CN117294514A

CN117294514A - Data transmission encryption and decryption method and device, electronic equipment and medium

Info

Publication number: CN117294514A
Application number: CN202311353577.6A
Authority: CN
Inventors: 詹立浩; 赵子颖; 卜昌浩
Original assignee: Tianyi Digital Life Technology Co Ltd
Current assignee: Tianyi Digital Life Technology Co Ltd
Priority date: 2023-10-18
Filing date: 2023-10-18
Publication date: 2023-12-26

Abstract

The invention discloses a data transmission encryption and decryption method, a device, electronic equipment and a medium, wherein the method comprises the following steps: obtaining a public key from a transmission server by responding to a data transmission request; generating a key string array according to the plurality of random length character strings; the transmission server also comprises a private key matched with the public key; performing exclusive or encryption on the request plaintext through a key string array to obtain a first ciphertext and a first key sequence; carrying out asymmetric encryption on the key string array through the public key to obtain a key string ciphertext; and transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server, so that the transmission server can decrypt by combining the private key to obtain the target plaintext. The embodiment of the invention realizes the combination of encryption by combining the public key with the key string array and further combining the exclusive-or encryption and the asymmetric encryption, can provide the data encryption transmission method with high security and better encryption and decryption performance and transmission efficiency, and can be widely applied to the technical field of data processing.

Description

Data transmission encryption and decryption method and device, electronic equipment and medium

Technical Field

The present invention relates to the field of data processing technologies, and in particular, to a method, an apparatus, an electronic device, and a medium for encrypting and decrypting data transmission.

Background

The Web application generally uses SSL/TLS to encrypt the Web data transmission based on HTTPS protocol to ensure the security of the data in the network transmission process. However, when the user installs an unsafe certificate, uses an unsafe browser plug-in and disregards that the safety prompt of the browser is hijacked by the middle person, the safety of the data transmission process cannot be ensured. At present, more encryption methods are used for carrying out security transmission on Web application data: 1. asymmetric encryption algorithms such as RSA, SM2, ECC, etc.; 2. symmetric encryption algorithms such as AES, SM4, DEC, etc.; 3. hybrid encryption of asymmetric+symmetric algorithms, such as RSA+AES, SM2+SM4, etc. Each method has certain limitations in use. If the asymmetric algorithm has the problem of slow decryption, the symmetric encryption algorithm has the problems of key transmission and encryption data expansion, and the asymmetric+symmetric algorithm mixed encryption can solve the problems generated by using the asymmetric algorithm and the symmetric algorithm singly, but has the defects of performance and convenience in use.

Disclosure of Invention

The present invention aims to solve at least one of the technical problems in the related art to some extent. Therefore, the invention provides a data transmission encryption and decryption method, a device, electronic equipment and a medium, which can effectively encrypt data transmission.

In one aspect, an embodiment of the present invention provides a data transmission encryption method, applied to a client, including:

responding to a data transmission request, and acquiring a public key from a transmission server; generating a key string array according to the plurality of random length character strings; the transmission server also comprises a private key matched with the public key;

performing exclusive or encryption on the request plaintext through a key string array to obtain a first ciphertext and a first key sequence;

carrying out asymmetric encryption on the key string array through the public key to obtain a key string ciphertext;

and transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server, so that the transmission server can decrypt by combining the private key to obtain the target plaintext.

Optionally, the method further comprises:

generating a key pair of a transmission server through an asymmetric algorithm based on a random prime pair in response to a data transmission request; the key pair includes a public key and a private key.

Optionally, generating the key string array from the plurality of random length strings includes:

Forming a character string sequence according to a plurality of random length character strings, and inserting a segmenter between each character string of the character string sequence to generate a key string array of the disposable codebook; wherein the first string of the key string array is a round key.

Optionally, the first string of the key string array is a round key; exclusive or encryption is carried out on the request plaintext through the key string array to obtain a first ciphertext and a first key sequence, and the method comprises the following steps:

acquiring a plurality of character strings from the key string array to form a first key string, and obtaining a first key sequence according to the position codes of each character string in the first key string in the key string array; the length of the first key string is greater than the length of the request plaintext;

performing first exclusive OR operation on the first key string and the round key to obtain a second key string;

and performing a second exclusive or operation on the second key string and the request plaintext to obtain a first ciphertext.

Optionally, the method further comprises:

receiving a second ciphertext and a second key sequence fed back by the transmission server; the second ciphertext and the second key sequence are obtained by performing exclusive or encryption on the response plaintext through the transmission server;

and performing exclusive or decryption on the second ciphertext through the key string array and the second key sequence to obtain a response plaintext.

On the other hand, the embodiment of the invention provides a data transmission decryption method, which is applied to a transmission server and comprises the following steps:

acquiring a first ciphertext, a first key sequence, a key string ciphertext and a private key; the first ciphertext, the first key sequence and the key string ciphertext are obtained according to the data transmission encryption method, and the private key is matched with the public key in the data transmission encryption method;

asymmetric decryption is carried out on the cipher text of the key string through the private key, so that a key string array is obtained;

and performing exclusive or decryption on the first ciphertext through the key string array and the first key sequence to obtain a target plaintext.

Optionally, the method further comprises:

generating a key pair through an asymmetric algorithm based on a random prime number pair in response to a data transmission request; the key pair comprises a public key and a private key;

and transmitting the public key to the client to which the data transmission encryption method is applied.

Optionally, the method further comprises:

performing exclusive or encryption on the response plaintext through the key string array to obtain a second ciphertext and a second key sequence;

and transmitting the second ciphertext and the second key sequence to the client applied to the data transmission encryption method, so that the client can decrypt by combining the key string array to obtain a response plaintext.

In another aspect, an embodiment of the present invention provides a data transmission encryption device, applied to a client, including:

the first module is used for responding to the data transmission request and acquiring the public key from the transmission server; generating a key string array according to the plurality of random length character strings; the transmission server also comprises a private key matched with the public key;

the second module is used for carrying out exclusive or encryption on the request plaintext through the key string array to obtain a first ciphertext and a first key sequence;

the third module is used for carrying out asymmetric encryption on the key string array through the public key to obtain a key string ciphertext;

and the fourth module is used for transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server so that the transmission server can decrypt by combining the private key to obtain the target plaintext.

Optionally, the apparatus further comprises:

an eighth module, configured to generate, in response to the data transmission request, a key pair of the transmission server through an asymmetric algorithm based on a random prime pair; the key pair includes a public key and a private key.

Optionally, the apparatus further comprises:

a ninth module, configured to receive a second ciphertext and a second key sequence fed back by the transmission server; the second ciphertext and the second key sequence are obtained by performing exclusive or encryption on the response plaintext through the transmission server;

And a tenth module, configured to perform exclusive-or decryption on the second ciphertext through the key string array and the second key sequence, to obtain a response plaintext.

On the other hand, an embodiment of the present invention provides a data transmission decryption device, which is applied to a transmission server, including:

a fifth module, configured to obtain a first ciphertext, a first key sequence, a key string ciphertext, and a private key; the first ciphertext, the first key sequence and the key string ciphertext are obtained according to the data transmission encryption device, and the private key is matched with the public key in the data transmission encryption device;

a sixth module, configured to asymmetrically decrypt the key string ciphertext through the private key, to obtain a key string array;

and the seventh module is used for performing exclusive-or decryption on the first ciphertext through the key string array and the first key sequence to obtain a target plaintext.

Optionally, the apparatus further comprises:

an eleventh module for generating a key pair by an asymmetric algorithm based on a random prime pair in response to a data transmission request; the key pair comprises a public key and a private key;

a twelfth module, configured to transmit the public key to the client of the data transmission encryption device application.

Optionally, the apparatus further comprises:

A thirteenth module, configured to perform exclusive-or encryption on the response plaintext through the key string array, to obtain a second ciphertext and a second key sequence;

and the fourteenth module is used for transmitting the second ciphertext and the second key sequence to the client applied by the data transmission encryption device, so that the client can decrypt by combining the key string array to obtain a response plaintext.

In another aspect, an embodiment of the present invention provides an electronic device, including: a processor and a memory; the memory is used for storing programs; the processor executes the program to realize the data transmission encryption or decryption method.

In another aspect, an embodiment of the present invention provides a computer storage medium in which a processor-executable program is stored, which when executed by a processor is configured to implement the above-described data transmission encryption or decryption method.

According to the embodiment of the invention, the public key is acquired from the transmission server by responding to the data transmission request; generating a key string array according to the plurality of random length character strings; the transmission server also comprises a private key matched with the public key; performing exclusive or encryption on the request plaintext through a key string array to obtain a first ciphertext and a first key sequence; carrying out asymmetric encryption on the key string array through the public key to obtain a key string ciphertext; and transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server, so that the transmission server can decrypt by combining the private key to obtain the target plaintext. The embodiment of the invention realizes the combination of encryption by combining the public key with the key string array and further combining the exclusive-or encryption and the asymmetric encryption, and can provide the data encryption transmission method with high security and better encryption and decryption performance and transmission efficiency.

Drawings

The accompanying drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate and do not limit the invention.

FIG. 1 is a schematic diagram of an implementation environment for data transmission encryption according to an embodiment of the present invention;

fig. 2 is a schematic flow chart of a data transmission encryption method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a key string array according to an embodiment of the present invention;

fig. 4 is a schematic diagram of an overall flow of data transmission encryption according to an embodiment of the present invention;

fig. 5 is a flow chart of a data transmission decryption method according to an embodiment of the present invention;

fig. 6 is a schematic diagram of an overall flow of data transmission decryption according to an embodiment of the present invention;

fig. 7 is a schematic overall flow chart of a data transmission encryption and decryption method according to an embodiment of the present invention;

fig. 8 is a schematic structural diagram of a data transmission encryption device according to an embodiment of the present invention;

fig. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present invention;

fig. 10 is a block diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.

It should be noted that although functional block diagrams are depicted as block diagrams, and logical sequences are shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the block diagrams in the system. The terms first/S100, second/S200, and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the invention. The appearances of such phrases in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those of skill in the art will explicitly and implicitly appreciate that the embodiments described herein may be combined with other embodiments.

It can be understood that the data transmission encryption and decryption method provided by the embodiment of the invention can be applied to any computer device with data processing and computing capabilities, and the computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or is a server cluster or a distributed system formed by a plurality of physical servers, or is a cloud server for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network ), basic cloud computing services such as big data and artificial intelligence platforms, and the like. Alternatively, the terminal is a smart phone, a tablet computer, a notebook computer, a desktop computer, or the like, but is not limited thereto.

FIG. 1 is a schematic view of an embodiment of the invention. Referring to fig. 1, the implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected through a network in a wireless or wired mode to complete data transmission encryption exchange.

The server 101 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs (Content Delivery Network, content delivery networks), basic cloud computing services such as big data and artificial intelligent platforms, and the like.

In addition, server 101 may also be a node server in a blockchain network. The blockchain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like.

The terminal 102 may be, but is not limited to, a smart phone, tablet, notebook, desktop, smart box, smart watch, etc. The terminal 102 and the server 101 may be directly or indirectly connected through wired or wireless communication, which is not limited in this embodiment of the present invention.

Exemplary based on the implementation environment shown in fig. 1, an embodiment of the present invention provides a data transmission encryption method, and the following description will take an example in which the data transmission encryption method is applied to the terminal 102.

Referring to fig. 2, fig. 2 is a flowchart of a data transmission encryption method applied to a terminal according to an embodiment of the present invention, where an execution body of the data transmission encryption method may be any one of the foregoing computer devices (including a server or a terminal). Referring to fig. 2, the method includes the steps of:

s100, responding to a data transmission request, and acquiring a public key from a transmission server; generating a key string array according to the plurality of random length character strings;

it should be noted that, the transmission server side also includes a private key matched with the public key;

in some embodiments, the method may further comprise: generating a key pair of a transmission server through an asymmetric algorithm based on a random prime pair in response to a data transmission request; the key pair includes a public key and a private key.

Among them, RSA (asymmetric algorithm) is the most widely used public key cryptographic algorithm. In 1977, the RSA algorithm was designed jointly by Ronus Livister (Ron Rivest), addi Samo (Adi Shamir) and Lonnade Adaman (Lenard Adleman) at MIT, and was formally released in 1978 under the acronym of their three persons. The symmetric encryption Q method used heretofore uses only one key, and the decryption key can be known by knowing the encryption key. However, since the two parties need to agree on encryption rules in advance, there is no way to exchange keys securely and establish a secure transfer channel. But the idea of the asymmetric encryption Q algorithm that appeared in 1976 can solve the key exchange and storage problems. It uses two keys, one for encrypting the message and verifying the signature, called public key, and the other for decrypting, called private key, both of which are unequal. The new concept is proposed by the United states computer scientist Whitfield Difide and Martin Hellman, called Difide-Helman key exchange algorithm, the RSA algorithm is inspired by it, and is a specific implementation of the concept, which can be used for encryption, decryption and key exchange.

RSA is designed mainly by using the mathematical problem of large integer decomposition, and ingeniously utilizes the concept of number theory. Given the RSA public key, the first thought attack is to decompose the modulus, and the given factor attacker can calculate the decryption index, we call the method of decomposing the modulus as the violent attack against RSA. Although decomposition algorithms have steadily improved, the current state of the art still poses far from threatening the security of RSA in the case of correct use of RSA. Today, only short RSA keys are likely to be compromised in a brute force manner.

RSA is currently deployed in many commercial systems. The Web server and browser use it to protect Web traffic, it can be used to guarantee the privacy and authenticity of emails, and it can also be used to protect telnet sessions, and it is also the core of electronic credit card payment systems. In short, RSA is commonly used in applications where digital data security needs to be considered.

Illustratively, the RSA algorithm steps are as follows, and a public/private key pair (key pair) may be generated by:

1. selecting two unequal prime numbers p and q according to the calculation;

2. calculating their product n=p×q;

3. Calculating Euler function p (N) = (p-1) (q-1), wherein the binary length of N is used as the length of the key;

4. randomly selecting an encryption key e, where 1< e < p (N), gcd (e, p (N))=1;

5. solving to obtain a decryption key d according to the following formula; ed=1 mod p (N), O is less than or equal to dsN;

6. issuing an encryption key (i.e., public key) (e, N);

7. secret decryption key (i.e., private key) (d, N).

In some embodiments, generating the key string array from the plurality of random length strings may include: forming a character string sequence according to a plurality of random length character strings, and inserting a segmenter between each character string of the character string sequence to generate a key string array of the disposable codebook; wherein the first string of the key string array is a round key.

The encryption method is simple and efficient based on the XOR exclusive-OR encryption algorithm, the encryption method can be completed only by exclusive-OR operation, code writing does not depend on a third party library, and the generated ciphertext is consistent with the original file in size and cannot cause data expansion. However, regular encryption is easy to occur when the same key is used for encryption multiple times or the plaintext length needs to be encrypted far longer than the key length, so that ciphertext can be cracked. The embodiment of the invention adopts a One-Time Pad (OTP) to ensure the security of data encryption, and requires that the codebook is only used once.

S200, performing exclusive or encryption on a request plaintext through a key string array to obtain a first ciphertext and a first key sequence;

it should be noted that, the first string of the key string array is a round key, and in some embodiments, step S200 may include: acquiring a plurality of character strings from the key string array to form a first key string, and obtaining a first key sequence according to the position codes of each character string in the first key string in the key string array; the length of the first key string is greater than the length of the request plaintext; performing first exclusive OR operation on the first key string and the round key to obtain a second key string; and performing a second exclusive or operation on the second key string and the request plaintext to obtain a first ciphertext. The round key performs a first exclusive or operation through a round key string formed by repeatedly arranging the round keys.

Where the key length needs to be greater than or equal to the length of the plaintext, too long a key may result in an RSA encryption process of the key that is too inefficient. In view of this, embodiments of the present invention are based on XOR (OTP) encryption algorithms: a plurality of character string arrays with random lengths are used, key strings with lengths equal to or greater than that of plaintext are generated in the character string arrays through random combination, and the positions of the character strings in the arrays are recorded. And generating a random length character string (R), and performing cyclic exclusive OR operation on the key string to generate a final key string, so that the regularity of the key can be greatly eliminated, and the encryption safety is ensured. In the data transmission process, only a plurality of random length character strings with limited lengths are required to be subjected to RSA encryption protection, so that the transmission key length is reduced, and the encryption and decryption efficiency is improved.

Illustratively, as shown in fig. 3, the structure (S) of the XOR key string array is: the key string array consists of a random length character string (R) and a plurality of character string arrays with random lengths, the total length is set to 128, the key string array is controlled within the maximum length range of one RSA encryption, and the key string array is regenerated every time a data request begins.

S300, carrying out asymmetric encryption on the key string array through a public key to obtain a key string ciphertext;

illustratively, using public key (7,187), private key (23,187) as an example, the public key and private key are generated and can be used to encrypt and decrypt.

1. Sender encrypts message M:

after the public key e and the public key N of the other party are taken, C=Memod N is calculated, wherein M < N is not less than 0, and C is used as ciphertext to be sent to a receiver; for example, m=88, c=88' 7mod 187=11;

2. the receiving side decrypts ciphertext C:

taking out the private keys d and N, and calculating m=c≡mod N to obtain the original message m=11' 23mod 187=88.

S400, transmitting the first ciphertext, the first key sequence and the key string ciphertext to a transmission server, so that the transmission server can decrypt by combining with a private key to obtain a target plaintext;

in some embodiments, the method may further include: receiving a second ciphertext and a second key sequence fed back by the transmission server; the second ciphertext and the second key sequence are obtained by performing exclusive or encryption on the response plaintext through the transmission server; and performing exclusive or decryption on the second ciphertext through the key string array and the second key sequence to obtain a response plaintext.

In some embodiments, as shown in fig. 4, the data transmission encryption includes the steps of:

1) Constructing a key string with a length longer than that of a plaintext (C1) by using the character strings in the XOR key string array (S), and recording a position sequence (X1) of the character strings in the key string array (S), wherein NX: representing the position in the XOR key string array (S).

2) The last generated key string is exclusive-ored with a round key (R) in the XOR key string array (S) to generate a final key string (SS).

3) The plaintext is exclusive-ored using the key string (SS) to generate a final ciphertext (M1).

The embodiment of the present invention further provides a data transmission decryption method based on the implementation environment shown in fig. 1, and the description below uses the data transmission decryption method applied to the server 101 as an example.

Referring to fig. 5, fig. 5 is a flowchart of a data transmission decryption method applied to a server according to an embodiment of the present invention, where an execution body of the data transmission decryption method may be any one of the foregoing computer devices (including a server or a terminal). Referring to fig. 5, the method includes the steps of:

t100, acquiring a first ciphertext, a first key sequence, a key string ciphertext and a private key;

The first ciphertext, the first key sequence and the key string ciphertext are obtained according to the data transmission encryption method, and the private key is matched with the public key in the data transmission encryption method;

t200, asymmetrically decrypting the cipher text of the key string through the private key to obtain a key string array;

and T300, performing exclusive OR decryption on the first ciphertext through the key string array and the first key sequence to obtain a target plaintext.

In some embodiments, the method may further comprise: generating a key pair through an asymmetric algorithm based on a random prime number pair in response to a data transmission request; the key pair comprises a public key and a private key; the public key is transmitted to the client (terminal) to which the aforementioned data transmission encryption method is applied.

In some embodiments, the method may further comprise: performing exclusive or encryption on the response plaintext through the key string array to obtain a second ciphertext and a second key sequence; and transmitting the second ciphertext and the second key sequence to a client (terminal) to which the data transmission encryption method is applied, so that the client can decrypt by combining the key string array to obtain a response plaintext.

In the foregoing data transmission encryption method, when the encryption logic of the plaintext and the related data such as the key have been clearly defined, the decryption logic of the ciphertext is correspondingly implemented by implementing the reverse derivation of the encryption logic by the related data such as the key. Therefore, the decryption process of the ciphertext will not be described in detail. Similarly, the encryption and decryption flow logic principles for the response plaintext and the second ciphertext and second key sequence are the same.

In some embodiments, as shown in fig. 6, the data transmission decryption includes the following steps:

1) The key string of the first exclusive-or operation in the encryption process is restored using the XOR key string array (S) and the key sequence (X1).

2) The key string (SS) is generated by exclusive-or-operating the key string generated in the previous step using the round key (R) in the XOR key string array (S).

3) The ciphertext (M1) is exclusive-ored using the key string (SS) to generate a final plaintext (C1).

For the purpose of illustrating the principles of the present invention in detail, the following general flow chart of the present invention is described in connection with certain specific embodiments, and it is to be understood that the following is illustrative of the principles of the present invention and is not to be construed as limiting the present invention.

In some embodiments, as shown in fig. 7, the overall flow of encryption and decryption of data transmission implemented based on the method of the present invention is as follows:

step one, a Web server generates a Public Key (PK) and a private key (PRK) through an asymmetric RSA algorithm.

And step two, the client accesses the Web service to acquire an RSA Public Key (PK).

And step three, the client generates an XOR key string array (S).

And step four, the client encrypts the request plaintext (C1) by using the XOR key string array (S) to generate ciphertext (M1) and a key sequence (X1).

And fifthly, the client encrypts the XOR key string array (S) by using the RSA Public Key (PK) to generate a key string ciphertext (namely, the illustrated encryption key string array SM).

And step six, the client transmits the XOR key string ciphertext (SM), the key sequence (X1) and the encrypted ciphertext (M1) to the Web server.

And step seven, the Web server decrypts the key string ciphertext (SM) by using an RSA private key (PRK) to obtain a key string array (S).

And step eight, the Web server uses the key string array (S) and the key sequence (X1) to perform XOR decryption on the ciphertext (M1) to obtain a plaintext (C1).

And step nine, the Web server side multiplexes the key string array (S) to perform XOR encryption on the response plaintext (C2) to generate a response ciphertext (M2), generates a key sequence (X2), and then sends the key sequence to the client side.

And step ten, the client receives the response ciphertext (M2) and the key sequence (X2), and decrypts the response plaintext (C2) by using the key string array (S).

The embodiment of the invention is based on the transmission of the XOR key string array, encrypts the key string array (S) by using an RSA Public Key (PK), and decrypts the private key (PRK). The private key is stored in the server, the public key is sent to the client by the server, and even if the public key and the ciphertext are revealed in the transmission process, the plaintext cannot be obtained through the public key and the ciphertext.

In view of the determination of transmission encryption in the prior art, web data transmission security cannot rely on HTTPS protocol alone, and in the Web data transmission process, data needs to be encrypted to protect data security, and meanwhile, it must be ensured that the encryption process cannot affect development complexity and performance of applications too much. The invention realizes the safe transmission of Web data by an easy-to-use, efficient and safe data transmission encryption method.

In summary, the invention encrypts the plaintext by the XOR-based encryption algorithm, and simultaneously encrypts and transmits the key by using the RSA public key. The embodiment of the invention uses a plurality of character string arrays with random length, generates the key strings with the length equal to or greater than that of plaintext in the character string arrays through random combination, and records the positions of the character strings in the arrays. And generating a random length character string (R), and performing cyclic exclusive OR operation on the key string to generate a final key string, so that the regularity of the key can be greatly eliminated, and the encryption safety is ensured. In the data transmission process, only a plurality of random length character strings with limited lengths are required to be subjected to RSA encryption protection, so that the transmission key length is reduced, and the encryption and decryption efficiency is improved.

Compared with the prior art, the invention at least comprises the following intentional effects:

1. the encryption and decryption algorithm based on the XOR can realize the encryption and decryption function by using the XOR operation no matter the client or the server, the realization process is simple, the third party library is not needed, the encryption and decryption process has high performance and is convenient and quick to develop.

2. The transmission key length is controlled by an XOR key string array encryption mode, so that the performance consumption of RSA on key encryption is reduced; and the size of the ciphertext is controlled in a ciphertext, key array and key sequence mode, so that the flow consumption is reduced.

3. And when the server responds to the encryption of the content, multiplexing the key string array of the client, only regenerating the key sequence, reducing the transmission of the key string array and improving the encryption and decryption efficiency.

Specifically, the embodiment of the invention generates the disposable random key through the key array, replaces the key transmission through the mode of transmitting the key array and the key sequence, reduces the key transmission length and improves the efficiency. In addition, in Web data transmission, request response content is encrypted in a key sequence mode by reusing the key array in a ciphertext, key array and key sequence multi-factor encryption mode, so that the one-time codebook is ensured, and the transmission times of the key array are reduced.

On the other hand, as shown in fig. 8, an embodiment of the present invention provides a data transmission encryption apparatus 800, applied to a client, including: a first module 810, configured to obtain a public key from a transmission server in response to a data transmission request; generating a key string array according to the plurality of random length character strings; the transmission server also comprises a private key matched with the public key; a second module 820, configured to perform exclusive-or encryption on the requested plaintext through the key string array, to obtain a first ciphertext and a first key sequence; a third module 830, configured to perform asymmetric encryption on the key string array through a public key to obtain a key string ciphertext; and a fourth module 840, configured to transmit the first ciphertext, the first key sequence, and the key string ciphertext to the transmission server, so that the transmission server decrypts by combining the private key to obtain the target plaintext.

In some embodiments, the apparatus may further include: an eighth module, configured to generate, in response to the data transmission request, a key pair of the transmission server through an asymmetric algorithm based on a random prime pair; the key pair includes a public key and a private key.

In some embodiments, the apparatus may further include: a ninth module, configured to receive a second ciphertext and a second key sequence fed back by the transmission server; the second ciphertext and the second key sequence are obtained by performing exclusive or encryption on the response plaintext through the transmission server; and a tenth module, configured to perform exclusive-or decryption on the second ciphertext through the key string array and the second key sequence, to obtain a response plaintext.

The content of the method embodiment of the invention is suitable for the device embodiment, the specific function of the device embodiment is the same as that of the method embodiment, and the achieved beneficial effects are the same as those of the method.

On the other hand, an embodiment of the present invention provides a data transmission decryption device, which is applied to a transmission server, including: a fifth module, configured to obtain a first ciphertext, a first key sequence, a key string ciphertext, and a private key; the first ciphertext, the first key sequence and the key string ciphertext are obtained according to the data transmission encryption device, and the private key is matched with the public key in the data transmission encryption device; a sixth module, configured to asymmetrically decrypt the key string ciphertext through the private key, to obtain a key string array; and the seventh module is used for performing exclusive-or decryption on the first ciphertext through the key string array and the first key sequence to obtain a target plaintext.

In some embodiments, the apparatus may further include: an eleventh module for generating a key pair by an asymmetric algorithm based on a random prime pair in response to a data transmission request; the key pair comprises a public key and a private key; a twelfth module, configured to transmit the public key to the client of the data transmission encryption device application.

In some embodiments, the apparatus may further include: a thirteenth module, configured to perform exclusive-or encryption on the response plaintext through the key string array, to obtain a second ciphertext and a second key sequence; and the fourteenth module is used for transmitting the second ciphertext and the second key sequence to the client applied by the data transmission encryption device, so that the client can decrypt by combining the key string array to obtain a response plaintext.

On the other hand, as shown in fig. 9, an embodiment of the present invention further provides an electronic device 900, which includes at least one processor 910, and at least one memory 920 for storing at least one program; take a processor 910 and a memory 920 as examples.

The processor 910 and the memory 920 may be connected by a bus or other means.

Memory 920 acts as a non-transitory computer readable storage medium that may be used to store non-transitory software programs as well as non-transitory computer executable programs. In addition, memory 920 may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid state storage device. In some implementations, the memory 920 may optionally include memory located remotely from the processor, which may be connected to the device via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The above described embodiments of the electronic device are merely illustrative, wherein the units described as separate components may or may not be physically separate, i.e. may be located in one place, or may be distributed over a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In particular, FIG. 10 schematically shows a block diagram of a computer system for implementing an electronic device of an embodiment of the invention.

It should be noted that, the computer system 1000 of the electronic device shown in fig. 10 is only an example, and should not impose any limitation on the functions and the application scope of the embodiments of the present invention.

As shown in fig. 10, the computer system 1000 includes a central processing unit 1001 (Central Processing Unit, CPU) which can execute various appropriate actions and processes according to a program stored in a Read-Only Memory 1002 (ROM) or a program loaded from a storage section 1008 into a random access Memory 1003 (Random Access Memory, RAM). In the random access memory 1003, various programs and data necessary for the system operation are also stored. The cpu 1001, the rom 1002, and the ram 1003 are connected to each other via a bus 1004. An Input/Output interface 1005 (i.e., an I/O interface) is also connected to bus 1004.

The following components are connected to the input/output interface 1005: an input section 1006 including a keyboard, a mouse, and the like; an output portion 1007 including a Cathode Ray Tube (CRT), a liquid crystal display (Liquid Crystal Display, LCD), and a speaker; a storage portion 1008 including a hard disk or the like; and a communication section 1009 including a network interface card such as a local area network card, a modem, or the like. The communication section 1009 performs communication processing via a network such as the internet. The drive 1010 is also connected to the input/output interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like, is installed as needed in the drive 1010, so that a computer program read out therefrom is installed as needed in the storage section 1008.

In particular, the processes described in the various method flowcharts may be implemented as computer software programs according to embodiments of the invention. For example, embodiments of the present invention include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via the communication portion 1009, and/or installed from the removable medium 1011. The computer programs, when executed by the central processor 1001, perform the various functions defined in the system of the present invention.

It should be noted that, the computer readable medium shown in the embodiments of the present invention may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-Only Memory (ROM), an erasable programmable read-Only Memory (Erasable Programmable Read Only Memory, EPROM), flash Memory, an optical fiber, a portable compact disc read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

The content of the method embodiment of the invention is suitable for the system embodiment, the specific function of the system embodiment is the same as that of the method embodiment, and the achieved beneficial effects are the same as those of the method.

Another aspect of the embodiments of the present invention also provides a computer-readable storage medium storing a program that is executed by a processor to implement the foregoing method.

The content of the method embodiment of the invention is applicable to the computer readable storage medium embodiment, the functions of the computer readable storage medium embodiment are the same as those of the method embodiment, and the achieved beneficial effects are the same as those of the method.

Embodiments of the present invention also disclose a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The computer instructions may be read from a computer-readable storage medium by a processor of a computer device, and executed by the processor, to cause the computer device to perform the foregoing method.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

It should be noted that although in the above detailed description several modules of a device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functions of two or more modules or units described above may be embodied in one module or unit in accordance with embodiments of the invention. Conversely, the features and functions of one module or unit described above may be further divided into a plurality of modules or units to be embodied.

From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, the technical solution according to the embodiments of the present invention may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and includes several instructions to cause a computing device (may be a personal computer, a server, a touch terminal, or a network device, etc.) to perform the method according to the embodiments of the present invention.

In some alternative embodiments, the functions/acts noted in the block diagrams may occur out of the order noted in the operational illustrations. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Furthermore, the embodiments presented and described in the flowcharts of the present invention are provided by way of example in order to provide a more thorough understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed, and in which sub-operations described as part of a larger operation are performed independently.

Furthermore, while the invention is described in the context of functional modules, it should be appreciated that, unless otherwise indicated, one or more of the functions and/or features may be integrated in a single physical device and/or software module or may be implemented in separate physical devices or software modules. It will also be appreciated that a detailed discussion of the actual implementation of each module is not necessary to an understanding of the present invention. Rather, the actual implementation of the various functional modules in the apparatus disclosed herein will be apparent to those skilled in the art from consideration of their attributes, functions and internal relationships. Accordingly, one of ordinary skill in the art can implement the invention as set forth in the claims without undue experimentation. It is also to be understood that the specific concepts disclosed are merely illustrative and are not intended to be limiting upon the scope of the invention, which is to be defined in the appended claims and their full scope of equivalents.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method of the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

Logic and/or steps represented in the flowcharts or otherwise described herein, e.g., a ordered listing of executable instructions for implementing logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution apparatus, device, or apparatus, such as a computer-based apparatus, processor-containing apparatus, or other apparatus that can fetch the instructions from the instruction execution apparatus, device, or apparatus and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution apparatus, device, or apparatus.

More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium may even be paper or other suitable medium upon which the program is printed, as the program may be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

It is to be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, may be implemented using any one or combination of the following techniques, as is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits having suitable combinational logic gates, programmable Gate Arrays (PGAs), field Programmable Gate Arrays (FPGAs), and the like.

In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

While embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that: many changes, modifications, substitutions and variations may be made to the embodiments without departing from the spirit and principles of the invention, the scope of which is defined by the claims and their equivalents.

While the preferred embodiment of the present invention has been described in detail, the present invention is not limited to the embodiments, and those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and the equivalent modifications or substitutions are intended to be included in the scope of the present invention as defined in the appended claims.

Claims

1. A data transmission encryption method applied to a client, comprising:

performing exclusive or encryption on the request plaintext through the key string array to obtain a first ciphertext and a first key sequence;

performing asymmetric encryption on the key string array through the public key to obtain a key string ciphertext;

And transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server, so that the transmission server can decrypt by combining the private key to obtain a target plaintext.

2. The data transmission encryption method according to claim 1, characterized in that the method further comprises:

generating a key pair of the transmission server through an asymmetric algorithm based on a random prime number pair in response to the data transmission request; the key pair includes the public key and the private key.

3. The data transmission encryption method according to claim 1, wherein the generating a key string array from a plurality of random length strings comprises:

forming a character string sequence according to a plurality of random length character strings, and inserting a divider between each character string of the character string sequence to generate a key string array of the disposable codebook; wherein the first string of the key string array is a round key.

4. The data transmission encryption method according to claim 1, wherein the first string of the key string array is a round key; the exclusive or encryption is carried out on the request plaintext through the key string array to obtain a first ciphertext and a first key sequence, and the method comprises the following steps:

performing first exclusive-or operation on the first key string and the round key to obtain a second key string;

and performing a second exclusive-or operation on the second key string and the request plaintext to obtain a first ciphertext.

5. The data transmission encryption method according to claim 1, characterized in that the method further comprises:

receiving a second ciphertext and a second key sequence fed back by the transmission server; the second ciphertext and the second key sequence are obtained by performing exclusive-or encryption on the response plaintext through the transmission server;

and performing exclusive-or decryption on the second ciphertext through the key string array and the second key sequence to obtain the response plaintext.

6. A data transmission decryption method applied to a transmission server, comprising:

acquiring a first ciphertext, a first key sequence, a key string ciphertext and a private key; wherein the first ciphertext, the first key sequence, and the key string ciphertext are obtained according to the data transmission encryption method of any one of claims 1 to 5, the private key matching a public key of the data transmission encryption method of any one of claims 1 to 5;

Performing asymmetric decryption on the key string ciphertext through the private key to obtain a key string array;

and performing exclusive-or decryption on the first ciphertext through the key string array and the first key sequence to obtain a target plaintext.

7. The data transmission decryption method according to claim 6, wherein the method further comprises:

generating a key pair through an asymmetric algorithm based on a random prime number pair in response to a data transmission request; the key pair includes the public key and the private key;

transmitting the public key to a client to which the data transmission encryption method of any one of claims 1 to 5 is applied.

8. The data transmission decryption method according to claim 6, wherein the method further comprises:

transmitting the second ciphertext and the second key sequence to a client to which the data transmission encryption method of any one of claims 1 to 5 is applied, so that the client decrypts in combination with the key string array to obtain a response plaintext.

9. A data transmission encryption device applied to a client, comprising:

and the fourth module is used for transmitting the first ciphertext, the first key sequence and the key string ciphertext to the transmission server so that the transmission server can decrypt by combining the private key to obtain a target plaintext.

10. A data transmission decryption device applied to a transmission server, comprising:

a fifth module, configured to obtain a first ciphertext, a first key sequence, a key string ciphertext, and a private key; wherein the first ciphertext, the first key sequence, and the key string ciphertext are obtained according to the data transmission encryption device of claim 9, and the private key is matched with a public key in the data transmission encryption device of claim 9;

and a seventh module, configured to perform exclusive-or decryption on the first ciphertext through the key string array and the first key sequence, to obtain a target plaintext.

11. An electronic device comprising a processor and a memory;

the memory is used for storing programs;

the processor executing the program implements the method of any one of claims 1 to 5 or 6 to 8.

12. A computer storage medium in which a processor executable program is stored, characterized in that the processor executable program is for implementing the method according to any one of claims 1 to 5 or 6 to 8 when being executed by the processor.