CN118214558B - Data circulation processing method, system, device and storage medium - Google Patents
Data circulation processing method, system, device and storage medium Download PDFInfo
- Publication number
- CN118214558B CN118214558B CN202410632457.8A CN202410632457A CN118214558B CN 118214558 B CN118214558 B CN 118214558B CN 202410632457 A CN202410632457 A CN 202410632457A CN 118214558 B CN118214558 B CN 118214558B
- Authority
- CN
- China
- Prior art keywords
- key
- source system
- transfer platform
- data
- public key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 23
- 238000003860 storage Methods 0.000 title claims abstract description 14
- 238000012546 transfer Methods 0.000 claims abstract description 395
- 238000000034 method Methods 0.000 claims abstract description 128
- 230000005540 biological transmission Effects 0.000 claims abstract description 112
- 238000004422 calculation algorithm Methods 0.000 claims description 86
- 230000006870 function Effects 0.000 claims description 45
- 238000005111 flow chemistry technique Methods 0.000 claims description 34
- 238000012795 verification Methods 0.000 claims description 33
- 238000009795 derivation Methods 0.000 claims description 30
- 230000008569 process Effects 0.000 claims description 29
- 238000012545 processing Methods 0.000 claims description 21
- 238000012790 confirmation Methods 0.000 claims description 3
- 238000004891 communication Methods 0.000 description 19
- 230000008676 import Effects 0.000 description 8
- 238000005516 engineering process Methods 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 5
- 238000009826 distribution Methods 0.000 description 4
- 230000005610 quantum mechanics Effects 0.000 description 4
- 238000006243 chemical reaction Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000013144 data compression Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 238000000354 decomposition reaction Methods 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 238000005336 cracking Methods 0.000 description 1
- 238000013478 data encryption standard Methods 0.000 description 1
- 238000013496 data integrity verification Methods 0.000 description 1
- 238000013524 data verification Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
- H04L67/565—Conversion or adaptation of application format or content
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/08—Randomization, e.g. dummy operations or using noise
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/72—Signcrypting, i.e. digital signing and encrypting simultaneously
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Algebra (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Mathematical Physics (AREA)
- Pure & Applied Mathematics (AREA)
- Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The application discloses a data circulation processing method, a system, a device and a storage medium, which ensure the high efficiency and the safety of the whole transmission process, thereby effectively reducing or avoiding the occurrence of events of large-scale data leakage and greatly improving the safety of data transmission. The method comprises the following steps: the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key; the transfer platform and the source system conduct key negotiation to generate a symmetric key; and the source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature.
Description
Technical Field
The present application relates to the field of data communication technologies, and in particular, to a data communication processing method, system, device, and storage medium.
Background
In the context of rapid development of modern information technology, it has become normal to exchange data between different systems and platforms, where the systems may cover different industries and domains, such as finance, medical treatment, education, government institutions, etc., and efficient and safe data stream transmission between these systems is an important basis for constructing reliable information services, and conventional data exchange methods generally involve transmitting data from a source system to a transfer platform, performing necessary processing and conversion on the data on the platform, and then transmitting the data to a destination system, where the data circulation process is the whole process of starting from the source, through a series of transmission and processing, and finally reaching the destination.
The existing data exchange method generally involves transmitting data from a source system to a transfer platform, performing necessary processing and conversion on the data on the transfer platform, and then transmitting the data to a destination system, so that the method has obvious defects that the data is encrypted during transmission, and the encryption method is simpler, so that the data is in a leakage risk, the link becomes a potential security hole, and once the transfer platform is attacked or abused by internal personnel, large-scale data leakage events can be caused, so that personal privacy and enterprise confidentiality are endangered.
Disclosure of Invention
In order to solve the technical problems, the application provides a data circulation processing method, a system, a device and a storage medium.
The following describes the technical scheme provided in the present application:
The first aspect of the present application provides a data circulation processing method, where the data circulation processing method is applied to three systems, namely, a source system, a transit platform and a destination system, and the method includes:
The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;
The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;
the transfer platform decrypts the authentication information by using the transfer platform private key;
after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;
the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;
The transit platform sends the public key QA to the source system;
the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;
The source system sends the public key QB to the transfer platform;
The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;
the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;
The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;
The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
the source system sends the encrypted data and the digital signature to the transit platform;
the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;
The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;
the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
The destination system verifies the digital signature on the encrypted data using a source system public key;
After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.
Optionally, the source system and the transit platform use a shared key S as a seed, and generate a symmetric key through the shared key derivation function KDF, including:
Determining a key derivation function of the HMAC, and setting iteration times and key length information for the key derivation function of the HMAC;
Selecting a target random number D;
inputting the target random number D, the shared secret key S, the iteration number information and the secret key length information into a secret key derivation function of the HMAC to carry out derivation processing;
and obtaining the symmetric key after the deriving process.
Optionally, the source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system and generates a digital signature, including:
the source system calculates a hash value of the target data and combines the hash value with the symmetric key to generate a target symmetric key;
The source system encrypts the target data through the target symmetric key to obtain the encrypted data;
The source system calculates a target hash value of the encrypted data;
the source system encrypts the target hash value using the source system private key to generate a digital signature.
Optionally, the source system calculates a target hash value of the encrypted data, including:
the source system calculates a first hash value and a second hash value of the encrypted data by using an SHA-256 algorithm and an SHA-3 algorithm respectively;
and the source system combines the first hash value and the second hash value to obtain the target hash value.
Optionally, the source system calculates a target hash value of the encrypted data, including:
the source system divides the encrypted data into a plurality of blocks of data and calculates the hash value of each block of data respectively;
The source system combines the hash values of each block of data using a merck tree to obtain the target hash value.
Optionally, the source system calculates a target hash value of the encrypted data, including:
The source system calculates a hash value of the encrypted data by using an SHA-256 algorithm;
the source system calculates a second-class hash value and a third-class hash value of the source system public key and the source system private key by using an SHA-3 algorithm;
The source system combines the one type of hash value, the two types of hash values, and the three types of hash values using a merck tree to obtain the target hash value.
Optionally, before the source system encrypts the authentication information according to the transit platform public key, the method further includes:
and the source system and the transfer platform construct a data security transmission channel based on the call key.
Optionally, the source system generates a source system key pair, including:
determining a first prime number P1, wherein P1 is the basis of a finite field;
defining a first elliptic curve: wherein a and b are curve parameters on the first elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the first elliptic curve;
selecting a base point G1 on the first elliptic curve;
Defining a source system private key d1, d1 as a randomly defined positive integer, the range [1, n-1] of d1, wherein n is the order of the base point G1, i.e. the smallest positive integer n;
Calculating a source system public key Q1 according to the point multiplication operation on the first elliptic curve, wherein Q1=d1×G1;
and acquiring the source system public key Q1 and the source system private key d1.
Optionally, the generating, by the relay platform, a relay platform key pair includes:
determining a second prime number P2, wherein P2 is the basis of the finite field;
Defining a second elliptic curve: wherein a and b are curve parameters on the second elliptic curve equation, and a and b need to satisfy the following conditions: To ensure that there are no irregularities on the second elliptic curve;
Selecting a base point G2 on the second elliptic curve;
Defining a transit platform private key d2, d2 as a randomly defined positive integer, and d2 is in the range [1, n-1] of n, wherein n is the order of the base point G2, namely the smallest positive integer n;
Calculating a source system public key Q2 according to the point multiplication operation on the second elliptic curve, wherein Q2=d2×G2;
and acquiring the transit platform public key Q2 and the transit platform private key d2.
Optionally, the destination system generates a destination key pair, including:
Determining a third prime number P3, wherein P3 is the basis of the finite field;
Defining a third elliptic curve: Wherein a and b are curve parameters on the third elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the third elliptic curve;
selecting a base point G3 on the third elliptic curve;
Defining a destination system private key d3, d3 as a randomly defined positive integer, d3 ranging from [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;
calculating a source system public key Q3 according to the point multiplication operation on the third elliptic curve, wherein Q3=d3×G3;
The destination public key Q3 and the destination system private key d3 are acquired.
Optionally, the source system sends the encrypted data and the digital signature to the transit platform, including:
the source system divides the encrypted data into a plurality of data packets;
the source system determines a plurality of transmission channels transmitted to the transit platform;
The source system transmits the data packets and the digital signature to the transfer platform through the transmission channels, and the digital signature is corresponding to the data packets.
Optionally, the transferring platform verifies the digital signature using the source system public key, including:
the transfer platform receives a plurality of data packets of a plurality of transmission channels and the digital signature;
The intermediate transfer platform invokes the source system public key;
The transfer platform verifies digital signatures on a plurality of data packets using the source system public key;
and after the transfer platform determines that the digital signature of the data packets is verified to be correct, combining the data packets to generate the encrypted data.
Optionally, the exchange of the public key of the destination system and the public key of the relay platform is performed by the relay platform and the destination system, including:
the transfer platform determines a destination system according to the identification on the encrypted data;
The transfer platform sends a receiving instruction to the destination system;
After the transfer platform acquires a confirmation instruction fed back by the destination system, the transfer platform and the destination system construct a safe transmission channel;
The transfer platform sends the public key of the transfer platform to the destination system through the secure transmission channel;
After the destination system acquires the public key of the transfer platform, verifying whether the IP address of the public key of the transfer platform is consistent with the IP address of the receiving instruction;
If yes, the destination system sends the destination system public key to the transit platform.
Optionally, the encrypting the encrypted data by the transfer platform using the destination system public key to obtain the target encrypted data includes:
The transfer platform calls out the public key of the destination system;
the transfer platform generates a series of random numbers;
the transfer platform calculates a hash value hash obtained by combining a destination system public key and a random number by using a target hash function;
The transfer platform uses the calculated hash value hash as the input of a key derivation function and generates a target key K;
and the transfer platform encrypts the encrypted data by using the target secret key K and the destination system public key to obtain target encrypted data.
Optionally, before sending the target encrypted data and the source system public key to the destination system, the method further comprises:
the transfer platform performs key negotiation with the destination system to generate a call key;
and the transit platform and the destination system construct a data transmission channel according to the call key.
Optionally, the transferring platform performs key negotiation with the destination system to generate a call key, including:
The transit platform determines a prime number p and a base number g and sends the prime number p and the base number g to the destination system;
The destination system randomly selects a private key a and calculates a public key A=ga mod p;
The transfer platform randomly selects a private key B and calculates a public key B=gb mod p;
The destination system sends the public key a to a transfer platform, and the transfer platform sends the public key b to the destination system;
when the destination system receives the public key B, calculating a shared key s=b≡a mod p by using the private key a;
when the transit platform receives the public key a, the private key b of the transit platform is used for calculating a shared secret key S=A≡mod p;
the transit platform and the destination system use a key derivation function and combine a shared key S and a session ID to generate a session key.
Optionally, before the destination system decrypts the target data packet using the destination system private key to obtain the encrypted data, the method further includes:
And the destination system receives the target encrypted data and a series of random numbers sent by the transfer platform.
Optionally, the destination system decrypts the target data packet using the destination system private key to obtain the encrypted data, including:
The destination system calculates a hash value through the target hash function by using a destination system public key and a series of random numbers;
The destination system generates a decryption key through a key derivation function using the hash value;
And the destination system decrypts the target encrypted data by using the decryption key and the destination system private key to obtain the encrypted data.
Optionally, after the verification is successful, before the transit platform sends the symmetric key pair to the destination system, the method further includes:
the destination system sends feedback information which is successfully verified to the transfer platform, wherein the feedback information comprises identification information of the encrypted data;
And the transfer platform sends the corresponding symmetric key to the destination system according to the identification information in the feedback information.
A second aspect of the present application provides a data flow processing system, the data flow processing system comprising:
A source system, a relay platform, and a destination system, the source system, the relay platform, and the destination system performing the following operations:
The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;
The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;
the transfer platform decrypts the authentication information by using the transfer platform private key;
after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;
the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;
The transit platform sends the public key QA to the source system;
the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;
The source system sends the public key QB to the transfer platform;
The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;
the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;
The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;
The transfer platform and the source system conduct key negotiation to generate a symmetric key;
The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
the source system sends the encrypted data and the digital signature to the transit platform;
the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;
The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;
the destination system decrypts the target data packet by using the private key of the destination system to obtain the encrypted data;
The destination system verifies the digital signature on the encrypted data using a source system public key;
After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.
A third aspect of the present application provides a data flow processing apparatus, the apparatus comprising:
a processor, a memory, an input-output unit, and a bus;
the processor is connected with the memory, the input/output unit and the bus;
the memory holds a program that the processor invokes to perform the method of any of the first aspect and optionally the method of the first aspect.
A fourth aspect of the application provides a computer readable storage medium having stored thereon a program which when executed on a computer performs the method of any of the first aspect and optionally the first aspect.
From the above technical scheme, the application has the following advantages:
The data circulation processing method effectively improves the safety and efficiency of data transmission. Specifically, the source system, the transfer platform and the destination system respectively generate own key pairs, generate symmetric keys through key negotiation, ensure the intensity of data encryption, the source system not only encrypts data by using the symmetric keys, but also generates digital signatures for the encrypted data by using own private keys, increase the security level of data transmission, and the transfer platform is responsible for exchanging public keys with the destination system after verifying the digital signatures, the destination system decrypts the data through the private key of the destination system, and verifies the digital signature through the public key of the source system, so that the integrity of the data and the identity verification of a sender are ensured, and finally, the transfer platform safely sends the symmetric key to the destination system to unlock the encrypted data, so that safe data transmission is realized.
The scheme of the application utilizes the advantages of symmetric and asymmetric encryption, combines the digital signature to ensure confidentiality and integrity of data transmission and authenticity of sender identity, reduces complexity of key management, reduces security risk of direct key exchange, and ensures high efficiency and security of the whole transmission process, thereby effectively reducing or avoiding occurrence of large-scale data leakage and greatly improving security of data transmission.
Drawings
In order to more clearly illustrate the technical solutions of the present application, the drawings that are needed in the description of the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a diagram illustrating a data flow processing method according to an embodiment of the present application;
FIG. 2 is a flow chart of the contents of the sections S201 to S209 in one embodiment of the data flow processing method of the present application;
fig. 3 is a flow chart illustrating a part of contents from S209 to S214 in an embodiment of the data flow processing method of the present application;
FIG. 4 is a flow chart illustrating a data flow processing method according to an embodiment of the present application, wherein the flow chart includes the following steps S301 to S309;
FIG. 5 is a flow chart illustrating a data flow processing method according to an embodiment of the present application;
FIG. 6 is a flow chart of the contents of the sections S401 to S409 in one embodiment of the data flow processing method of the present application;
FIG. 7 is a flow chart illustrating a data flow processing method according to an embodiment of the present application;
FIG. 8 is a flow chart illustrating a data flow processing method according to an embodiment of the present application;
FIG. 9 is a flow chart of the contents of the sections S511 to S513 according to one embodiment of the data flow processing method of the present application;
FIG. 10 is a diagram of one embodiment of a data flow processing system of the present application;
Fig. 11 is a schematic diagram of a data flow processing apparatus according to an embodiment of the present application.
Detailed Description
Referring to fig. 1, the present application first provides an embodiment of a data circulation processing method, where the data circulation processing method is applied to a source system, a transit platform and a destination system, and the embodiment includes:
S101, the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
In the embodiment of the present application, first, description is made of the composition in the system:
Source system: multiple systems or platforms that need to securely transfer data to a staging platform;
And (3) a transfer platform: a platform responsible for receiving, authenticating, encrypting, and transmitting data;
Destination system: a destination system that receives the encrypted data from the staging platform.
Before the source system, the transit platform and the destination system perform data circulation processing, the source system, the transit platform and the destination system firstly generate key pairs of each bit, wherein the key pair generation generally relates to an asymmetric encryption technology, and the most common method comprises the following steps:
RSA (Rivest-Shamir-Adleman): it is one of the earliest and most widely used asymmetric encryption algorithms, RSA is based on a simple number theory fact that it is easy to multiply two large prime numbers, but factoring the product is extremely difficult, and the security of the RSA algorithm is based on the difficulty of the large number decomposition problem.
ECC (Elliptic Curve Cryptography): ECC can provide the same level of security compared to RSA, while using a shorter key length, which means faster processing speed and lower resource consumption.
DSA (Digital Signature Algorithm): is a standard digital signature algorithm and can also be used to generate key pairs. It is based on the discrete logarithm problem of modulus numbers and is particularly suitable for use in signature verification processes.
Diffie-Hellman key exchange protocol: while not itself directly generating a key pair, it allows two parties that do not have a prior shared secret to generate a common secret key over an unsecured communication channel that can be used for subsequent communication encryption.
The process of generating a key pair typically involves the steps of:
selection algorithm: firstly, selecting an asymmetric encryption algorithm according to security requirements and application environments;
generating parameters: for example, in the ECC and DSA algorithms, a set of appropriate parameters must first be generated or selected;
generating a key pair: a pair of keys is generated using the selected algorithm and parameters, one of which is referred to as the public key and the other is referred to as the private key, which can be publicly shared and the private key must be kept secret.
For the key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to actual conditions, and preferably, in the application, in order to facilitate encryption and decryption between subsequent key pairs, the key pair is generated by adopting an ECC elliptic encryption algorithm. The generated source system key pair comprises a source system public key and a source system private key, wherein the source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair comprises a transfer platform public key and a transfer platform private key, the transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair includes a destination system public key and a destination system private key, the destination system public key is public, and the destination system private key is private and is stored only in the destination system.
The obtained public keys can be disclosed outwards, but the corresponding private keys are stored in various systems and cannot be disclosed outwards.
S102, exchanging the public key of the source system and the public key of the transit platform between the source system and the transit platform;
S103, carrying out key negotiation on the transit platform and the source system to generate a symmetric key;
In the embodiment of the present application, after the source system and the transit platform generate various key pairs, further, the source system is configured to securely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system first performs key negotiation with the source system to generate a symmetric key, and the generated symmetric key is only transmitted between the transit platform and the source system, and for generating the symmetric key, the following method may be referred to specifically:
Diffie-Hellman key exchange: this is a very popular method that allows both parties to securely generate symmetric keys through an insecure channel without a shared secret.
RSA key exchange: a party may generate a temporary RSA key pair and send the public key of the RSA key pair to another party, which the recipient encrypts the symmetric key using and sends back.
Pre-shared key negotiation: both parties will share a key in advance, which pre-shared key can be used directly as a symmetric key or for securely negotiating a new key over an insecure channel.
Transport layer security protocol: while TLS is typically used for secure communications between clients and servers, it may also be used for secure key agreement.
Quantum key distribution: QKD represents a method of generating and assigning an absolute secure key pair using quantum mechanics principles.
In practical applications, which key agreement method is selected depends on specific security requirements, performance requirements and capabilities of both parties, for example, in environments where computing resources are limited, a lighter-weight key agreement method is selected, and in cases where extremely high security guarantees are required, a more complex protocol is employed.
In the present application, the transit platform and the source system may generate the symmetric key according to the corresponding method, and further execute step S104 after generating the symmetric key.
S104, the source system encrypts the target data by using the symmetric key to obtain encrypted data, encrypts the encrypted data by using a private key of the source system and generates a digital signature;
In the embodiment of the application, after the source system and the transfer platform generate the symmetric key, the source system further calls out the target data which needs to be sent to the destination system, and encrypts the target data by using the symmetric key which is negotiated with the transfer platform to obtain the encrypted data, specifically, firstly, the encrypted data is ensured to be in a form which can be processed by an encryption algorithm, the data compression is needed to reduce the size of the encrypted data, and if the size of the encrypted data to be encrypted does not meet the requirement of the encryption algorithm, filling is needed to enable the data to meet the size requirement of an encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data, and after encryption is completed, the generated encrypted data can be safely stored in the source system. Further, to ensure the integrity and security of the encrypted data after transmission to the staging platform, the source system encrypts the encrypted data using the source system private key and generates a digital signature, and specifically, the source system generates a unique hash value for the encrypted data using a hash function designed as a one-way function, which generates a fixed-length, unique hash value for any given data, but cannot derive the original data in the reverse direction from the hash value, and after the hash value of the encrypted data is obtained, the source system encrypts the hash value using the source system private key to generate a so-called digital signature. In this step, the source system private key is used as the encryption key, ensuring that only the receiver with the corresponding public key can verify the signature, i.e. only the source system public key can decrypt the hash value.
S105, the source system sends the encrypted data and the digital signature to the transit platform;
In the embodiment of the application, after the source system acquires the encrypted data and the corresponding digital signature, the encrypted data and the digital signature are safely transmitted to the transfer platform, a special data transmission channel is established between the source system and the transfer platform, the data transmission channel can be generated based on a symmetrical algorithm, and when the data transmission is carried out, communication is only carried out between the active system and the transfer platform, and then the source system packages the encrypted data and the digital signature together and transmits the packaged encrypted data and the digital signature to the transfer platform.
S106, the transit platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transit platform exchanges the public key of the destination system and the public key of the transit platform with the destination system;
In the implementation of the application, after the transfer platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data is not decrypted or not changed in a serial manner in the transmission process, the integrity of the encrypted data is ensured, further verification is required to be performed on the digital signature, because the source system encrypts the encrypted data by using the source system private key to generate the digital signature, the target data and the digital signature can be verified only through the source system public key, in particular, the transfer platform separates the target data from the digital signature, then decrypts the digital signature by using the source system public key to obtain a hash value, and because the source system public key and the source system private key are a matched pair of keys, the source system public key can successfully decrypt the signature encrypted by using the source system private key to obtain an original hash value, further, the transfer system recalculates the hash value of the encrypted data, finally, the source system compares the hash value obtained by decryption with the recalculated hash value, and determines that the encrypted data is not tampered in the transmission process when determining that the two hash values are identical.
After the source system determines the integrity of the encrypted data, the transfer platform temporarily stores the encrypted data, determines a destination system connected to the transfer platform according to the identification on the encrypted data, exchanges the public key of the destination system and the public key of the transfer platform between the transfer platform and the destination system after the destination system is determined, namely, the transfer platform sends the public key of the transfer platform to the destination system, and after the destination system receives the public key of the transfer platform, the destination system sends the public key of the destination system to the transfer platform according to the identification or the IP address on the public key of the transfer platform, so that the public key exchange of the two parties is completed.
S107, the transfer platform encrypts the encrypted data by using the public key of the destination system to obtain target encrypted data, and sends the target encrypted data and the public key of the source system to the destination system;
In the embodiment of the application, after the transfer platform establishes communication connection with the destination system and completes exchange of the public key of the transfer platform and the private key of the transfer platform, the transfer platform encrypts the encrypted data by using the obtained public key of the destination system and then obtains the target encrypted data, wherein, the method for encrypting the encrypted data by using the public key of the destination system by the transfer platform is similar to the method for encrypting the target data by using the source system to obtain the encrypted data, which is not described herein again, and can be selected according to actual conditions. After obtaining the target encrypted data, the transfer platform further transmits the target encrypted data and the source system public key to the destination system.
S108, the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
In the embodiment of the application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporary stores the source system public key, and because the target encrypted data is encrypted by using the destination system public key on the basis of the encrypted data, even if the data is stolen in the transmission process of the transfer platform and the destination system, an lawbreaker cannot acquire the real target data. The destination system will use the unique destination system private key to decrypt the target encrypted data and then obtain the encrypted data, and what needs to be said is that the encrypted data will have a digital signature generated by the source system, and before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data, it is ensured that the encrypted data is not tampered before being further encrypted by the destination system, and further, the destination system needs to verify the digital signature, and step S109 is performed.
S109, the destination system verifies the digital signature on the encrypted data by using a source system public key;
in the embodiment of the present application, the destination system calls the public key of the source system and verifies the digital signature on the encrypted data, and for the verification process of the digital signature, the process of verifying the digital signature by using the public key of the source system with reference to the foregoing transfer platform may be referred to, which is not described herein.
And S110, after the verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data, and the target data transmitted by the source system is obtained.
In the embodiment of the application, after the destination system determines that the digital signature on the encrypted data is successfully verified, the destination system further sends feedback information of the verification success to the transfer platform, wherein the feedback information comprises identification information of the encrypted data; and the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, and the target data transmitted by the source system is obtained.
For a code example of the processing procedure of the data flow processing method, reference may be made to the following:
import hashlib
import hmac
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding as symmetric_padding
# generating key pairs
def generate_key_pair():
private_key =rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()
return private_key, public_key
# Key exchange
def exchange_public_keys(source_system, relay_platform):
source_system.public_key = relay_platform.public_key
relay_platform.public_key = source_system.public_key
# Key negotiation
def negotiate_symmetric_key(source_system, relay_platform):
symmetric_key = os.urandom(32)
source_system.symmetric_key = symmetric_key
relay_platform.symmetric_key = symmetric_key
return symmetric_key
# Encryption target data
def encrypt_data(source_system, data):
cipher = Cipher(algorithms.AES(source_system.symmetric_key), modes.ECB())
encryptor = cipher.encryptor()
padder =symmetric_padding.PKCS7(algorithms.AES.block_size).padder()
padded_data = padder.update(data) + padder.finalize()
encrypted_data = encryptor.update(padded_data) + encryptor.finalize()
return encrypted_data
# Generating digital signature
def sign_data(source_system, data):
signature = source_system.private_key.sign(
data,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
return signature
# Verify digital signature
def verify_signature(destination_system, data, signature):
try:
destination_system.public_key.verify(
signature,
data,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
return True
except:
return False
# Decrypted data
def decrypt_data(destination_system, encrypted_data):
cipher = Cipher(algorithms.AES(destination_system.symmetric_key), modes.ECB())
decryptor = cipher.decryptor()
decrypted_data = decryptor.update(encrypted_data) + decryptor.finalize()
unpadder = symmetric_padding.PKCS7(algorithms.AES.block_size).unpadder()
data = unpadder.update(decrypted_data) + unpadder.finalize()
return data.
In the security guarantee of data transmission, the source system, the transfer platform and the destination system respectively generate RSA key pairs, including public keys and private keys, the source system and the transfer platform exchange public keys first, then the transfer platform and the destination system also exchange public keys, the source system and the transfer platform generate a symmetric key through negotiation for encrypting target data, the source system generates a digital signature for the encrypted data by using own private key to ensure the integrity and identity verification of the data, the encrypted data and the digital signature are sent to the transfer platform, the transfer platform uses the public key of the source system to verify the signature, the encrypted data is forwarded to the destination system, the transfer platform exchanges the public keys with the destination system, a protection layer is added, the destination system receives the encrypted data, then decrypts the encrypted data by using own private key to obtain original encrypted data, the public key of the source system is used for verifying the digital signature, the transfer platform transmits the negotiated symmetric key to the destination system after successful verification, the destination system uses the encrypted data to ensure the integrity and the identity of the encrypted data, and the integrity of the encrypted data is ensured in the process of the encrypted data and the original signature.
The data circulation processing method effectively improves the safety and efficiency of data transmission. Specifically, the source system, the transfer platform and the destination system respectively generate own key pairs, generate symmetric keys through key negotiation, ensure the intensity of data encryption, the source system not only encrypts data by using the symmetric keys, but also generates digital signatures for the encrypted data by using own private keys, increase the security level of data transmission, and the transfer platform is responsible for exchanging public keys with the destination system after verifying the digital signatures, the destination system decrypts the data through the private key of the destination system, and verifies the digital signature through the public key of the source system, so that the integrity of the data and the identity verification of a sender are ensured, and finally, the transfer platform safely sends the symmetric key to the destination system to unlock the encrypted data, so that safe data transmission is realized.
The scheme of the application utilizes the advantages of symmetric and asymmetric encryption, combines the digital signature to ensure confidentiality and integrity of data transmission and authenticity of sender identity, reduces complexity of key management, reduces security risk of direct key exchange, and ensures high efficiency and security of the whole transmission process, thereby effectively reducing or avoiding occurrence of large-scale data leakage and greatly improving security of data transmission.
Referring to fig. 2 to 3, another embodiment of a data circulation processing method is provided, where the data circulation processing method is applied to a source system, a transit platform and a destination system, and the embodiment includes:
s201, the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
In the embodiment of the application, the source system, the transfer platform and the destination system generate the corresponding source system key pair, the transfer platform key pair and the destination system key pair, specifically, the source system, the transfer platform and the destination system key pair are generated by an ECC elliptic curve algorithm, and the steps and the processes for generating by using the ECC elliptic curve algorithm are now described as follows:
the generation process of the source system key pair comprises the following steps:
determining a first prime number P1, wherein P1 is the basis of a finite field;
defining a first elliptic curve: wherein a and b are curve parameters on the first elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the first elliptic curve;
selecting a base point G1 on the first elliptic curve;
Defining a source system private key d1, d1 as a randomly defined positive integer, the range [1, n-1] of d1, wherein n is the order of the base point G1, i.e. the smallest positive integer n;
Calculating a source system public key Q1 according to the point multiplication operation on the first elliptic curve, wherein Q1=d1×G1;
Acquiring the source system public key Q1 and the source system private key d1;
Generating a key pair of a transfer platform:
determining a second prime number P2, wherein P2 is the basis of the finite field;
Defining a second elliptic curve: wherein a and b are curve parameters on the second elliptic curve equation, and a and b need to satisfy the following conditions: To ensure that there are no irregularities on the second elliptic curve;
Selecting a base point G2 on the second elliptic curve;
Defining a transit platform private key d2, d2 as a randomly defined positive integer, and d2 is in the range [1, n-1] of n, wherein n is the order of the base point G2, namely the smallest positive integer n;
Calculating a source system public key Q2 according to the point multiplication operation on the second elliptic curve, wherein Q2=d2×G2;
and acquiring the transit platform public key Q2 and the transit platform private key d2.
The generation process of the destination system key pair:
Determining a third prime number P3, wherein P3 is the basis of the finite field;
Defining a third elliptic curve: Wherein a and b are curve parameters on the third elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the third elliptic curve;
selecting a base point G3 on the third elliptic curve;
Defining a destination system private key d3, d3 as a randomly defined positive integer, d3 ranging from [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;
calculating a source system public key Q3 according to the point multiplication operation on the third elliptic curve, wherein Q3=d3×G3;
The destination public key Q3 and the destination system private key d3 are acquired.
It should be noted that, for generating the source system key pair, the first elliptic curve, the second elliptic curve and the third elliptic curve of the transit platform key pair and the destination system key pair may use the same elliptic curve equation or may use different elliptic curve equations, and may be selected by adjusting a and b on the elliptic curve equations.
Although the ECC elliptic curve algorithm is adopted to calculate the corresponding key pair, the generated source system key pair, the transit platform key pair and the destination system key pair are different, so that effective distinction is carried out in the subsequent encryption and transmission processes. After the source system key pair, the relay platform key pair, and the destination system key pair are acquired, step S202 is performed.
S202, exchanging a public key of the source system and a public key of the transit platform between the source system and the transit platform;
In the embodiment of the present application, after the source system and the transit platform generate various key pairs, further, the source system is configured to securely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system first performs key negotiation with the source system to generate a symmetric key, and the generated symmetric key is only transmitted between the transit platform and the source system, and for generating the symmetric key, the following method may be referred to specifically:
Diffie-Hellman key exchange: this is a very popular method that allows both parties to securely generate symmetric keys through an insecure channel without a shared secret.
RSA key exchange: a party may generate a temporary RSA key pair and send the public key of the RSA key pair to another party, which the recipient encrypts the symmetric key using and sends back.
Pre-shared key negotiation: both parties will share a key in advance, which pre-shared key can be used directly as a symmetric key or for securely negotiating a new key over an insecure channel.
Transport layer security protocol: while TLS is typically used for secure communications between clients and servers, it may also be used for secure key agreement.
Quantum key distribution: QKD represents a method of generating and assigning an absolute secure key pair using quantum mechanics principles.
In practical applications, which key negotiation method is selected depends on specific security requirements, performance requirements and capabilities of both parties, for example, in an environment with limited computing resources, a lighter key negotiation method is selected, and in the case where extremely high security assurance is required, a more complex protocol is adopted, and in the present application, the transit platform and the source system can generate symmetric keys according to the corresponding methods.
S203, the source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;
In the embodiment of the application, after the source system sends the public key of the source system to the transfer platform and the transfer platform sends the public key of the transfer platform to the source system, further, before the source system communicates with the transfer platform, the two parties need to verify, specifically, the source system encrypts the authentication information by using the obtained public key of the transfer platform, specifically, the source system can encrypt by using an ECC elliptic curve algorithm or other symmetric algorithms, and the process is used for ensuring the mutual independence between the source system and the transfer platform. The source system encrypts the authentication information through the public key of the transfer platform and sends the encrypted authentication information to the transfer platform, so that the next authentication process is carried out.
S204, the transfer platform decrypts the authentication information by using the transfer platform private key;
In the embodiment of the application, after receiving the authentication information, the relay platform further, when knowing that the authentication information is acquired from the source system, the relay platform directly calls the relay platform private key and decrypts the authentication information by using the relay platform private key, thereby obtaining the content of the authentication information, wherein the authentication information comprises but is not limited to the following information: the IP address of the source system, the type of data to be transmitted by the source system, the type of authentication information of the source system, etc.
S205, after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system conduct key negotiation to generate a symmetric key;
In the embodiment of the application, after the transfer platform determines that the authentication information is correct, a corresponding data transmission channel is constructed between the source system and the transfer platform, so that key negotiation is performed between the transfer platform and the source system to generate a symmetric key, and the process of generating the symmetric key can refer to the following modes:
the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve, wherein the target elliptic curve is jointly selected by the transfer platform and the source system, the base point is a random point number, and the base point G is recognized by both parties. Then, the transfer platform randomly selects a private key dA and calculates a corresponding public key qa=da times G, where G is a base point, "times" represents multiplication operations, "dA times G" may be understood as "multiplying dA by G" for performing mathematical operations, calculating a value of QA, and "times" appearing later is the same as this, and will not be described later. Then the transfer platform sends the public key QA to the source system; the source system randomly selects a private key dB and calculates a corresponding public key QB=dB time G, wherein G is a base point; the source system sends the public key QB to the transfer platform;
The transit platform calculates a shared key s= dAtimesQB by using the private key dA and the public key QB; the source system calculates a shared key s= dBtimesQA using the private key dB and the public key QA; according to the algorithm principle, the shared secret key S calculated by the transfer platform and the source system is the same, and in order to further improve the security of the shared secret key, the source system and the transfer platform use the shared secret key S as a seed and generate a symmetric secret key through a shared secret key derivation function KDF.
Further: in generating a symmetric key by a shared key derivation function KDF, the following method may be referred to specifically:
Firstly, determining a key derivation function of the HMAC, setting iteration times and key length information for the key derivation function of the HMAC, selecting the iteration times and the key length information in advance, identifying the selected information by both parties, selecting a target random number D, inputting the target random number D, a shared key S, preset iteration times information and key length information into the key derivation function of the HMAC for derivation processing, and obtaining a symmetric key after the derivation processing.
S206, the source system calculates a hash value of the target data, and combines the hash value with the symmetric key to generate a target symmetric key;
In the embodiment of the application, after the source system and the transfer platform negotiate together to generate the symmetric key, the symmetric key is stored in the source system and the transfer platform, and both sides can call and use the symmetric key for subsequent session communication or data transmission. Specifically, to further improve the security of data transmission, the source system first calculates a hash value of the target data, combines the hash value with the symmetric key to generate the target symmetric key, and since the target symmetric key generated by combining the hash value with the hash value based on the symmetric key has strong security, the hash value is a fixed-size number, typically a combination of a series of letters and numbers, generated by a hash function, which is a digital "fingerprint" or "digest" of data of any size, the hash function is designed such that it can map input data of an indefinite length to output of a fixed length, and the hash value has irreversibility, and after combining the two, the target symmetric key of strong security can be generated.
S207, the source system encrypts the target data through the target symmetric key to obtain the encrypted data;
In the embodiment of the application, after the source system obtains the target symmetric key, the source system further selects a corresponding key encryption algorithm, such as an advanced encryption standard algorithm, a data encryption standard algorithm, a triple data encryption algorithm and the like, the source system encrypts the target data by using the target symmetric key and the selected encryption algorithm, in the process, the target data is converted into encrypted data under the action of the selected encryption algorithm and the target symmetric key, and in the encryption process of the whole target data, a plurality of conversion and replacement steps are generally involved, and the steps jointly ensure the security of the target data.
S208, the source system calculates a target hash value of the encrypted data;
In the embodiment of the application, after the source system acquires the encrypted data, further, in order to improve the integrity of the encrypted data transmitted to the intermediate transfer platform and enable the intermediate transfer platform to verify, specifically, the source system calculates a target hash value of the encrypted data, and the target hash value of the encrypted data can be acquired by the following manner:
1. the source system calculates a first hash value and a second hash value of the encrypted data by using an SHA-256 algorithm and an SHA-3 algorithm respectively; and the source system combines the first hash value and the second hash value to obtain the target hash value.
In an embodiment of the present application, the source system first calculates a first hash value of the encrypted data using the SHA-256 algorithm, then calculates a second hash value of the encrypted data using the SHA-3 algorithm, wherein,
The risk of collision attack can be reduced by combining the SHA-256 algorithm and the SHA-3 algorithm, the SHA-256 algorithm and the SHA-3 algorithm are based on different design principles, the SHA-256 is based on a Merkle-Damg å rd structure, the SHA-3 is based on a Keccak algorithm, the attack resistance modes are different, the diversity can provide more layers of security assurance, data can be damaged during transmission or storage, and two independently calculated hash values can provide stronger data integrity check to reduce the risks of data errors and tampering.
After the first hash value and the second hash value are obtained through calculation, further, the source system combines the first hash value and the second hash value to obtain a target hash value, specifically, the first hash value and the second hash value can be combined in a serial mode, and when the two hash values are connected in series, the length of the final target hash value is the sum of the lengths of the first hash value and the second hash value.
2. The source system divides the encrypted data into a plurality of blocks of data and calculates the hash value of each block of data respectively; the source system combines the hash values of each block of data using a merck tree to obtain the target hash value.
In the embodiment of the application, after the encrypted data is divided into a plurality of blocks of data and the hash value of each block of data is calculated respectively, the hash value of each block of data is combined by applying a merck tree to obtain a target hash value, wherein the merck tree is a binary tree, each leaf node comprises the hash value of the data block, and the non-leaf node stores the combination of the hash values of the child nodes, so that the integrity of the data can be verified.
Specifically, when processing encrypted data, firstly, the data is divided into a plurality of blocks, and the size of each block can be adjusted according to actual requirements. Further calculating the hash value of each block of data, wherein the hash value is a character string with fixed length, is a unique identification of the content of the data block, and can be obviously changed even if the content of the data block is slightly changed, so that the hash value becomes an important index of data integrity and authenticity.
Then, the hash value of each block of encrypted data is used as a leaf node by utilizing the structure of the merck tree, and the hash values of adjacent leaf nodes are combined through a hash function to generate the hash value of a non-leaf node. This process continues until a root node is generated, the hash value of which is the so-called "target hash value". This target hash value is a compact representation of the entire data set that can be used to verify the integrity and authenticity of the entire encrypted data set.
When the encrypted data needs to be verified, only the target hash value is calculated and compared with the original target hash value, if the target hash value and the original target hash value are consistent, the encrypted data is not tampered in the transmission or storage process, the integrity is maintained, and if the target hash value is inconsistent, the encrypted data has a problem, and further processing is needed. By the method for using the merck tree, not only is the processing efficiency of encrypted data improved, but also the safety and the integrity of the encrypted data are ensured.
3. The source system calculates a hash value of the encrypted data by using an SHA-256 algorithm; the source system calculates a second-class hash value and a third-class hash value of the source system public key and the source system private key by using an SHA-3 algorithm; the source system combines the one type of hash value, the two types of hash values and the three types of hash values using a merck tree to obtain the target hash value;
In the embodiment of the application, the source system calculates the hash value of the encrypted data by using the SHA-256 algorithm, and the SHA-256 algorithm is an advanced encrypted hash algorithm, has extremely high safety and stability, and can effectively ensure the integrity and the authenticity of the data. By means of the algorithm, the source system can convert the encrypted data into a hash value with a fixed length, and the hash value has unique identification property, so that even if the original data slightly changes, the hash value can be obviously changed.
Besides calculating the encrypted data to obtain a class of hash values, the source system also uses an SHA-3 algorithm to calculate a class II hash value and a class III hash value of a source system public key and a source system private key, and by carrying out hash calculation on the source system public key and the source system private key, the source system can further ensure the safety of data transmission and prevent the secret key from being stolen or tampered.
In order to further enhance the security of the data, the source system combines the first class hash value, the second class hash value and the third class hash value by using the merck tree, thereby obtaining a final target hash value. The merck tree is an efficient data structure that can combine multiple hash values into a single hash value, thus detecting any minor changes to the data. Through the application of the merck tree, the source system can realize end-to-end data integrity verification in the data transmission process, and the data is ensured not to be tampered or forged in the transmission process.
Therefore, the source system realizes high-efficiency and safe transmission and verification of data by using the SHA-256 and SHA-3 algorithms and the merck tree, and the mechanism not only has strong encryption capability and cracking resistance, but also can timely discover and cope with the risk of data tampering, thereby providing firm guarantee for the security of data transmission.
S209, the source system encrypts the target hash value by using the source system private key to generate a digital signature;
In the embodiment of the application, after the source system acquires the target hash value, the source system encrypts the target hash value by using a private key of the source system to generate a digital signature, specifically, the source system firstly picks out a corresponding algorithm from algorithms such as an asymmetric algorithm RSA, ECDSA or DSA and the like, and then transmits the target hash value to the selected asymmetric encryption algorithm, and the algorithm encrypts the hash value by using the private key to generate an encrypted output, namely the digital signature. The generated digital signature has extremely high uniqueness and non-counterfeitability, and the digital signature contains the encryption result of the identity information and the hash value of the source system.
S210, the source system sends the encrypted data and the digital signature to the transit platform;
In the embodiment of the application, after the source system acquires the encrypted data and the corresponding digital signature, the encrypted data and the digital signature are safely transmitted to the transfer platform, a special data transmission channel is established between the source system and the transfer platform, the data transmission channel can be generated based on a symmetrical algorithm, and when the data transmission is carried out, communication is only carried out between the active system and the transfer platform, and then the source system packages the encrypted data and the digital signature together and transmits the packaged encrypted data and the digital signature to the transfer platform.
S211, the transit platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transit platform exchanges the public key of the destination system and the public key of the transit platform with the destination system;
In the implementation of the application, after the transfer platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data is not decrypted or not changed in a serial manner in the transmission process, the integrity of the encrypted data is ensured, further verification is required to be performed on the digital signature, because the source system encrypts the encrypted data by using the source system private key to generate the digital signature, the target data and the digital signature can be verified only through the source system public key, in particular, the transfer platform separates the target data from the digital signature, then decrypts the digital signature by using the source system public key to obtain a hash value, and because the source system public key and the source system private key are a matched pair of keys, the source system public key can successfully decrypt the signature encrypted by using the source system private key to obtain an original hash value, further, the transfer system recalculates the hash value of the encrypted data, finally, the source system compares the hash value obtained by decryption with the recalculated hash value, and determines that the encrypted data is not tampered in the transmission process when determining that the two hash values are identical.
After the source system determines the integrity of the encrypted data, the transfer platform temporarily stores the encrypted data, determines a destination system connected to the transfer platform according to the identification on the encrypted data, exchanges the public key of the destination system and the public key of the transfer platform between the transfer platform and the destination system after the destination system is determined, namely, the transfer platform sends the public key of the transfer platform to the destination system, and after the destination system receives the public key of the transfer platform, the destination system sends the public key of the destination system to the transfer platform according to the identification or the IP address on the public key of the transfer platform, so that the public key exchange of the two parties is completed.
S212, the transfer platform encrypts the encrypted data by using the public key of the destination system to obtain target encrypted data, and sends the target encrypted data and the public key of the source system to the destination system;
In the embodiment of the application, after the transfer platform establishes communication connection with the destination system and completes exchange of the public key of the transfer platform and the private key of the transfer platform, the transfer platform encrypts the encrypted data by using the obtained public key of the destination system and then obtains the target encrypted data, wherein, the method for encrypting the encrypted data by using the public key of the destination system by the transfer platform is similar to the method for encrypting the target data by using the source system to obtain the encrypted data, which is not described herein again, and can be selected according to actual conditions. After obtaining the target encrypted data, the transfer platform further transmits the target encrypted data and the source system public key to the destination system.
S213, the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
In the embodiment of the application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporary stores the source system public key, and because the target encrypted data is encrypted by using the destination system public key on the basis of the encrypted data, even if the data is stolen in the transmission process of the transfer platform and the destination system, an lawbreaker cannot acquire the real target data. The destination system can use the unique destination system private key to decrypt the target encrypted data and then obtain the encrypted data, and what needs to be said is that the encrypted data has a digital signature generated by an active system, and before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data, it is ensured that the encrypted data is not tampered before being further encrypted by the destination system, and further, the destination system needs to verify the digital signature.
S214, the destination system verifies the digital signature on the encrypted data by using a source system public key;
in the embodiment of the present application, the destination system calls the public key of the source system and verifies the digital signature on the encrypted data, and for the verification process of the digital signature, the process of verifying the digital signature by using the public key of the source system with reference to the foregoing transfer platform may be referred to, which is not described herein.
And S215, after the verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data, and the target data transmitted by the source system is obtained.
In the embodiment of the application, after the destination system determines that the digital signature on the encrypted data is successfully verified, the destination system further sends feedback information of the verification success to the transfer platform, wherein the feedback information comprises identification information of the encrypted data; and the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, and the target data transmitted by the source system is obtained.
Referring to fig. 4 to 5, another embodiment of a data circulation processing method is provided, where the data circulation processing method is applied to a source system, a transit platform and a destination system, and the embodiment includes:
s301, the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
In embodiments of the present application, the process of generating a key pair generally involves the steps of:
selection algorithm: firstly, selecting an asymmetric encryption algorithm according to security requirements and application environments;
generating parameters: for example, in the ECC and DSA algorithms, a set of appropriate parameters must first be generated or selected;
generating a key pair: a pair of keys is generated using the selected algorithm and parameters, one of which is referred to as the public key and the other is referred to as the private key, which can be publicly shared and the private key must be kept secret.
For the key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to actual conditions, and preferably, in the application, in order to facilitate encryption and decryption between subsequent key pairs, the key pair is generated by adopting an ECC elliptic encryption algorithm. The generated source system key pair comprises a source system public key and a source system private key, wherein the source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair comprises a transfer platform public key and a transfer platform private key, the transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair includes a destination system public key and a destination system private key, the destination system public key is public, and the destination system private key is private and is stored only in the destination system. The obtained public keys can be disclosed outwards, but the corresponding private keys are stored in various systems and cannot be disclosed outwards.
S302, exchanging the public key of the source system and the public key of the transit platform between the source system and the transit platform;
S303, carrying out key negotiation on the transit platform and the source system to generate a symmetric key;
In the embodiment of the present application, after the source system and the transit platform generate various key pairs, further, the source system is configured to securely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system first performs key negotiation with the source system to generate a symmetric key, and the generated symmetric key is only transmitted between the transit platform and the source system, and for generating the symmetric key, the following method may be referred to specifically:
Diffie-Hellman key exchange: this is a very popular method that allows both parties to securely generate symmetric keys through an insecure channel without a shared secret.
RSA key exchange: a party may generate a temporary RSA key pair and send the public key of the RSA key pair to another party, which the recipient encrypts the symmetric key using and sends back.
Pre-shared key negotiation: both parties will share a key in advance, which pre-shared key can be used directly as a symmetric key or for securely negotiating a new key over an insecure channel.
Transport layer security protocol: while TLS is typically used for secure communications between clients and servers, it may also be used for secure key agreement.
Quantum key distribution: QKD represents a method of generating and assigning an absolute secure key pair using quantum mechanics principles.
In practical applications, which key negotiation method is selected depends on specific security requirements, performance requirements and capabilities of both parties, for example, in an environment with limited computing resources, a lighter key negotiation method is selected, and in the case where extremely high security assurance is required, a more complex protocol is adopted, and in the present application, the transit platform and the source system can generate symmetric keys according to the corresponding methods.
S304, the source system encrypts the target data by using the symmetric key to obtain encrypted data, encrypts the encrypted data by using a private key of the source system and generates a digital signature;
In the embodiment of the application, after the source system and the transfer platform generate the symmetric key, the source system further calls out the target data which needs to be sent to the destination system, and encrypts the target data by using the symmetric key which is negotiated with the transfer platform to obtain the encrypted data, specifically, firstly, the encrypted data is ensured to be in a form which can be processed by an encryption algorithm, the data compression is needed to reduce the size of the encrypted data, and if the size of the encrypted data to be encrypted does not meet the requirement of the encryption algorithm, filling is needed to enable the data to meet the size requirement of an encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data, and after encryption is completed, the generated encrypted data can be safely stored in the source system. Further, to ensure the integrity and security of the encrypted data after transmission to the staging platform, the source system encrypts the encrypted data using the source system private key and generates a digital signature, and specifically, the source system generates a unique hash value for the encrypted data using a hash function designed as a one-way function, which generates a fixed-length, unique hash value for any given data, but cannot derive the original data in the reverse direction from the hash value, and after the hash value of the encrypted data is obtained, the source system encrypts the hash value using the source system private key to generate a so-called digital signature. In this step, the source system private key is used as the encryption key, ensuring that only the receiver with the corresponding public key can verify the signature, i.e. only the source system public key can decrypt the hash value.
S305, the source system divides the encrypted data into a plurality of data packets;
In the embodiment of the application, after the source system obtains the encrypted data, the encrypted data is divided into a plurality of data packets, the data packets pass through a plurality of network nodes and a transmission medium, if the whole encrypted data is transmitted as a whole, once the data packets are intercepted in the transmission process, an attacker can obtain the content of the whole encrypted data, so that the safety of the data is threatened, and therefore, the risk of intercepting the data packets can be reduced by dividing the encrypted data into a plurality of data packets.
In the process of encryption data packetizing, the source system divides the encryption data into data packets with proper sizes according to factors such as the size of the encryption data and the bandwidth of the network, each data packet contains a part of encryption data and necessary metadata such as the serial number, the source address, the destination address and the like of the data packet, so that even if the data packet is lost or damaged in the transmission process, the receiving system can reconstruct the original encryption data through the metadata.
In addition, in order to further improve the security of data transmission, some advanced encryption techniques and transmission protocols may be used. For example, each data packet may be encrypted using public key encryption techniques to ensure that only the receiving system that has the corresponding private key can decrypt the contents of the data packet. Meanwhile, a reliable transmission protocol, such as TCP (Transmission control protocol), can be adopted, so that the data packets can reach the destination according to the correct sequence, and the data packets are prevented from being tampered or repeated in the transmission process.
S306, the source system determines a plurality of transmission channels transmitted to the transit platform;
In the embodiment of the present application, after dividing the encrypted data into a plurality of data packets, in order to further determine the transmission channels of the source system and the transit platform, the transmission channels need to be multiple, so that the plurality of data packets can be transmitted to the transit platform through different transmission channels, each data packet can be sent through a preset or dynamically selected transmission channel, load balancing of different transmission channels is to be ensured, delay or data loss caused by overload of a certain transmission channel is avoided, and this can be achieved through a Software Defined Network (SDN) or other network load balancing technologies.
It should be noted that, all transmission channels should be encrypted using an encryption protocol such as TLS or SSL, so as to protect security and privacy of data during transmission, and an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) should be deployed in the transmission channels to identify and prevent potential malicious traffic and attack attempts.
S307, the source system transmits the data packets and the digital signature to the transfer platform through the transmission channels, wherein the digital signature is corresponding to the data packets;
in the embodiment of the application, after the transmission channel is built, the source system further transmits a plurality of data packets and corresponding digital signatures to the transfer platform through the transmission channel, when the transmission is performed, each data packet has a unique serial number so that the data packets can be correctly restored to original data when the transfer platform is assembled, and each data packet needs to be subjected to integrity verification after reaching the transfer platform, so that the data is ensured not to be tampered in the transmission process.
S308, the transit platform verifies the digital signature by using the public key of the source system;
In the embodiment of the application, the transfer platform receives a plurality of data packets and digital signatures of a plurality of transmission channels, and in order to ensure the integrity of the transmitted data packets, the transfer platform invokes a source system public key and verifies the digital signatures on the data packets by using the source system public key, and after the verification is successful, the transfer platform confirms the integrity and the authenticity of the data packets, thereby avoiding the data from being tampered or damaged in the transmission process. At the same time, the staging platform will also sort and integrate the packets to ensure that they are re-composed into encrypted data in the correct order and format.
S309, after the integrity of the encrypted data is determined, the transit platform exchanges a destination system public key and a transit platform public key with the destination system;
In the embodiment of the application, after the transfer platform obtains the target encrypted data and determines the integrity of the target encrypted data, the transfer platform further transmits the encrypted data to the destination system, thereby completing the data transmission from the source system to the destination system, specifically, the transfer platform determines the destination system according to the identifier on the encrypted data, and then the transfer platform transmits a receiving instruction to the destination system; after the transfer platform acquires a confirmation instruction fed back by the destination system, the transfer platform and the destination system construct a safe transmission channel; the transfer platform sends the public key of the transfer platform to a destination system through a secure transmission channel; after the destination system acquires the public key of the transfer platform, verifying whether the IP address of the public key of the transfer platform is consistent with the IP address of the receiving instruction; if yes, the destination system sends the public key of the destination system to the transfer platform.
After receiving the public key of the destination system, the transfer platform performs public key verification to ensure the security of data transmission. The verification process includes checking the validity period of the public key, the signature of the public key, etc. Once the verification is passed, the transfer platform can use the public key and the private key to encrypt and decrypt, so as to ensure the security of the data in the transmission process.
S310, the transfer platform encrypts the encrypted data by using the public key of the destination system to obtain target encrypted data, and sends the target encrypted data and the public key of the source system to the destination system;
In the embodiment of the application, after the transfer platform establishes communication connection with the destination system and completes exchange of the public key of the transfer platform and the private key of the transfer platform, the transfer platform encrypts the encrypted data by using the obtained public key of the destination system and then obtains the target encrypted data, wherein, the method for encrypting the encrypted data by using the public key of the destination system by the transfer platform is similar to the method for encrypting the target data by using the source system to obtain the encrypted data, which is not described herein again, and can be selected according to actual conditions. After obtaining the target encrypted data, the transfer platform further transmits the target encrypted data and the source system public key to the destination system.
S311, the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
In the embodiment of the application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporary stores the source system public key, and because the target encrypted data is encrypted by using the destination system public key on the basis of the encrypted data, even if the data is stolen in the transmission process of the transfer platform and the destination system, an lawbreaker cannot acquire the real target data. The destination system uses the unique destination system private key to decrypt the target encrypted data and then obtains the encrypted data, and what needs to be said is that the encrypted data has a digital signature generated by the active system, and before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data, it is ensured that the encrypted data is not tampered before being further encrypted by the destination system, and further, the destination system needs to verify the digital signature, and step S312 is performed.
S312, the destination system verifies the digital signature on the encrypted data by using a source system public key;
in the embodiment of the present application, the destination system calls the public key of the source system and verifies the digital signature on the encrypted data, and for the verification process of the digital signature, the process of verifying the digital signature by using the public key of the source system with reference to the foregoing transfer platform may be referred to, which is not described herein.
And S313, after the verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data, and the target data transmitted by the source system is obtained.
In the embodiment of the application, after the destination system determines that the digital signature on the encrypted data is successfully verified, the destination system further sends feedback information of the verification success to the transfer platform, wherein the feedback information comprises identification information of the encrypted data; and the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, and the target data transmitted by the source system is obtained.
The data circulation processing method effectively improves the safety and efficiency of data transmission. Specifically, the source system, the transfer platform and the destination system respectively generate own key pairs, generate symmetric keys through key negotiation, ensure the intensity of data encryption, the source system not only encrypts data by using the symmetric keys, but also generates digital signatures for the encrypted data by using own private keys, increase the security level of data transmission, and the transfer platform is responsible for exchanging public keys with the destination system after verifying the digital signatures, the destination system decrypts the data through the private key of the destination system, and verifies the digital signature through the public key of the source system, so that the integrity of the data and the identity verification of a sender are ensured, and finally, the transfer platform safely sends the symmetric key to the destination system to unlock the encrypted data, so that safe data transmission is realized.
Referring to fig. 6 to 7, another embodiment of a data circulation processing method is provided, where the data circulation processing method is applied to a source system, a transit platform and a destination system, and the embodiment includes:
S401, the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
Before the source system, the transit platform and the destination system perform data circulation processing, the source system, the transit platform and the destination system firstly generate key pairs of each bit, wherein the key pair generation generally relates to an asymmetric encryption technology, and the most common method comprises the following steps:
RSA (Rivest-Shamir-Adleman): it is one of the earliest and most widely used asymmetric encryption algorithms, RSA is based on a simple number theory fact that it is easy to multiply two large prime numbers, but factoring the product is extremely difficult, and the security of the RSA algorithm is based on the difficulty of the large number decomposition problem.
ECC (Elliptic Curve Cryptography): ECC can provide the same level of security compared to RSA, while using a shorter key length, which means faster processing speed and lower resource consumption.
DSA (Digital Signature Algorithm): is a standard digital signature algorithm and can also be used to generate key pairs. It is based on the discrete logarithm problem of modulus numbers and is particularly suitable for use in signature verification processes.
Diffie-Hellman key exchange protocol: while not itself directly generating a key pair, it allows two parties that do not have a prior shared secret to generate a common secret key over an unsecured communication channel that can be used for subsequent communication encryption.
The process of generating a key pair typically involves the steps of:
selection algorithm: firstly, selecting an asymmetric encryption algorithm according to security requirements and application environments;
generating parameters: for example, in the ECC and DSA algorithms, a set of appropriate parameters must first be generated or selected;
generating a key pair: a pair of keys is generated using the selected algorithm and parameters, one of which is referred to as the public key and the other is referred to as the private key, which can be publicly shared and the private key must be kept secret.
For the key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to actual conditions, and preferably, in the application, in order to facilitate encryption and decryption between subsequent key pairs, the key pair is generated by adopting an ECC elliptic encryption algorithm. The generated source system key pair comprises a source system public key and a source system private key, wherein the source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair comprises a transfer platform public key and a transfer platform private key, the transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair includes a destination system public key and a destination system private key, the destination system public key is public, and the destination system private key is private and is stored only in the destination system.
The obtained public keys can be disclosed outwards, but the corresponding private keys are stored in various systems and cannot be disclosed outwards.
S402, exchanging the public key of the source system and the public key of the transit platform between the source system and the transit platform;
S403, the transit platform and the source system conduct key negotiation to generate a symmetric key;
In the embodiment of the present application, after the source system and the transit platform generate various key pairs, further, the source system is configured to securely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system first performs key negotiation with the source system to generate a symmetric key, and the generated symmetric key is only transmitted between the transit platform and the source system, and for generating the symmetric key, the following method may be referred to specifically:
Diffie-Hellman key exchange: this is a very popular method that allows both parties to securely generate symmetric keys through an insecure channel without a shared secret.
RSA key exchange: a party may generate a temporary RSA key pair and send the public key of the RSA key pair to another party, which the recipient encrypts the symmetric key using and sends back.
Pre-shared key negotiation: both parties will share a key in advance, which pre-shared key can be used directly as a symmetric key or for securely negotiating a new key over an insecure channel.
Transport layer security protocol: while TLS is typically used for secure communications between clients and servers, it may also be used for secure key agreement.
Quantum key distribution: QKD represents a method of generating and assigning an absolute secure key pair using quantum mechanics principles.
In practical applications, which key agreement method is selected depends on specific security requirements, performance requirements and capabilities of both parties, for example, in environments where computing resources are limited, a lighter-weight key agreement method is selected, and in cases where extremely high security guarantees are required, a more complex protocol is employed. In the present application, the transit platform and the source system may generate the symmetric key according to the corresponding method, and further perform step S403 after generating the symmetric key.
S404, the source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
In the embodiment of the application, after the source system and the transfer platform generate the symmetric key, the source system further calls out the target data which needs to be sent to the destination system, and encrypts the target data by using the symmetric key which is negotiated with the transfer platform to obtain the encrypted data, specifically, firstly, the encrypted data is ensured to be in a form which can be processed by an encryption algorithm, the data compression is needed to reduce the size of the encrypted data, and if the size of the encrypted data to be encrypted does not meet the requirement of the encryption algorithm, filling is needed to enable the data to meet the size requirement of an encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data, and after encryption is completed, the generated encrypted data can be safely stored in the source system. Further, to ensure the integrity and security of the encrypted data after transmission to the staging platform, the source system encrypts the encrypted data using the source system private key and generates a digital signature, and specifically, the source system generates a unique hash value for the encrypted data using a hash function designed as a one-way function, which generates a fixed-length, unique hash value for any given data, but cannot derive the original data in the reverse direction from the hash value, and after the hash value of the encrypted data is obtained, the source system encrypts the hash value using the source system private key to generate a so-called digital signature. In this step, the source system private key is used as the encryption key, ensuring that only the receiver with the corresponding public key can verify the signature, i.e. only the source system public key can decrypt the hash value.
S405, the source system sends the encrypted data and the digital signature to the transit platform;
In the embodiment of the application, after the source system acquires the encrypted data and the corresponding digital signature, the encrypted data and the digital signature are safely transmitted to the transfer platform, a special data transmission channel is established between the source system and the transfer platform, the data transmission channel can be generated based on a symmetrical algorithm, and when the data transmission is carried out, communication is only carried out between the active system and the transfer platform, and then the source system packages the encrypted data and the digital signature together and transmits the packaged encrypted data and the digital signature to the transfer platform.
S406, the transit platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transit platform exchanges the public key of the destination system and the public key of the transit platform with the destination system;
In the implementation of the application, after the transfer platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data is not decrypted or not changed in a serial manner in the transmission process, the integrity of the encrypted data is ensured, further verification is required to be performed on the digital signature, because the source system encrypts the encrypted data by using the source system private key to generate the digital signature, the target data and the digital signature can be verified only through the source system public key, in particular, the transfer platform separates the target data from the digital signature, then decrypts the digital signature by using the source system public key to obtain a hash value, and because the source system public key and the source system private key are a matched pair of keys, the source system public key can successfully decrypt the signature encrypted by using the source system private key to obtain an original hash value, further, the transfer system recalculates the hash value of the encrypted data, finally, the source system compares the hash value obtained by decryption with the recalculated hash value, and determines that the encrypted data is not tampered in the transmission process when determining that the two hash values are identical.
After the source system determines the integrity of the encrypted data, the transfer platform temporarily stores the encrypted data, determines a destination system connected to the transfer platform according to the identification on the encrypted data, exchanges the public key of the destination system and the public key of the transfer platform between the transfer platform and the destination system after the destination system is determined, namely, the transfer platform sends the public key of the transfer platform to the destination system, and after the destination system receives the public key of the transfer platform, the destination system sends the public key of the destination system to the transfer platform according to the identification or the IP address on the public key of the transfer platform, so that the public key exchange of the two parties is completed.
S407, the transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data;
In the implementation of the application, the transfer platform calls out the public key of the destination system and correspondingly generates a series of random numbers; the transfer platform calculates a hash value hash obtained by combining a destination system public key and a random number by using a target hash function, and then the transfer platform uses the calculated hash value hash as the input of a key derivation function and generates a target key K; and the transfer platform encrypts the encrypted data by using the target key K and the destination system public key to obtain target encrypted data.
The target encryption data is the key for ensuring the safety of the data in the transmission process, and by encrypting the original data and carrying out secondary encryption by using the target secret key K and the destination system public key, the data can be decrypted and accessed only by the destination system with the corresponding private key, and the double encryption mode greatly enhances the safety of the data, so that an attacker cannot directly acquire the content of the original data even if the data is intercepted in the transmission process.
S408, the transit platform performs key negotiation with the destination system to generate a call key;
In the embodiment of the application, after encrypting the encrypted data according to the public key of the destination system and the target key K to obtain the target encrypted data, in order to further ensure the data transmission between the transfer platform and the destination system, the transfer platform performs key negotiation with the destination system to generate a call key, and specifically, the transfer platform determines a prime number p and a base number g and sends the prime number p and the base number g to the destination system; the destination system randomly selects one private key a, calculates a public key A=gA mod p, the transfer platform randomly selects one private key B, calculates a public key B=gB mod p, the destination system sends the public key a to the transfer platform, and the transfer platform sends the public key B to the destination system; after the destination system receives the transit platform public key B, calculating a shared key S=B≡a mod p by using a private key a; when the transit platform receives the public key a of the destination system, the private key b of the transit platform is used for calculating the shared secret key S=A≡b mod p; because the shared secret key calculated by the destination system and the transfer platform is the same, the transfer platform and the destination system use a secret key derivative function and combine the shared secret key S and the session ID to generate a call secret key, so that the transfer platform and the destination system construct a data transmission channel according to the call secret key.
S409, the transfer platform sends the target encrypted data and the source system public key to the destination system;
In the embodiment of the application, after the transfer platform and the destination system construct the data transmission channel according to the call key, the transfer platform further transmits the target encrypted data and the source system public key to the destination system through the data transmission channel, and the destination system temporarily stores the received target encrypted data and the source system public key and is used for executing subsequent data processing.
S410, the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
s411, the destination system verifies the digital signature on the encrypted data by using a source system public key;
S412, after the verification is successful, the transfer platform sends the symmetric key pair to a destination system; the destination system uses a symmetric key pair to unlock the encrypted data to obtain the target data for transmission by the source system.
In the implementation of the present application, the steps S410 to S412 are similar to the steps S108 to S110 described above, and are not repeated here.
Referring to fig. 8 to 9, another embodiment of a data circulation processing method is provided, where the data circulation processing method is applied to a source system, a transit platform and a destination system, and the embodiment includes:
s501, the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
s502, exchanging the public key of the source system and the public key of the transit platform between the source system and the transit platform;
S503, performing key negotiation by the transit platform and the source system to generate a symmetric key;
S504, the source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
S505, the source system sends the encrypted data and the digital signature to the transit platform;
S506, the transit platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transit platform exchanges the public key of the destination system and the public key of the transit platform with the destination system;
S507, the transfer platform encrypts the encrypted data by using the public key of the destination system to obtain target encrypted data, and sends the target encrypted data and the public key of the source system to the destination system;
In the embodiment of the present application, the steps S501 to S507 are similar to the steps S101 to S107 described above, and are not described herein.
S508, the destination system receives the target encrypted data and a string of random numbers sent by the transfer platform;
in the embodiment of the application, after the transfer platform sends the target encrypted data and the source system public key to the destination system, further, a string of random numbers is also sent to the destination system together, so that the destination system receives the target encrypted data, the string of random numbers and the source system public key from the transfer platform.
Specifically, after the transfer platform sends the target encrypted data and the source system public key to the destination system, further security measures are taken, and in order to enhance the security in the data transmission process, the transfer platform also generates a series of random numbers and sends the random numbers, together with the target encrypted data and the source system public key, to the destination system. In this way, the destination system can obtain not only the target encrypted data and the source system public key, but also the series of random numbers when receiving the data, thereby ensuring the integrity and security of the data transmission.
In particular, the string of random numbers plays an important role in the data transmission process. Firstly, the method can be used as a checking mechanism for verifying the integrity of data, when a destination system receives the data, whether the data is tampered or damaged in the transmission process can be judged by comparing whether the random numbers held by a transfer platform are consistent, and if the random numbers are consistent, the data can be considered to be intact; if the random numbers are inconsistent, the problem of the data in the transmission process is indicated, and corresponding processing is needed.
Second, the string of random numbers may also serve as an encryption mechanism for enhancing the security of the data. Before sending the data, the transfer platform can use the random number to further encrypt the target encrypted data so as to ensure that the data is not illegally intercepted or tampered in the transmission process. When the destination system receives the encrypted data, a decryption operation may be performed using the corresponding decryption algorithm and the series of random numbers, thereby restoring the original target encrypted data. Therefore, even if the data is illegally intercepted in the transmission process, an attacker cannot directly acquire the content of the target encrypted data, so that the security of the data is ensured.
In addition, the string of random numbers may also be used as an authentication mechanism for confirming the identities of the relay platform and the destination system, and the relay platform may attach the string of random numbers as an authentication information to the target encrypted data before the relay platform sends the data. When the destination system receives the target encrypted data, it can confirm whether the identity of the sender is correct by verifying whether the string of random numbers is consistent with the expected one. Likewise, the staging platform may also verify that the identity of the recipient is correct by verifying the random number held by the destination system. Thus, an attacker with counterfeit identity can be effectively prevented from performing illegal operation.
S509, the destination system calculates a hash value through the target hash function by using a destination system public key and a series of random numbers;
In the embodiment of the application, the string of random numbers is used as part of the input and is transmitted to the target hash function together with the public key of the destination system, and by the operation, a hash value which is unique and unpredictable can be obtained, and the hash function has unidirectionality, namely the original input cannot be deduced through the hash value in a reverse direction, so that the hash value becomes a very effective data checking mechanism, and the integrity of data can be ensured and the data cannot be tampered.
S510, the destination system uses the hash value to generate a decryption key through a key derivation function;
In the embodiment of the application, the data security and the data integrity are ensured by using the hash value and the key derivation function to generate the decryption key, so that only the receiver with the correct key and the hash value can decrypt and read the data, thereby effectively preventing illegal access and tampering of the data.
S511, the destination system decrypts the target encrypted data by using the decryption key and the destination system private key to obtain encrypted data;
In the embodiment of the application, the decrypted encrypted data plays a key role in a destination system, and the data not only represents the core of the original information, but also is a key for ensuring that the information is not tampered in the transmission process. To ensure the integrity and security of data, destination systems employ advanced encryption techniques to protect the data.
In the decryption process, the destination system first uses the decryption key to unlock the external protection layer of the target encrypted data. This step is critical because it ensures that only the receiver with the correct key can access the content of the data, and once the external protection layer is opened, the system exposes the true appearance of the encrypted data.
Next, the destination system uses its own private key to further decrypt the decrypted data, the private key being unique to the destination system, which ensures that only the system can access and decrypt the data, which not only enhances the security of the data, but also ensures the privacy of the data.
The decrypted data can now be freely circulated in the destination system, which, however, is still subject to strict monitoring and management by the system, by implementing a series of security measures, such as access control, data auditing, encrypted storage, etc., the destination system ensures that the decrypted data is not obtained or misused by unauthorized third parties.
S512, the destination system verifies the digital signature on the encrypted data by using a source system public key;
And S513, after the verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data, and the target data transmitted by the source system is obtained.
In the embodiment of the present application, the steps S512 to S513 are similar to the step S110 of the step S109, and are not described herein.
Referring to fig. 10, a second aspect of the present application provides a data circulation processing system, which includes:
a source system 1, a relay platform 2 and a destination system 3, the source system 1, the relay platform 2 and the destination system 3 performing the following operations:
The source system 1, the transfer platform 2 and the destination system 3 respectively generate a source system 1 key pair, a transfer platform 2 key pair and a destination system 3 key pair, wherein the source system 1 key pair comprises a source system 1 public key and a source system 1 private key, the transfer platform 2 key pair comprises a transfer platform 2 public key and a transfer platform 2 private key, and the destination system 3 key pair comprises a destination system 3 public key and a destination system 3 private key;
exchanging the source system public key and the transit platform public key between the source system 1 and the transit platform 2;
the transit platform 2 and the source system 1 perform key negotiation to generate a symmetric key;
The source system 1 encrypts target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system 1 to generate a digital signature;
The source system 1 sends the encrypted data and the digital signature to the transit platform 2;
the transit platform 2 verifies the digital signature by using the public key of the source system 1, and after the integrity of the target encrypted data is determined, the transit platform 2 exchanges the public key of the destination system 3 and the public key of the transit platform 2 with the destination system 3;
the transit platform 2 encrypts the encrypted data by using the public key of the destination system 3 to obtain target encrypted data, and sends the target encrypted data and the public key of the source system 1 to the destination system 3;
the destination system 3 decrypts the target data packet by using the private key of the destination system 3 to obtain the encrypted data;
the destination system 3 verifies the digital signature on the encrypted data using the source system 1 public key;
After verification is successful, the staging platform 2 sends the shared key pair to the destination system 3 so that the destination system 3 uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system 1.
Referring to fig. 11, the present application further provides a data circulation processing device, including:
A processor 701, a memory 702, an input/output unit 703, and a bus 704;
The processor 701 is connected to the memory 702, the input-output unit 703, and the bus 704;
The memory 702 holds a program, and the processor 701 calls the program to execute any of the methods described above.
The application also relates to a computer readable storage medium having a program stored thereon, characterized in that the program, when run on a computer, causes the computer to perform any of the methods as described above.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, which are not repeated herein.
In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a random-access memory (RAM, random access memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
Claims (22)
1. A data flow processing method, wherein the data flow processing method is applied to three systems of a source system, a transit platform and a destination system, and the method comprises the following steps:
The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;
The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;
the transfer platform decrypts the authentication information by using the transfer platform private key;
after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;
the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;
The transit platform sends the public key QA to the source system;
the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;
The source system sends the public key QB to the transfer platform;
The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;
the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;
The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;
The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
the source system sends the encrypted data and the digital signature to the transit platform;
the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;
The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;
the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;
The destination system verifies the digital signature on the encrypted data using a source system public key;
After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.
2. The data flow processing method according to claim 1, wherein the source system and the transit platform use a shared key S as a seed, and generating a symmetric key by the shared key derivation function KDF comprises:
Determining a key derivation function of the HMAC, and setting iteration times and key length information for the key derivation function of the HMAC;
Selecting a target random number D;
inputting the target random number D, the shared secret key S, the iteration number information and the secret key length information into a secret key derivation function of the HMAC to carry out derivation processing;
and obtaining the symmetric key after the deriving process.
3. The data flow processing method according to claim 1, wherein the encrypting the target data by the source system using the symmetric key to obtain encrypted data, and encrypting and generating a digital signature on the encrypted data by using a source system private key, comprises:
the source system calculates a hash value of the target data and combines the hash value with the symmetric key to generate a target symmetric key;
The source system encrypts the target data through the target symmetric key to obtain the encrypted data;
The source system calculates a target hash value of the encrypted data;
the source system encrypts the target hash value using the source system private key to generate a digital signature.
4. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:
the source system calculates a first hash value and a second hash value of the encrypted data by using an SHA-256 algorithm and an SHA-3 algorithm respectively;
and the source system combines the first hash value and the second hash value to obtain the target hash value.
5. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:
the source system divides the encrypted data into a plurality of blocks of data and calculates the hash value of each block of data respectively;
The source system combines the hash values of each block of data using a merck tree to obtain the target hash value.
6. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:
The source system calculates a hash value of the encrypted data by using an SHA-256 algorithm;
the source system calculates a second-class hash value and a third-class hash value of the source system public key and the source system private key by using an SHA-3 algorithm;
The source system combines the one type of hash value, the two types of hash values, and the three types of hash values using a merck tree to obtain the target hash value.
7. The data flow processing method according to claim 1, wherein before the source system encrypts authentication information according to the transit platform public key, the method further comprises:
and the source system and the transfer platform construct a data security transmission channel based on the call key.
8. The data flow processing method of claim 1, wherein the source system generates a source system key pair comprising:
determining a first prime number P1, wherein P1 is the basis of a finite field;
defining a first elliptic curve: wherein a and b are curve parameters on the first elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the first elliptic curve;
selecting a base point G1 on the first elliptic curve;
Defining a source system private key d1, d1 as a randomly defined positive integer, the range [1, n-1] of d1, wherein n is the order of the base point G1, i.e. the smallest positive integer n;
Calculating a source system public key Q1 according to the point multiplication operation on the first elliptic curve, wherein Q1=d1×G1;
and acquiring the source system public key Q1 and the source system private key d1.
9. The data flow processing method according to claim 1, wherein the relay platform generates a relay platform key pair, comprising:
determining a second prime number P2, wherein P2 is the basis of the finite field;
Defining a second elliptic curve: wherein a and b are curve parameters on the second elliptic curve equation, and a and b need to satisfy the following conditions: To ensure that there are no irregularities on the second elliptic curve;
Selecting a base point G2 on the second elliptic curve;
Defining a transit platform private key d2, d2 as a randomly defined positive integer, and d2 is in the range [1, n-1] of n, wherein n is the order of the base point G2, namely the smallest positive integer n;
Calculating a source system public key Q2 according to the point multiplication operation on the second elliptic curve, wherein Q2=d2×G2;
and acquiring the transit platform public key Q2 and the transit platform private key d2.
10. The data flow processing method according to claim 1, wherein the destination system generates a destination key pair, comprising:
Determining a third prime number P3, wherein P3 is the basis of the finite field;
Defining a third elliptic curve: Wherein a and b are curve parameters on the third elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the third elliptic curve;
selecting a base point G3 on the third elliptic curve;
Defining a destination system private key d3, d3 as a randomly defined positive integer, d3 ranging from [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;
calculating a source system public key Q3 according to the point multiplication operation on the third elliptic curve, wherein Q3=d3×G3;
The destination public key Q3 and the destination system private key d3 are acquired.
11. The data flow processing method of claim 1, wherein the source system sending the encrypted data and the digital signature to the staging platform comprises:
the source system divides the encrypted data into a plurality of data packets;
the source system determines a plurality of transmission channels transmitted to the transit platform;
The source system transmits the data packets and the digital signature to the transfer platform through the transmission channels, and the digital signature is corresponding to the data packets.
12. The data flow processing method of claim 11, wherein the relay platform verifies the digital signature using the source system public key, comprising:
the transfer platform receives a plurality of data packets of a plurality of transmission channels and the digital signature;
The intermediate transfer platform invokes the source system public key;
The transfer platform verifies digital signatures on a plurality of data packets using the source system public key;
and after the transfer platform determines that the digital signature of the data packets is verified to be correct, combining the data packets to generate the encrypted data.
13. The data flow processing method according to claim 1, wherein the relay platform exchanges a destination system public key and a relay platform public key with the destination system, comprising:
the transfer platform determines a destination system according to the identification on the encrypted data;
The transfer platform sends a receiving instruction to the destination system;
After the transfer platform acquires a confirmation instruction fed back by the destination system, the transfer platform and the destination system construct a safe transmission channel;
The transfer platform sends the public key of the transfer platform to the destination system through the secure transmission channel;
After the destination system acquires the public key of the transfer platform, verifying whether the IP address of the public key of the transfer platform is consistent with the IP address of the receiving instruction;
If yes, the destination system sends the destination system public key to the transit platform.
14. The method for processing data circulation according to claim 1, wherein the step of encrypting the encrypted data by the relay platform using the destination system public key to obtain the target encrypted data includes:
The transfer platform calls out the public key of the destination system;
the transfer platform generates a series of random numbers;
the transfer platform calculates a hash value hash obtained by combining a destination system public key and a random number by using a target hash function;
The transfer platform uses the calculated hash value hash as the input of a key derivation function and generates a target key K;
and the transfer platform encrypts the encrypted data by using the target secret key K and the destination system public key to obtain target encrypted data.
15. The data flow processing method of claim 1, wherein prior to sending the target encrypted data and the source system public key to the destination system, the method further comprises:
the transfer platform performs key negotiation with the destination system to generate a call key;
and the transit platform and the destination system construct a data transmission channel according to the call key.
16. The data flow processing method of claim 15, wherein the staging platform performing key agreement with the destination system to generate a session key comprises:
The transit platform determines a prime number p and a base number g and sends the prime number p and the base number g to the destination system;
The destination system randomly selects a private key a and calculates a public key A=ga mod p;
The transfer platform randomly selects a private key B and calculates a public key B=gb mod p;
The destination system sends the public key a to a transfer platform, and the transfer platform sends the public key b to the destination system;
when the destination system receives the public key B, calculating a shared key s=b≡a mod p by using the private key a;
when the transit platform receives the public key a, the private key b of the transit platform is used for calculating a shared secret key S=A≡mod p;
the transit platform and the destination system use a key derivation function and combine a shared key S and a session ID to generate a session key.
17. The data flow processing method of claim 1, wherein prior to the destination system decrypting the target data packet using the destination system private key to obtain the encrypted data, the method further comprises:
And the destination system receives the target encrypted data and a series of random numbers sent by the transfer platform.
18. The data flow processing method of claim 17, wherein the destination system decrypting the target data packet using the destination system private key to obtain the encrypted data, comprising:
The destination system calculates a hash value through the target hash function by using a destination system public key and a series of random numbers;
The destination system generates a decryption key through a key derivation function using the hash value;
And the destination system decrypts the target encrypted data by using the decryption key and the destination system private key to obtain the encrypted data.
19. The data flow processing method of claim 1, wherein after verification is successful, the staging platform sends the symmetric key pair to a destination system before the method further comprises:
the destination system sends feedback information which is successfully verified to the transfer platform, wherein the feedback information comprises identification information of the encrypted data;
And the transfer platform sends the corresponding symmetric key to the destination system according to the identification information in the feedback information.
20. A data flow processing system, the data flow processing system comprising:
A source system, a relay platform, and a destination system, the source system, the relay platform, and the destination system performing the following operations:
The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;
Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;
The transfer platform and the source system conduct key negotiation to generate a symmetric key;
The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;
the source system sends the encrypted data and the digital signature to the transit platform;
the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;
The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;
the transfer platform decrypts the authentication information by using the transfer platform private key;
after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;
the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;
The transit platform sends the public key QA to the source system;
the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;
The source system sends the public key QB to the transfer platform;
The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;
the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;
The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;
The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;
the destination system decrypts the target data packet by using the private key of the destination system to obtain the encrypted data;
The destination system verifies the digital signature on the encrypted data using a source system public key;
After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.
21. A data flow processing apparatus, the apparatus comprising:
a processor, a memory, an input-output unit, and a bus;
the processor is connected with the memory, the input/output unit and the bus;
the memory holds a program which the processor invokes to perform the method of any one of claims 1 to 19.
22. A computer readable storage medium having a program stored thereon, which when executed on a computer performs the method of any of claims 1 to 19.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410632457.8A CN118214558B (en) | 2024-05-21 | 2024-05-21 | Data circulation processing method, system, device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410632457.8A CN118214558B (en) | 2024-05-21 | 2024-05-21 | Data circulation processing method, system, device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN118214558A CN118214558A (en) | 2024-06-18 |
| CN118214558B true CN118214558B (en) | 2024-08-23 |
Family
ID=91454904
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410632457.8A Active CN118214558B (en) | 2024-05-21 | 2024-05-21 | Data circulation processing method, system, device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN118214558B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118573473B (en) * | 2024-07-31 | 2024-10-11 | 飞驰云联(南京)科技有限公司 | Network data safety transmission method based on trusted platform |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021009554A1 (en) * | 2019-07-18 | 2021-01-21 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and system for secured information exchange between intermediate and endpoint nodes in a communications network |
| CN117879833A (en) * | 2024-01-15 | 2024-04-12 | 郑州盛见网络科技有限公司 | Digital signature generation method based on improved elliptic curve |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20220385453A1 (en) * | 2021-05-28 | 2022-12-01 | Atakama LLC | Secure file transfer |
-
2024
- 2024-05-21 CN CN202410632457.8A patent/CN118214558B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021009554A1 (en) * | 2019-07-18 | 2021-01-21 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and system for secured information exchange between intermediate and endpoint nodes in a communications network |
| CN117879833A (en) * | 2024-01-15 | 2024-04-12 | 郑州盛见网络科技有限公司 | Digital signature generation method based on improved elliptic curve |
Also Published As
| Publication number | Publication date |
|---|---|
| CN118214558A (en) | 2024-06-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP3872107B2 (en) | Encryption key recovery system | |
| US7373507B2 (en) | System and method for establishing secure communication | |
| US8670563B2 (en) | System and method for designing secure client-server communication protocols based on certificateless public key infrastructure | |
| Schäfer et al. | Security in fixed and wireless networks | |
| JP2022537733A (en) | Authenticated key agreement | |
| CN118214558B (en) | Data circulation processing method, system, device and storage medium | |
| TW201537937A (en) | Unified identity authentication platform and authentication method thereof | |
| EP1079565A2 (en) | Method of securely establishing a secure communication link via an unsecured communication network | |
| Boyd | Modern data encryption | |
| Paar et al. | Message authentication codes (MACs) | |
| Pavani et al. | Data Security and Privacy Issues in Cloud Environment | |
| Rajasekar et al. | Introduction to classical cryptography | |
| Kumar et al. | A novel framework for secure file transmission using modified AES and MD5 algorithms | |
| CN115865313A (en) | Lightweight privacy protection longitudinal federal learning model parameter aggregation method | |
| KR102304831B1 (en) | Encryption systems and method using permutaion group based cryptographic techniques | |
| Hayden et al. | Multi-channel security through data fragmentation | |
| Arora et al. | Handling Secret Key Compromise by Deriving Multiple Asymmetric Keys based on Diffie-Hellman Algorithm | |
| Anuradha et al. | Hybrid Multiple Cryptography for Data Encryption | |
| Gohel | Introduction to Network & Cybersecurity | |
| Thwe et al. | Prevention of Man-In-The-Middle Attack in Diffie-Hellman Key Exchange Algorithm using Proposed Hash Function | |
| Hartl et al. | Subverting Counter Mode Encryption for Hidden Communication in High-Security Infrastructures | |
| Gountia et al. | Towards security aspects of secret key transmission | |
| Alaidi | Enhanced a TCP security protocol by using optional fields in TCP header | |
| Kanagala | Design and analysis of a Diffie–Hellman-based network security and cryptography approach | |
| Kanagala | Design and analysis of |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |