embodiment provides a data receiving end, which can be used to process the target data generated in the first embodiment. Referring to FIG13 , the data receiving end mainly includes:

[0290] Receiving module: used to receive target data;

[0291] A first decryption module is used to decrypt the payload ciphertext in the target data to obtain the decrypted payload field;

[0292] Data ontology acquisition module: used for acquiring the data ontology of the target data from the decrypted payload field;

[0293] A first reading module is used to read the data sending end identity identifier and the payload digital signature bound to the data sending end identity identifier in the target data;

[0294] A first determining module: configured to determine a data sending end of the target data using the data sending end identity identifier;

[0295] A first trusted authentication module is configured to obtain the digital certificate of the data sending end, perform trusted authentication on the payload digital signature using the public key in the digital certificate of the data sending end, and obtain the authentication result of the trusted authentication of the payload field and the authentication result of the identity authentication of the data sending end;

[0296] The digital certificate of the data sending end is verified by the corresponding certificate chain.

[0297] In summary, the data receiving end decrypts the payload ciphertext through the first decryption module to obtain the data body stored in the payload field, which can prevent the data body from being illegally tampered with during the transmission process and ensure the authenticity and reliability of the data body; the data sending end identity identifier is used to determine the data sending end of the target data, and the true source of the target data can be traced; the public key of the data sending end is used to perform a trusted authentication on the payload digital signature. If the trusted authentication passes, it indicates that the target data currently received is truly derived from the data sending end, and the data body has not been tampered with during the transmission process. If the trusted authentication fails, it indicates that the received target data may be false information and unreliable. Here, the data sending end identity identifier and the payload digital signature can be stored in the digital signature field of the target data.

[0298] The aforementioned first decryption module can be specifically used to: decrypt the payload ciphertext using a master key or a private key of a data receiving end; wherein, the master key can be obtained by decrypting the master key ciphertext stored in the target data through a second decryption module.

[0299] It should be understood that not every data receiving end can decrypt the master key ciphertext. The data receiving ends here are limited to those that are granted permission to read the payload field. For unauthorized data receiving ends, they cannot decrypt the master key ciphertext and thus cannot obtain the master key.

[0300] The encryption type of the master key can be selected according to the actual application scenario, and the method of decrypting the master key ciphertext should match the encryption type of the master key ciphertext. Therefore, the second decryption module can use the private key or group key or shared key or session key of the data receiving end to decrypt the master key ciphertext.

[0301] The master key ciphertext can be stored in the encryption key field. To ensure the security of data transmission, the encryption key field can be encrypted using the network key. Therefore, the data receiving end provided by the embodiment of the present invention also includes:

[0302] The third decryption module is configured to decrypt the encryption key field storing the master key ciphertext in the target data before decrypting the master key ciphertext in the target data.

[0303] More specifically, the third decryption module is used to:

[0304] Obtaining description information in the target data, and obtaining a network key according to the description information;

[0305] The encryption key field is decrypted using the network key.

[0306] To avoid repeated authentication, the authentication result of the trusted authentication of the payload digital signature can be stored in the authentication status field in the target data. Before the data receiving end uses the public key in the digital certificate of the data sending end to perform trusted authentication on the payload digital signature, the first trusted authentication module first reads the authentication status field in the target data. In response to the trusted authentication result already stored in the authentication status field, the authentication result is directly output; in response to the content of the authentication status field being empty, the operation of trusted authentication of the payload digital signature is performed. Optionally, the data receiving end also includes a first display module for outputting and displaying the payload digital signature that has passed the trusted authentication in the form of a watermark.

[0307] Optionally, the data receiving end provided by the embodiment of the present invention further includes:

[0308] Priority acquisition module: used to obtain the priority of the target data;

[0309] Receipt module: used to determine whether to feedback a receipt to the data sending end of the target data and the information required for the receipt based on the priority, specifically:

[0310] The receipt module does not feed back a receipt to the data sending end in response to the obtained priority being low;

[0311] The receipt module sends a data identifier of the target data to the data sending end in response to the obtained priority being medium;

[0312] In response to the obtained priority being high, the receipt module sends the data identifier of the target data and a hash value carrying the digital signature of the data receiving end to the data sending end, where the hash value is obtained by performing a hash calculation on the target data or a network data field and / or a payload field in the target data;

[0313] The data identifier is pre-stored in the network data field and / or the payload field and is used to identify the target data.

[0314] Furthermore, the priority acquisition module specifically includes:

[0315] A first acquiring unit: configured to acquire description information from the target data;

[0316] A second acquiring unit is configured to acquire a network key according to the description information;

[0317] Decryption unit: used for decrypting the network data field in the target data using the network key;

[0318] A third acquiring unit is configured to acquire the priority from the decrypted network data field.

[0319] The second acquiring unit is specifically configured to:

[0320] Acquire a key type of the network key from the description information;

[0321] In response to the key type being a session key, obtaining a session identifier from the description record, and determining a key body of the session key using the session identifier, where the key body of the session key is the network key to be obtained;

[0322] In response to the key type being a shared key, obtaining a key name from the description record, and determining a key body of the shared key using the key name; the key body of the shared key is the network key to be obtained;

[0323] In response to the key type being a public key, the data receiving end identity is obtained from the description record, and the data receiving end identity is used to determine a local private key that matches the public key; the local private key is the network key to be obtained.

[0324] In order to track modification traces of target data during transmission, the data receiving end provided by the embodiment of the present invention further includes:

[0325] A second reading module: configured to read modification records in the target data;

[0326] Tracking module: used to track the modification traces of target data during the transmission process using the modification records;

[0327] A third reading module: configured to read the modification execution end identity in the target data;

[0328] Identification module: used for identifying the modification execution end that forms the modification record by using the modification execution end identity identifier;

[0329] A fourth reading module is used to read the modification execution end digital signature in the target data;

[0330] A second trusted authentication module is used to perform trusted authentication on the modification record using the digital signature of the modification execution end;

[0331] The identity identifier of the modification execution end is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain.

[0332] In order to facilitate users to locate and read the modification record more quickly, the data receiving end provided by the embodiment of the present invention further includes a second display module: configured to display the modification record in a hyperlink manner.

[0333] After receiving the target data, the data receiving end should first verify whether it supports the data communication protocol carried by the target data. Therefore, the data receiving end also includes:

[0334] Communication protocol acquisition module: used to obtain the data communication protocol in the target data;

[0335] Exit module: used for exiting the current data processing step in response to the data receiving end not supporting the data communication protocol.

[0336] A file segment is created in the payload field of the target data, and one or more target data can be created in each file segment. The data body is stored in the file segment or the target file. For this purpose, the data body acquisition module is specifically used to: obtain the file segment in the payload field; obtain the data body from the file segment or obtain the data body from the target file in the file segment.

[0337] There may be multiple data entities. To avoid unnecessary information collection, the data receiving end provided by the embodiment of the present invention further includes:

[0338] File segment acquisition module: used for acquiring the file segment in the payload field;

[0339] Data body loading module: used for loading the data body in the file segment according to the browser's needs in response to the file segment being an HTML file.

[0340] The data sending end may need to send target data to multiple data receiving ends. The data body requested by each data receiving end may be different. In this case, there may be multiple data bodies. In order to ensure that each data receiving end can only read the data body it requested, the data body acquisition module is further specifically used to:

[0341] Reading the private key ciphertext and the decryption authority owner identity in the payload field;

[0342] Determining the decryption authority owner using the decryption authority owner identity identifier;

[0343] Decrypting the private key ciphertext using the private key of the decryption authority owner to obtain the private key;

[0344] Decrypting the encrypted data body using the dedicated key to obtain the data body;

[0345] The identity identifier of the decryption authority owner is bound to the digital certificate of the decryption authority owner, and the digital certificate of the decryption authority owner can pass the verification of the corresponding certificate chain.

[0346] Optionally, the data receiving end provided by this embodiment further includes:

[0347] File attribute acquisition module: used to acquire the file attributes of the target file;

[0348] The third display module is used to display the file attributes through a watermark or a pop-up window;

[0349] Instruction acquisition module: used for acquiring the target file processing instruction in the payload field;

[0350] Execution module: used for executing corresponding processing operations on the target file according to the target file processing instruction.

[0351] Optionally, the data receiving end provided by the embodiment of the present invention further includes:

[0352] Field acquisition module: used to obtain the function module field and the function module field in the payload field;

[0353] A first calling module is used to call the function module in the function module field to process the target data;

[0354] The second calling module is used to call the function module in the function module field to further process the target data processed by the function module.

[0355] The data receiving end provided in this embodiment can be used to implement the method described in the second embodiment. For technical features not fully explained in this embodiment, please refer to the second embodiment.

[0356] Example 6:

[0357] An embodiment of the present invention provides a data transmitting end, as shown in FIG14 , which mainly includes:

[0358] Data generating device: used to generate target data;

[0359] The data generating device may adopt the data generating device described in the fourth embodiment, which will not be described in detail here to save space.

[0360] Target data acquisition module: used to obtain pre-generated target data;

[0361] Target data sending module: used for sending the acquired target data to a data receiving end.

[0362] Furthermore, the data sending end further includes:

[0363] A transmission type reading module is configured to read the data transmission type stored in the target data before sending the target data to the data receiving end;

[0364] At this time, the target data sending module is specifically configured to send the target data to the data receiving end according to the data transmission type.

[0365] Furthermore, it also includes:

[0366] Receiving end information reading module: used for reading the data receiving end identity and the data receiving end agent in the target data before sending the target data to the data receiving end;

[0367] Identification module: used for identifying the data receiving end according to the identity identifier of the data receiving end;

[0368] At this time, the target data sending module is specifically configured to send the target data to the data receiving end in response to the data receiving end agent being in an activated state.

[0369] The data sending end provided in this embodiment can be used to implement the method described in the third embodiment. For technical features not fully explained in this embodiment, please refer to the third embodiment.

[0370] Embodiment seven:

[0371] The electronic terminal includes a processor and a memory connected to the processor, wherein a computer program is stored in the memory. When the computer program is executed by the processor, the method steps described in Example 1 are performed. For simplicity of description, they are not described here.

[0372] Embodiment 8:

[0373] An embodiment of the present invention provides an electronic terminal comprising a processor and a memory connected to the processor, wherein a computer program is stored in the memory. When the computer program is executed by the processor, the method steps described in Embodiment 2 are performed. For simplicity of description, they are not described here in detail.

[0374] Embodiment 9:

[0375] An embodiment of the present invention provides an electronic terminal comprising a processor and a memory connected to the processor, wherein a computer program is stored in the memory. When the computer program is executed by the processor, the method steps described in Embodiment 3 are performed. For simplicity of description, these steps are omitted here.

[0376] Embodiment 10:

[0377] The embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps described in Embodiment 1. For simplicity of description, these steps are omitted here.

[0378] Example 11:

[0379] The embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps described in embodiment 2. To simplify the description, these steps are omitted here.

[0380] Example 12:

[0381] The embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps described in embodiment 3. To simplify the description, they are not described here in detail.

[0382] Example 13:

[0383] 15 , an embodiment of the present invention provides a communication system, including the data receiving end described in Embodiment 5 and the data transmitting end described in Embodiment 6. For simplicity of description, they are not described here in detail.

[0384] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0385] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0386] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0387] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0388] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data generation method, characterized in that: include: Acquire a data body of target data, and store the data body in a pre-created payload field in the target data; Digitally signing the payload field using the private key of the data sending end of the target data to form a payload digital signature; Binding the payload digital signature and the data sender identity identifier and storing them in the target data; Encrypting the payload field to generate a payload ciphertext and storing it in the target data, wherein the payload ciphertext can only be decrypted by a designated data receiving end; The data sending end identity identifier is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; The payload digital signature is used to perform trustworthy authentication on the payload field and identity authentication on the data sending end.

2. The data generation method according to claim 1, characterized in that: The encrypting the payload field comprises: Encrypting the payload field using a master key or a public key of the data receiving end; The master key is encrypted to generate a master key ciphertext which is then stored in the target data.

3. The data generation method according to claim 2, characterized in that: The master key is encrypted to generate a master key ciphertext, including: Obtaining a digital certificate of the data receiving end; Encrypting the master key using the public key in the digital certificate of the data receiving end to generate the master key ciphertext, and binding the master key ciphertext to the data receiving end identity identifier and storing it in the target data; Among them, the data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity identifier is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can pass the verification of the corresponding certificate chain.

4. The data generation method according to claim 3, characterized in that: Also includes: The master key ciphertext is bound to the data receiving terminal identity through a relationship mapping table.

5. The data generation method according to claim 3 or 4, characterized in that: Also includes: The data sending end identity identifier and the data receiving end identity identifier are unique and are bound to one or more privacy identity identifiers of the user according to the user's authorization.

6. The data generation method according to claim 5, characterized in that: The private identity identifier includes any one of a telephone number, an email address, and a social media account.

7. The data generation method according to claim 2, characterized in that: The master key is encrypted to generate a master key ciphertext, including: encrypting the master key using a group key, a shared key session key, or a public certificate; The public certificate is obtained by accessing the local storage space of the data sender or the public certificate server or the blockchain, and is verified by the root certificate or the certificate chain.

8. The data generation method according to claim 1, characterized in that: Also includes: An authentication status field is created in the target data, where the authentication status field is used to store the authentication result of the payload digital signature.

9. The data generation method according to claim 1, characterized in that: Also includes: storing the data sending end identity and / or the data sending end agent in a pre-created network data field in the target data; The data sending end agent is used to record the agent that compiles and sends the target data.

10. The data generation method according to claim 1, characterized in that: It also includes storing the data receiving end identity and / or the data receiving end agent in a pre-created network data field in the target data; Among them, the data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity identifier is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can pass the verification of the corresponding certificate chain; the data receiving end intelligent entity is used to record the intelligent entity that receives and processes the target data; the data sending end identity identifier and / or the data receiving end identity identifier is a single identity identifier or a list containing multiple identity identifiers.

11. The data generation method according to claim 1, characterized in that: Also includes: storing a data identifier identifying the target data in the payload field and / or a pre-created network data field in the target data; The data identifier is a unique random character or string.

12. The data generation method according to claim 1, characterized in that: Also includes: The priority is stored in a pre-created network data field in the target data, and the priority is used to indicate whether the data receiving end feeds back a receipt to the data sending end of the target data and the information that the receipt needs to contain.

13. The data generation method according to any one of claims 9 to 12, characterized in that: Also includes: Encrypting the network data field using a network key; The description information used to obtain the network key is stored in a description record field pre-created in the target data.

14. The data generation method according to claim 1, characterized in that: Also includes: Binding the master key ciphertext and the data receiving end identity identifier and storing them in a pre-created encryption key field in the target data; Encrypting the encryption key field using a network key; storing description information for obtaining the network key in a description record field pre-created in the target data; Among them, the data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity identifier is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can pass the verification of the corresponding certificate chain.

15. The data generation method according to claim 13 or 14, characterized in that: The description information includes a key type of the network key, and the key type of the network key includes any one of a session key, a shared key, and a public key.

16. The data generation method according to claim 15, characterized in that: When the key type of the network key is a session key, the description information further includes a session identifier, and the session identifier is used to obtain a key body of the session key.

17. The data generation method according to claim 15, characterized in that: When the key type of the network key is a shared key, the description information further includes a key name, and the key name is used to obtain the key body of the shared key.

18. The data generation method according to claim 15, characterized in that: When the key type of the network key is a public key, the description information further includes a data receiving end identity identifier, and the local private key matching the key body of the public key is determined through the data receiving end identity identifier in the description information.

19. The data generation method according to claim 1, characterized in that: Also includes: The data transmission type is stored in the target data.

20. The data generation method according to claim 19, characterized in that: The data transmission type includes any one of Bluetooth, mobile data communication, WIFI, wireless frequency band digital communication, block code scanning communication, sound wave digital communication, infrared digital communication, laser digital communication, high energy ray digital communication, and optical image data exchange.

21. The data generation method according to claim 1, characterized in that: Also includes: The data communication protocol that the data receiving end of the target data needs to support is stored in the target data.

22. The data generation method according to claim 1, characterized in that: Also includes: Encrypting the data body using a dedicated key; Encrypting the private key using the public key of the decryption authority owner to form a private key ciphertext; Binding the private key ciphertext to the decryption authority owner's identity identifier and storing them in the payload field; Among them, the decryption authority owner identity identifier is used to identify the identity of the decryption authority owner, the decryption authority owner identity identifier is bound to the decryption authority owner's digital certificate, and the decryption authority owner's digital certificate can pass the verification of the corresponding certificate chain.

23. The data generation method according to claim 1, characterized in that: The data body is stored in a file segment pre-created in the payload field or in a target file pre-created in the file segment.

24. The data generation method according to claim 23, characterized in that: Also includes: The target file processing instruction is stored in the payload field, and the target file processing instruction is used to control the data receiving end of the target data to perform corresponding processing operations on the target file.

25. The data generation method according to claim 23, characterized in that: Also includes: The file attributes of the target file are stored in the payload field, wherein the file attributes include one or more of a target file name, a target file type, a target file size, and a target file creation time.

26. The data generation method according to claim 1, characterized in that: Also includes: storing modification information of the target data in the payload field; The modification information at least includes: a modification record, an identity identifier of the modification execution end bound to the modification record, and a digital signature of the modification execution end; The modification record is used to record the modification trace of the target data during data transmission; The modification execution end identity identifier is used to identify the identity of the modification execution end that forms the modification record; the modification execution end identity identifier is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain; The modification execution end digital signature is formed after the modification execution end digitally signs the modification record, and is used to perform trustworthy authentication on the modification record.

27. The data generation method according to claim 1, characterized in that: Also includes: A function module field and a function module field are added to the payload field, wherein the function module field is used to determine the function module for processing the target data, and the function module field is used to determine the function module in the function module for further processing the target data.

28. A data processing method, characterized in that: include: Receive target data; Decrypting the payload ciphertext in the target data to obtain a decrypted payload field; Acquire the data body of the target data from the decrypted payload field; Reading a data sender identity in the target data and a payload digital signature bound to the data sender identity; Determining a data sending end of the target data by using the data sending end identity identifier; Obtaining the digital certificate of the data sending end, using the public key in the digital certificate of the data sending end to perform trusted authentication on the payload digital signature, and obtaining the authentication result of the trusted authentication of the payload field and the authentication result of the identity authentication of the data sending end; Wherein, the digital certificate of the data sending end is verified by the corresponding certificate chain.

29. The data processing method according to claim 28, characterized in that: The decrypting of the payload ciphertext in the target data includes: Decrypting the payload ciphertext using a master key or a private key of a data receiving end; The master key is obtained by decrypting the master key ciphertext stored in the target data.

30. The data processing method according to claim 29, characterized in that: The method for obtaining the master key ciphertext comprises: Obtaining description information in the target data, and obtaining a network key according to the description information; The encryption key field storing the master key ciphertext is decrypted using the network key.

31. The data processing method according to claim 29, characterized in that: The decrypting the master key ciphertext stored in the target data includes: According to the encryption type of the master key ciphertext, the master key ciphertext is decrypted using the private key, group key, shared key or session key of the data receiving end.

32. The data processing method according to claim 28, characterized in that: The authentication result of the payload digital signature is stored in an authentication status field in the target data.

33. The data processing method according to claim 32, characterized in that: Before the public key of the data sending end is used to perform trusted authentication on the payload digital signature, an authentication status field in the target data is read, and in response to an authentication result already stored in the authentication status field, the authentication result is directly output; In response to the content of the authentication status field being empty, an operation of performing trusted authentication on the payload digital signature is performed.

34. The data processing method according to claim 28, characterized in that: Also includes: The digital signature of the payload that has passed the trusted authentication is output and displayed as a watermark.

35. The data processing method according to claim 28, characterized in that: Also includes: Obtaining the priority of the target data; and determining whether to feed back a receipt and the information required to be included in the receipt to a data sending end of the target data according to the priority.

36. The data processing method according to claim 35, characterized in that: The determining whether to feed back a receipt to the data sending end of the target data and the information required to be included in the receipt according to the priority level includes: In response to the obtained priority being low, not feeding back a receipt to the data sending end; In response to the obtained priority being medium, sending a data identifier of target data to the data sending end; In response to the priority being high, the data identifier of the target data and a HASH value carrying the digital signature of the data receiving end are sent to the data sending end, wherein the HASH value is obtained by performing a Hash calculation and acquisition; The data identifier is pre-stored in the network data field and / or the payload field and is used to identify the target data.

37. The data processing method according to claim 35, characterized in that: The obtaining the priority of the target data includes: Obtaining description information in the target data, and obtaining a network key according to the description information; decrypting a network data field in the target data using the network key; The priority is obtained from the decrypted network data field.

38. The data processing method according to claim 30 or 37, characterized in that: The obtaining of the network key according to the description information includes: Acquire a key type of the network key from the description information; In response to the key type being a session key, a session identifier is obtained from the description record, and a key body of the session key is determined using the session identifier. The key body of the session key is the network key to be obtained.

39. The data processing method according to claim 30 or 37, characterized in that: The obtaining of the network key according to the description information includes: Acquire a key type of the network key from the description information; In response to the key type being a shared key, a key name is obtained from the description record, and a key body of the shared key is determined using the key name; the key body of the shared key is the network key to be obtained.

40. The data processing method according to claim 30 or 37, characterized in that: The obtaining of the network key according to the description information includes: Acquire a key type of the network key from the description information; In response to the key type being a public key, the data receiving end identity is obtained from the description record, and the data receiving end identity is used to determine a local private key matching the public key; the local private key is the network key to be obtained.

41. The data processing method according to claim 28, characterized in that: Also includes: Reading the modification record in the target data, and using the modification record to track the modification traces of the target data during the transmission process; Reading the modification execution end identity in the target data, and using the modification execution end identity to identify the modification execution end that forms the modification record; Reading the modification execution end digital signature in the target data, and using the modification execution end digital signature to perform trustworthy authentication on the modification record; The identity identifier of the modification execution end is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain.

42. The data processing method according to claim 41, characterized in that: Also includes: The modification record is displayed in a hyperlink manner.

43. The data processing method according to claim 28, characterized in that: Also includes: After receiving the target data, obtaining a data communication protocol in the target data; In response to the data receiving end not supporting the data communication protocol, exiting the data processing method.

44. The data processing method according to claim 28, characterized in that: Also includes: Obtaining a file segment in the payload field; In response to the file segment being an HTML file, the data body in the file segment is loaded according to the browser's requirement.

45. The data processing method according to claim 28, characterized in that: Acquiring the data body of the target data from the decrypted payload field, comprising: Read the private key ciphertext and the decryption authority owner identity in the payload field; Determining the decryption authority owner using the decryption authority owner identity identifier; Decrypting the private key ciphertext using the private key of the decryption authority owner to obtain the private key; Decrypting the encrypted data body using the dedicated key, thereby obtaining the data body; The identity identifier of the decryption authority owner is bound to the digital certificate of the decryption authority owner, and the digital certificate of the decryption authority owner can pass the verification of the corresponding certificate chain.

46. ​​The data processing method according to claim 28 or 45, characterized in that: Acquiring the data body of the target data from the decrypted payload field, comprising: Obtaining a file segment in the payload field; The data body is obtained from the file segment or from a target file in the file segment.

47. The data processing method according to claim 46, characterized in that: Also includes: The file attributes of the target file are obtained, and the file attributes are displayed in the form of a watermark or a pop-up window.

48. The data processing method according to claim 46, characterized in that: Also includes: Obtaining the target file processing instruction in the payload field; A corresponding processing operation is performed on the target file according to the target file processing instruction.

49. The data processing method according to claim 28, characterized in that: Also includes: Obtaining a functional module field and a function module field in the payload field; Calling the function module in the function module field to process the target data; The function module in the function module field is called to further process the target data processed by the function module.

50. A data transmission method, characterized in that: include: Get pre-generated target data; Sending the target data to a data receiving end; Wherein, the target data is generated using the data generation method described in any one of claims 1 to 28.

51. The data transmission method according to claim 50, characterized in that: Before sending the target data to the data receiving end, reading the data transmission type stored in the target data; The target data is sent to the data receiving end according to the data transmission type.

52. The data transmission method according to claim 50, characterized in that: Before sending the target data to the data receiving end, reading the data receiving end identity and the data receiving end agent in the target data; Identifying a data receiving end that receives the target data according to the data receiving end identity identifier; In response to the data receiving end agent being in an activated state, the target data is sent to the data receiving end.

53. A data generating device, characterized in that: include: A first storage module: used for acquiring a data body of target data, and storing the data body in a pre-created payload field in the target data; Digital signature module: used to digitally sign the payload field using the private key of the data sending end of the target data to form a payload digital signature; A second storage module: used for binding the payload digital signature and the data sender identity identifier and storing them in the target data; A first encryption module: used for encrypting the payload field to generate a payload ciphertext and storing it in the target data, wherein the payload ciphertext can only be decrypted by a designated data receiving end; The data sending end identity identifier is used to identify the identity of the data sending end that sends the target data; the data sending end identity identifier is bound to the digital certificate of the data sending end, and the digital certificate of the data sending end can pass the verification of the corresponding certificate chain; The payload digital signature is used to perform trustworthy authentication on the payload field and identity authentication on the data sending end.

54. The data generating device according to claim 53, characterized in that: The first encryption module is specifically used to encrypt the payload field using a master key or a public key of the data receiving end; The master key is encrypted by the second encryption module to generate a master key ciphertext which is then stored in the target data.

55. The data generating device according to claim 54, characterized in that: The second encryption module is specifically used for: Obtaining a digital certificate of the data receiving end; Encrypting the master key using the public key in the digital certificate of the data receiving end to generate the master key ciphertext, and binding the master key ciphertext to the data receiving end identity identifier and storing it in the target data; Among them, the data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity identifier is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can pass the verification of the corresponding certificate chain.

56. The data generating device according to claim 55, characterized in that: Also includes: The first binding module is used to bind the master key ciphertext with the data receiving end identity through a relationship mapping table.

57. The data generating device according to claim 55 or 56, characterized in that: The data sending end identity identifier and the data receiving end identity identifier are unique, and are bound to one or more privacy identity identifiers of the user according to the user's authorization.

58. The data generating device according to claim 57, characterized in that: The private identity identifier includes any one of a telephone number, an email address, and a social media account.

59. The data generating device according to claim 54, characterized in that: The second encryption module is specifically used for: encrypting the master key using a group key, a shared key session key, or a public certificate; The public certificate is obtained by accessing the local storage space of the data sender or a public certificate server or a blockchain, and the public certificate is verified by a root certificate or a certificate chain.

60. The data generating device according to claim 53, characterized in that: Also includes: The first creation module is used to create an authentication status field in the target data, and the authentication status field is used to store the authentication result of the payload digital signature.

61. The data generating device according to claim 53, characterized in that: Also includes: A third storage module: used for storing the data sending terminal identity and / or the data sending terminal agent in a pre-created network data field in the target data; The data sending end agent is used to record the agent that compiles and sends the target data.

62. The data generating device according to claim 53, characterized in that: Also includes, A fourth storage module: used for storing the data receiving end identity and / or the data receiving end agent in a pre-created network data field in the target data; Among them, the data receiving end identity identifier is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity identifier is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can pass the verification of the corresponding certificate chain; the data receiving end intelligent entity is used to record the intelligent entity that receives and processes the target data; the data sending end identity identifier and / or the data receiving end identity identifier is a single identity identifier or a list containing multiple identity identifiers.

63. The data generating device according to claim 53, characterized in that: Also includes: Data identification storage module: used for storing the data identification identifying the target data into the payload field and / or the pre-created network data field in the target data; The data identifier is a unique random character or string.

64. The data generating device according to claim 53, characterized in that: Also includes: Priority storage module: used to store the priority in the pre-created network data field in the target data, and the priority is used to indicate whether the data receiving end feeds back a receipt to the data sending end of the target data and the information required to be included in the receipt.

65. The data generating device according to any one of claims 61 to 64, characterized in that: Also includes: The third encryption module is used to encrypt the network data field using a network key; Description information storage module: used to store the description information used to obtain the network key in the description record field pre-created in the target data.

66. The data generating device according to claim 53, characterized in that: Also includes: A fifth storage module: used for binding the master key ciphertext and the data receiving end identity identifier and storing them in the pre-created encryption key field in the target data; A fourth encryption module: used to encrypt the encryption key field using a network key; Description information storage module: used to store the description information used to obtain the network key in the description record field pre-created in the target data. The data receiving end identity is used to identify the identity of the data receiving end that receives the target data; the data receiving end identity is bound to the digital certificate of the data receiving end, and the digital certificate of the data receiving end can be verified by the corresponding certificate chain.

67. The data generating device according to claim 65 or 66, characterized in that: The description information includes a key type of the network key, and the key type of the network key includes any one of a session key, a shared key, and a public key.

68. The data generating device according to claim 67, characterized in that: When the key type of the network key is a session key, the description information further includes a session identifier, and the session identifier is used to obtain a key body of the session key.

69. The data generating device according to claim 67, characterized in that: When the key type of the network key is a shared key, the description information further includes a key name, and the key name is used to obtain the key body of the shared key.

70. The data generating device according to claim 67, characterized in that: When the key type of the network key is a public key, the description information further includes a data receiving end identity identifier, and the local private key matching the key body of the public key is determined through the data receiving end identity identifier in the description information.

71. The data generating device according to claim 53, characterized in that: Also includes: The sixth storage module is used to store the data transmission type in the target data.

72. The data generating device according to claim 71, characterized in that: The data transmission type includes any one of Bluetooth, mobile data communication, WIFI, wireless frequency band digital communication, block code scanning communication, sound wave digital communication, infrared digital communication, laser digital communication, high energy ray digital communication, and optical image data exchange.

73. The data generating device according to claim 53, characterized in that: Also includes: The seventh storage module is used to store the data communication protocol that the data receiving end of the target data needs to support in the target data.

74. The data generating device according to claim 53, characterized in that: Also includes: A fifth encryption module: used to encrypt the data body using a dedicated key; The sixth encryption module is used to encrypt the private key using the public key of the decryption authority owner to form a private key ciphertext; An eighth storage module: used for binding the private key ciphertext with the identity identifier of the decryption authority owner and storing the binding in the payload field; Among them, the decryption authority owner identity identifier is used to identify the identity of the decryption authority owner, the decryption authority owner identity identifier is bound to the decryption authority owner's digital certificate, and the decryption authority owner's digital certificate can pass the verification of the corresponding certificate chain.

75. The data generating device according to claim 53, characterized in that: The first storage module is specifically used to store the data body in a file segment pre-created in the payload field or in a target file pre-created in the file segment.

76. The data generating device according to claim 75, characterized in that: Also includes: Instruction storage module: used to store the target file processing instruction in the payload field, and the target file processing instruction is used to control the data receiving end of the target data to perform corresponding processing operations on the target file.

77. The data generating device according to claim 75, characterized in that: Also includes: File attribute storage module: used to store the file attributes of the target file in the payload field, wherein the file attributes include one or more of the target file name, target file type, target file size and target file creation time.

78. The data generating device according to claim 53, characterized in that: Also includes: Modification information storage module: used for storing the modification information of the target data in the payload field; The modification information at least includes: a modification record, an identity identifier of the modification execution end bound to the modification record, and a digital signature of the modification execution end; The modification record is used to record the modification trace of the target data during data transmission; The modification execution end identity identifier is used to identify the identity of the modification execution end that forms the modification record; the modification execution end identity identifier is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain; The modification execution end digital signature is formed after the modification execution end digitally signs the modification record, and is used to perform trustworthy authentication on the modification record.

79. The data generating device according to claim 53, characterized in that: Also includes: Field adding module: used to add a function module field and a function module field in the payload field, the function module field is used to determine the function module for processing the target data, and the function module field is used to determine the function module in the function module for further processing the target data.

80. A data receiving end, characterized in that: include: Receiving module: used to receive target data; A first decryption module: used to decrypt the payload ciphertext in the target data to obtain the decrypted payload field; A data body acquisition module: used for acquiring the data body of the target data from the decrypted payload field; The first reading module is used to read the data sender identity in the target data and the payload digital signature bound to the data sender identity; A first determining module: used to determine the data sending end of the target data by using the data sending end identity identifier; A first trusted authentication module: used to obtain the digital certificate of the data sending end, use the public key in the digital certificate of the data sending end to perform trusted authentication on the payload digital signature, and obtain the authentication result of the trusted authentication of the payload field and the authentication result of the identity authentication of the data sending end; Wherein, the digital certificate of the data sending end is verified by the corresponding certificate chain.

81. The data receiving end according to claim 80, characterized in that: The first decryption module is specifically used to: decrypt the payload ciphertext using a master key or a private key of a data receiving end; The master key is obtained by decrypting the master key ciphertext stored in the target data through the second decryption module.

82. The data receiving end according to claim 81, characterized in that: Also includes: The third decryption module is used to obtain the description information in the target data and obtain the network key according to the description information; The encryption key field storing the master key ciphertext is decrypted using the network key.

83. The data receiving end according to claim 81, characterized in that: The second decryption module is specifically used for: According to the encryption type of the master key ciphertext, the master key ciphertext is decrypted using the private key, group key, shared key or session key of the data receiving end.

84. The data receiving end according to claim 80, characterized in that: The first trusted authentication module is further configured to store the authentication result of the payload digital signature in an authentication status field in the target data.

85. The data receiving end according to claim 84, characterized in that: The first trusted authentication module is further configured to read the authentication status field in the target data before using the public key in the digital certificate of the data sending end to perform trusted authentication on the payload digital signature, and directly output the authentication result in response to the authentication status field having an authentication result stored therein; In response to the content of the authentication status field being empty, an operation of performing trusted authentication on the payload digital signature is performed.

86. The data receiving end according to claim 80, characterized in that: Also includes: The first display module is used to output and display the digital signature of the payload that has passed the trusted authentication in the form of a watermark.

87. The data receiving end according to claim 80, characterized in that: Also includes: Priority acquisition module: used to acquire the priority of the target data; Receipt module: used to determine whether to feed back a receipt and the information required to be included in the receipt to the data sending end of the target data according to the priority.

88. The data receiving terminal according to claim 87, characterized in that: The receipt module is specifically used for: In response to the obtained priority being low, not feeding back a receipt to the data sending end; In response to the obtained priority being medium, sending a data identifier of target data to the data sending end; In response to the priority being high, sending the data identifier of the target data and a HASH value carrying the digital signature of the data receiving end to the data sending end, wherein the HASH value is obtained by performing a hash calculation on the target data or a network data field and / or a payload field in the target data; The data identifier is pre-stored in the network data field and / or the payload field and is used to identify the target data.

89. The data receiving end according to claim 87, characterized in that: The priority acquisition module specifically includes: A first acquisition unit: used to acquire description information in the target data; A second acquisition unit: configured to acquire a network key according to the description information; Decryption unit: used for decrypting the network data field in the target data using the network key; A third acquiring unit is configured to acquire the priority from the decrypted network data field.

90. The data receiving terminal according to claim 82 or 89, characterized in that: The second acquisition unit is specifically used for: Acquire a key type of the network key from the description information; In response to the key type being a session key, a session identifier is obtained from the description record, and a key body of the session key is determined using the session identifier. The key body of the session key is the network key to be obtained.

91. The data receiving terminal according to claim 82 or 89, characterized in that: The second acquisition unit is specifically used for: Acquire a key type of the network key from the description information; In response to the key type being a shared key, a key name is obtained from the description record, and a key body of the shared key is determined using the key name; the key body of the shared key is the network key to be obtained.

92. The data receiving terminal according to claim 82 or 89, characterized in that: The second acquisition unit is specifically used for: Acquire a key type of the network key from the description information; In response to the key type being a public key, the data receiving end identity is obtained from the description record, and the data receiving end identity is used to determine a local private key matching the public key; the local private key is the network key to be obtained.

93. The data receiving end according to claim 80, characterized in that: Also includes: A second reading module: used for reading the modification record in the target data; Tracking module: used to track the modification traces of target data during the transmission process by using the modification records; The third reading module is used to read the modification execution end identity in the target data; Identification module: used for identifying the modification execution end that forms the modification record by using the modification execution end identity identifier; A fourth reading module: used for reading the modification execution end digital signature in the target data; A second trusted authentication module: used to perform trusted authentication on the modification record using the digital signature of the modification execution end; The identity identifier of the modification execution end is bound to the digital certificate of the modification execution end, and the digital certificate of the modification execution end can pass the verification of the corresponding certificate chain.

94. The data receiving terminal according to claim 93, characterized in that: Also includes: The second display module is used to display the modification record in the form of a hyperlink.

95. The data receiving end according to claim 80, characterized in that: Also includes: Communication protocol acquisition module: used for acquiring the data communication protocol in the target data after receiving the target data; Exit module: used to exit the current data processing step in response to the data receiving end not supporting the data communication protocol.

96. The data receiving end according to claim 80, characterized in that: Also includes: File segment acquisition module: used to acquire the file segment in the payload field; Data body loading module: used for loading the data body in the file segment according to the browser's requirement in response to the file segment being an HTML file.

97. The data receiving end according to claim 80, characterized in that: The data ontology acquisition module is specifically used for: Read the private key ciphertext and the decryption authority owner identity in the payload field; Determining the decryption authority owner using the decryption authority owner identity identifier; Decrypting the private key ciphertext using the private key of the decryption authority owner to obtain the private key; Decrypting the encrypted data body using the dedicated key, thereby obtaining the data body; The identity identifier of the decryption authority owner is bound to the digital certificate of the decryption authority owner, and the digital certificate of the decryption authority owner can pass the verification of the corresponding certificate chain.

98. The data receiving terminal according to claim 80 or 97, characterized in that: The data ontology acquisition module is specifically used for: Obtaining a file segment in the payload field; The data body is obtained from the file segment or from a target file in the file segment.

99. The data receiving end according to claim 98, characterized in that: Also includes: File attribute acquisition module: used to acquire the file attribute of the target file; The third display module is used to display the file attributes by means of a watermark or a pop-up window.

100. The data receiving end according to claim 98, characterized in that: Also includes: Instruction acquisition module: used for acquiring the target file processing instruction in the payload field; Execution module: used for executing corresponding processing operations on the target file according to the target file processing instruction.

101. The data receiving end according to claim 80, characterized in that: Also includes: Field acquisition module: used to acquire the function module field and the function module field in the payload field; A first calling module: used for calling the function module in the function module field to process the target data; The second calling module is used to call the function module in the function module field to further process the target data processed by the function module.

102. A data transmitting end, characterized in that: include: The data generating device of any one of claims 53 to 79: used to generate target data; Target data acquisition module: used to acquire the target data; Target data sending module: used for sending the acquired target data to a data receiving end.

103. The data transmitting end according to claim 102, characterized in that: Also includes: A transmission type reading module: used for reading the data transmission type stored in the target data before sending the target data to the data receiving end; The target data sending module is specifically configured to send the target data to the data receiving end according to the data transmission type.

104. The data transmitting end according to claim 102, characterized in that: Also includes: A receiving end information reading module: used for reading the data receiving end identity and the data receiving end intelligent body in the target data before sending the target data to the data receiving end; Identification module: used to identify the data receiving end according to the identity identifier of the data receiving end; The target data sending module is specifically used to send the target data to the data receiving end in response to the data receiving end agent being in an activated state.

105. An electronic terminal, characterized in that: It comprises a processor and a memory connected to the processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 52 are executed.

106. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 52 are implemented.

107. A communication system, characterized in that: It comprises a data receiving end as described in any one of claims 80 to 101 and a data sending end as described in any one of claims 102 to 104.

Images