WO2007071140A1

WO2007071140A1 - A method for transmitting data securely

Info

Publication number: WO2007071140A1
Application number: PCT/CN2006/002417
Authority: WO
Inventors: Yuemin Qi; Wenbin Hu; Jintan Wu; Jingwen Xu
Original assignee: China Unionpay
Priority date: 2005-12-21
Filing date: 2006-09-15
Publication date: 2007-06-28
Also published as: CN1988441A

Abstract

A method for transmitting data securely includes the steps of: (1) transmitter uniformly encoding the original data that need to be encrypted importantly; (2) transmitter encrypting the encoded data and then transmitting the encrypted data; (3) receiver decrypting the received data, and then decoding the encoded data according to the corresponding step of step (1), restoring the original data that need to be encrypted importantly. That uniformly encoding the original data specifically is: firstly converting the original data that need to be encrypted importantly into ASCII code, and then converting each symbol in ASCII code into corresponding hexadecimal symbol, and forming into encrypted data block in fixed format; or firstly converting the data that need to be encrypted importantly into hexadecimal symbol, and forming into encrypted data block in fixed format.

Description

TECHNICAL FIELD The present invention relates to the field of security, and more particularly to a method for secure transmission of data.

BACKGROUND OF THE INVENTION Network security solutions can be divided into two categories: one is a passive defense scheme represented by firewall technology, and the other is an active open scheme centered on data encryption and user authorization authentication. Passive security solutions can only passively protect corporate intranet security and have special requirements for the topology of the network. The active open solution based on data encryption and user authentication does not require any network structure, and can directly protect the source data to achieve end-to-end security. In a proactive and open approach, only designated users or network devices can interpret the force. Confidential data, no doubt, encryption is at the heart of this type of solution. Encryption technology is a technique for encoding and decoding information. The encoding is to translate the original readable information (also known as plaintext) into a code form (also known as ciphertext), and the reverse process is decoding (decryption).

In order to minimize the data obtained by the criminals in the data transmission process, when the transmitting end sends data to the receiving end, the data is usually encrypted by using various encryption algorithms, and the receiving end uses the corresponding decryption algorithm for decryption. However, in addition to the possibility of a compromise in the data transmission process, there is also the possibility of leaking at the transmitting end and the receiving end. For example, after the expansion of personal payment channels, the way of making payment transactions on the Internet has gradually been accepted by the public. If a user uses a public computer for online payment, it is easy to leave a record on the public computer, such as a card number or a personal password. Even if the user pre-establishes the correspondence between the personal account number, the network payment password and the card number, and the personal password, the user can use the personal account and the network payment password to make online payment, but on the public computer, it is possible to leave the personal account and the network payment password. . Obviously, after the information is obtained by the criminals, it will bring economic losses to the customers.

Similarly, when transmitting various important data in the bank's local area network, for example, each card issuer periodically transmits a VIP file containing a VIP (very important person) account to UnionPay, although The VIP file is connected to the UnionPay's dedicated line through the card issuer, and in order to facilitate the receiver to correctly parse the file content, all the fields in the VIP file are displayed with visible characters. If the VIP account is directly placed in the VIP file as a visible character, Increase the possibility of leaks. In particular, the card issuer and UnionPay are usually a relatively complicated LAN. The VIP account is transmitted directly as visible characters with a low safety factor. Therefore, in addition to strengthening internal encryption management, it is necessary to reduce the leakage of important data (such as VIP accounts) from a technical level.

That is to say, in the prior art, in the data transmission process, in addition to preventing theft in the data transmission process, it is necessary to strengthen the security of the data of the transmitting end and the receiving end.

Summary of the invention

It is an object of the present invention to provide a method for secure transmission of data to solve the technical problem of improving the data security of the transmitting end and the receiving end in the prior art.

Correspondingly, the present invention discloses a method for data security transmission, including: (1) The transmitting end converts the data that needs to be encrypted first into an ASCII code, and then converts each character in the ASCII code into a corresponding hexadecimal number. (2) The transmitting end encrypts the data block containing the encrypted data block and sends it; (3) the receiving end decrypts the received data first, and then follows the steps corresponding to step (1). Decoding the heavily encrypted data block to obtain data that requires emphasis on encryption.

In step (2), encryption is performed using a double length or a single long encryption algorithm. Step (1) The encrypted data block includes the length of the data to be emphasized. The data to be encrypted is an Internet payment password, and in step (2), the encryption key of the PIN is used for encryption, and in step (3), the corresponding decryption key is used for decryption.

The invention discloses another method for data security transmission, comprising: (1) the transmitting end converts the data that needs to be encrypted first into hexadecimal, and forms a fixed-format encrypted data block; (2) the transmitting end will contain emphasis. The data of the encrypted data block is encrypted and sent; (3) The receiving end decrypts the received data first, and then decodes the heavily encrypted data block according to the step corresponding to step (1) to obtain data that needs to be encrypted.

In step (2), encryption is performed by using a double length or a single long encryption algorithm. Step (2) further includes: inverting each byte of the invisible character obtained by encrypting the double-length encryption algorithm The system converts two hexadecimal numbers, converts two hexadecimal numbers into visible ASCII code, or converts the binary number of each byte of all data obtained by encrypting the double-length encryption algorithm. Converts two hexadecimal numbers to visible ASCII code for two hexadecimal digits. The step (2) further includes: generating an encryption key by using a key generation method of the file check code, and sending, by the sender, the encryption key to the receiving end.

The method for secure transmission of data disclosed by the invention includes: (1) the transmitting end converts the original data that needs to be encrypted with emphasis into a unified encoding; (2) the transmitting end encrypts and transmits the data including the unified encoding; (3) the receiving end The received data is decrypted first, and then the unified encoded data is decoded according to the step corresponding to the step (1), and the original data that needs to be encrypted is obtained.

The conversion of the original data into a unified code is specifically: converting the original data that needs to be encrypted first into an ASCII code, and then converting each character in the ASCII code into a corresponding hexadecimal, forming a fixed-format encrypted data block; or The data that needs to be encrypted is first converted into hexadecimal, which constitutes a fixed-format cryptographic data block.

If the sender and the receiver are a local area network, the encrypted internal code is transmitted inside the local area network instead of the original data that needs to be encrypted.

The invention also discloses a method for file transmission in a local area network, wherein the file includes account data represented by a digital number, and the following steps are included:

(1) The sender converts the account data that needs to be encrypted in the file into hexadecimal data, and forms a fixed-format encrypted data block;

(2) The sender encrypts the data containing the encrypted data block;

(3) The sender converts the binary number in each byte of the encrypted data into two hexadecimal numbers, and converts the two hexadecimal numbers into a visible ASCII code form;

(4) The sender sends a file containing account data converted into ASCII code;

(5) The receiving end converts the account data in the form of ASCII code according to the reverse step corresponding to step (4), and then decrypts the converted data, and then decodes the decrypted data according to the reverse step corresponding to step (1). Get raw data that needs to be encrypted.

Compared with the prior art, the present invention has the following advantages: The transmitting end encrypts important data into another visible character, and then needs to send the data including the visible character. After the encryption is performed, the receiving end first decrypts the received data, and then converts the visible characters into important data by using the corresponding decryption method, thereby reducing the chance of leaking at the transmitting end and the receiving end, and improving data security. In addition, if the transmitting end and the receiving end are local area networks, the encrypted characters are transmitted inside the transmitting end and the receiving end, instead of the original data that needs to be encrypted, to ensure the reliability of the data.

BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a flow chart of a method for secure transmission of data disclosed by the present invention; FIG. 2 is a flow chart of an embodiment of data security transmission according to the present invention;

3 is a flow chart of another embodiment of data secure transmission of the present invention.

DETAILED DESCRIPTION OF THE INVENTION The present invention will be specifically described below with reference to the accompanying drawings.

In view of the fact that the receiver correctly parses the received data, in many cases it is necessary to display all the fields in the file with visible characters, even if the encrypted content must be displayed with visible characters. Therefore, the core of the present invention is that after the transmitting end uniformly encodes important data into another visible character, the data to be transmitted including the visible character is encrypted and transmitted, and the receiving end first decrypts the received data. And then use the corresponding decryption method to convert the visible characters into important data. When the transmitting end is a local area network, the original important data is immediately encoded into other visible characters for display, and the data transmitted inside the local area network is the encoded visible character instead of the original important data. In the case where the receiving end is a local area network, after decrypting the received data, the encoded visible characters are obtained instead of the original important data. Similarly, the data transmitted over the LAN is the encoded visible character rather than the original important data. Through the above processing, the reliability of data transmission can be ensured, and in particular, the opportunity for direct leakage of the transmitting end and the receiving end can be reduced, and the security of data transmission can be improved.

Please refer to FIG. 1 , which is a flow chart of a method for data secure transmission disclosed by the present invention. it includes:

S110: The sending end uniformly encodes the original data that needs to be encrypted.

S120: The sending end encrypts the data including the unified encoding and sends the data; S130: The receiving end first decrypts the received data, and then decrypts the unified encoded data according to the step corresponding to step S110 to obtain original data that needs to be encrypted.

In step S110, the transmitting end displays the original data that needs to be encrypted intensively into other visible characters. For example, the user terminal inputs important data such as a personal account number and a network payment password or a card number and a personal password on a public computer, but the public computer displays other encoded visible characters, which cannot be directly obtained even if the criminals peek around. This raw data improves security. In addition, if the transmitting end is a local area network, the receiving terminal that receives the original important data can directly encode the original important data into other visible characters, and then add other visible characters to the data to be sent, and then send the encrypted data to the encrypting machine, and the encryption machine encrypts the encrypted data. After transmission, the security of the transmission between the receiving terminal and the encryption machine is improved. In addition, the encryption machine can also be integrated on the receiving terminal, so that the receiving terminal receives the original important data, and then directly converts it into a uniformly encoded visible character, and then adds the visible character to the data to be sent, and finally contains the visible character. The data that needs to be sent is encrypted and sent, which also improves the security of data transmission.

There are many ways to convert raw data into visible characters, such as:

The original data that needs to be encrypted is first converted into an ASCII code, and then each character in the ASCII code is converted into a corresponding hexadecimal, which constitutes a fixed-format encrypted data block, and the emphasized encrypted data block is a visible character; Or

The data that needs to be encrypted is first converted into a hexadecimal, which constitutes a fixed-format encrypted data block, and the emphasized encrypted data block is a visible character.

The above disclosure is only a few embodiments in which the present invention converts raw data into visible characters, and is not limited thereto.

The data containing the visible characters is encrypted, and the encryption algorithm used is very much, such as the DES algorithm. The encryption algorithm used is a well-known technology, and will not be described here.

In addition, the receiving end first decrypts the received data according to the corresponding decryption algorithm, and then inversely converts the visible character into the original data that needs to be encrypted in accordance with the corresponding conversion manner. If the receiving end is a local area network, the encoded visible characters are transmitted inside the receiving end instead of the original data that needs to be encrypted. The invention is illustrated below in two specific embodiments.

Please refer to FIG. 2 , which is a flowchart of a data security transmission embodiment of the present invention, including:

S210: The sender converts the data that needs to be encrypted first into ASCII code, and then converts each character in the ASCII code into a corresponding hexadecimal code to form a fixed-format encrypted data block;

S220: The sending end encrypts the data including the encrypted data block and sends the data. S230: The receiving end decrypts the received data first, and then decrypts the emphasized encrypted data block according to the step corresponding to step S210 to obtain data that needs to be encrypted. .

The encrypted data block includes the length of the data to be emphasized. The encrypted data block is added to the data to be sent at the agreed position of the sender and the receiver, so that the receiver can perform correct decryption.

Take the online payment password as an example to illustrate the above process.

After the expansion of personal payment channels, the way in which payment transactions are conducted on the Internet has been accepted by more and more people. Since the function of the Internet payment password is very similar to the personal identification code, in order to reduce the organizational changes, the algorithm should be designed as close as possible to the personal identification code. When the website of the card issuing institution or the intermediary service provider such as UnionPay is popping up the page and the user needs to input the payment password, the website can uniformly encode the received payment password into other visible characters in the following manner.

Al, convert the payment password to ASCII code

Since the payment password can be composed of numbers, characters or other symbols, just because the character password can be composed of such a large number of characters, it is necessary to find an encoding rule that can fully identify them in order to uniformly convert it into a coding form recognizable by the encryption machine. Otherwise, the conversion method will be complicated, which is not conducive to machine implementation. The encoding rule that applies to the cartridge is ASCII. Therefore, the payment password can be converted to ASCII code.

Table 1

N N P P P P P P P P P P P P P P P P P P P F F F

1 1 / 1 / 1 / 1 1 / 1 1 / /

1 1 / 1 1 1 1 1 / 1 / /

FFFFFFFFFFFFFF Note 1: P means Password, F means Filler

Note 2: N is the length of the payment password (8 - bit)

Note 3: P is the character of the 8-bit binary internet payment password.

Note 4: P/F is the character of the 8-bit binary internet payment password / padding character Note 5: F is the padding character of the 8-bit binary internet payment password

The ASCII code converted into each payment password has the fixed format of Table 2.

Table 2

Its character set is the characters listed in the standard ASCII conversion table.

A2: Convert each character in the ASCII code to the corresponding hexadecimal number and re-encrypt the data block.

An example is as follows:

Clear text payment password: Hello! 123

Since the payment password is a plain text display, it needs to be converted to ASCII first and then converted to a hexadecimal number, as shown in Table 3.

table 3

According to the supplementary principle described above, the length of the two characters is preceded by a total of

9 characters, thus complementing 09 two characters, converting to ASCII is 48 and 57, converting to hexadecimal is 0x30 and 0x39. Need to add 13-bit white space afterwards, convert to ten The hexadecimal is OxFF, so the resulting Internet payment password block is as follows:

0x30 0x39 0x48 0x65 0x6C 0x6C 0x6F 0x21 0x31 0x32 0x33 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF The payment cipher block is composed into a file or a packet, and the file or packet is encrypted. The encryption key uses the PIN encryption key. The encryption algorithm uses a double-length encryption algorithm or a single-length encryption algorithm depending on whether the key is double or single.

The decryption of the receiving end is an inverse process of decryption by the transmitting end, which is omitted here. Please refer to FIG. 3 , which is a flowchart of another data security transmission disclosed by the present invention. it includes:

S310: The sending end converts the data that needs to be encrypted first into hexadecimal, and forms a cryptographic data block in a fixed format;

S320: The sending end encrypts the data including the encrypted data block and sends the data. S330: The receiving end decrypts the received data first, and then decrypts the heavily encrypted data block according to the step corresponding to step S310, and obtains data that needs to be encrypted. .

In step S320, the double-length encryption algorithm is used to encrypt the data to be sent. And it also includes: Converting the binary number of each byte of the invisible characters obtained by encrypting the double-length encryption algorithm into two hexadecimal numbers, and converting the two hexadecimal numbers into visible ASCII codes.

The following takes the VIP main account in the VIP file as an example to explain the above process. A VIP file is a data file developed by each bank for information about its important customers (ie, very pricey cardholders). The VIP file includes the VIP number of the VIP customer, and under each corresponding card number, sets the important information of each cardholder in the corresponding card number.

VIP documents need to be updated regularly. In order to facilitate UnionPay or other qualified merchants to serve VIPs, each bank will periodically send VIP files to UnionPay or other qualified merchants. In order to ensure the security of the VIP file transmission on the network, not only the VIP file is kept secret, but also the card number of each VIP client in the VIP file is encrypted. Therefore, the important information in the VIP file is the card number of the VIP client, as long as The content is encrypted, even if the VIP file is stolen. Therefore, for To prevent the VIP client card number from being stolen, it is necessary to encrypt the VIP card number during the transmission.

The encryption algorithm for designing the VIP account master account is as follows:

The main account is composed of numbers. Since the card numbers are directly composed of numbers, they can be directly converted to hexadecimal. There is no need for an intermediate transition of ASCII, which is different from the Internet payment password. Therefore, it designs the structure of the encrypted data block to be similar to the format of the online PIN, but the length of the primary account is much larger than the online PIN, so it is still different in the specific implementation, and the format is as follows:

Table 4

Note 1: N is the length of the VIPPAN (4 - bit)

Note 2: P is a 4-bit binary VIPPAN digital

Note 3: P/F is 4-bit binary VIPPAN digital /FILLER

Note 4: F is 4-bit % B 1111 ( FILLER )

To sum it up, the format is:

Its character set is:

Table 6

VIP main account character (abbreviated as: VIPPAN) binary representation

0 0000

1 0001 4 0100

5 0101

6 0110

7 0111

8 1000

9 1001

An example is as follows:

Clear text VIPPAN: 1234567890123456789

Then VIPPAN BLOCK is:

0x19 0x12 0x34 0x56 0x78 0x90 0x12 0x34 0x56 0x78 0x9F OxFF OxFF OxFF OxFF OxFF

This defines a conversion method: Convert the "12" correspondence to "0x12", which converts the two-byte ASCII characters into one-byte hexadecimal characters. Of course, other feasible conversion methods can also be used to directly convert the VIP account number of the VIP file into a hexadecimal digit string.

The encryption key is generated by a key generation method similar to the file calibration code. Each time the file is generated, the encryption key is randomly generated at the same time (the generation of the key is also different from that of the Internet, here every time Randomly generated, this is in consideration of how the file is maintained by the key. The key of the Internet is stored in advance and will not change for a certain period of time, and is stored in a special section of the VIP file. After receiving the VIP file, the receiver first takes out the key and then uses the key to decrypt the VIP primary account ciphertext. In order to ensure the security of the data, the key used is a mega-long key, and the calculation algorithm used is a double-length encryption algorithm.

The VIP primary account ciphertext calculated by the mega-long encryption algorithm is actually only 16 bytes, and most of them are invisible characters. In order to make it a visible character, a binary representation to an ASCII code representation is also required, that is, Each byte first converts the 8-bit binary number into two 4-bit hexadecimal numbers, and then converts each 4-bit hexadecimal number to its corresponding 8 bits. Bit ASCII code, eventually available in file and screen Displayed on.

An example is as follows:

If the calculated one byte is 11110001, the corresponding hexadecimal number is "F1", and then the two hexadecimal numbers "F1" are converted into ASCII characters "F" and T. Finally, one invisible number of bytes 11110001 is converted to two visible characters "F" and "1".

The process of decrypting the received file by the receiving end is the reverse process of the foregoing process, and the description of the device is as follows:

The receiving end first converts the account data in the form of ASCII code according to the reverse step corresponding to step (4);

Then, decrypting the converted data by using a corresponding decryption algorithm;

Finally, the decrypted data is decoded according to the inverse step corresponding to step (1), and the original data that needs to be encrypted is obtained.

The above disclosure is only a few specific embodiments of the present invention, but the present invention is not limited thereto, and any changes that can be made by those skilled in the art should fall within the protection scope of the present invention.

Claims

Rights request

A method for secure transmission of data, comprising:

(1) The sender converts the data that needs to be encrypted first into ASCII code, and then converts each character in the ASCII code into a corresponding hexadecimal to form a fixed-format encrypted data block;

(2) The transmitting end encrypts and transmits the data including the encrypted data block;

(3) The receiving end decrypts the received data first, and then decodes the heavily encrypted data block according to the step corresponding to step (1) to obtain data that needs to be encrypted.

2. The method of secure transmission of data according to claim 1, wherein in step (2), encryption is performed using a double length or a single long encryption algorithm.

The method of secure transmission of data according to claim 1, wherein in step (1), the encrypted data block includes the length of the data to be emphasized.

The method for secure transmission of data according to claim 1 or 3, wherein the data to be encrypted is an internet payment password, and in step (2), the encryption key of the PIN is used for encryption, the step ( 3) The corresponding decryption key is used for decryption.

5. A method for secure transmission of data, characterized by comprising:

(1) The sender will convert the data that needs to be encrypted first into hexadecimal, and form a fixed format of the encrypted data block;

6. The method of secure transmission of data according to claim 5, wherein in step (2), encryption is performed using a double length or a single long encryption algorithm.

The method for secure transmission of data according to claim 6, wherein the step (2) further comprises: converting the binary number of each byte of the invisible character obtained by encrypting the double-length encryption algorithm into two Hexadecimal, then convert two hexadecimal numbers into visible ASCII code, or, The binary number in each byte of all data obtained by encrypting the double-length encryption algorithm is converted into two hexadecimal numbers, and then the two hexadecimal numbers are converted into visible ASCII codes.

The method for secure transmission of data according to claim 6, wherein the step (2) further comprises: generating an encryption key by using a key generation method of the file calibration-risk code, and the sender encrypts the key Send to the receiving end.

9. A method of securely transmitting data, characterized by comprising:

(1) The sender converts the original data that needs to be encrypted with emphasis into a unified code;

(2) The transmitting end encrypts and transmits the data including the unified encoding;

(3) The receiving end decrypts the received data first, and then decodes the unified encoded data according to the step corresponding to step (1) to obtain original data that needs to be encrypted.

10. The method of secure transmission of data according to claim 9, wherein the conversion of the original data into the unified coding is specifically:

Raw data that needs to be encrypted is first converted into ASCII code, and then each character in the ASCII code is converted into a corresponding hexadecimal code to form a fixed-format encrypted data block; or

The data that needs to be encrypted is first converted into hexadecimal, which constitutes a fixed-format cryptographic data block.

The method for secure transmission of data according to claim 9, wherein if the transmitting end and the receiving end are a local area network, the unified encoding of the encrypted processing is transmitted inside the local area network, instead of requiring emphasis on encryption. Raw data.

12. A method for file transfer in a local area network, wherein the file includes account data using a digital representation, and the method includes:

(2) The sender encrypts the data containing the encrypted data block;

(3) The sender converts the binary number in each byte of the encrypted data into two hexadecimal numbers, and then converts the two hexadecimal numbers into a visible ASCII code form; (4) The sender sends a file containing account data converted into ASCII code;