Data transmission method and apparatus

Abstract

Provided are a data transmission method and apparatus, relating to the technical field of computers. The method comprises: a transmitting node encrypts, on the basis of a symmetric key of the transmitting node, data to be transmitted, so as to obtain data ciphertext; the transmitting node encapsulates the symmetric key on the basis of a public key of the transmitting node and a homomorphic encryption algorithm, so as to obtain first key ciphertext; the transmitting node transmits the data ciphertext and the first key ciphertext to an intermediate node; the intermediate node executes a re-encapsulation operation on the first key ciphertext on the basis of a key switch key, so as to obtain second key ciphertext, an encapsulation key of the second key ciphertext being a public key of a receiving node; the intermediate node transmits the data ciphertext and the second key ciphertext to the receiving node; the receiving node decrypts the second key ciphertext to obtain the symmetric key; and then decrypts the data ciphertext by using the symmetric key, so as to obtain plaintext of the data to be transmitted. In this way, end-to-end secure data transmission is achieved, while computational complexity and communication volume during key establishment are effectively reduced.

Description

A data transmission method and apparatus

[0001] This application claims priority to Chinese Patent Application No. 202411981830.7, filed on December 27, 2024, entitled "A Data Transmission Method and Apparatus", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer technology, and in particular to a data transmission method and apparatus. Background Technology

[0003] In edge-cloud collaborative computing scenarios, users can assign tasks to cloud-side computing nodes. To ensure the reasonable allocation of cloud-side computing tasks, a load balancer solution needs to be deployed on the cloud side. Users only need to know the load balancer's IP address, not the IP address of the actual computing node performing the computation, ensuring ease of use. Simultaneously, the load balancer can remove downtime nodes, monitor traffic, balance computing load, and improve response speed, thereby enhancing service performance and stability. However, to protect user privacy, end-to-end encryption is required between cloud-side computing nodes and edge devices. In this scenario, users can only see the load balancer, but load balancers are often untrusted due to their complex software stack or being provided by third parties, posing a challenge to implementing end-to-end encryption. Summary of the Invention

[0004] The embodiments of this application provide a data transmission method and apparatus that achieves end-to-end secure data transmission while effectively reducing the computational complexity and communication volume in the key establishment process.

[0005] In a first aspect, this application provides a data transmission method applied to a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node. The method includes: the sending node encrypting the data to be transmitted based on its own symmetric key to obtain ciphertext; the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext; the sending node sending the data ciphertext and the first key ciphertext to the intermediate node, so that the intermediate node sends the data ciphertext and the second key ciphertext to the receiving node, wherein the second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key switch key (KSK), the encapsulation key of the second key ciphertext is the public key of the receiving node, and the second key ciphertext is used to enable the receiving node to obtain the symmetric key.

[0006] The data transmission method provided in this application ensures that during the data transmission from the sending node to the receiving node, the data is encrypted only at the sending node and decrypted at the receiving node. During other processes, the data remains encrypted and cannot be read by intermediate nodes, thus achieving secure end-to-end data transmission. On the other hand, the sending node encapsulates its own symmetric key using a homomorphic encryption algorithm, which facilitates subsequent intermediate nodes to use KSK to convert the encapsulation key of the key ciphertext from the sending node's public key to the receiving node's public key without decryption. This does not rely on the trust of intermediate nodes and can also ensure the security of key transmission. At the same time, the key conversion key is used to perform a re-encapsulation operation on the first key ciphertext, converting the encapsulation key of the symmetric key into the receiving node's private key or public key. This eliminates the need for the sender and receiver to negotiate the key, effectively reducing the communication volume during the key establishment phase.

[0007] In one possible implementation, the key conversion key is generated by the key configuration node, and the intermediate node obtains the key conversion key by receiving the key conversion key sent by the key configuration node.

[0008] The key configuration node generates a key conversion key, which is then distributed to intermediate nodes. This allows the intermediate nodes to perform a re-encapsulation operation on the first key ciphertext, converting the encapsulation key of the first key ciphertext into the public and private keys of the receiving nodes. This ensures that the re-encapsulated key ciphertext can only be decrypted by the private key of the receiving nodes, thus guaranteeing the channel security of the receiving nodes.

[0009] In another possible implementation, the public-private key pair of the receiving node is generated by itself; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

[0010] In this possible implementation, the public-private key pair of the receiving node is generated by itself. The receiving node sends its own public key to the key configuration node so that the key configuration node can generate a key conversion key based on the private key of the sending node and the public key of the receiving node. Since the receiving node and the key configuration node are transmitting the public key, there is no need to establish a secure channel, thus saving communication volume.

[0011] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0012] When the public and private key pair of the receiving node is configured for the key configuration node, the key configuration node can directly obtain the private key of the receiving node. Therefore, it can use the private key of the sending node and the private key of the receiving node to generate a key conversion key without having to collect the public and private keys of the receiving node.

[0013] Optionally, the symmetric key of the sending node can be generated by the sending node itself, thus eliminating the need for a key configuration node and reducing the amount of communication between the key configuration node and the sending node.

[0014] In another possible implementation, the public key of the sending node is configured by the key configuration node; the data transmission method provided in this application also includes the sending node receiving the public key of the sending node sent by the key configuration node.

[0015] In another possible implementation, the data transmission method provided in this application can be applied to secure end-to-end data transmission in various scenarios. For example, it can be applied to edge-cloud collaborative computing scenarios, where the sending node is an edge device, the intermediate node is a cloud-side load balancer, the key configuration node is a cloud-side trusted node, and the receiving node is a cloud-based high-security computing node. As another example, the data transmission method provided in this application can also be applied to cluster confidential computing scenarios, where the sending node is any computing node, the intermediate node is a switching node, the key configuration node is a trusted node, and the receiving node is any computing node other than the sending node. As yet another example, the data transmission method provided in this application can also be applied to trusted data circulation scenarios, where the sending node is a data provider node, the intermediate node is a data transfer platform, the key configuration node is a trusted node, and the receiving node is a data user node.

[0016] In another possible implementation, homomorphic encryption algorithms are based on the ring learning with errors (RLWE) problem or the learning with errors (LWE) problem.

[0017] Secondly, this application also provides a data transmission method applied to a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node. The method includes: the receiving node receiving encrypted data and a second key ciphertext sent by the intermediate node, wherein the encrypted data is obtained by encrypting the symmetric key of the sending node, the second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key, the encapsulation key of the second key ciphertext is the public key of the receiving node, and the first key ciphertext is obtained by the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm; the receiving node decrypts the second key ciphertext based on its private key and a homomorphic decryption algorithm to obtain the plaintext symmetric key; and the receiving node decrypts the encrypted data based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0018] In this application, the encrypted data and key sent by the sending node can only be decrypted and opened by the receiving node. This ensures the security of data transmission while eliminating the need for the sending node and each receiving node to establish a separate key, effectively reducing communication costs.

[0019] In one possible implementation, the public-private key pair of the receiving node is generated by itself; the data transmission method provided in this application further includes: the receiving node sending its public key to the key configuration node; and the key conversion key being generated by the key configuration node based on the sending node's private key and the receiving node's public key.

[0020] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the data transmission method provided in this application further includes: the receiving node receiving the public-private key pair of the receiving node sent by the configuration node; and the key conversion key being generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0021] Thirdly, this application provides a data transmission method applied to a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: the key configuration node configuring a public-private key pair for the sending node, and sending the public key of the public-private key pair to the sending node, so that the sending node encapsulates its own symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext, the symmetric key being used to encrypt the data to be transmitted to obtain data ciphertext; the key configuration node generating a key conversion key based on the private key of the sending node and the public key of the receiving node, or generating a key conversion key based on the private key of the sending node and the private key of the receiving node; sending the key conversion key to the intermediate node, so that the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext, the encapsulation key of the second key ciphertext being the public key of the receiving node; sending the data ciphertext and the second key ciphertext to the receiving node; the receiving node decrypting the second key ciphertext to obtain a symmetric key, and then decrypting the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0022] In another possible implementation, the public-private key pair of the receiving node is generated by the receiving node; the data transmission method provided in this application also includes: the key configuration node receiving the public key of the receiving node sent by the receiving node.

[0023] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the data transmission method provided in this application also includes: the key configuration node sending the public-private key pair of the receiving node to the receiving node.

[0024] In another possible implementation, the data transmission method provided in this application further includes: a key configuration node generating public parameters; and the key configuration node configuring a public-private key pair for the sending node based on the public parameters.

[0025] Fourthly, this application provides a data transmission method applied to a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: the intermediate node receiving ciphertext data and a first key ciphertext sent by the sending node, the ciphertext data being encrypted based on the symmetric key of the sending node, and the first key ciphertext being encapsulated based on the public key of the sending node and a homomorphic encryption algorithm to encapsulate the symmetric key; the intermediate node receiving a key conversion key sent by the key configuration node; the intermediate node performing a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext, the encapsulation key of the second key ciphertext being the public key of the receiving node; the intermediate node sending the ciphertext data and the second key ciphertext to the receiving node, so that the receiving node decrypts the second key ciphertext to obtain a symmetric key, and then decrypts the ciphertext data based on the symmetric key to obtain the plaintext data to be transmitted.

[0026] In another possible implementation, the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node; or, the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0027] Fifthly, this application provides a data transmission method applied to a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: the key configuration node configuring a public-private key pair for the sending node and sending the public key of the public-private key pair to the sending node; the key configuration node generating a key conversion key based on the private key of the sending node and the public key of the receiving node, or generating a key conversion key based on the private key of the sending node and the private key of the receiving node; the key configuration node sending the key conversion key to the intermediate node; and the sending node encrypting the data to be transmitted based on its own symmetric key to obtain ciphertext. The sending node encapsulates the symmetric key using its own public key and a homomorphic encryption algorithm to obtain the first key ciphertext. The sending node sends the data ciphertext and the first key ciphertext to the intermediate node. The intermediate node performs a re-encapsulation operation on the first key ciphertext using the key transformation key to obtain the second key ciphertext. The encapsulation key of the second key ciphertext is the public key of the receiving node. The intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The receiving node decrypts the second key ciphertext using its private key and a homomorphic decryption algorithm to obtain the symmetric key plaintext. The receiving node decrypts the data ciphertext using the symmetric key to obtain the plaintext of the data to be transmitted.

[0028] Sixthly, this application provides a data transmission device, deployed as a sending node in a data transmission system. The data transmission system includes a sending node, an intermediate node, a key configuration node, and a receiving node. The data transmission device provided in this application includes an encryption module, an encapsulation module, and a sending module. The encryption module is used to encrypt the data to be transmitted based on its own symmetric key to obtain ciphertext. The encapsulation module is used to encapsulate the symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext. The sending module is used to send the data ciphertext and the first key ciphertext to the intermediate node, so that the intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The second key ciphertext is used to enable the receiving node to obtain the symmetric key.

[0029] In one possible implementation, the key conversion key is generated by the key configuration node, and the intermediate node obtains the key conversion key by receiving the key conversion key sent by the key configuration node.

[0030] In another possible implementation, the public-private key pair of the receiving node is generated by itself; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

[0031] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0032] Optionally, the symmetric key of the sending node is generated by the sending node itself.

[0033] In another possible implementation, the public key of the sending node is configured by the key configuration node; the data transmission apparatus provided in this application also includes a receiving module for receiving the public key of the sending node sent by the key configuration node.

[0034] In another possible implementation, the data transmission system provided in this application can be applied to secure end-to-end data transmission in various scenarios. For example, it can be applied to edge-cloud collaborative computing scenarios, where the sending node is an edge device, the intermediate node is a cloud-side load balancer, the key configuration node is a cloud-side trusted node, and the receiving node is a cloud-based high-security computing node. As another example, the data transmission system provided in this application can also be applied to cluster confidential computing scenarios, where the sending node is any computing node, the intermediate node is a switching node, the key configuration node is a trusted node, and the receiving node is any computing node other than the sending node. As yet another example, the data transmission system provided in this application can also be applied to trusted data circulation scenarios, where the sending node is a data provider node, the intermediate node is a data transfer platform, the key configuration node is a trusted node, and the receiving node is a data user node.

[0035] In another possible implementation, homomorphic encryption algorithms are based on the RLWE problem or the LWE problem.

[0036] Seventhly, this application provides a data transmission apparatus, deployed as a receiving node in a data transmission system. The data transmission system includes a sending node, an intermediate node, a key configuration node, and a receiving node. The data transmission apparatus provided by this application includes a receiving module and a decryption module. The receiving module is used to receive ciphertext data and a second key ciphertext sent by the intermediate node. The ciphertext data is obtained by encrypting the symmetric key of the sending node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The first key ciphertext is obtained by the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm. The decryption module is used to decrypt the second key ciphertext based on the private key of the receiving node and a homomorphic decryption algorithm to obtain the plaintext symmetric key. The data ciphertext is then decrypted based on the symmetric key to obtain the plaintext data to be transmitted.

[0037] In one possible implementation, the public-private key pair of the receiving node is generated by itself; the data transmission apparatus provided in this application also includes a sending module, which is used to send the public key of the receiving node to the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

[0038] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the receiving module in the data transmission device provided in this application is also used to: receive the public-private key pair of the receiving node sent by the configuration node; and the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0039] Eighthly, this application provides a data transmission apparatus, a key configuration node deployed in a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and a receiving node; the data transmission apparatus provided by this application includes a configuration module, a generation module, and a sending module, wherein the configuration module is used to configure a public-private key pair for the sending node and send the public key in the public-private key pair to the sending node, so that the sending node encapsulates its own symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext, the symmetric key being used to encrypt the data to be transmitted to obtain data ciphertext; the generation module is used to generate a key conversion key based on the private key of the sending node and the public key of the receiving node, or to generate a key conversion key based on the private key of the sending node and the private key of the receiving node; the sending module is used to send the key conversion key to the intermediate node, so that the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext, the encapsulation key of the second key ciphertext being the public key of the receiving node, and sends the data ciphertext and the second key ciphertext to the receiving node, the receiving node decrypts the second key ciphertext to obtain a symmetric key, and then decrypts the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0040] In another possible implementation, the public-private key pair of the receiving node is generated by the receiving node; the data transmission apparatus provided in this application also includes a receiving module for receiving the public key of the receiving node sent by the receiving node.

[0041] In another possible implementation, the public-private key pair of the receiving node is configured for the key configuration node; the sending module in the data transmission apparatus provided in this application is also used to send the public-private key pair of the receiving node to the receiving node.

[0042] In another possible implementation, the configuration module is also used to generate public parameters; based on the public parameters, a public-private key pair is configured for the sending node.

[0043] Ninthly, this application provides a data transmission device deployed in an intermediate node of a data transmission system. The data transmission system includes a sending node, an intermediate node, a key configuration node, and a receiving node. The data transmission device provided by this application includes a receiving module, a re-encapsulation module, and a sending module. The receiving module is used to receive ciphertext data and a first key ciphertext sent by the sending node. The ciphertext data is encrypted based on the symmetric key of the sending node, and the first key ciphertext is obtained by encapsulating the symmetric key based on the public key of the sending node and a homomorphic encryption algorithm. The receiving module receives a key conversion key sent by the key configuration node. The re-encapsulation module is used to perform a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext. The encapsulation key of the second key ciphertext is the public key of the receiving node. The sending module is used to send the ciphertext data and the second key ciphertext to the receiving node, so that the receiving node decrypts the second key ciphertext to obtain a symmetric key, and then decrypts the ciphertext data based on the symmetric key to obtain the plaintext data to be transmitted.

[0044] In another possible implementation, the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node; or, the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0045] Tenthly, this application provides a data transmission system, comprising a sending node, an intermediate node, a key configuration node, and a receiving node. The key configuration node configures a public-private key pair for the sending node and sends the public key of the public-private key pair to the sending node; generates a key conversion key based on the private key of the sending node and the public key of the receiving node, or generates a key conversion key based on the private key of the sending node and the private key of the receiving node; sends the key conversion key to the intermediate node; the sending node encrypts the data to be transmitted based on its own symmetric key to obtain ciphertext; encapsulates the symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext; sends the data ciphertext and the first key ciphertext to the intermediate node; the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext, the encapsulation key of the second key ciphertext being the public key of the receiving node; sends the data ciphertext and the second key ciphertext to the receiving node; the receiving node decrypts the second key ciphertext based on its private key and a homomorphic decryption algorithm to obtain symmetric key plaintext; and decrypts the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0046] Eleventhly, embodiments of this application provide a computing device, including a memory and a processor, wherein the memory stores instructions that, when executed by the processor, cause the method described in the first aspect, or the method described in the second aspect, or the method described in the third aspect, or the method described in the fourth aspect to be implemented.

[0047] In a twelfth aspect, embodiments of this application provide a data transmission system including the data transmission apparatus described in the fifth to eighth aspects. The data transmission apparatus described in the fifth aspect can be deployed on a sending node and can implement the method described in the first aspect. The data transmission apparatus described in the sixth aspect can be deployed on a receiving node and can implement the method described in the second aspect. The data transmission apparatus described in the seventh aspect can be deployed on a key configuration node and can implement the method described in the third aspect. The data transmission apparatus described in the eighth aspect can be deployed on an intermediate node and can implement the method described in the fourth aspect.

[0048] In a thirteenth aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the method described in the first aspect, or the method described in the second aspect, or the method described in the third aspect, or the method described in the fourth aspect to be implemented.

[0049] In a fourteenth aspect, embodiments of this application also provide a computer program or computer program product, the computer program or computer program product including instructions that, when executed, cause a computer to perform the method described in the first aspect, or the method described in the second aspect, or the method described in the third aspect, or the method described in the fourth aspect.

[0050] In a fifteenth aspect, embodiments of this application also provide a chip including at least one processor and a communication interface, the processor being configured to execute the method described in the first aspect, or the method described in the second aspect, or the method described in the third aspect, or the method described in the fourth aspect. Attached Figure Description

[0051] Figure 1 is a schematic diagram of an end-to-end encrypted transmission architecture using the data transmission method provided in the embodiments of this application;

[0052] Figure 2 illustrates a schematic diagram of the end-to-end encrypted transmission architecture provided in this application embodiment applied to an end-to-cloud collaborative computing scenario;

[0053] Figure 3 illustrates a schematic diagram of the end-to-end encrypted transmission architecture provided in this application embodiment applied to a cluster confidential computing scenario;

[0054] Figure 4 is a signaling interaction diagram of the data transmission method provided in the embodiment of this application during the implementation process;

[0055] Figure 5 is a schematic diagram of a data transmission device provided in an embodiment of this application;

[0056] Figure 6 is a schematic diagram of another data transmission device provided in an embodiment of this application;

[0057] Figure 7 is a schematic diagram of another data transmission device provided in an embodiment of this application;

[0058] Figure 8 is a schematic diagram of another data transmission device provided in an embodiment of this application;

[0059] Figure 9 is a schematic diagram of the structure of the computing device provided in the embodiment of this application. Detailed Implementation

[0060] The term "and / or" used in this article describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0061] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same properties in the description of embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a list of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such processes, methods, systems, products, or apparatus.

[0062] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0063] In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more, for example, multiple processing units means two or more processing units, multiple elements means two or more elements, etc.

[0064] To achieve secure end-to-end data transmission, various technical solutions exist. For example, one such solution is the Private Cloud Compute (PCC) end-to-end encryption scheme. To provide users with secure cloud-based AI inference services, a PCC solution was developed and deployed on the company's servers. This solution protects user-uploaded data to the cloud by providing a private cloud enclave extension.

[0065] The specific steps of the end-to-end encryption scheme to ensure the secure uploading of user data are as follows:

[0066] 1. The user generates a symmetric key in the secure world on the client side and encrypts the user prompt;

[0067] 2. The user requests available PCC nodes from the load balancer and obtains the public key of the available PCC nodes;

[0068] 3. The user encapsulates the user key using the public key of a trusted PCC node;

[0069] 4. The load balancer sends the user key ciphertext and the prompt ciphertext to the appropriate PCC node;

[0070] 5. The PCC node uses its private key to decrypt the user key, and then decrypts the prompt to execute the computation task.

[0071] To achieve end-to-end encryption, each cloud-side device node in the PCC scheme needs to establish an independent session key with the endpoint. Therefore, the user needs to perform N key encapsulation operations (N = number of PCC nodes), and the complexity increases linearly with the number of servers. Furthermore, when a new server node joins, the scheme requires the user to establish an additional key with the server separately. Therefore, the communication cost during the key establishment phase is high.

[0072] The second related technical solution is an end-to-end encryption scheme for cluster confidential computing. In cluster confidential computing scenarios, computing tasks are distributed among confidential computing nodes, and data flow requires end-to-end encryption between nodes to ensure that plaintext data only appears in the secure world. Taking a common cluster confidential computing scenario as an example, the Nvidia B200 GPU enables NVLink Inline encryption and decryption, and can directly access the secure memory of the peer, which can be used to build a confidential computing supernode composed of 128 GPUs. Currently, exploration of this scenario is still in its early stages, and there are no publicly available cluster end-to-end encryption and key management schemes. Several potential technical solutions will be described below:

[0073] 1. Device-Device Secure Data Channel: Taking a confidential computing supernode built with Nvidia B200 as an example, this scenario does not trust any exchange nodes, and a secure channel is established directly between any two computing nodes. In this process, the key establishment process between each pair of nodes is independent, thus requiring multiple key negotiations and storage of multiple keys, which may limit the size of the supernode.

[0074] 2. Device-Switch-Device Secure Data Channel: In this scenario, all cloud servers trust a single switching node. Therefore, only a secure channel needs to be established between the compute node and the switching node, significantly reducing the required key negotiation and key storage. However, any data uploaded by the user must be decrypted and re-encrypted by the switching node.

[0075] 3. Device-Switch-Device Secure Key Channel: In this scenario, cloud computing nodes trust the switching node, and a secure channel is established between them. However, this secure channel is only used to transmit data encryption keys and no longer transmits user data. Therefore, this scheme requires only a small amount of key negotiation and key storage. Data transmission between the user and the cloud requires only one encryption / decryption operation, but the secure transmission of the key during key establishment requires multiple encryption / decryption operations.

[0076] The relevant potential solutions either require multiple encryption and decryption processes or multiple key negotiations and storage of multiple keys, resulting in significant redundancy in communication and computation.

[0077] In view of this, embodiments of this application provide a data transmission method and apparatus that, by using a homomorphic encryption key conversion algorithm, makes the key encapsulation process independent of the selection of the receiving node, and the key encapsulation process does not require decryption of the key ciphertext, thereby reducing the complexity of the key transmission process.

[0078] The specific implementation of the data transmission method and apparatus provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0079] Figure 1 is a schematic diagram of an end-to-end encrypted transmission architecture using the data transmission method provided in the embodiments of this application. As shown in Figure 1, the end-to-end encrypted transmission architecture mainly consists of four modules: a key configuration module, an encryption module, a key distribution module, and a decryption module. Different modules can be deployed on different nodes. For example, the key configuration module can be deployed on a trusted node, the encryption module on a sending node, the key distribution module on an intermediate node, and the decryption module on a receiving node.

[0080] The key configuration node's functions include key generation, key exchange with receiving nodes, and key conversion key generation. It has a key configuration module deployed on it, primarily used for configuring keys for other nodes, exchanging keys with receiving nodes, generating key conversion keys based on homomorphic encryption algorithms, and distributing the key conversion keys to intermediate nodes. Key configuration nodes are generally performed by trusted nodes, meaning they are secure and trustworthy, meeting certain security and trustworthiness requirements.

[0081] The initial node's function is to encrypt and send ciphertext. It has an encryption module deployed on it, primarily responsible for generating a symmetric key (such as an AES key) to encrypt data, homomorphically encrypting the symmetric key using the initial public key, and then sending the encrypted data and key.

[0082] The function of the intermediate node is to receive and distribute ciphertext. It is equipped with a key distribution module, which can use a key conversion key to reseal the ciphertext without decryption, so that it can be distributed to the receiving node for decryption. At the same time, the sending node, intermediate node and receiving node form a ciphertext transmission channel. The intermediate node can receive the ciphertext sent by the sending node and distribute it to the receiving node for decryption.

[0083] The function of the receiving node is to decrypt data. A receiving node can consist of multiple nodes, each containing a decryption module. This module performs homomorphic decryption on the symmetric key, and then uses the symmetric key to decrypt the ciphertext to obtain the plaintext data.

[0084] The end-to-end encrypted transmission architecture provided in this application embodiment ensures that during the data transmission process from one party to another, encryption can only occur at the sending end and decryption at the receiving end. During other processes, the data remains encrypted and cannot be read by intermediate nodes. In this process, this application embodiment can utilize homomorphic encryption algorithms to reseal the encrypted key, enabling the receiving end to decrypt the encrypted data once without sharing keys with any other receiving end.

[0085] The end-to-end encrypted transmission architecture provided in this application can be applied to multiple scenarios requiring secure end-to-end data transmission. For example, in edge-cloud collaborative computing scenarios, the sending node is the edge device, the intermediate node is the cloud-side load balancer, the key configuration node is the cloud-side trusted node, and the receiving node is the cloud-side high-security computing node. Since the load balancer, as an intermediate node, is not entirely trustworthy, the end-to-end encrypted transmission architecture provided in this application can ensure the security of the key during the distribution process.

[0086] For example, the end-to-end encrypted transmission architecture provided in this application embodiment can also be applied to cluster confidential computing scenarios. In cluster confidential computing scenarios, any computing node can act as a sending node, the remaining computing nodes can act as receiving nodes, the key configuration node can act as a trusted node, the intermediate node can act as an exchange node, and the interaction node can perform data resealing to provide data to other nodes to complete the computing task.

[0087] For example, the end-to-end encrypted transmission architecture provided in this application embodiment can also be applied to scenarios of trusted data circulation. In a trusted data circulation scenario, the sending node is the data provider node, the intermediate node is the data transfer platform, the key configuration node is the trusted node, and the receiving node is the data user node. That is, in a trusted data circulation scenario, the data provider, as the sending node, can encrypt the data and provide the encrypted data and encryption key to the data transfer platform. The data transfer platform can then encapsulate the encrypted data and provide it to the data user at the receiving node. After the data user decrypts the data, end-to-end data circulation is achieved.

[0088] Figure 2 illustrates a schematic diagram of the end-to-end encrypted transmission architecture provided in this application embodiment applied to an edge-cloud collaborative computing scenario. As shown in Figure 2, the key configuration module is deployed on the trusted node, the encryption module is deployed on the initial node (also known as the sending node), the key distribution module is deployed on the routing node, and the decryption module is deployed on the target node (also known as the receiving node). The routing node and the channels before and after it (i.e., the channel between the routing node and the initial node, and the channel between the routing node and the target node) together form the encrypted data transmission channel.

[0089] The trusted node is responsible for generating public parameters and configuring a public-private key pair for the encryption module of the initial node based on these parameters. For example, the public parameters include positive integers N and q, thereby constructing an Nth-degree cyclotomic polynomial quotient ring R, where the modulus of R is a positive integer q. A public-private key pair (sk`, pk`) is generated for the encryption module of the initial node and then sent to the initial node via a public-private key transmission channel. Since the transmitted data involves the initial node's private key sk`, the security of the public-private key transmission channel between the trusted node and the initial node must be ensured to prevent the initial node's private key sk` from being leaked. Optionally, a secure channel can be established using key encapsulation to transmit the initial node's public-private key pair (sk`, pk`).

[0090] In another example, after generating the public-private key pair (sk`, pk`) of the initial node, the trusted node only sends the public key pk` to the initial node. Since the transmission of the private key sk` is not involved, there is no need to establish a secure channel. The public key pk` of the initial node can be transmitted directly in plaintext, reducing the communication overhead caused by establishing a secure channel.

[0091] Trusted nodes are also responsible for configuring new public-private key pairs for target nodes according to different security level requirements, or collecting the public keys from the pre-configured public-private key pairs of target nodes; and generating key conversion keys and securely transmitting the key conversion keys to the key distribution module in the routing node.

[0092] For example, when the target node's public-private key pair is pre-generated (e.g., generated by the target node itself), the trusted node collects each target node's public-private key pair (sk... o ,pk i The public key pk in ) i When the target node's public-private key pair is configured by a trusted node, the trusted node generates the target node's public-private key pair (sk). i ,pk i ), and then transmit it to the target node via a secure channel. Under both conditions, pk i All satisfy the following relationship pk i =(-a i .sk i +e i ,a i )=(b i ,a i )∈R 2 ,where a i ∈R is a randomly selected element on the polynomial ring, e i ∈R represents a random perturbation drawn from a Gaussian distribution.

[0093] The public / private key pair (sk) for the target node i ,pk i As a pre-generated scenario, the trusted node is based on Formula 1, using the initial node's private key sk` and the target node's public key pk. i Generate a series of KSKs in RLWE ciphertext form i Formula 1 is shown below:

[0094] Among them, u i Let ∈R be randomly selected elements on the polynomial ring, e0, e1 ∈ R be random perturbations drawn from a Gaussian distribution, and a i ∈R is a randomly selected element on the polynomial ring.

[0095] The public / private key pair (sk) for the target node i ,pk i In the case where the trusted node is responsible for configuration, the trusted node uses the initial node's private key sk` and the target node's private key sk based on Formula 2. i Generate KSK i Formula 2 is shown below:

[0096] Where a∈R and e∈R are random perturbations drawn from a Gaussian distribution.

[0097] The initial node's encryption module performs the following operations: generates a symmetric key sk and encrypts the data (i.e., the data to be transmitted). It then encapsulates the symmetric key sk using the initial node's public key pk` and a homomorphic encryption algorithm to obtain the homomorphic ciphertext Enc. pk` (sk). Send the encapsulated key (i.e., key ciphertext) and encrypted data (i.e. data ciphertext) to the routing node.

[0098] The routing node receives the key ciphertext and data ciphertext sent by the initial node, obtains the key ciphertext and data ciphertext, and then uses a homomorphic encryption key transformation algorithm to encapsulate the key ciphertext, converting the encapsulation key into the target node's public key (pk). i Or private key sk i .

[0099] For example, a routing node receives a KSK sent by a trusted node. i Then based on KSK i For key ciphertext Perform key conversion to obtain the target node's public key pk. i Or private key sk i Encrypted SK ciphertext. Based on KSK. i Formula 3 for key ciphertext transcoding is shown below: Switch(Enc pk` (sk),KSK i )=(c0,0)+c1.KSK i Formula 3

[0100] The public / private key pair for the target node is pre-generated. In this case, Formula 4 is used to cipher the key Enc. pk` (sk) performs a repackaging operation. The resulting homomorphic ciphertext is: Formula 4 is shown below:

[0101] Configure trusted nodes with public and private keys for the target node. In this case, Formula 5 is used to cipher the key Enc. pk` (sk) performs a repackaging operation. The resulting homomorphic ciphertext is: Formula 5 is shown below:

[0102] After performing encapsulation on the key ciphertext, the routing node sends the encapsulated key ciphertext and data ciphertext to the target node.

[0103] In this embodiment, the key swapping and encapsulation process does not decrypt the key ciphertext, and the security of the protocol does not depend on the trust of the routing node that performs the key swapping and encapsulation operation. At the same time, the selection of the target node in the key swapping and encapsulation process is independent of the key ciphertext, and the target node does not need to be specified in advance before the protocol is executed. The routing node that performs the key swapping and encapsulation operation can securely transmit the key to the corresponding node according to real-time needs.

[0104] The target node receives the key ciphertext sent by the routing node. or From the encrypted data, obtain the encrypted key and encrypted data, and then use the target node's private key sk i Homomorphic decryption algorithms for key ciphertext or The initial node's symmetric key sk is obtained by decryption. The ciphertext data is then decrypted using the symmetric key sk to obtain the plaintext data. In this way, the encapsulated key ciphertext can only be decrypted by the target node's private key, thus ensuring the channel security between the initial node and the target node.

[0105] It should be noted that the homomorphic encryption algorithm used in the data transmission method provided in this application is the same homomorphic encryption algorithm. This homomorphic encryption algorithm can be any type of homomorphic encryption algorithm, such as encpk and encski. The homomorphic decryption algorithm needs to correspond to the homomorphic encryption algorithm. For example, if the encpk homomorphic encryption algorithm is used to encapsulate and re-encapsulate the symmetric key, then the target node uses the encpk homomorphic decryption algorithm to decrypt the received homomorphic ciphertext. or Perform homomorphic decryption.

[0106] Understandably, key conversion is an operation in fully homomorphic encryption. Its core function is to convert ciphertext from one encryption key to another while maintaining data security, so that different participants can process the same set of encrypted data without having to access the plaintext.

[0107] It's important to clarify that key encapsulation can be understood as follows: to ensure the security of key transmission, one key is used to encrypt another key (this key is typically the one used to encrypt the transmitted data), resulting in ciphertext. This ensures the key is transmitted in ciphertext form, thus protecting the security of key transmission. For example, to ensure the security of the symmetric key sk transmission, the initial node uses its public key pk` and a homomorphic encryption algorithm to encapsulate the symmetric key sk, obtaining the homomorphic ciphertext Enc. pk`(sk). Key transcoding means converting the encapsulation key of a key ciphertext from one key to another. For example, a routing node uses key transcoding to convert the encapsulation key of the key ciphertext from pk` to the public key pk of the target node. i Or private key sk i This makes it easier for the target node to use its own private key sk after receiving the key ciphertext and data ciphertext. i The ciphertext is decapsulated to obtain the symmetric key sk, and then the symmetric key sk is used to decrypt the data ciphertext to obtain the plaintext of the transmitted data.

[0108] The data transmission method provided in this application uses a homomorphic encryption key exchange algorithm to achieve secure transmission of the symmetric key of the initial node. It enables secure key transmission to any target node with only one encryption by the user. Simultaneously, the data encryption key transmission process does not require decryption, making it suitable for end-to-end encryption in multi-hop scenarios and high-throughput transmission scenarios. Data is transmitted in ciphertext form, and the data encryption key is encapsulated and transmitted along with it. Data only requires a single encryption and decryption, reducing the processing pressure on the user end. The routing node uses a homomorphic encryption algorithm to re-encapsulate the key ciphertext without decryption, re-encapsulating it into ciphertext that only the target node can decrypt, ensuring end-to-end encryption effectiveness and preventing key leakage due to security risks at the routing node.

[0109] It should be noted that the application scenarios exemplified above in the embodiments of this application are merely examples to facilitate a better understanding of the solutions provided in this application, and do not constitute a limitation on the applicable scenarios of the solutions provided in the embodiments of this application. The solutions provided in the embodiments of this application can be applied to scenarios where a shared key needs to be established between a subject (usually a data owner or central manager) and multiple recipients. The need for such protocols may also arise in environments involving secure communication, encrypted data sharing, or distributed computing, such as Internet of Things (IoT) device management, electronic voting systems, and secure multi-party computation or collaborative learning scenarios.

[0110] Figure 3 illustrates a schematic diagram of the end-to-end encrypted transmission architecture provided in this application embodiment applied to a cluster confidential computing scenario. As shown in Figure 3, the architecture includes an initial computing node, exchange nodes, other computing nodes, and trusted nodes. In the cluster of computing nodes, any computing node can be used as the initial computing node, and the remaining computing nodes can be used as other computing nodes. This architecture is used to complete the end-to-end secure data transmission between the initial computing node and other computing nodes.

[0111] The key configuration module is handled by a trusted node, which is responsible for generating the initial public-private key pair for the computing nodes. Depending on the security level requirements, the trusted node may choose to generate and distribute public-private key pairs for other computing nodes, or collect pre-generated public keys from other computing nodes and then generate corresponding key conversion keys to provide to the exchange nodes.

[0112] The initial computing node performs the following operations: generates a symmetric key sk and encrypts the data; it then encapsulates the symmetric key using the initial public key pk` and a homomorphic algorithm to obtain the homomorphic ciphertext Enc. pk` (sk); The initial computing node sends the encryption key and encrypted data to the exchange node.

[0113] The exchange node receives the key ciphertext and data ciphertext sent by the initial computing node, obtains the key ciphertext and data ciphertext, and then uses a homomorphic encryption key transformation algorithm to encapsulate the key ciphertext, converting the encapsulation key into the target node's public key pk. i Or private key sk i The specific key ciphertext transcoding method can be implemented using formula 1 or formula 2 mentioned above.

[0114] The exchange node sends the ciphertext and the repackaged encryption key to the target computing node.

[0115] The target computing node receives the encryption key and ciphertext, then uses a homomorphic decryption algorithm to decrypt the encryption key into a symmetric key sk, and finally uses the symmetric key sk to decrypt the ciphertext to obtain the plaintext data, which is then used for computation.

[0116] It is understood that, since the embodiments of this application not only employ key encapsulation but also key swapping encapsulation, the RLWE or LWE parameters used will be larger than the parameters of the standard key exchange protocol.

[0117] Figure 4 is a signaling interaction diagram of the data transmission method provided in this application embodiment during implementation. As shown in Figure 4, the key configuration node executes steps S401 to S403 to complete key configuration and key distribution, as well as the generation of the key conversion key KSK, and sends the key conversion key KSK to the intermediate node. The sending node executes steps S404 to S406 to complete the encryption of the transmitted data and the encapsulation of the symmetric key, and then sends the data ciphertext and key ciphertext to the intermediate node. The intermediate node executes steps S407 to S408 to re-encapsulate the key ciphertext based on the key conversion key KSK, and then sends the re-encapsulated key ciphertext and data ciphertext to the receiving node. The receiving node executes steps S409 and S410 to decrypt the key ciphertext using its own public key and homomorphic decryption algorithm to obtain the symmetric key, and then uses the symmetric key to decrypt the data ciphertext to obtain the plaintext data of the transmitted data.

[0118] In step S401, the key configuration node configures a public-private key pair for the sending node and sends the public-private key pair to the sending node.

[0119] In this embodiment, the key configuration node is a trusted node. The key configuration node is responsible for generating public parameters and configuring a public-private key pair for the sending node based on these parameters. For example, the public parameters include positive integers N and q, thereby constructing an Nth-degree cyclotomic polynomial quotient ring R, where the modulus of R is a positive integer q. A public-private key pair (sk`, pk`) is generated for the sending node and then sent to it via a public-private key transmission channel. Since the transmitted data involves the initial node's private key sk`, to ensure the sending node's private key sk` is not leaked, the security of the public-private key transmission channel between the key configuration node and the sending node must be guaranteed. Optionally, a secure channel can be established using key encapsulation to transmit the sending node's public-private key pair (sk`, pk`).

[0120] In another example, after generating the public-private key pair (sk`, pk`) for the sending node, the key configuration node only sends the public key pk` to the sending node. Since the transmission of the private key sk` is not involved, there is no need to establish a secure channel. The public key pk` of the sending node can be transmitted directly in plaintext, reducing the communication overhead caused by establishing a secure channel.

[0121] In step S402, the key configuration node generates a key conversion key KSK based on the private key of the sending node and the public key of the receiving node.

[0122] In one example, the receiving node generates its own public-private key pair. The receiving node uploads its public key to the key configuration node via a public key upload channel. The key configuration node obtains the receiving node's public key and then uses the sending node's private key `sk` and the receiving node's public key `pk`. i Generate key conversion key KSK i The key conversion key KSK can be generated using Formula 1 above. i .

[0123] In another example, the public-private key pair for the receiving node is configured by the key configuration node. That is, the key configuration node is also responsible for configuring the public-private key pair for the receiving node and then distributing the public-private key pair to the receiving node through a secure key transmission channel. In this case, the key configuration node uses the private key of the sending node and the private key of the receiving node to generate the key conversion key KSK. i The key conversion key KSK can be generated using Formula 2 above. i .

[0124] It should be noted that under these two conditions, pk i All satisfy the following relationship pk i =(-a i .sk i +e i ,ai )=(b i ,a i )∈R 2 ,where a i ∈R is a randomly selected element on the polynomial ring, e i ∈R represents a random perturbation drawn from a Gaussian distribution.

[0125] In step S403, the key configuration node sends the key conversion key KSK to the intermediate node.

[0126] After generating the key conversion key KSK, the key configuration node sends the key conversion key KSK to the intermediate node through the key conversion key KSK transmission channel.

[0127] In step S404, the sending node encrypts the data based on the symmetric key to obtain the ciphertext data.

[0128] In this embodiment of the application, the sending node is responsible for generating a symmetric key sk, which is used to encrypt the data to be transmitted to obtain ciphertext (i.e., the ciphertext after encrypting the data to be transmitted), thus ensuring security during transmission.

[0129] In step S405, the sending node encapsulates the symmetric key based on its own public key and homomorphic encryption algorithm to obtain the key ciphertext.

[0130] The sending node encapsulates its own symmetric key sk using its public key pk` and a homomorphic encryption algorithm to obtain the homomorphic ciphertext Enc. pk` (sk), the homomorphic ciphertext Enc pk` (sk) can be called the key ciphertext.

[0131] It should be noted that the homomorphic encryption algorithm used in the embodiments of this application can be any feasible homomorphic encryption algorithm, such as encpk and encski.

[0132] In step S406, the sending node sends the data ciphertext and key ciphertext to the intermediate node.

[0133] The sending node sends encrypted data and encrypted key to the intermediate node. Both the transmitted data and key are in encrypted form, and the intermediate node cannot obtain the data in plaintext form, thus ensuring the security of data transmission even if the intermediate node is untrusted.

[0134] In step S407, the intermediate node performs a re-encapsulation operation on the key ciphertext based on the key conversion key KSK.

[0135] After receiving the ciphertext key from the sending node and the key conversion key (KSK) from the key configuration node, the intermediate node uses the key conversion key to perform a re-encapsulation operation on the ciphertext key. This transforms the encapsulation key from the sending node's public key to the receiving node's public or private key, allowing the receiving node to decrypt the data. In this way, the key re-encapsulation process does not decrypt the ciphertext itself, ensuring protocol security without relying on the trust of the intermediate node performing the re-encapsulation operation, further guaranteeing the security of data and key transmission.

[0136] For a detailed explanation of the encapsulation change operation, please refer to the detailed explanation of the encapsulation change operation of the routing node above. For the sake of brevity, it will not be repeated here.

[0137] In step S408, the intermediate node sends the data ciphertext and the re-encapsulated key ciphertext to the receiving node.

[0138] The intermediate node sends the encrypted data and the re-encapsulated key ciphertext to the receiving node, so that the receiving node can decrypt the key ciphertext and the encrypted data to obtain the plaintext of the data transmitted by the sending node.

[0139] In step S409, the receiving node decodes the key ciphertext based on its own private key and homomorphic decryption algorithm to obtain the symmetric key.

[0140] The receiving node receives the encrypted data and the repackaged key ciphertext sent by the intermediate node, obtains the encrypted data and the repackaged key ciphertext, and then decrypts the repackaged key ciphertext based on its own private key and homomorphic decryption algorithm to obtain the symmetric key.

[0141] In step S410, the ciphertext of the data is decrypted based on the symmetric key to obtain the plaintext of the transmitted data.

[0142] The receiving node uses a symmetric key to decrypt the encrypted data, obtaining the plaintext of the data sent by the sending node, thus achieving secure end-to-end data transmission between the sending and receiving nodes.

[0143] This application primarily achieves targeted key distribution through key conversion technology based on homomorphic encryption schemes. In addition, proxy re-encryption technology can also be used to achieve similar functionality, supporting the conversion of ciphertext encrypted with one user's public key into ciphertext encrypted with another user's public key. Alternatively, by appropriately configuring server attribute policies, identity-based encryption or attribute-based encryption technology can be used to target and share keys with server entities that conform to the corresponding attribute rules.

[0144] Based on the same concept as the aforementioned data transmission method embodiment, this application also provides a data transmission device 500, which can be deployed on a sending node to provide end-to-end secure data transmission services. The data transmission device 500 includes units or modules for implementing the various steps performed by the sending node in FIG4.

[0145] Figure 5 is a schematic diagram of a data transmission device provided in an embodiment of this application. As shown in Figure 5, the data transmission device 500 includes an encryption module 501, an encapsulation module 502, and a sending module 503. The encryption module 501 is used to encrypt the data to be transmitted based on its own symmetric key to obtain ciphertext. The encapsulation module 502 is used to encapsulate the symmetric key based on its own public key and a homomorphic encryption algorithm to obtain a first key ciphertext. The sending module 503 is used to send the data ciphertext and the first key ciphertext to the intermediate node, so that the intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The second key ciphertext is used to enable the receiving node to obtain the symmetric key.

[0146] In one possible implementation, the key conversion key is generated by the key configuration node, and the intermediate node obtains the key conversion key by receiving the key conversion key sent by the key configuration node.

[0147] In another possible implementation, the public-private key pair of the receiving node is generated by itself; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

[0148] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0149] Optionally, the symmetric key of the sending node is generated by the sending node itself.

[0150] In another possible implementation, the public key of the sending node is configured by the key configuration node; the data transmission apparatus 500 provided in this application also includes a receiving module 504, which is used to receive the public key of the sending node sent by the key configuration node.

[0151] In another possible implementation, the data transmission system provided in this application can be applied to secure end-to-end data transmission in various scenarios. For example, it can be applied to edge-cloud collaborative computing scenarios, where the sending node is an edge device, the intermediate node is a cloud-side load balancer, the key configuration node is a cloud-side trusted node, and the receiving node is a cloud-based high-security computing node. As another example, the data transmission system provided in this application can also be applied to cluster confidential computing scenarios, where the sending node is any computing node, the intermediate node is a switching node, the key configuration node is a trusted node, and the receiving node is any computing node other than the sending node. As yet another example, the data transmission system provided in this application can also be applied to trusted data circulation scenarios, where the sending node is a data provider node, the intermediate node is a data transfer platform, the key configuration node is a trusted node, and the receiving node is a data user node.

[0152] In another possible implementation, homomorphic encryption algorithms are based on the RLWE problem or the LWE problem.

[0153] The data transmission device 500 according to the embodiments of this application can correspond to the execution of the method described in the embodiments of this application, and the above and other operations and / or functions of each module in the data transmission device 500 are respectively to implement the steps performed by the sending node in FIG4. For the sake of brevity, they will not be described again here.

[0154] Based on the same concept as the aforementioned data transmission method embodiment, this application also provides a data transmission device 500, which can be deployed on a sending node to provide end-to-end secure data transmission services. The data transmission device 500 includes units or modules for implementing the various steps performed by the sending node in FIG4.

[0155] Based on the same concept as the aforementioned data transmission method embodiment, this application also provides a data transmission device 600, which can be deployed on a receiving node to provide end-to-end secure data transmission services. The data transmission device 600 includes units or modules for implementing the various steps performed by the receiving node in FIG4.

[0156] Figure 6 is a schematic diagram of another data transmission device provided in an embodiment of this application. As shown in Figure 6, the data transmission device 600 includes a receiving module 601 and a decryption module 602. The receiving module 601 is used to receive data ciphertext and second key ciphertext sent by an intermediate node. The data ciphertext is obtained by encrypting the data based on the symmetric key of the sending node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The first key ciphertext is obtained by the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm. The decryption module 602 is used to decrypt the second key ciphertext based on the private key of the receiving node and a homomorphic decryption algorithm to obtain the symmetric key plaintext. The data ciphertext is also decrypted based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0157] In one possible implementation, the public-private key pair of the receiving node is generated by itself; the data transmission apparatus 600 provided in this application also includes a sending module 603, which is used to send the public key of the receiving node to the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

[0158] In another possible implementation, the public-private key pair of the receiving node is configured by the key configuration node; the receiving module 601 in the data transmission device provided in this application is also used to: receive the public-private key pair of the receiving node sent by the configuration node; and the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0159] The data transmission device 600 according to the embodiments of this application can correspond to the execution of the method described in the embodiments of this application, and the above and other operations and / or functions of each module in the data transmission device 600 are respectively to implement the steps performed by the receiving node in FIG4. For the sake of brevity, they will not be described again here.

[0160] Based on the same concept as the aforementioned data transmission method embodiment, this application also provides a data transmission device 700, which can be deployed on a sending node to provide end-to-end secure data transmission services. The data transmission device 700 includes units or modules for implementing the various steps performed by the key configuration node in FIG4.

[0161] Figure 7 is a schematic diagram of another data transmission device provided in an embodiment of this application. As shown in Figure 7, the data transmission device 700 includes a configuration module 701, a generation module 702, and a sending module 703. The configuration module 701 is used to configure a public-private key pair for the sending node and send the public key in the public-private key pair to the sending node, so that the sending node encapsulates its own symmetric key based on its own public key and homomorphic encryption algorithm to obtain a first key ciphertext. The symmetric key is used to encrypt the data to be transmitted to obtain data ciphertext. The generation module 702 is used to generate a key conversion key based on the private key of the sending node and the public key of the receiving node, or to generate a key conversion key based on the private key of the sending node and the private key of the receiving node. The sending module 703 is used to send the key conversion key to an intermediate node, so that the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext. The encapsulation key of the second key ciphertext is the public key of the receiving node. The data ciphertext and the second key ciphertext are sent to the receiving node. The receiving node decrypts the second key ciphertext to obtain a symmetric key, and then decrypts the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0162] In another possible implementation, the public-private key pair of the receiving node is generated by the receiving node; the data transmission apparatus 700 provided in this application also includes a receiving module 704, which is used to receive the public key of the receiving node sent by the receiving node.

[0163] In another possible implementation, the public-private key pair of the receiving node is configured for the key configuration node; the sending module 703 in the data transmission apparatus 700 provided in this application is also used to send the public-private key pair of the receiving node to the receiving node.

[0164] In another possible implementation, configuration module 701 is also used to generate public parameters; and to configure a public-private key pair for the sending node based on the public parameters.

[0165] The data transmission device 700 according to the embodiments of this application can be used to execute the methods described in the embodiments of this application. The above and other operations and / or functions of each module in the data transmission device 700 are respectively for implementing the steps performed by the key configuration node in FIG4. For the sake of brevity, they will not be described again here.

[0166] Based on the same concept as the aforementioned data transmission method embodiment, this application also provides a data transmission device 800, which can be deployed on an intermediate node to provide end-to-end secure data transmission services. The data transmission device 800 includes units or modules for implementing the various steps performed by the intermediate node in FIG4.

[0167] Figure 8 is a schematic diagram of another data transmission device provided in an embodiment of this application. As shown in Figure 8, the data transmission device 800 includes a receiving module 801, a re-encapsulation module 802, and a sending module 803. The receiving module 801 is used to receive data ciphertext and a first key ciphertext sent by a sending node. The data ciphertext is obtained by encrypting the symmetric key based on the sending node's symmetric key, and the first key ciphertext is obtained by encapsulating the symmetric key based on the sending node's public key and a homomorphic encryption algorithm. The receiving module 801 receives a key conversion key sent by a key configuration node. The re-encapsulation module 802 is used to perform a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext. The encapsulation key of the second key ciphertext is the receiving node's public key. The sending module 803 is used to send the data ciphertext and the second key ciphertext to the receiving node, so that the receiving node can decrypt the second key ciphertext to obtain a symmetric key, and then decrypt the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

[0168] In another possible implementation, the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node; or, the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

[0169] The data transmission device 800 according to the embodiments of this application can correspond to the execution of the method described in the embodiments of this application, and the above and other operations and / or functions of each module in the data transmission device 800 are respectively to implement the steps executed by the intermediate node in FIG4. For the sake of brevity, they will not be described again here.

[0170] This application also provides a computing device including at least one processor, a memory, and a communication interface, wherein the processor is used to execute the method described in Figures 1-4. This computing device can be a sending node, an intermediate node, a key configuration node, or a receiving node.

[0171] Figure 9 is a schematic diagram of the structure of the computing device provided in the embodiment of this application.

[0172] As shown in Figure 9, the computing device 900 includes at least one processor 901, a memory 902, and a communication interface 903. The processor 901, memory 902, and communication interface 903 are communicatively connected, which can be achieved via a wired (e.g., bus) or wireless connection. The communication interface 903 is used to send and / or receive data from other devices. The memory 902 stores computer instructions, which the processor 901 executes to perform the methods described in the preceding method embodiments, thereby achieving secure end-to-end data transmission.

[0173] It should be understood that, in the embodiments of this application, the processor 901 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0174] The memory 902 may include read-only memory and random access memory, and provides instructions and data to the processor 901. The memory 902 may also include non-volatile random access memory. Optionally, the random access memory may be, for example, high bandwidth memory (HBM).

[0175] The memory 902 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0176] It should be understood that the computing device 900 according to the embodiments of this application can execute the method shown in Figures 1-4 of the embodiments of this application. For a detailed description of the implementation of the method, please refer to the above text. For the sake of brevity, it will not be repeated here.

[0177] Embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer instructions are executed by a processor, the aforementioned method is implemented.

[0178] An embodiment of this application provides a chip including at least one processor and an interface, wherein the at least one processor determines program instructions or data through the interface; the at least one processor is used to execute the program instructions to implement the method mentioned above.

[0179] Embodiments of this application provide a computer program or computer program product that includes instructions that, when executed, cause a computer to perform the methods mentioned above.

[0180] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0181] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of both. The software module may be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0182] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above description is only a specific embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A data transmission method, characterized in that, The method is applied to a data transmission system, which includes a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: The sending node encrypts the data to be transmitted using its own symmetric key to obtain ciphertext. The sending node encapsulates the symmetric key based on its own public key and homomorphic encryption algorithm to obtain the first key ciphertext; The sending node sends the data ciphertext and the first key ciphertext to the intermediate node, so that the intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on the key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The second key ciphertext is used to enable the receiving node to obtain the symmetric key.

2. The method according to claim 1, characterized in that, The key conversion key is generated by the key configuration node, and the intermediate node obtains the key conversion key by receiving the key conversion key sent by the key configuration node.

3. The method according to claim 1 or 2, characterized in that, The public-private key pair of the receiving node is generated by itself; the key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

4. The method according to claim 1 or 2, characterized in that, The public-private key pair of the receiving node is configured by the key configuration node; the key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

5. The method according to any one of claims 1-4, characterized in that, The symmetric key is generated by the sending node.

6. The method according to any one of claims 1-5, characterized in that, The public key of the sending node is configured by the key configuration node; The method further includes: The sending node receives the public key of the sending node sent by the key configuration node.

7. The method according to any one of claims 1-6, characterized in that, The sending node is an end-side device, the intermediate node is a cloud-side load balancer, the key configuration node is a cloud-side trusted node, and the receiving node is a cloud-side high-security computing node. Alternatively, the sending node can be any computing node, the intermediate node can be a switching node, the key configuration node can be a trusted node, and the receiving node can be any computing node other than the sending node. Alternatively, the sending node may be a data provider node, the intermediate node may be a data transfer platform, the key configuration node may be a trusted node, and the receiving node may be a data user node.

8. The method according to any one of claims 1-7, characterized in that, The homomorphic encryption algorithm is based on the ring-based fault-tolerant learning problem or the fault-tolerant learning problem.

9. A data transmission method, characterized in that, The method is applied to a data transmission system, which includes a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: The receiving node receives the data ciphertext and the second key ciphertext sent by the intermediate node. The data ciphertext is obtained by encrypting the data based on the symmetric key of the sending node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on the key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The first key ciphertext is obtained by the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm. The receiving node decrypts the second key ciphertext based on its private key and a homomorphic decryption algorithm to obtain the symmetric key plaintext. The receiving node decrypts the ciphertext of the data based on the symmetric key to obtain the plaintext of the data to be transmitted.

10. The method according to claim 9, characterized in that, The public-private key pair of the receiving node is generated by itself; The method further includes: The receiving node sends its public key to the key configuration node; The key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node.

11. The method according to claim 9, characterized in that, The public and private key pair of the receiving node is configured by the key configuration node; The method further includes: The receiving node receives the public-private key pair sent by the configuration node. The key conversion key is generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

12. A data transmission method, characterized in that, The method is applied to a data transmission system, which includes a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: The key configuration node configures a public-private key pair for the sending node and sends the public key in the public-private key pair to the sending node, so that the sending node encapsulates its own symmetric key based on its own public key and homomorphic encryption algorithm to obtain the first key ciphertext. The symmetric key is used to encrypt the data to be transmitted to obtain the data ciphertext. The key configuration node generates a key conversion key based on the private key of the sending node and the public key of the receiving node, or generates a key conversion key based on the private key of the sending node and the private key of the receiving node. The key configuration node sends the key conversion key to the intermediate node, so that the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain the second key ciphertext. The encapsulation key of the second key ciphertext is the public key of the receiving node. The second key ciphertext is used to obtain the symmetric key, and the symmetric key is used to decrypt the data ciphertext to obtain the plaintext of the data to be transmitted.

13. The method according to claim 12, characterized in that, The public-private key pair of the receiving node is generated by the receiving node; The method further includes: The key configuration node receives the public key of the receiving node sent by the receiving node.

14. The method according to claim 12, characterized in that, The public and private key pair of the receiving node is configured by the key configuration node; The method further includes: The key configuration node sends the public and private key pair of the receiving node to the receiving node.

15. The method according to any one of claims 12-14, characterized in that, Also includes: The key configuration node generates common parameters; The key configuration node configures a public-private key pair for the sending node based on the public parameters.

16. A data transmission method, characterized in that, The method is applied to a data transmission system, which includes a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: The intermediate node receives the data ciphertext and the first key ciphertext sent by the sending node. The data ciphertext is obtained by encrypting the symmetric key of the sending node, and the first key ciphertext is obtained by encapsulating the symmetric key based on the public key of the sending node and a homomorphic encryption algorithm. The intermediate node receives the key conversion key sent by the key configuration node; The intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain the second key ciphertext, and the encapsulation key of the second key ciphertext is the public key of the receiving node; The intermediate node sends the data ciphertext and the second key ciphertext to the receiving node, so that the receiving node can decrypt the second key ciphertext to obtain the symmetric key, and then decrypt the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

17. The method according to claim 16, characterized in that, The key conversion key is generated by the key configuration node based on the private key of the sending node and the public key of the receiving node; Alternatively, the key conversion key may be generated by the key configuration node based on the private key of the sending node and the private key of the receiving node.

18. A data transmission method, characterized in that, The method is applied to a data transmission system, which includes a sending node, an intermediate node, a key configuration node, and a receiving node; the method includes: The key configuration node configures a public-private key pair for the sending node and sends the public key in the public-private key pair to the sending node; The key configuration node generates a key conversion key based on the private key of the sending node and the public key of the receiving node, or generates a key conversion key based on the private key of the sending node and the private key of the receiving node. The key configuration node sends the key conversion key to the intermediate node; The sending node encrypts the data to be transmitted using its own symmetric key to obtain ciphertext. The sending node encapsulates the symmetric key based on its own public key and homomorphic encryption algorithm to obtain the first key ciphertext; The sending node sends the data ciphertext and the first key ciphertext to the intermediate node; The intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain the second key ciphertext, and the encapsulation key of the second key ciphertext is the public key of the receiving node; The intermediate node sends the data ciphertext and the second key ciphertext to the receiving node; The receiving node decrypts the second key ciphertext based on its private key and a homomorphic decryption algorithm to obtain the symmetric key plaintext. The receiving node decrypts the ciphertext of the data based on the symmetric key to obtain the plaintext of the data to be transmitted.

19. A data transmission device, characterized in that, A sending node deployed in a data transmission system, the data transmission system including the sending node, intermediate nodes, key configuration nodes, and receiving nodes; the device includes: The encryption module is used to encrypt the data to be transmitted based on its own symmetric key to obtain the ciphertext data. The encapsulation module is used to encapsulate the symmetric key based on its own public key and homomorphic encryption algorithm to obtain the first key ciphertext; A sending module is configured to send the data ciphertext and the first key ciphertext to the intermediate node, so that the intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on a key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The second key ciphertext is used to enable the receiving node to obtain the symmetric key.

20. A data transmission device, characterized in that, A receiving node deployed in a data transmission system, the data transmission system including a sending node, an intermediate node, a key configuration node, and the receiving node; the device includes: The receiving module is used to receive the data ciphertext and the second key ciphertext sent by the intermediate node. The data ciphertext is obtained by encrypting the data based on the symmetric key of the sending node. The second key ciphertext is obtained by the intermediate node performing a re-encapsulation operation on the first key ciphertext based on the key conversion key. The encapsulation key of the second key ciphertext is the public key of the receiving node. The first key ciphertext is obtained by the sending node encapsulating the symmetric key based on its own public key and a homomorphic encryption algorithm. The decryption module is used to decrypt the second key ciphertext based on the private key of the receiving node and the homomorphic decryption algorithm to obtain the symmetric key plaintext; The ciphertext of the data is decrypted using the symmetric key to obtain the plaintext of the data to be transmitted.

21. A data transmission device, characterized in that, A key configuration node deployed in a data transmission system, the data transmission system including a sending node, an intermediate node, the key configuration node, and a receiving node; the device includes: The configuration module is used to configure a public-private key pair for the sending node and send the public key of the public-private key pair to the sending node, so that the sending node encapsulates its own symmetric key based on its own public key and homomorphic encryption algorithm to obtain a first key ciphertext. The symmetric key is used to encrypt the data to be transmitted to obtain data ciphertext. The generation module is used to generate a key conversion key based on the private key of the sending node and the public key of the receiving node, or to generate a key conversion key based on the private key of the sending node and the private key of the receiving node. The sending module is used to send the key conversion key to the intermediate node, so that the intermediate node performs a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext. The encapsulation key of the second key ciphertext is the public key of the receiving node. The intermediate node sends the data ciphertext and the second key ciphertext to the receiving node. The receiving node decrypts the second key ciphertext to obtain the symmetric key, and then decrypts the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

22. A data transmission device, characterized in that, An intermediate node deployed in a data transmission system, the data transmission system including a sending node, the intermediate node, a key configuration node, and a receiving node; the device includes: The receiving module is used to receive the data ciphertext and the first key ciphertext sent by the sending node. The data ciphertext is obtained by encrypting the symmetric key of the sending node, and the first key ciphertext is obtained by encapsulating the symmetric key based on the public key of the sending node and a homomorphic encryption algorithm. Receive the key conversion key sent by the key configuration node; The encapsulation module is used to perform an encapsulation operation on the first key ciphertext based on the key conversion key to obtain a second key ciphertext, wherein the encapsulation key of the second key ciphertext is the public key of the receiving node; The sending module is used to send the data ciphertext and the second key ciphertext to the receiving node, so that the receiving node can decrypt the second key ciphertext to obtain the symmetric key, and then decrypt the data ciphertext based on the symmetric key to obtain the plaintext of the data to be transmitted.

23. A data transmission system, characterized in that, It includes sending nodes, intermediate nodes, key configuration nodes, and receiving nodes, among which, The key configuration node is used to configure a public-private key pair for the sending node and send the public key in the public-private key pair to the sending node. A key conversion key is generated based on the private key of the sending node and the public key of the receiving node, or a key conversion key is generated based on the private key of the sending node and the private key of the receiving node. Send the key conversion key to the intermediate node; The sending node is used to encrypt the data to be transmitted based on its own symmetric key to obtain ciphertext. The symmetric key is encapsulated using its own public key and homomorphic encryption algorithm to obtain the first key ciphertext; The encrypted data and the encrypted first key are sent to the intermediate node; The intermediate node is used to perform a re-encapsulation operation on the first key ciphertext based on the key conversion key to obtain the second key ciphertext, wherein the encapsulation key of the second key ciphertext is the public key of the receiving node. The encrypted data and the encrypted second key are sent to the receiving node; The receiving node is used to decrypt the second key ciphertext based on the receiving node's private key and a homomorphic decryption algorithm to obtain the symmetric key plaintext. The ciphertext of the data is decrypted using the symmetric key to obtain the plaintext of the data to be transmitted.

24. A computing device, comprising a memory and a processor, characterized in that, The memory stores instructions that, when executed by a processor, cause the method as described in any one of claims 1-8, or the method as described in any one of claims 9-11, or the method as described in any one of claims 12-15, or the method as described in any one of claims 16-17 to be implemented.

25. A data transmission system, characterized in that, Includes the data transmission apparatus as described in claims 19-21.

26. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it causes the method as described in any one of claims 1-8, or the method as described in any one of claims 9-11, or the method as described in any one of claims 12-15, or the method as described in any one of claims 16-17 to be implemented.

Images