CN106961411B - Data transmission method and system - Google Patents

Data transmission method and system Download PDF

Info

Publication number
CN106961411B
CN106961411B CN201610012590.9A CN201610012590A CN106961411B CN 106961411 B CN106961411 B CN 106961411B CN 201610012590 A CN201610012590 A CN 201610012590A CN 106961411 B CN106961411 B CN 106961411B
Authority
CN
China
Prior art keywords
data
encrypted
terminal
virtual
encryption algorithm
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201610012590.9A
Other languages
Chinese (zh)
Other versions
CN106961411A (en
Inventor
李爽
杨轶
郭宇鹏
李伟敏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Muji Network Technology Co ltd
Original Assignee
Shanghai Muji Network Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Muji Network Technology Co ltd filed Critical Shanghai Muji Network Technology Co ltd
Priority to CN201610012590.9A priority Critical patent/CN106961411B/en
Publication of CN106961411A publication Critical patent/CN106961411A/en
Application granted granted Critical
Publication of CN106961411B publication Critical patent/CN106961411B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/06Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

A data transmission method and system, the method includes: the first data terminal compiles the encryption algorithm into a virtual instruction and sends a data packet containing the virtual instruction to the second data terminal; the second data terminal encrypts data to be encrypted by using the virtual instruction to obtain encrypted data; the second data end sends the encrypted data to the first data end; and the first data end decrypts the encrypted data to judge the validity of the encrypted data. The method and the system can improve the safety of data transmission.

Description

Data transmission method and system
Technical Field
The present invention relates to the field of communications, and in particular, to a data transmission method and system.
Background
With the development of network technology, more and more data transmission is performed through the network. The related aspects of network data transmission are very wide, the industries for applying networks to carry out data transmission are more and more, and the requirements of more and more network data transmission on data security are higher.
However, the data security of the existing network data transmission method needs to be improved.
Disclosure of Invention
The invention aims to improve the safety of the data transmission method.
To solve the foregoing technical problem, an embodiment of the present invention provides a data transmission method, including:
the first data terminal compiles the encryption algorithm into a virtual instruction and sends a data packet containing the virtual instruction to the second data terminal;
the second data terminal encrypts data to be encrypted by using the virtual instruction to obtain encrypted data;
the second data end sends the encrypted data to the first data end;
and the first data end decrypts the encrypted data to judge the validity of the encrypted data.
Optionally, the data packet further includes: a virtual environment capable of executing the virtual instructions or a selection identifier corresponding to the virtual environment.
Optionally, the first data end compiles the encryption algorithm by using a dynamically updated instruction system.
Optionally, the first data end is further adapted to update the encryption algorithm.
Optionally, the data packet further includes signature information; before encrypting the data to be encrypted, the method further comprises the following steps: the second data terminal uses the signature information to sign the data to be encrypted;
the first data terminal decrypts the encrypted data to judge the validity of the encrypted data, and the judging step includes: the first data end decrypts the encrypted data to obtain signed data to be encrypted; and the first data terminal verifies the signed data to be encrypted so as to judge the validity of the encrypted data.
Optionally, the data to be encrypted includes payment information.
Optionally, when the encrypted data is valid data, the method further includes: the first data terminal initiates a payment application.
An embodiment of the present invention further provides a data transmission system, including:
the first data terminal is suitable for compiling the encryption algorithm into a virtual instruction, sending a data packet containing the virtual instruction to the second data terminal, and decrypting the encrypted data from the second data terminal to judge the validity of the encrypted data;
the second data terminal is suitable for encrypting data to be encrypted by using the virtual instruction to obtain encrypted data, and sending the encrypted data to the first data terminal.
Optionally, the data packet further includes: a virtual environment capable of executing the virtual instructions or a selection identifier corresponding to the virtual environment.
Optionally, the first data end compiles the encryption algorithm by using a dynamically updated instruction system.
Optionally, the first data end is further adapted to update the encryption algorithm.
Optionally, the data packet further includes signature information;
the second data terminal is also suitable for signing the data to be encrypted by using the signature information before encrypting the data to be encrypted;
the first data terminal comprises: the decryption unit is suitable for decrypting the encrypted data to obtain signed data to be encrypted; and the verification unit is suitable for verifying the signed data to be encrypted so as to judge the validity of the encrypted data.
Optionally, the data to be encrypted includes payment information.
Optionally, the first data end further includes: and the payment application initiating unit is suitable for initiating a payment application when the encrypted data is valid data.
Compared with the prior art, the technical scheme of the embodiment of the invention has the following beneficial effects:
by compiling the encryption algorithm into the virtual instruction, the encryption algorithm does not exist in a plain text form any more, so that an illegal third party is difficult to know the encryption algorithm, and the confidentiality of the encryption algorithm is improved. The second data terminal encrypts the data to be encrypted by using the virtual instruction to obtain encrypted data, so that the data security of the data to be encrypted can be improved. The second data end sends the encrypted data to the first data end, and the first data end can decrypt the data, so that the whole communication process of data transmission can be completed in a higher-security mode.
Drawings
FIG. 1 is a flow chart of a data transmission method in an embodiment of the invention;
fig. 2 is a schematic structural diagram of a data transmission system according to an embodiment of the present invention;
fig. 3 is a schematic structural diagram of a first data terminal according to an embodiment of the present invention.
Detailed Description
With the development of network technology, more and more data transmission is performed through the network. The related aspects of network data transmission are very wide, the industries for applying networks to carry out data transmission are more and more, and the requirements of more and more network data transmission on data security are higher.
However, the data security of the existing network data transmission method needs to be improved.
According to the invention, the encryption algorithm is compiled into the virtual instruction, so that the encryption algorithm does not exist in a plain text form any more, and an illegal third party is difficult to know the encryption algorithm, thereby increasing the confidentiality of the encryption algorithm. The second data terminal encrypts the data to be encrypted by using the virtual instruction to obtain encrypted data, so that the data security of the data to be encrypted can be improved. The second data end sends the encrypted data to the first data end, and the first data end can decrypt the data, so that the whole communication process of data transmission can be completed in a higher-security mode.
In order to make the aforementioned objects, features and advantages of the present invention comprehensible, embodiments accompanied with figures are described in detail below.
Fig. 1 is a flowchart of a data transmission method according to an embodiment of the present invention.
In step S11, the first data side compiles the encryption algorithm into a virtual instruction.
The first data terminal may be a server or a server cluster, or may be other devices with data processing capability. The virtual instructions may be custom instructions or may be various suitable general instructions that can be executed in a matching virtual environment.
In the prior art, the encryption algorithm is often present in the user terminal in various forms exposed to the third party, such as in the form of client program code or script code, which is usually open in clear, thus providing the third party with the possibility of forging data.
In the embodiment of the invention, the encryption algorithm in the source code form is compiled and then sent to the second data terminal for use, so that a malicious third party cannot easily obtain the specific content of the compiled encryption algorithm, and the data are difficult to forge. Furthermore, the encryption algorithm is compiled into the virtual instruction, and the virtual instruction can be a self-defined instruction and is in an undisclosed state, so that an illegal third party cannot easily obtain an instruction system of the virtual instruction, and the confidentiality of the encryption algorithm can be greatly enhanced.
In a specific implementation, the first data terminal is further adapted to update the encryption algorithm. The updating of the encryption algorithm may be a periodic updating or a different encryption algorithm may be used for each data transmission.
The encryption algorithm is updated, so that the encryption algorithm has timeliness, even if a data packet in the data transmission process is intercepted, and an illegal third party also cracks the encryption algorithm of the intercepted data, but the decryption is useless due to the timeliness of the encryption algorithm, and the safety of the data transmission method is further improved.
In step S12, a data packet containing the virtual command is sent to the second data end.
The second data terminal can be a computer, a server, a mobile phone, a tablet computer and other devices with certain computing capability.
In one implementation, the data packet may further include a virtual environment capable of executing the virtual instruction. That is to say, the virtual environment capable of executing the virtual instruction may be loaded on the second data terminal, and the data packet sent by the first data terminal to the second data terminal includes the selection identifier, so as to select or activate the virtual environment loaded in the second data terminal; or, the virtual environment may also be sent from the first data end to the second data end, that is, the second data end does not load the virtual environment, and the complete file of the virtual environment is transmitted from the first data end to the second data end. Wherein, the virtual instruction system and the virtual environment are matched with each other, if the virtual instruction is self-defined, the virtual environment is the virtual environment matched with the self-defined virtual instruction, and the virtual environment can interpret or execute the virtual instruction in a proper way. For example, the virtual environment may be a virtual machine.
In another specific implementation, the first data terminal compiles the encryption algorithm by using a dynamically updated instruction system. The first data terminal can update the instruction system periodically, or update the instruction system before data transmission is needed each time.
Correspondingly, the second data terminal should prepare a virtual environment supporting the command system of the first data terminal, and the virtual environment may be sent from the first data terminal to the second data terminal in step S11, or an environment supporting multiple command systems may be configured on the second data terminal, and the command system applied by the first data terminal is notified in step S11 by the first data terminal each time data transmission is required.
Similarly to updating the encryption algorithm, the instruction system with dynamic update can be used for enabling the instruction system to have timeliness, even if a data packet in the data transmission process is intercepted and an illegal third party also cracks the instruction system, due to the fact that the instruction system has timeliness, the data transmission process corresponding to the cracked instruction system is completed, and the next data transmission process adopts different instruction systems, and therefore the safety of the data transmission method can be further improved.
In step S13, the second data end encrypts the data to be encrypted by using the virtual instruction to obtain encrypted data.
In a specific implementation, the data to be encrypted includes payment information. The payment information may be information related to the network payment such as a payment key, payment amount, payee identification, and the like.
The payment process has higher requirement on data security, in the payment process, the second data terminal can be used by a client with payment requirement, and the first data terminal can initiate a payment application after verifying the legality of payment information. For example, after the validity is verified, the first data terminal forwards the payment information of the user to the corresponding payment server to complete the payment.
The payment process needs to prevent an illegal third party from masquerading as the second data terminal sending data to forge the transaction. In the embodiment of the invention, because an illegal third party is difficult to know the encryption algorithm, the illegal third party is difficult to pretend to be a fake transaction of the second data terminal, and the safety of the payment process is further improved.
In step S14, the second data end sends the encrypted data to the first data end.
In step S15, the first data end decrypts the encrypted data to determine the validity of the encrypted data.
The judgment of the validity of the encrypted data can be carried out by the following method: and the first data terminal decrypts the encrypted data by adopting a decryption method corresponding to the encryption method, judges whether the decrypted data is complete or not, and if the decrypted data is complete, the encrypted data can be considered to be effective. Whether the data is complete or not can be performed through a preset check rule.
In one implementation, the data packet may further include signature information; before encrypting the data to be encrypted, the method may further include: the second data terminal uses the signature information to sign the data to be encrypted;
the decrypting, by the first data end, the encrypted data to determine the validity of the encrypted data may include: the first data end decrypts the encrypted data to obtain signed data to be encrypted; and the first data terminal verifies the signed data to be encrypted so as to judge the validity of the encrypted data.
In a specific implementation, when the data to be encrypted includes payment information, the validity of the payment information is determined in the step S15, so that the payment security can be improved.
In the electronic payment process, a user authentication process may be included, which is required to reflect the real user payment intention rather than the false intention forged by a malicious program. User authentication typically takes the form of entering a password or dynamic verification code. Since the password or the authentication code is indispensable information in the payment request data, and this information is known only by the user himself, such a process is difficult to be forged by an illegal third party (such as malicious program code or the like). However, the payment form needs more processes of manual participation and is not convenient enough.
In the similar mobile short message payment service, an operator can directly acquire the user identity (namely the mobile phone number) through the user access point, so that the user authentication process is omitted, a password does not need to be input, and the convenience is improved. However, in this way, it is difficult for the server to identify whether the received data packet is legitimate because the sender may be malicious code that masquerades as a user and sends a false payment request.
The malicious code is disguised as the premise that the user needs to know the encryption algorithm, but the encryption algorithm in the embodiment of the invention is difficult to obtain, so that an illegal third party is difficult to deploy the malicious code, and the fund security of the user can be guaranteed.
An embodiment of the present invention further provides a data transmission system, and a schematic structural diagram of the data transmission system is shown in fig. 2.
A data transmission system, may include:
the first data terminal 21 is adapted to compile an encryption algorithm into a virtual instruction, send a data packet containing the virtual instruction to the second data terminal 22, and decrypt encrypted data from the second data terminal 22 to determine validity of the encrypted data;
the second data terminal 22 is adapted to encrypt data to be encrypted by using the virtual instruction to obtain encrypted data, and send the encrypted data to the first data terminal 21.
In a specific implementation, the data packet may further include: a virtual environment capable of executing the virtual instructions or a selection identifier corresponding to the virtual environment.
In a specific implementation, the first data terminal 21 may compile the encryption algorithm by using a dynamically updated instruction system.
In a specific implementation, the first data terminal 21 is further adapted to update the encryption algorithm.
In a specific implementation, the data packet may further include signature information;
the second data terminal 22 is further adapted to sign the data to be encrypted by using the signature information before encrypting the data to be encrypted;
the first data terminal 21 may include: a decryption unit 31 (see fig. 3, described below in connection with fig. 3) adapted to decrypt the encrypted data to obtain signed data to be encrypted; and the verification unit 32 is suitable for verifying the signed data to be encrypted so as to judge the validity of the encrypted data.
In a specific implementation, the data to be encrypted may include payment information.
In a specific implementation, the first data end may further include: a payment application initiating unit 33, adapted to initiate a payment application when the encrypted data is valid data.
Those skilled in the art will appreciate that all or part of the steps in the methods of the above embodiments may be implemented by associated hardware instructed by a program, which may be stored in a computer-readable storage medium, and the storage medium may include: ROM, RAM, magnetic or optical disks, and the like.
Although the present invention is disclosed above, the present invention is not limited thereto. Various changes and modifications may be effected therein by one skilled in the art without departing from the spirit and scope of the invention as defined in the appended claims.

Claims (14)

1. A method of data transmission, comprising:
the encryption algorithm is compiled into a virtual instruction by a first data end, and the first data end is a server or a server cluster;
the first data terminal sends a data packet containing the virtual instruction and a virtual environment for executing the virtual instruction to a second data terminal, and the second data terminal is a client terminal;
the second data terminal encrypts data to be encrypted by using the virtual instruction to obtain encrypted data, wherein the data to be encrypted comprises payment information;
the second data end sends the encrypted data to the first data end;
the first data end decrypts the encrypted data to judge the validity of the encrypted data;
in the process, the illegal third party is prevented from being disguised as the second data terminal to send data to forge the transaction by preventing the illegal third party from knowing the encryption algorithm.
2. The data transmission method according to claim 1, wherein the data packet further comprises: a virtual environment capable of executing the virtual instructions or a selection identifier corresponding to the virtual environment.
3. The data transmission method according to claim 2, wherein the first data terminal compiles the encryption algorithm using a dynamically updated instruction system.
4. The data transmission method according to claim 1, characterized in that the first data side is further adapted to update the encryption algorithm.
5. The data transmission method according to claim 1, wherein the data packet further includes signature information; before encrypting the data to be encrypted, the method further comprises the following steps: the second data terminal uses the signature information to sign the data to be encrypted;
the first data terminal decrypts the encrypted data to judge the validity of the encrypted data, and the judging step includes: the first data end decrypts the encrypted data to obtain signed data to be encrypted; and the first data terminal verifies the signed data to be encrypted so as to judge the validity of the encrypted data.
6. The data transmission method according to any one of claims 1 to 5, wherein the data to be encrypted includes payment information.
7. The data transmission method according to claim 6, wherein when the encrypted data is valid data, the method further comprises: the first data terminal initiates a payment application.
8. A data transmission system, comprising:
a first data terminal suitable for compiling the encryption algorithm into a virtual instruction, sending a data packet containing the virtual instruction and a virtual environment for executing the virtual instruction to a second data terminal, and processing the encrypted data packet from the second data terminal
Decrypting the encrypted data of the second data end to judge the validity of the encrypted data, wherein the first data end is a server or a server cluster, and the second data end is a client;
the second data terminal is suitable for encrypting data to be encrypted by using the virtual instruction to obtain encrypted data and sending the encrypted data to the first data terminal, wherein the data to be encrypted comprises payment information;
in the transaction process, the illegal third party is prevented from being disguised as the second data terminal to send data to forge the transaction by preventing the illegal third party from knowing the encryption algorithm.
9. The data transmission system of claim 8, wherein the data packet further comprises: a virtual environment capable of executing the virtual instructions or a selection identifier corresponding to the virtual environment.
10. The data transmission system of claim 9, wherein the first data end employs a dynamically updated command system to compile the encryption algorithm.
11. The data transmission system according to claim 8, wherein the first data terminal is further adapted to update the encryption algorithm.
12. The data transmission system of claim 8, wherein the data packet further includes signature information;
the second data terminal is also suitable for signing the data to be encrypted by using the signature information before encrypting the data to be encrypted;
the first data terminal comprises: the decryption unit is suitable for decrypting the encrypted data to obtain signed data to be encrypted; and the verification unit is suitable for verifying the signed data to be encrypted so as to judge the validity of the encrypted data.
13. The data transmission system according to any one of claims 8 to 12, wherein the data to be encrypted includes payment information.
14. The data transmission system of claim 13, wherein the first data end further comprises: and the payment application initiating unit is suitable for initiating a payment application when the encrypted data is valid data.
CN201610012590.9A 2016-01-08 2016-01-08 Data transmission method and system Expired - Fee Related CN106961411B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610012590.9A CN106961411B (en) 2016-01-08 2016-01-08 Data transmission method and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610012590.9A CN106961411B (en) 2016-01-08 2016-01-08 Data transmission method and system

Publications (2)

Publication Number Publication Date
CN106961411A CN106961411A (en) 2017-07-18
CN106961411B true CN106961411B (en) 2020-11-27

Family

ID=59480602

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610012590.9A Expired - Fee Related CN106961411B (en) 2016-01-08 2016-01-08 Data transmission method and system

Country Status (1)

Country Link
CN (1) CN106961411B (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101216775A (en) * 2008-01-03 2008-07-09 北京深思洛克数据保护中心 Software program protection method, device and system

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7134141B2 (en) * 2000-06-12 2006-11-07 Hewlett-Packard Development Company, L.P. System and method for host and network based intrusion detection and response
CN101587524B (en) * 2009-06-23 2015-02-11 宏碁电脑(上海)有限公司 Method for encrypting data memory apparatus based on virtual system
CN101668022B (en) * 2009-09-14 2012-09-12 陈博东 Virtual network isolation system established on virtual machine and implementation method thereof
CN101976317B (en) * 2010-11-05 2012-12-05 北京世纪互联宽带数据中心有限公司 Virtual machine image safety method in private cloud computing application
CN104598799A (en) * 2015-02-15 2015-05-06 张贵宝 Read-write terminal, system and method of storage medium

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101216775A (en) * 2008-01-03 2008-07-09 北京深思洛克数据保护中心 Software program protection method, device and system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"良好隐私"PGP5.0i加密软件与网络安全;田涛;《Internet信息世界》;19990215;正文第61-62页 *

Also Published As

Publication number Publication date
CN106961411A (en) 2017-07-18

Similar Documents

Publication Publication Date Title
CN109309565B (en) Security authentication method and device
CN110380852B (en) Bidirectional authentication method and communication system
EP3723399A1 (en) Identity verification method and apparatus
KR101904177B1 (en) Data processing method and apparatus
CN110519309B (en) Data transmission method, device, terminal, server and storage medium
CN108566381A (en) A kind of security upgrading method, device, server, equipment and medium
CN103067401A (en) Method and system for key protection
CN108322416B (en) Security authentication implementation method, device and system
CN110690956B (en) Bidirectional authentication method and system, server and terminal
CN106411902B (en) Data secure transmission method and system
CN107733636B (en) Authentication method and authentication system
KR20220086580A (en) Non-custodial tool for building decentralized computer applications
WO2018021708A1 (en) Public key-based service authentication method and system
CN110677382A (en) Data security processing method, device, computer system and storage medium
KR20150059347A (en) Mobile terminal, terminal and method for authentication using security cookie
CN111130799B (en) Method and system for HTTPS protocol transmission based on TEE
CN106550359B (en) Authentication method and system for terminal and SIM card
CN110635901A (en) Local Bluetooth dynamic authentication method and system for Internet of things equipment
GB2522445A (en) Secure mobile wireless communications platform
CN105407467A (en) Short message encryption methods, devices and system
CN106411520B (en) Method, device and system for processing virtual resource data
CN110838919B (en) Communication method, storage method, operation method and device
CN105574720A (en) Secure information processing method and secure information processing apparatus
CN104901967A (en) Registration method for trusted device
CN110636503B (en) Data encryption method, device, equipment and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20201127

CF01 Termination of patent right due to non-payment of annual fee