Password protection method and apparatus for data communication, device, and storage medium

Abstract

The present application relates to the technical field of vehicle-to-infrastructure wireless communications, and discloses a password protection method and apparatus for data communication, a device, and a storage medium. The method comprises: on the basis of a data transmission scenario of a target device of a device computation layer, determining a Chinese national cryptographic algorithm and a key system corresponding to a data communication process; on the basis of the key system, determining a target key corresponding to a data transmission layer in the data communication process, wherein the data transmission layer comprises at least one of an application data layer, a network communication layer, and the device computation layer; and performing password protection on communication data in the data communication process on the basis of the target key and the Chinese national cryptographic algorithm. According to the technical solution, the data transmission scenario and the data transmission layer are taken into account to determine the target key and the Chinse national cryptographic algorithm, so as to perform password protection on the communication data in the data communication process, thereby achieving multi-layered defence in depth, and improving the security and reliability of data communications.

Description

A data communication password protection method, device, equipment and storage medium Technical Field

[0001] The embodiments of the present application relate to the field of computer communications, in particular to the field of vehicle-ground wireless communication technology, and specifically to a cryptographic protection method, apparatus, device, and storage medium for data communications. Background Art

[0002] For rail transit train control systems that use wireless communication systems to transmit two-way data between trains and the ground, since the transmission medium of the wireless communication system exists in open space, there are risks such as unauthorized access and information theft. Therefore, cryptographic technology is needed to protect the wireless communication between trains and the ground to ensure the authenticity of the identities of both parties in the information transmission, the confidentiality of the transmitted data, and the integrity of the transmitted data.

[0003] At present, in order to control the risks of unauthorized access and information theft in the open space transmission medium of wireless communication systems, most of them adopt secure communication protocols and application data layer data encryption to protect the integrity or confidentiality of vehicle-ground wireless communication data, mainly using international standard cryptographic algorithms to achieve the integrity or confidentiality of data transmission.

[0004] However, existing technologies cannot simultaneously guarantee the authenticity of the identities of both parties in information transmission, the confidentiality of the transmitted data, and the integrity of the transmitted data; at a single level, such as the application layer and network layer, cryptographic operations on data cannot achieve in-depth defense; there is a lack of key management mechanisms to ensure the security of keys and thus the security of cryptographic technology cannot be guaranteed; the use of international standard cryptographic algorithms cannot guarantee independent control. Summary of the Invention

[0005] The present application provides a data communication cryptographic protection method, apparatus, device and storage medium to improve the security and reliability of data communications.

[0006] According to one aspect of the present application, a method for password protection of data communication is provided, the method comprising:

[0007] Determine the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device at the device computing layer;

[0008] Determining, according to the key system, a target key corresponding to a data transmission layer during data communication; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer;

[0009] According to the target key and the national secret algorithm, the communication data is cryptographically protected during the data communication process.

[0010] According to another aspect of the present application, a password protection device for data communication is provided, the device comprising:

[0011] The scenario analysis module is used to determine the national encryption algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer;

[0012] A key determination module, configured to determine, according to the key system, a target key corresponding to a data transmission layer during data communication; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer;

[0013] The data protection module is used to perform cryptographic protection on the communication data during the data communication process according to the target key and the national secret algorithm.

[0014] According to another aspect of the present application, an electronic device is provided, comprising:

[0015] one or more processors;

[0016] a memory for storing one or more programs;

[0017] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the data communication cryptographic protection methods provided in the embodiments of the present application.

[0018] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, it implements any one of the cryptographic protection methods for data communication provided in the embodiments of the present application.

[0019] This application determines the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer; determines the target key corresponding to the data transmission layer in the data communication process based on the key system; the data transmission layer includes at least one of the application data layer, the network communication layer, and the device computing layer; and cryptographically protects the communication data during the data communication process based on the target key and the national secret algorithm. The above technical solution, by combining the data transmission scenario and the data transmission layer to determine the target key and the national secret algorithm to cryptographically protect the communication data during the data communication process, achieves multi-level in-depth defense, and helps to improve the security and reliability of data communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] FIG1 is a flow chart of a method for password protection of data communication provided according to a first embodiment of the present application;

[0021] FIG2 is a flow chart of a method for password protection of data communication provided according to a second embodiment of the present application;

[0022] FIG3 is a schematic structural diagram of a data communication password protection device provided according to a third embodiment of the present application;

[0023] FIG4 is a schematic diagram of the structure of an electronic device that implements the password protection method for data communication according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In addition, it should be noted that in the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of relevant data such as data transmission scenarios and national secret algorithms involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0027] Example 1

[0028] FIG1 is a flow chart of a data communication password protection method provided in accordance with the first embodiment of the present application. This embodiment is applicable to situations where communication data is password protected during vehicle-ground wireless communication. The method can be performed by a data communication password protection device. The data communication password protection device can be implemented in the form of hardware and / or software. The data communication password protection device can be configured in a computer device, such as a server. As shown in FIG1 , the method includes:

[0029] S110. Determine the national secret algorithm and key system corresponding to the data communication process according to the data transmission scenario of the target device of the device computing layer.

[0030] Among them, the device computing layer is an important component of the information technology architecture, mainly covering hardware devices and computing resources. At this level, it mainly includes hardware devices such as computers, servers, storage devices, network devices, as well as related software and services such as operating systems, virtualization technology, and computing resource management. The target device refers to the hardware equipment involved in data communication, including at least one of vehicle-mounted equipment, ground equipment, wireless communication equipment, national secret equipment, and IPSecVPN (Internet Protocol Security Virtual Private Network) equipment. The data transmission scenario refers to the scenario in which the target device conducts data communication, including at least one cryptographic application scenario of vehicle-to-ground wireless communication such as vehicle remote control, vehicle network communication, and vehicle diagnosis and maintenance. The data communication process refers to the process of sending communication information from one location to another. National cryptographic algorithms are domestically developed and independently controlled cryptographic algorithms. They have established industry and national standards for cryptographic systems and are used to protect the security of information systems. These algorithms include at least one of the following: SM3 (Secure Hash Algorithm) for message authentication code calculation and key derivation; SM4 (Block Cipher Algorithm) for symmetric encryption and decryption calculations and key derivation; and SM2 (Elliptic Curve Public Key Cryptographic Algorithm) for key negotiation. A key system refers to the collection of keys used in cryptographic protection.

[0031] For example, the data transmission scenario of the target device of the device computing layer is analyzed to determine the national secret algorithm and key system required for data communication in the data transmission scenario.

[0032] Optionally, the key system refers to a set of keys used in the vehicle-ground wireless communication scenario, including at least one key such as a master key, a train control application key, a working key, a device key and a session key.

[0033] The master key is the key used to establish a secure management channel for national security equipment. The train control application key is the key used to generate or protect the session key. The working key is an intermediate key generated during the key negotiation process and used to protect the negotiation of the session key. The device key is the key used to identify the device. The session key is the key used to ensure the integrity and confidentiality of data transmission.

[0034] It should be noted that the key system established for different devices is also different; for example, the key system of national secret equipment includes three layers of keys: master key, train control application key and session key; the key system of IPSecVPN equipment includes three layers of keys: device key, work key and session key.

[0035] Furthermore, after determining the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device at the device computing layer, the key lifecycle management rules corresponding to the key system can be determined based on the data transmission scenario of the target device; and the key system can be managed based on the key lifecycle management rules.

[0036] Among them, key lifecycle management rules refer to the rules and measures taken for key generation, key distribution, key storage, key backup, key use, key update, and key destruction.

[0037] For example, key generation is completed by national secret equipment; key distribution methods include offline distribution and online distribution; key storage is protected by microelectronics or cryptographic technology; key backup is protected by cryptographic technology; key use follows the principle of clear and single key purpose and controlled key use authorization; key update is to replace keys that have expired or have leakage problems; key destruction is the irreversible destruction of keys replaced by key update;

[0038] Specifically, based on the application scenarios of train-to-ground wireless communication fault handling, operation and maintenance of the train control system, the train control application keys and train-to-ground session keys are stored in the database with integrity and confidentiality protection, and backed up and archived for decrypting historical train-to-ground data. The use of storage, backup and archiving keys is strictly controlled.

[0039] It should be noted that key lifecycle management rules are formulated separately for each key in the key system.

[0040] It is understandable that by combining data transmission scenarios and establishing targeted key lifecycle management rules for the key system, the security and credibility of the keys can be improved, and sensitive information and systems can be protected from potential threats.

[0041] S120. Determine, according to the key system, a target key corresponding to a data transmission layer during data communication; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer.

[0042] The target key refers to the key required by the data transmission layer during data communication. The application data layer is a crucial component of the information technology architecture, encompassing both the application and data layers. The application layer is the highest layer in the computer network architecture, responsible for handling communications between user applications. It provides a series of network services and protocols that enable applications on different devices to communicate and interact. The data layer is the part of the computer system responsible for handling data storage and access. It provides a set of interfaces and methods that allow applications to create, read, update, and delete data, including data storage and management technologies such as databases, file systems, and caches. The network communication layer is a crucial component of the information technology architecture, encompassing both the network and communication layers. The network layer handles network interconnection issues, routing data packets from source nodes to destination nodes and ensuring they are not lost or damaged during transmission. The communication layer is responsible for data transmission and communication between different devices, ensuring reliable data transmission and flow control between nodes.

[0043] Exemplarily, the data transmission layer in the data communication process is identified, and the target key corresponding to the data transmission layer is extracted from the key system. For example, if the data transmission layer is the application data layer, the session key corresponding to the application data layer is extracted from the key system as the target key.

[0044] S130. Perform cryptographic protection on the communication data during the data communication process according to the target key and the national secret algorithm.

[0045] Among them, cryptographic protection refers to measures to protect the security, integrity and authenticity of communication data.

[0046] Exemplarily, the communication data passing through the data transmission layer during the data communication process is cryptographically protected by the national secret algorithm and the target key corresponding to the data transmission layer to ensure the authenticity, integrity and confidentiality of the communication data during the data communication process.

[0047] The embodiments of the present application determine the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer; determine the target key corresponding to the data transmission layer in the data communication process based on the key system; the data transmission layer includes at least one of the application data layer, the network communication layer, and the device computing layer; and cryptographically protect the communication data during the data communication process based on the target key and the national secret algorithm. The above technical solution, by combining the data transmission scenario and the data transmission layer to determine the target key and the national secret algorithm to cryptographically protect the communication data during the data communication process, implements multi-layered in-depth defense and helps improve the security and reliability of data communications.

[0048] Example 2

[0049] FIG2 is a flowchart of a method for cryptographic protection of data communication provided in accordance with the second embodiment of the present application. Based on the technical solutions of the above embodiments, this embodiment refines “performing cryptographic protection on communication data during data communication according to the target key and the national secret algorithm” into “performing cryptographic protection on the initial data of the application data layer based on the target key and the national secret algorithm to obtain candidate data, and sending the candidate data to the network communication layer; performing cryptographic protection on the candidate data based on the target key and the national secret algorithm to obtain target data; and performing cryptographic protection on the target device of the device computing layer based on the target key and the national secret algorithm”. It should be noted that for the parts not described in detail in the embodiments of the present application, please refer to the relevant descriptions of other embodiments. As shown in FIG2 , the method includes:

[0050] S210. Determine the national secret algorithm and key system corresponding to the data communication process according to the data transmission scenario of the target device of the device computing layer.

[0051] S220. Determine, according to the key system, a target key corresponding to a data transmission layer in a data communication process; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer.

[0052] S230. Based on the target key and the national secret algorithm, the initial data of the application data layer is cryptographically protected to obtain candidate data, and the candidate data is sent to the network communication layer.

[0053] The initial data refers to the communication data sent by the data sender and required for data communication.

[0054] Optionally, cryptographic protection of the initial data of the application data layer based on the target key and the national secret algorithm can be achieved by establishing a data processing layer in the application data layer according to the national secret algorithm and the target key corresponding to the application data layer; in the data processing layer, cryptographic protection of the initial data is performed through the target key and the national secret algorithm corresponding to the application data layer to obtain candidate data.

[0055] The data processing layer is a specialized layer within the application data layer specifically used to perform cryptographic operations on initial data. These cryptographic operations include at least one of message authentication code calculations to ensure the authenticity and integrity of application messages and symmetric encryption and decryption calculations to ensure confidentiality. Candidate data refers to communication data protected by cryptographic techniques at the application data layer.

[0056] Furthermore, the initial data is cryptographically protected by applying the target key corresponding to the data layer and the national secret algorithm, and the candidate data obtained can be: the authenticity and integrity of the initial data are verified by applying the target key corresponding to the data layer and the message authentication code algorithm in the national secret algorithm; the initial data is encrypted and protected according to the target key corresponding to the network communication layer and the encryption and decryption algorithm in the national secret algorithm to obtain the candidate data.

[0057] The message authentication code algorithm refers to an algorithm used to ensure the authenticity and integrity of application messages. This message authentication code algorithm is implemented based on the session key used for authenticity and integrity verification, and can be the SM3 cryptographic hash algorithm used for calculating the message authentication code and key derivation. The encryption and decryption algorithm refers to an algorithm used to ensure the confidentiality of application messages. This encryption and decryption algorithm is implemented based on the session key used for confidentiality assurance, and can be the SM4 symmetric encryption algorithm used for symmetric encryption and decryption calculations and key derivation.

[0058] Exemplarily, the authenticity and integrity of the initial data are verified by using a session key and a message authentication code algorithm for authenticity and integrity verification; after the verification is passed, the confidentiality of the initial data is protected by using a session key and an encryption and decryption algorithm for confidentiality assurance to obtain candidate data.

[0059] S240. Based on the target key and the national secret algorithm, the candidate data is cryptographically protected to obtain the target data.

[0060] The target data refers to the communication data that is protected by the network communication layer cryptographic technology and needs to be sent to the data recipient.

[0061] Optionally, based on the target key and the national secret algorithm, the candidate data is cryptographically protected to obtain the target data. The candidate data can be integrity verified by using the target key corresponding to the network communication layer and the message authentication code algorithm in the national secret algorithm to obtain intermediate data; the intermediate data is encrypted and protected by using the target key corresponding to the network communication layer and the encryption and decryption algorithm in the national secret algorithm to obtain the target data.

[0062] The intermediate data refers to the communication data obtained after verifying the authenticity and integrity of the candidate data.

[0063] Exemplarily, the authenticity and integrity of the candidate data are verified by using a session key and a message authentication code algorithm for authenticity and integrity verification to obtain intermediate data; the confidentiality of the intermediate data is protected by using a session key and an encryption and decryption algorithm for confidentiality assurance to obtain target data.

[0064] It should be noted that the communication data is communicated via the IPSec (Internet Protocol Security) protocol at the network communication layer.

[0065] S250: Based on the target key and the national secret algorithm, the target device of the device computing layer is cryptographically protected.

[0066] Optionally, the target device of the device computing layer is cryptographically protected by the target key corresponding to the device computing layer and the identity authentication algorithm in the national secret algorithm.

[0067] Among them, the identity authentication algorithm refers to an algorithm used to verify and confirm the user's identity. The identity authentication algorithm is implemented based on the device key used for administrator identity authentication, and includes at least one of challenge-response two-way identity authentication and biometric recognition based on symmetric encryption algorithm or message authentication code calculation.

[0068] Exemplarily, the authenticity of the identity of the administrator who needs to log in to the target device is verified through the device key corresponding to the device computing layer and the identity authentication algorithm in the national secret algorithm; if the verification is successful, the administrator is allowed to log in to the target device and manage the key, log and other password data of the target device to ensure the normal operation of the password protection of the target device; if the verification fails, the administrator is prohibited from logging in to the target device. The embodiment of the present application determines the national secret algorithm and key system corresponding to the data communication process according to the data transmission scenario of the target device of the device computing layer; determines the target key corresponding to the data transmission layer in the data communication process according to the key system; the data transmission layer includes at least one of the application data layer, the network communication layer and the device computing layer; based on the target key and the national secret algorithm, the initial data of the application data layer is cryptographically protected to obtain candidate data, and the candidate data is sent to the network communication layer; based on the target key and the national secret algorithm, the candidate data is cryptographically protected to obtain the target data; based on the target key and the national secret algorithm, the target device of the device computing layer is authenticated. The above technical solution avoids the problem of failure of protection measures of the entire system due to failure of protection measures at a single level by adopting a multi-level, defense-in-depth cryptographic protection method for the application data layer, network communication layer and device computing layer, and helps to improve the security and reliability of data communication.

[0069] Example 3

[0070] FIG3 is a schematic diagram of the structure of a data communication password protection device provided in accordance with the third embodiment of the present application. The device is applicable to the case of password protection of communication data during vehicle-ground wireless communication. The data communication password protection device can be implemented in the form of hardware and / or software. The data communication password protection device can be configured in a computer device, such as a server. As shown in FIG3, the device includes:

[0071] The scenario analysis module 310 is used to determine the national encryption algorithm and key system corresponding to the data communication process according to the data transmission scenario of the target device of the device computing layer;

[0072] A key determination module 320 is configured to determine a target key corresponding to a data transmission layer during data communication based on a key system; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer;

[0073] The data protection module 330 is used to perform cryptographic protection on the communication data during the data communication process according to the target key and the national encryption algorithm.

[0074] The embodiments of the present application determine the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer; determine the target key corresponding to the data transmission layer in the data communication process based on the key system; the data transmission layer includes at least one of the application data layer, the network communication layer, and the device computing layer; and cryptographically protect the communication data during the data communication process based on the target key and the national secret algorithm. The above technical solution, by combining the data transmission scenario and the data transmission layer to determine the target key and the national secret algorithm to cryptographically protect the communication data during the data communication process, implements multi-layered in-depth defense and helps improve the security and reliability of data communications.

[0075] Optionally, the data protection module 330 includes:

[0076] The application data layer protection unit is used to perform cryptographic protection on the initial data of the application data layer based on the target key and the national secret algorithm, obtain candidate data, and send the candidate data to the network communication layer;

[0077] The network communication layer protection unit is used to perform cryptographic protection on the candidate data based on the target key and the national secret algorithm to obtain the target data;

[0078] The device computing layer protection unit is used to perform cryptographic protection on the target device of the device computing layer based on the target key and the national secret algorithm.

[0079] Optionally, apply a data layer protection unit, specifically for:

[0080] According to the national secret algorithm and the target key corresponding to the application data layer, a data processing layer is established in the application data layer;

[0081] In the data processing layer, the initial data is cryptographically protected by applying the target key and national secret algorithm corresponding to the data layer to obtain candidate data.

[0082] Optional network communication layer protection unit, specifically used for:

[0083] Through the target key corresponding to the network communication layer and the message authentication code algorithm in the national secret algorithm, the candidate data is verified for integrity to obtain the intermediate data;

[0084] The intermediate data is encrypted and protected through the target key corresponding to the network communication layer and the encryption and decryption algorithm in the national secret algorithm to obtain the target data.

[0085] Optional device computing layer protection unit, specifically used to:

[0086] The target device of the device computing layer is cryptographically protected through the target key corresponding to the device computing layer and the identity authentication algorithm in the national secret algorithm.

[0087] Optionally, the device further includes a key management module, configured to:

[0088] Determine the key lifecycle management rules corresponding to the key system based on the data transmission scenario of the target device;

[0089] Manage the key system based on key lifecycle management rules.

[0090] The cryptographic protection device for data communication provided in the embodiments of the present application can execute the cryptographic protection method for data communication provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing each cryptographic protection method for data communication.

[0091] Example 4

[0092] 4 is a block diagram of an electronic device 410 that implements a cryptographic protection method for data communication of an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0093] As shown in Figure 4, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 into the random access memory (RAM) 413. In RAM413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, ROM412 and RAM413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0094] Multiple components in electronic device 410 are connected to I / O interface 415, including an input unit 416, such as a keyboard, mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a magnetic disk, optical disk, etc.; and a communication unit 419, such as a network card, modem, wireless communication transceiver, etc. The communication unit 419 allows electronic device 410 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0095] Processor 411 can be various general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. Processor 411 executes the various methods and processes described above, such as the cryptographic protection method for data communications.

[0096] In some embodiments, the password protection method for data communication can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the password protection method for data communication described above can be performed. Alternatively, in other embodiments, processor 411 can be configured as the password protection method for data communication by any other appropriate means (for example, by means of firmware).

[0097] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments include being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data communication cryptographic protection device, so that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0099] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0101] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0102] A computing system includes clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server can be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0103] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0104] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A password protection method for data communication, characterized in that: include: Determine the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device at the device computing layer; Determine, according to the key system, the target key corresponding to the data transmission layer during the data communication process; The data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer; According to the target key and the national secret algorithm, the communication data is cryptographically protected during the data communication process.

2. The method according to claim 1, characterized in that The step of performing cryptographic protection on communication data during data communication according to the target key and the national secret algorithm includes: Based on the target key and the national secret algorithm, cryptographically protect the initial data of the application data layer to obtain candidate data, and send the candidate data to the network communication layer; Based on the target key and the national secret algorithm, the candidate data is cryptographically protected to obtain the target data; Based on the target key and the national secret algorithm, the target device of the device computing layer is cryptographically protected.

3. The method according to claim 2, characterized in that The step of performing cryptographic protection on the initial data of the application data layer based on the national secret algorithm and the target key to obtain candidate data includes: Establishing a data processing layer in the application data layer according to the national secret algorithm and the target key corresponding to the application data layer; In the data processing layer, the initial data is cryptographically protected using the target key corresponding to the application data layer and the national secret algorithm to obtain candidate data.

4. The method according to claim 2, characterized in that The step of performing cryptographic protection on the candidate data based on the national secret algorithm and the target key to obtain the target data includes: Performing integrity check on the candidate data using the target key corresponding to the network communication layer and the message authentication code algorithm in the national secret algorithm to obtain intermediate data; The intermediate data is encrypted and protected by the target key corresponding to the network communication layer and the encryption and decryption algorithm in the national secret algorithm to obtain the target data.

5. The method according to claim 2, characterized in that The cryptographic protection of the target device of the device computing layer based on the national secret algorithm and the target key includes: The target device of the device computing layer is cryptographically protected by the target key corresponding to the device computing layer and the identity authentication algorithm in the national secret algorithm.

6. The method according to claim 1, characterized in that After determining the national secret algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer, it also includes: Determine the key lifecycle management rules corresponding to the key system based on the data transmission scenario of the target device; The key system is managed based on the key lifecycle management rules.

7. A password protection device for data communication, characterized in that: include: The scenario analysis module is used to determine the national encryption algorithm and key system corresponding to the data communication process based on the data transmission scenario of the target device in the device computing layer; A key determination module, configured to determine, according to the key system, a target key corresponding to a data transmission layer during data communication; the data transmission layer includes at least one of an application data layer, a network communication layer, and a device computing layer; The data protection module is used to perform cryptographic protection on the communication data during the data communication process according to the target key and the national secret algorithm.

8. The device according to claim 7, characterized in that The data protection module includes: An application data layer protection unit, configured to perform cryptographic protection on the initial data of the application data layer based on the target key and the national secret algorithm, obtain candidate data, and send the candidate data to the network communication layer; A network communication layer protection unit, configured to perform cryptographic protection on the candidate data based on the target key and the national secret algorithm to obtain target data; The device computing layer protection unit is used to perform cryptographic protection on the target device of the device computing layer based on the target key and the national secret algorithm.

9. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the password protection method for data communication according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the password protection method for data communication according to any one of claims 1 to 6 is implemented.

Images