WO2022052859A1 - 一种数据传输方法及数据传输设备 - Google Patents

一种数据传输方法及数据传输设备 Download PDF

Info

Publication number
WO2022052859A1
WO2022052859A1 PCT/CN2021/116235 CN2021116235W WO2022052859A1 WO 2022052859 A1 WO2022052859 A1 WO 2022052859A1 CN 2021116235 W CN2021116235 W CN 2021116235W WO 2022052859 A1 WO2022052859 A1 WO 2022052859A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
hash value
length
module
data block
Prior art date
Application number
PCT/CN2021/116235
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US17/785,978 priority Critical patent/US20230336354A1/en
Publication of WO2022052859A1 publication Critical patent/WO2022052859A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD

Definitions

  • the invention relates to a data transmission method and a data transmission device, belonging to the field of information security.
  • the data to be transmitted may be tampered with or intercepted, and the integrity and security of the data transmission process cannot be guaranteed. integrity, may jeopardize the security of the user's account or property.
  • the purpose of the present invention is to provide a data transmission method, which can make data transmission more secure and efficient.
  • Another object of the present invention is to provide a data transmission device, which can make data transmission more secure and efficient.
  • a data transmission method comprising:
  • Step s1 the device is powered on, waiting to receive the first data sent by the upper computer, and when the first data is received, parse the first data to obtain the first content hash value, the first hash value and the first length;
  • Step s2 The device performs signature verification on the first data according to the first public key stored by itself, and determines whether the signature verification is successful. If yes, returns a signature verification success response to the upper computer, and executes step s3; otherwise, returns the signature verification to the upper computer. failure response, end;
  • Step s3 The device waits to receive the data block sent by the host computer. When the data block is received, it verifies the currently received data block according to the first hash value and the first length, and judges whether the verification is successful. If so, execute the steps s4; otherwise, return the verification failure response to the upper computer, and end;
  • Step s4 The device parses the currently received data block to obtain the payload data, the second length and the second hash value, decrypts the payload data to obtain the plaintext of the payload data, saves the plaintext of the payload data, and determines whether the second length is the first If it is the default value, perform step s5; otherwise, return a data block verification success response to the upper computer, replace the first length with the second length, replace the first hash value with the second hash value, and return to step s3; And
  • Step s5 The device performs a hash operation on the plaintext of the payload data to obtain the second content hash value, and determines whether the first content hash value is equal to the second content hash value. If so, it is determined that the data transmission is successful, and the data is returned to the upper computer. The transmission is successful and the response is ended; otherwise, it is determined that the data transmission fails, and the data transmission failure response is returned to the upper computer, and the end.
  • step s1 specifically includes:
  • the device is powered on and waits to receive the first data sent by the host computer.
  • the first data parses the first data to obtain the first hash value, the first length, the first signature value, the initial vector and the first content hash value. .
  • the device performing signature verification on the first data according to the first public key stored by itself specifically includes:
  • Step s2-1 the device sequentially splices the first hash value, the first length, the initial vector and the first content hash value to obtain spliced data, and performs a hash operation on the spliced data to obtain a first hash operation result;
  • Step s2-2 the device uses the first public key stored by itself to decrypt the first signature value to obtain the first decrypted value;
  • Step s2-3 The device determines whether the result of the first hash operation is the same as the first decrypted value, and if so, the first data signature verification succeeds; otherwise, the first data signature verification fails.
  • step s3 the currently received data block is verified according to the first hash value and the first length, and judging whether the verification is successful specifically includes:
  • Step s3-1 the device obtains the length of the currently received data block, and calculates the hash value of the currently received data block;
  • Step s3-2 the device judges whether the length of the currently received data block is the same as the first length, and if so, executes step s3-3; otherwise, the currently received data block verification fails;
  • Step s3-3 the device determines whether the hash value of the second data is the same as the first hash value, if so, the verification of the second data succeeds; otherwise, the verification of the second data fails.
  • the method further includes: the device decrypts the payload data ciphertext in the currently received data block to obtain the payload plaintext.
  • step s4 further includes:
  • the device judges whether the second hash value is the second preset value, if so, the data transmission is successful, and returns a successful data transmission response to the upper computer, ending; otherwise, it returns an error response to the upper computer, ending.
  • a data transmission device comprising:
  • the receiving module is used to receive the first data sent by the upper computer after the device is turned on;
  • a parsing module configured to parse the first data to obtain a first content hash value, a first hash value and a first length when the receiving module receives the first data
  • a signature verification module configured to perform signature verification on the first data received by the receiving module according to the first public key stored by the device itself, determine whether the signature verification is successful, and trigger the return module;
  • the returning module is used to return a successful signature verification response to the upper computer when the signature verification module determines that the first data signature verification is successful; and is also used to return the verification verification to the upper computer when the signature verification module determines that the first data signature verification fails. Sign failure response;
  • the receiving module is also used to receive the data block sent by the upper computer
  • the verification module is used to verify the currently received data block according to the first hash value and the first length obtained by the parsing module when the receiving module receives the data block sent by the host computer, to determine whether the verification is successful, and if so, trigger the Parse the module; otherwise, trigger the return module;
  • the parsing module is further configured to parse the currently received data block to obtain payload data, the second length and the second hash value when the receiving module receives the data block;
  • a decryption module for decrypting the payload data obtained by the parsing module to obtain plaintext of the payload data
  • the saving module is used to save the plaintext of the payload data obtained by the decryption module
  • a judging module for judging whether the second length is the first preset value, and if so, triggering the hash module; otherwise, triggering the return module and the replacement module;
  • the replacement module is configured to replace the first length with the second length and replace the first hash value with the second hash value when the judgment module judges that the second length is not the first preset value, and trigger the receiving module;
  • the hash module is configured to perform a hash operation on the plaintext of the payload data to obtain a second content hash value when the determination module determines that the second length is the first preset value;
  • the judgment module is further configured to judge whether the first content hash value is equal to the second content hash value after the hash module obtains the second content hash value.
  • the parsing module is specifically configured to parse the first data to obtain a first hash value, a first length, a first signature value, an initial vector and a first content hash value when the receiving module receives the first data.
  • the signature verification module includes:
  • a splicing sub-module for splicing the first hash value, the first length, the initial vector and the first content hash value to obtain the splicing data
  • a hash submodule configured to perform a hash operation on the spliced data obtained by the splicing submodule to obtain a first hash operation result
  • a decryption submodule used for decrypting the first signature value using the first public key stored by itself to obtain the first decrypted value
  • a first judgment submodule used for judging whether the first hash operation result is the same as the first decrypted value
  • the verification module includes:
  • the second judgment submodule is used to judge whether the length of the currently received data block obtained by the acquisition submodule is the same as the first length
  • the calculation submodule is used to calculate the hash value of the currently received data block
  • the second judgment submodule is further configured to judge whether the hash value of the currently received data block is the same as the first hash value.
  • the judgment module is further configured to judge whether the second hash value is the second preset value after judging that the second length is the first preset value.
  • FIG. 1 is a flowchart of a data transmission method according to Embodiment 1 of the present invention.
  • FIG. 2 is a flowchart of a data transmission method according to Embodiment 2 of the present invention.
  • FIG. 3 is a block diagram of a data transmission device according to Embodiment 3 of the present invention.
  • a data transmission method is provided, as shown in FIG. 1 , including:
  • Step s101 the device is powered on, waiting to receive the first data sent by the host computer, and when the first data is received, parse the first data to obtain a first hash value and a first length;
  • step s101 is specifically as follows: the device is powered on, waiting for the data header sent by the host computer to be received, and when the data header is received, parsing the received data header to obtain the first hash value, the first length, the first signature value, the initial a vector (ICV) and the first content hash value;
  • the first hash value is the hash value of the next data block in the data to be transmitted; the first length is the length of the next data block in the data to be transmitted; the first signature value is the private key pair used by the host computer The signature value obtained by signing all the data after the first signature value stored in the data header; the first content hash value is the hash value obtained by the upper computer performing hash operation on all payload data that needs to be transmitted to the device;
  • the data header includes: a first signature value, a first hash value, a first length, an ICV and a first content hash value.
  • Step s102 the device performs signature verification on the first data according to the first public key stored by itself, and determines whether the signature verification is successful, and if so, executes step s103; otherwise, returns a signature verification failure response to the upper computer, and ends;
  • the device performing signature verification on the first data according to the first public key stored by itself specifically includes:
  • Step s102-1 The device sequentially splices the first hash value, the first length, the ICV and the first content hash value to obtain spliced data, and performs a hash operation on the spliced data to obtain a first hash operation result;
  • the device sequentially splices the hash values of the next data block A5 3A 74 A9 F0 F7 A0 49 41 86 E7 6F 02 9DD8 45 6F 3E 98 5F 7F FA E2 78 88 32 CB A3 6B 2A 3F 91, the next data block
  • A4 8F FC E7F7 DF 23 8C 17 A0 0F E7 1C F4 8F 6F B2 6F 8B 0A 7C 17 Get the spliced data, perform hash operation on the spliced data, and get the first hash operation result:
  • Step s102-2 the device uses the RSA public key stored by itself to decrypt the first signature value to obtain the first decrypted value;
  • the device uses the RSA public keys 0xc8, 0xef, 0x98, 0xfe, 0x7e, 0xc2, 0x69, 0x79, 0x59, 0xa3, 0x6c, 0x1c, 0x13, 0x9b, 0xf6, 0x0b, 0x55, 0x2f, 0xcd, 0xbb, 0xf2, 0x57,0x7c,0x67,0xef,0x3d,0xaa,0xee,0x60,0xa8,0x3a,0x1d,0x9c,0xba,0x16,0xb7,0xc6,0xe1,0x80,0x5c,0xe1,0x44,0xcd,0xc3,0xf4,0x4d, 0x67,0xb4,0x32,0x32,
  • Step s102-3 The device determines whether the result of the first hash operation is the same as the first decryption value, and if so, the first data signature verification succeeds; otherwise, the first data signature verification fails.
  • Step s103 the device waits to receive the data block sent by the host computer, and when receiving the data block, verifies the received current data block according to the first hash value and the first length, and judges whether the verification is successful, and if so, execute the steps s104; otherwise, return a verification failure response to the upper computer, and end;
  • verifying the received current data block according to the first hash value and the first length, and judging whether the verification is successful specifically includes:
  • Step s103-1 the device obtains the length of the received current data block, and calculates the hash value of the received current data block;
  • Step s103-2 the device judges whether the length of the currently received data block is the same as the first length, and if so, executes step s103-3; otherwise, the verification of the received current data block fails;
  • Step s103-3 The device determines whether the received hash value of the current data block is the same as the first hash value, if so, the received current data block is successfully verified; otherwise, the received current data block signature verification fails.
  • the payload data in the current data block may be encrypted, and when the payload data is encrypted data, after the current data block is successfully verified, before step s104 is performed, step s103 further Including: decrypting the payload data in the current data block to obtain the payload data plaintext.
  • Step s104 The device parses the current data block to obtain the payload data, the second length and the second hash value, saves the payload data, and determines whether the second length is the first preset value. If so, the data transmission is successful, and the upper computer Return data transmission success response, end; otherwise, return the current data block verification success response to the upper computer, replace the first length with the second length, replace the first hash value with the second hash value, and return to step s103.
  • step s104 further includes: the device determines whether the second hash value is the second preset value, if so, the data transmission is successful, and returns the data transmission to the upper computer If it responds successfully, it ends; otherwise, it returns an error response to the upper computer, and it ends.
  • step s104 further includes:
  • the device performs a hash operation on the received payload data to obtain the second content hash value, and determines whether the second content hash value is equal to the first content hash value. If so, the data transmission is successful, and the upper computer returns the successful data transmission. Response, end; otherwise, data transmission failure, return data transmission failure response to the upper computer, end.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • a data transmission method is provided, as shown in FIG. 2 , including:
  • Step s201 the device is powered on, waiting to receive the first data sent by the host computer, and when receiving the first data, analyze the first data to obtain the first hash value and the first length;
  • step s201 is specifically: the device is powered on, waiting to receive the data header sent by the host computer, and when the data header is received, parse the data header to obtain the first signature value, and obtain the hash value of the next data block as the first hash value value, obtain the length of the next data block as the first length, obtain the ICV and the first content hash value (ContentHash);
  • the first signature value is the signature value obtained by the host computer signing all the data after the first signature value stored in the data header with the private key
  • the first content hash value is the host computer's data that needs to be transmitted to the device The hash value obtained by the hash operation
  • the data header received by the device is: C0 49 34 46 8B B9 66 16 B4 32 CA E8 06 5E 6C 46 FD 38 A0 F0 99 66 5D FF 11 77 40 99 03 E5 5E A8 03 1C 60 3E DD 3F DA 7A F2 CC D3 0C F2 C6 C6 D2 9E 59 03 56 43 B3 5A 28 F6 52 A3 1C 07 B9 11 D8 63 CB 1B 29 6F 13 8C 09 12 90 4C 07 E5 28 87 BD 3 B 06 DD 68 BE7 BD 1F AB DD 68 BE7 BA 80 BD 36 8A 2B E8 B2 15 02 11 31 0F 5E 7D 59 7B FC 57 E1 28 7A 8C 50 51 A4 ED 9D 8C 8D F8 B4 15 C6 D0 BB 96 64 E1 D6 1 1 1 1 6 4 E1 D6 1 1 1 1 2 0 0 54 74 B
  • the first hash value is: A5 3A 74 A9 F0 F7 A0 49 41 86 E7 6F 02 9D D8 45 6F 3E 98 5F 7F FA E2 78 88 32 CB A3 6B 2A 3F 91;
  • the first length is: 00 E2;
  • ICV is: 6E 49 48 9F 0A FE D7 0A 50 60 32 1C DC D5 8B BE
  • the hash value of the first content is: E9 76 D4 2B 76 EE 99 24 A0 19 A4 8F FC E7 F7 DF 23 8C 17 A0 0F E7 1C F4 8F 6F B2 6F 8B 0A 7C 17;
  • Step s202 the device performs signature verification on the first data according to the first public key stored by itself, and determines whether the signature verification is successful, and if so, executes step s203; otherwise, returns a signature verification failure response to the upper computer, and ends;
  • step s202 is specifically: the device uses the RSA public key stored in the device to perform an RSA signature verification operation on the acquired first hash value, first length, first signature value, ICV and first content hash value , determine whether the signature verification result is successful signature verification, if yes, save the data header, and execute step s203; otherwise, return a signature verification failure response to the upper computer, and end.
  • Step s203 the device waits to receive the data block sent by the host computer, when receiving the data block sent by the host computer, the received data block is used as the second data, and the second data is verified according to the first hash value and the first length, Determine whether the verification is successful, if so, decrypt the payload data in the second data to obtain and save the plaintext of the payload data, and execute step s204; otherwise, return a verification failure response to the host, and end;
  • step s203 is specifically as follows: the device waits to receive the data block sent by the host computer, and when receiving the data block sent by the host computer, takes the received data block as the current data block, according to the first hash value and the first length. Verify the current data block, determine whether the verification is successful, if so, decrypt the payload data in the current data block, obtain and save the payload data plaintext in the plaintext of the current data block, and execute step s204; otherwise, return a verification failure response to the host, end ;
  • step s203 the current data block is verified according to the first hash value and the first length, and judging whether the verification is successful specifically includes:
  • Step s203-1 The device uses the received data block as the current data block, calculates the length of the current data block, and judges whether the first length is the same as the length of the current data block, if so, execute step s203-2; otherwise, the current data block block validation failed;
  • Step s203-2 The device calculates the hash value of the current data block, and determines whether the hash value of the current data block is equal to the first hash value, if so, the current data block is successfully verified; otherwise, the current data block verification fails.
  • Step s204 the device parses the second data, obtains the length of the next data block and the hash value of the next data block, and judges whether the length of the next data block is the first preset value, if so, execute step s205; otherwise, Return the verification success response to the upper computer, replace the first length with the obtained length of the next data block, replace the first hash value with the obtained hash value of the next data block, and return to step s203;
  • step s204 specifically includes: the device parses the current data block, obtains the length of the next data block and the hash value of the next data block, determines whether the length of the next data block is 0, and if so, executes step s205; otherwise , returns a verification success response to the upper computer, replaces the first length with the obtained length of the next data block, replaces the first hash value with the obtained hash value of the next data block, and returns to step s203;
  • Step s205 the device judges whether the hash value of the next data block is the second preset value, if so, the current data block is the last data block, and executes step s206; otherwise, returns an error response to the upper computer, and ends;
  • step s205 is specifically as follows: the device determines whether the hash value of the next data block is 0xE3, 0xB0, 0xC4, 0x42, 0x98, 0xFC, 0x1C, 0x14, 0x9A, 0xFB, 0xF4, 0xC8, 0x99, 0x6F, 0xB9, 0x24, 0x27, 0xAE, 0x41, 0xE4, 0x64, 0x9B, 0x93, 0x4C, 0xA4, 0x95, 0x99, 0x1B, 0x78, 0x52, 0xB8, 0x55, if yes, the current data block is the last data block, and step s206 is executed; Otherwise, return an error response to the upper computer.
  • Step s206 The device performs a hash operation on all the received payload data to obtain a second content hash value, and determines whether the second content hash value is equal to the first content hash value. If so, it is determined that the data transmission is successful, and the upper The computer returns a data transmission success response, and ends; otherwise, it determines that the data transmission fails, and returns a data transmission failure response to the upper computer, and ends.
  • a data transmission device is provided, as shown in FIG. 3 , including:
  • the receiving module 301 is used for receiving the first data sent by the upper computer after the device is turned on;
  • the parsing module 302 is configured to parse the first data to obtain the first content hash value, the first hash value and the first length when the receiving module 301 receives the first data;
  • the signature verification module 303 is configured to verify the first data received by the receiving module 301 according to the first public key stored by the device itself, determine whether the signature verification is successful, and trigger the return module 304;
  • the return module 304 is used to return a successful signature verification response to the upper computer when the signature verification module 303 determines that the signature verification of the first data is successful; and is also used to return the signature verification success response to the upper computer when the verification module 303 determines that the signature verification of the first data fails. Return signature verification failure response;
  • the receiving module 301 is also used for receiving the data block sent by the upper computer;
  • the verification module 305 is used to verify the currently received data block according to the first hash value and the first length obtained by the parsing module 302 when the receiving module 301 receives the data block sent by the host computer, and judge whether the verification is successful, if Yes, trigger the parsing module 302; otherwise, trigger the return module 304;
  • the parsing module 302 is further configured to parse the currently received data block to obtain the payload data, the second length and the second hash value when the receiving module 301 receives the data block;
  • the decryption module 306 is used for decrypting the payload data obtained by the parsing module 302 to obtain the plaintext of the payload data;
  • the saving module 307 is used for saving the plaintext of the payload data obtained by the decryption module 306;
  • the judgment module 308 is used to judge whether the second length is the first preset value, if so, trigger the hash module 309; otherwise, trigger the return module 304 and the replacement module 310;
  • the replacement module 310 is configured to replace the first length with the second length and replace the second length with the second hash value when the judgment module 308 judges that the second length is not the first preset value. the first hash value, triggering the receiving module 301;
  • the hash module 309 is configured to perform a hash operation on the plaintext of the payload data to obtain the second content hash value when the determination module 308 determines that the second length is the first preset value;
  • the judgment module 308 is further configured to judge whether the first content hash value is equal to the second content hash value after the hash module 309 obtains the second content hash value.
  • the parsing module 302 is specifically configured to, when the receiving module 301 receives the first data, parse the first data to obtain the first hash value, the first length, the first signature value, and the initial vector and the first content hash value.
  • the signature verification module 303 includes:
  • a splicing submodule configured to splicing the first hash value, the first length, the initial vector and the first content hash value to obtain splicing data
  • a hash submodule configured to perform a hash operation on the spliced data obtained by the splicing submodule to obtain a first hash operation result
  • a decryption submodule configured to decrypt the first signature value using the first public key stored by itself to obtain a first decrypted value
  • a first judging submodule for judging whether the first hash operation result is the same as the first decryption value
  • the verification module 305 includes:
  • the second judging submodule is used for judging whether the length of the currently received data block obtained by the obtaining submodule is the same as the first length
  • the second judgment submodule is further configured to judge whether the currently received hash value of the data block is the same as the first hash value.
  • the judging module 308 is further configured to judge whether the second hash value is a second preset value after judging that the second length is a first preset value.

Abstract

一种数据传输方法，包括：当设备接收到上位机发送的第一数据时，解析第一数据获取第一内容哈希值、第一哈希值和第一长度，根据储存的第一公钥对第一数据进行验签，当验签成功时，等待接收上位机发送的数据块，当接收到数据块时，根据第一哈希值和第一长度验证数据块，当数据块验证成功时，解析当前数据块获得下一数据块的长度和哈希值以及当前数据块的有效载荷数据，解密有效载荷数据得到有效载荷数据明文。根据本发明的技术方案，数据传输的过程更加安全与高效。

Description

一种数据传输方法及数据传输设备 技术领域
本发明涉及一种数据传输方法及数据传输设备，属于信息安全领域。
背景技术
现有技术中，由上位机向设备传输数据的过程中，需要传输的数据可能会被篡改或者截获，无法保证数据传输过程中的完整性和安全性，如果数据的安全性降低或者无法保证数据的完整性，可能会危及用户的账户或者财产的安全。
发明内容
本发明的目的是提供一种数据传输方法，其可以使得数据传输更加安全和高效。
本发明的另外一个目的是提供一种数据传输设备，其可以使得数据传输更加安全和高效。
为此，根据本发明的一个方面，提供了一种数据传输方法，包括：
步骤s1：设备开机，等待接收上位机发送的第一数据，当接收到第一数据时，解析第一数据获取第一内容哈希值、第一哈希值和第一长度；
步骤s2：设备根据自身储存的第一公钥对第一数据进行验签，判断是否验签成功，如果是，向上位机返回验签成功响应，执行步骤s3；否则，向上位机返回验签失败响应，结束；
步骤s3：设备等待接收上位机发送的数据块，当接收到数据块时，根据第一哈希值和第一长度对当前接收到的数据块进行验证，判断是否验证成功，如果是，执行步骤s4；否则，向上位机返回验证失败响应，结束；
步骤s4：设备解析当前接收到的数据块获取有效载荷数据、第二长度和第二哈希值，解密有效载荷数据得到有效载荷数据明文，保存有效载荷数据明文，判断第二长度是否为第一预设值，如果是，执行步骤s5；否则，向上位机返回数据块验证成功响应，用第二长度替换第一长度，用第二哈希值替换第一哈希值，返回步骤s3；以及
步骤s5：设备对有效载荷数据明文作哈希运算得到第二内容哈希值，判断第一内容哈希值是否等于第二内容哈希值，如果是，判定数据传输成功，向上位机返回数据传输成功响应，结束；否则，判定数据传输失败，向上位机返回数据传输失败响应，结束。
优选地，步骤s1具体包括：
设备开机，等待接收上位机发送的第一数据，当接收到第一数据时，解析第一数据获取第一哈希值、第一长度、第一签名值、初始向量以及第一内容哈希值。
优选地，步骤s2中设备根据自身储存的第一公钥对第一数据进行验签具体包括：
步骤s2-1、设备顺序拼接第一哈希值、第一长度、初始向量以及第一内容哈希值得到拼接数据，对拼接数据进行哈希运算得到第一哈希运算结果；
步骤s2-2、设备使用自身储存的第一公钥对第一签名值进行解密获得第一解密值；以及
步骤s2-3：设备判断第一哈希运算结果与第一解密值是否相同，如果是，第一数据验签成功；否则，第一数据验签失败。
优选地，步骤s3中根据第一哈希值和第一长度对当前接收的数据块进行验证，判断是否验证成功具体包括：
步骤s3-1、设备获取当前接收的数据块的长度，并计算当前接收的数据块的哈希值；
步骤s3-2、设备判断当前接收的数据块的长度和第一长度是否相同，如果是，执行步骤s3-3；否则，当前接收的数据块验证失败；以及
步骤s3-3、设备判断第二数据的哈希值和第一哈希值是否相同，如果是，第二数据验证成功；否则，第二数据验证失败。
优选地，步骤s4中，保存有效载荷数据之前，还包括：设备解密当前接收的数据块中的有效载荷数据密文获取有效载荷明文。
优选地，判断出第二长度为第一预设值后，步骤s4还包括：
设备判断第二哈希值是否为第二预设值，如果是，数据传输成功，向上位机返回数据传输成功响应，结束；否则，向上位机返回错误响应，结束。
根据本发明另外一个方面，提供一种数据传输设备，包括：
接收模块，用于设备开机后，接收上位机发送的第一数据；
解析模块，用于当接收模块接收到第一数据时，解析第一数据获取第一内容哈希值、第一哈希值和第一长度；
验签模块，用于根据设备自身储存的第一公钥对接收模块接收到的第一数据进行验签，判断是否验签成功，触发返回模块；
返回模块，用于当验签模块判断出第一数据验签成功时，向上位机返回验签成功响应；还用于当验签模块判断出第一数据验签失败时，向上位机返回验签失败响应；
接收模块还用于接收上位机发送的数据块；
验证模块，用于当接收模块接收到上位机发送的数据块时，根据解析模块获取的第一哈希值和第一长度对当前接收的数据块进行验证，判断是否验证成功，如果是，触发解析模块；否则，触发返回模块；
解析模块还用于当接收模块接收到数据块时，解析当前接收到的数据块获取有效载荷数据、第二长度和第二哈希值；
解密模块，用于解密所述解析模块获取的有效载荷数据得到有效载荷数据明文；
保存模块，用于保存解密模块得到的有效载荷数据明文；
判断模块，用于判断第二长度是否为第一预设值，如果是，触发哈希模块；否则，触发返回模块和替换模块；
替换模块用于当判断模块判断出第二长度不为第一预设值时，用第二长度替换第一长度，用第二哈希值替换第一哈希值，触发接收模块；
哈希模块用于当判断模块判断出第二长度为第一预设值时，对有效载荷数据明文作哈希运算得到第二内容哈希值；以及
判断模块还用于当哈希模块得到第二内容哈希值后，判断第一内容哈希值是否等于第二内容哈希值。
优选地，解析模块具体用于当接收模块接收到第一数据时，解析第一数据获取第一哈希值、第一长度、第一签名值、初始向量以及第一内容哈希值。
优选地，验签模块包括：
拼接子模块，用于拼接第一哈希值、第一长度、初始向量以及第一内容哈希值得到拼接数据；
哈希子模块，用于对拼接子模块得到的拼接数据进行哈希运算得到第一哈希运算结果；
解密子模块，用于使用自身储存的第一公钥对第一签名值进行解密得到第一解密值；
第一判断子模块，用于判断第一哈希运算结果与第一解密值是否相同；
优选地，验证模块包括：
获取子模块，用于获取当前接收的数据块的长度；
第二判断子模块，用于判断获取子模块获取到的当前接收的数据块的长度和第一长度是否相同；
计算子模块，用于计算当前接收到的数据块的哈希值；
第二判断子模块还用于判断当前接收到的数据块的哈希值和第一哈希值是否相同。
优选地，判断模块还用于当判断出第二长度为第一预设值后，判断第二哈希值是否为第二预设值。
根据本发明的技术方案，可以使得数据传输更加安全和高效。
附图说明
图1为根据本发明实施例1的数据传输方法的流程图；
图2为根据本发明实施例2的数据传输方法的流程图；
图3为根据本发明实施例3的数据传输设备的方框图。
具体实施方式
下面将结合附图，对本发明的实施例进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明的一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一：
根据本发明实施例一，提供一种数据传输方法，如图1所示，包括：
步骤s101：设备开机，等待接收上位机发送的第一数据，当接收到第一数据时，解析第一数据获取第一哈希值和第一长度；
优选地，步骤s101具体为：设备开机，等待接收上位机发送的数据头，当接收到数据头时，解析接收到的数据头获取第一哈希值、第一长度、第一签名值、初始向量(ICV)以及第一内容哈希值；
优选地，第一哈希值为需要传输的数据中下一数据块的哈希值；第一长度为需要传输的数据中下一数据块的长度；第一签名值为上位机用私钥对存储在数据头中第一签名值后面的所有数据进行签名得到的签名值；第一内容哈希值为上位机对所有需要传输到设备的有效载荷数据进行哈希运算得到的哈希值；
优选地，数据头包括：第一签名值、第一哈希值、第一长度、ICV以及第一内容哈希值。
步骤s102：设备根据自身储存的第一公钥对第一数据进行验签，判断是否验签成功，如果是，执行步骤s103；否则，向上位机返回验签失败响应，结束；
优选地，步骤s102中设备根据自身储存的第一公钥对第一数据进行验签具体包括：
步骤s102-1：设备顺序拼接第一哈希值、第一长度、ICV以及第一内容哈希值得到拼接数据，对拼接数据进行哈希运算得到第一哈希运算结果；
具体地，设备顺序拼接下一数据块的哈希值A5 3A 74 A9 F0 F7 A0 49 41 86 E7 6F 02 9DD8 45 6F 3E 98 5F 7F FA E2 78 88 32 CB A3 6B 2A 3F 91、下一数据块的长度00 E2、ICV 6E 49 48 9F 0A FE D7 0A 50 60 32 1C DC D58B BE以及第一内容哈希值E9 76 D4 2B 76 EE 99 24 A0 19 A4 8F FC E7F7 DF 23 8C 17 A0 0F E7 1C F4 8F 6F B2 6F 8B 0A 7C 17得到拼接数据，对拼接数据进行哈希运算，得到第一哈希运算结果：
E4FF5E7D7A7F08E9800A3E25CB774533CB20040DF30B6BA10F956F9ACD0EB3F7；
步骤s102-2：设备使用自身储存的RSA公钥对第一签名值进行解密，获得第一解密值；
具体地，设备使用RSA公钥0xc8,0xef,0x98,0xfe,0x7e,0xc2,0x69,0x79,0x59,0xa3,0x6c,0x1c,0x13,0x9b,0xf6,0x0b,0x55,0x2f,0xcd,0xbb,0xf2,0x57,0x7c,0x67,0xef,0x3d,0xaa,0xee,0x60,0xa8,0x3a,0x1d,0x9c,0xba,0x16,0xb7,0xc6,0xe1,0x80,0x5c,0xe1,0x44,0xcd,0xc3,0xf4,0x4d,0x67,0xb4,0x32,0x90,0xb4,0x8b,0x45,0x67,0xa7,0x3b,0x18,0xc1,0x58,0x99,0x66,0x33,0xee,0xdc,0xcf,0xe2,0x9d,0xae,0x78,0x8f,0x5b,0x91,0x0d,0xfa,0xa5,0x11,0xb2,0x4f,0x79,0xda,0x24,0x8d,0x32,0x1e,0x32,0x52,0xcc,0xc0,0xcc,0x1e,0x9d,0x27,0xc3,0xc0,0xe3,0x96,0xc5,0xa6,0x56,0x92,0xed,0x9f,0xaa,0xe2,0x3a,0x8b,0xd3,0x49,0x52,0xd0,0x0d,0x63,0xcd,0x93,0xb1,0x8b,0x72,0x9c,0x63,0x80,0xe3,0x71,0x94,0x04,0x0c,0x1c,0xb0,0x7d,0xf5,0x0b,0x07,0x84,0x60,0xd3,0xdf,0xf1,0xdb,0x5f,0xd0,0x0f,0x4a,0x02,0x60,0xf6,0xf7,0x72,0xe6,0xf4,0x60,0x2b,0x04,0xcd,0x95,0x65,0xce,0xbc,0x5b,0xf2,0x73,0x8e,0xcb,0x29,0x47,0x92,0xf7,0x8c,0x77,0x8c,0x93,0x30,0x15,0xca,0xc3,0x1f,0xe3,0x02,0x47,0x66,0x46,0x7a,0xb6,0x5b,0x01,0x53,0xb8,0x23,0xaf,0x99,0x3c,0x5c,0x1b,0x0d,0x78,0x46,0x6a,0xdb,0x67,0x2c,0xd0,0x6d,0x69,0x9f,0x5a,0x00,0xea,0x30,0x98,0xf1,0xa7,0xeb,0x1a,0xfd,0x0c,0x3a,0xa8,0xd1,0xc0,0x90,0xf9,0x19,0x97,0x8b,0xa4,0x00,0x33,0x4d,0xd2,0x31,0x84,0x55,0x1d,0x08,0x4f,0x4a,0x4d,0xda,0xf9,0xa4,0x8d,0x97,0x02,0x65,0x8c,0xe5,0x69,0x6c,0x17,0xb3,0xe8,0x25,0xf0,0x44,0xf4,0xbe,0x5a,0xcb,0xba,0x53,0xff,0xd2,0x2b,0xdc,0xd6,0xeb,0x4b,0x10,0xf6,0x0d,0x30, 0x13,0xb7,0xa2,0x0d,0xc6,0x93,0x58,0x04,0x5c,0xd9,0xa3,0xc2,0x38,0x65,0x14,0x93,0xb9,0x95,0xe9,0x2d,0x e9,0x03,0x58,0xb0,0x50,0x91,0x6f,0xbf,0xc0,0xa2,0x3e,0x9f,0xf5,0xe8,0x1b,0xf4,0x31,0x99,0x3d,0xc0,0x86,0x98,0x15,0x6c,0xe1,0x6f,0x99,0x16,0xb6,0x4c,0x54,0x4b,0xf0,0xd9,0xed,0xc7,0xc7,0x77,0x50,0xf3,0x22,0xf0,0x33,0xec,0x39,0x90,0x93,0xf0,0x75,0x9a,0xec,0x7f,0x0a,0xb7,0x13,0xe2,0xca,0x27,0x64,0x45,0xae,0x67,0xb5,0xc5,0xdd,0xb3,0xc1,0xc0,0x1a,0x1c,0xe0,0xf7,0x9d,0x66,0x55,0x7e,0x9b,0x01,0x3b,0x69,0x33,0xea,0x4a,0xed,0x36,0x56,0x16,0x9c,0x88,0x20,0x11,0x62,0xbb,0xf5,0x81对第一签名值C0 49 34 46 8B B9 66 16 B4 32 CA E8 06 5E 6C 46 FD 38 A0 F0 99 66 5D FF 11 77 40 99 03 E5 5E A8 03 1C 60 3E DD 3F DA 7A F2 CC D3 0C F2 C6 C6 D2 9E 59 03 56 43 B3 5A 28 F6 52 A3 1C 07 B9 11 D8 63 CB 1B 29 6F 13 8C 09 12 90 4C E5 28 87 BD 1F 06 68 BE BD 3B AB DD 10 17 07 BA 80 BD 36 8A 2B E8 B2 15 02 11 31 0F 5E 7D 59 7B FC 57 E1 28 7A 8C 50 51 A4 ED 9D 8C 8D F8 B4 15 C6 D0 BB 96 64 E1 D6 F7 3E 54 4E 38 D4 9D 77 61 10 B5 88 5E A4 3C 1B E2 DD EB 5F 43 4C C0 2A 4E DB 4C B3 B6 E8 15 EE A7 82 7B 82 94 1F F2 51 CE B5 81 70 0D F7 93 03 76 1C 84 5F B0 28 8E 64 42 60 84 4B B0 00 1F F6 63 DF 39 01 66 1C 04 F1 AD 45 07 1D 0C A3 84 0F E7 E1 89FD 26 9D 44 11 B1 0B 54 14 B7 82 44 D9 ED 68 09 75 B0 73 DD 59 43 42 43 9F 6E F0 3B AA 80 CF 80 90 58 13 5F FA 90 6C 0D 44 9B 25 87 93 F7 89 DF 8B FC 52 B0 DF CA C6 A0 FE B1 20 CF 7D 0C DD EE 9E CA B5 53 38 0D 78 DF 7A 35 97 76 A2 0B 93 7B 80 6F 25 1A 5A CF 6F BA 69 9C 43 9D 63 00 30 D9 FE C2 D8 CB 61 08 55 85 51 EF 21 AE C6 C6 F8 28 68 85 B8 22 34 B7 6C 65 71 C3 A1 B7 61 39 05 FA 2F D5 90 E2 B0 1C EF 74 E8 CF 6E 63 BC 70 D3 60 24 49 F5 4E F8 89 72 18 76 A2 27 52 97 22 88 C2 F8 71 E9 E1 C7 B9 FF 01 CA 84 8E解密，得到第一解密值；
步骤s102-3：设备判断第一哈希运算结果是否和第一解密值相同，如果是，第一数据验签成功；否则，第一数据验签失败。
步骤s103：设备等待接收上位机发送的数据块，当接收到数据块时，根据第一哈希值和第一长度对接收到的当前数据块进行验证，判断是否验证成功，如果是，执行步骤s104；否则，向上位机返回验证失败响应，结束；
优选地，根据第一哈希值和第一长度对接收到的当前数据块进行验证，判断是否验证成功具体包括：
步骤s103-1：设备获取接收到的当前数据块的长度，并计算接收到的当前数据块的哈希值；
步骤s103-2：设备判断当前接收到的数据块的长度和第一长度是否相同，如果是，执行步骤s103-3；否则，接收到的当前数据块验证失败；
步骤s103-3：设备判断接收到的当前数据块的哈希值和第一哈希值是否相同，如果是，接收到的当前数据块验证成功；否则，接收到的当前数据块验签失败。
优选地，设备接收到当前数据块时，当前数据块中的有效载荷数据可以是加密的，当有效载荷数据为加密的数据时，当当前数据块验证成功后，执行步骤s104之前，步骤s103还包括：解密当前数据块中的有效载荷数据得到有效载荷数据明文。
步骤s104：设备解析当前数据块获取有效载荷数据、第二长度和第二哈希值，保存有效载荷数据，判断第二长度是否为第一预设值，如果是，数据传输成功，向上位机返回数据传输成功响应，结束；否则，向上位机返回当前数据块验证成功响应，用第二长度替换第一长度，用第二哈希值替换第一哈希值，返回步骤s103。
优选地，当判断出第二长度为第一预设值时，步骤s104还包括：设备判断第二哈希值是否为第二预设值，如果是，数据传输成功，向上位机返回数据传输成功响应，结束；否则，向上位机返回错误响应，结束。
优选地，当判断出第二长度为第一预设值，第二哈希值为第二预设值时候，步骤s104还包括：
设备对收到的有效载荷数据作哈希运算得到第二内容哈希值，判断第二内容哈希值是否等于第一内容哈希值，如果是，数据传输成功，向上位机返回数据传输成功响应，结束；否则，数据传输失败，向上位机返回数据传输失败响应，结束。
实施例二：
根据本发明实施例二，提供一种数据传输方法，如图2所示，包括：
步骤s201：设备开机，等待接收上位机发送的第一数据，当接收到第一数据时，解析第 一数据获取第一哈希值和第一长度；
优选地，步骤s201具体为：设备开机，等待接收上位机发送的数据头，当接收到数据头时，解析数据头获取第一签名值、获取下一数据块的哈希值作为第一哈希值、获取下一数据块的长度作为第一长度、获取ICV以及第一内容哈希值(ContentHash)；
其中，第一签名值为上位机用私钥对存储在数据头中第一签名值后面的所有数据进行签名得到的签名值；第一内容哈希值为上位机对所有需要传输到设备的数据进行哈希运算得到的哈希值；
例如：设备接收到的数据头为：C0 49 34 46 8B B9 66 16 B4 32 CA E8 06 5E 6C 46 FD 38 A0 F0 99 66 5D FF 11 77 40 99 03 E5 5E A8 03 1C 60 3E DD 3F DA 7A F2 CC D3 0C F2 C6 C6 D2 9E 59 03 56 43 B3 5A 28 F6 52 A3 1C 07 B9 11 D8 63 CB 1B 29 6F 13 8C 09 12 90 4C E5 28 87 BD 1F 06 68 BE BD 3B AB DD 10 17 07 BA 80 BD 36 8A 2B E8 B2 15 02 11 31 0F 5E 7D 59 7B FC 57 E1 28 7A 8C 50 51 A4 ED 9D 8C 8D F8 B4 15 C6 D0 BB 96 64 E1 D6 F7 3E 54 4E 38 D4 9D 77 61 10 B5 88 5E A4 3C 1B E2 DD EB 5F 43 4C C0 2A 4E DB 4C B3 B6 E8 15 EE A7 82 7B 82 94 1F F2 51 CE B5 81 70 0D F7 93 03 76 1C 84 5F B0 28 8E 64 42 60 84 4B B0 00 1F F6 63 DF 39 01 66 1C 04 F1 AD 45 07 1D 0C A3 84 0F E7 E1 89 FD 26 9D 44 11 B1 0B 54 14 B7 82 44 D9 ED 68 09 75 B0 73 DD 59 43 42 43 9F 6E F0 3B AA 80 CF 80 90 58 13 5F FA 90 6C 0D 44 9B 25 87 93 F7 89 DF 8B FC 52 B0 DF CA C6 A0 FE B1 20 CF 7D 0C DD EE 9E CA B5 53 38 0D 78 DF 7A 35 97 76 A2 0B 93 7B 80 6F 25 1A 5A CF 6F BA 69 9C 43 9D 63 00 30 D9 FE C2 D8 CB 61 08 55 85 51 EF 21 AE C6 C6 F8 28 68 85 B8 22 34 B7 6C 65 71 C3 A1 B7 61 39 05 FA 2F D5 90 E2 B0 1C EF 74 E8 CF 6E 63 BC 70 D3 60 24 49 F5 4E F8 89 72 18 76 A2 27 52 97 22 88 C2 F8 71 E9 E1 C7 B9 FF 01 CA 84 8E A5 3A 74 A9 F0 F7 A0 49 41 86 E7 6F 02 9D D8 45 6F 3E 98 5F 7F FA E2 78 88 32 CB A3 6B 2A 3F 91 00 E26E 49 48 9F 0A FE D7 0A 50 60 32 1C DC D5 8B BE E9 76 D4 2B 76 EE 99 24 A0 19 A4 8F FC E7 F7 DF 23 8C 17 A0 0F E7 1C F4 8F 6F B2 6F 8B 0A 7C 17；
解析数据头获取到第一签名值为：C0 49 34 46 8B B9 66 16 B4 32 CA E8 06 5E 6C 46 FD 38 A0 F0 99 66 5D FF 11 77 40 99 03 E5 5E A8 03 1C 60 3E DD 3F DA 7A F2 CC D3 0C F2 C6 C6 D2 9E 59 03 56 43 B3 5A 28 F6 52 A3 1C 07 B9 11 D8 63 CB 1B 29 6F 13 8C 09 12 90 4C E5 28 87 BD 1F 06 68 BE BD 3B AB DD 10 17 07 BA 80 BD 36 8A 2B E8 B2 15 02 11 31 0F 5E 7D 59 7B FC 57 E1 28 7A 8C 50 51 A4 ED 9D 8C 8D F8 B4 15 C6 D0 BB 96 64 E1 D6 F7 3E 54 4E 38 D4 9D 77 61 10 B5 88 5E A4 3C 1B E2 DD EB 5F 43 4C C0 2A 4E DB 4C B3 B6 E8 15 EE A7 82 7B 82 94 1F F2 51 CE B5 81 70 0D F7 93 03 76 1C 84 5F B0 28 8E 64 42 60 84 4B B0 00 1F F6 63 DF 39 01 66 1C 04 F1 AD 45 07 1D 0C A3 84 0F E7 E1 89 FD 26 9D 44 11 B1 0B 54 14 B7 82 44 D9 ED 68 09 75 B0 73 DD 59 43 42 43 9F 6E F0 3B AA 80 CF 80 90 58 13 5F FA 90 6C 0D 44 9B 25 87 93 F7 89 DF 8B FC 52 B0 DF CA C6 A0 FE B1 20 CF 7D 0C DD EE 9E CA B5 53 38 0D 78 DF 7A 35 97 76 A2 0B 93 7B 80 6F 25 1A 5A CF 6F BA 69 9C 43 9D 63 00 30 D9 FE C2 D8 CB 61 08 55 85 51 EF 21 AE C6 C6 F8 28 68 85 B8 22 34 B7 6C 65 71 C3 A1 B7 61 39 05 FA 2F D5 90 E2 B0 1C EF 74 E8 CF 6E 63 BC 70 D3 60 24 49 F5 4E F8 89 72 18 76 A2 27 52 97 22 88 C2 F8 71 E9 E1 C7 B9 FF 01 CA 84 8E；
第一哈希值为：A5 3A 74 A9 F0 F7 A0 49 41 86 E7 6F 02 9D D8 45 6F 3E 98 5F 7F FA E2 78 88 32 CB A3 6B 2A 3F 91；
第一长度为：00 E2；
ICV为：6E 49 48 9F 0A FE D7 0A 50 60 32 1C DC D5 8B BE
第一内容哈希值为：E9 76 D4 2B 76 EE 99 24 A0 19 A4 8F FC E7 F7 DF 23 8C 17 A0 0F E7 1C F4 8F 6F B2 6F 8B 0A 7C 17；
步骤s202：设备根据自身储存的第一公钥对第一数据进行验签，判断是否验签成功，如果是，执行步骤s203；否则，向上位机返回验签失败响应，结束；
优选地，步骤s202具体为：设备使用储存在设备中的RSA公钥对获取到的第一哈希值、第一长度、第一签名值、ICV以及第一内容哈希值进行RSA验签操作，判断验证签名结果是否为验签成功，如果是，保存数据头，执行步骤s203；否则，向上位机返回验签失败响应，结束。
步骤s203：设备等待接收上位机发送的数据块，当接收到上位机发送的数据块时，将接收到的数据块作为第二数据，根据第一哈希值和第一长度验证第二数据，判断是否验证成功，如果是，解密第二数据中的有效载荷数据获得并保存有效载荷数据明文，执行步骤s204；否则，向主机返回验证失败响应，结束；
优选地，步骤s203具体为：设备等待接收上位机发送的数据块，当接收到上位机发送的 数据块时，将接收到的数据块作为当前数据块，根据第一哈希值和第一长度验证当前数据块，判断是否验证成功，如果是，解密当前数据块中的有效载荷数据，获得并保存当前数据块明文中有效载荷数据明文，执行步骤s204；否则，向主机返回验证失败响应，结束；
优选地，步骤s203中根据第一哈希值和第一长度验证当前数据块，判断是否验证成功具体包括：
步骤s203-1：设备将接收到的数据块作为当前数据块，计算当前数据块的长度，判断第一长度与当前数据块的长度是否相同，如果是，执行步骤s203-2；否则，当前数据块验证失败；
步骤s203-2：设备计算当前数据块的哈希值，判断当前数据块的哈希值是否等于第一哈希值，如果是，当前数据块验证成功；否则，当前数据块验证失败。
步骤s204：设备解析第二数据，获取下一数据块的长度和下一数据块的哈希值，判断下一数据块的长度是否为第一预设值，如果是，执行步骤s205；否则，向上位机返回验证成功响应，用获取到的下一数据块的长度替换第一长度，用获取到的下一数据块的哈希值替换第一哈希值，返回步骤s203；
优选地，步骤s204具体包括：设备解析当前数据块，获取下一数据块的长度和下一数据块的哈希值，判断下一数据块的长度是否为0，如果是，执行步骤s205；否则，向上位机返回验证成功响应，用获取到的下一数据块的长度替换第一长度，用获取到的下一数据块的哈希值替换第一哈希值，返回步骤s203；
步骤s205：设备判断下一数据块的哈希值是否为第二预设值，如果是，当前数据块为最后一个数据块，执行步骤s206；否则，向上位机返回错误响应，结束；
优选地，步骤s205具体为：设备判断下一数据块的哈希值是否为0xE3,0xB0,0xC4,0x42,0x98,0xFC,0x1C,0x14,0x9A,0xFB,0xF4,0xC8,0x99,0x6F,0xB9,0x24,0x27,0xAE,0x41,0xE4,0x64,0x9B,0x93,0x4C,0xA4,0x95,0x99,0x1B,0x78,0x52,0xB8,0x55，如果是，当前数据块为最后一个数据块，执行步骤s206；否则，向上位机返回错误响应。
步骤s206：设备对收到的全部有效载荷数据作哈希运算得到第二内容哈希值，判断第二内容哈希值是否等于第一内容哈希值，如果是，判定数据传输成功，向上位机返回数据传输成功响应，结束；否则，判定数据传输失败，向上位机返回数据传输失败响应，结束。
实施例三：
根据本发明实施例三，提供一种数据传输设备，如图3所示，包括：
接收模块301，用于设备开机后，接收上位机发送的第一数据；
解析模块302，用于当接收模块301接收到第一数据时，解析第一数据获取第一内容哈希值、第一哈希值和第一长度；
验签模块303，用于根据设备自身储存的第一公钥对接收模块301接收到的第一数据进行验证，判断是否验签成功，触发返回模块304；
返回模块304，用于当验签模块303判断出第一数据验签成功时，向上位机返回验签成功响应；还用于当验证模块303判断出第一数据验签失败时，向上位机返回验签失败响应；
接收模块301还用于接收上位机发送的数据块；
验证模块305，用于当接收模块301接收到上位机发送的数据块时，根据解析模块302获取的第一哈希值和第一长度对当前接收的数据块进行验证，判断是否验证成功，如果是，触发解析模块302；否则，触发返回模块304；
解析模块302还用于当接收模块301接收到数据块时，解析当前接收到的数据块获取有效载荷数据、第二长度和第二哈希值；
解密模块306，用于解密解析模块302获取的有效载荷数据得到有效载荷数据明文；
保存模块307，用于保存解密模块306得到的有效载荷数据明文；
判断模块308，用于判断第二长度是否为第一预设值，如果是，触发哈希模块309；否则， 触发所述返回模块304和替换模块310；
替换模块310用于当判断模块308判断出所述第二长度不为所述第一预设值时，用所述第二长度替换所述第一长度，用所述第二哈希值替换所述第一哈希值，触发所述接收模块301；
哈希模块309用于当判断模块308判断出第二长度为第一预设值时，对有效载荷数据明文作哈希运算得到第二内容哈希值；以及
判断模块308还用于当哈希模块309得到第二内容哈希值后，判断所述第一内容哈希值是否等于所述第二内容哈希值。
优选地，解析模块302具体用于当所述接收模块301接收到所述第一数据时，解析第一数据获取所述第一哈希值、所述第一长度、第一签名值、初始向量以及第一内容哈希值。
优选地，验签模块303包括：
拼接子模块，用于拼接所述第一哈希值、所述第一长度、所述初始向量以及所述第一内容哈希值得到拼接数据；
哈希子模块，用于对所述拼接子模块得到的所述拼接数据进行哈希运算得到第一哈希运算结果；
解密子模块，用于使用所述自身储存的第一公钥对所述第一签名值进行解密得到第一解密值；
第一判断子模块，用于判断所述第一哈希运算结果与所述第一解密值是否相同；
优选地，所述验证模块305包括：
获取子模块，用于获取所述当前接收的所述数据块的长度；
第二判断子模块，用于判断所述获取子模块获取到的所述当前接收到的所述数据块的长度和所述第一长度是否相同；
计算子模块，用于计算当前接收到的所述数据块的哈希值；
所述第二判断子模块还用于判断当前接收到的所述数据块的哈希值和所述第一哈希值是否相同。
优选地，所述判断模块308还用于当判断出所述第二长度为第一预设值后，判断所述第二哈希值是否为第二预设值。

Claims (10)

  1. 一种数据传输方法，其特征在于，该方法包括以下步骤：
    s1)设备开机，等待接收上位机发送的第一数据，当接收到所述第一数据时，解析所述第一数据获取第一内容哈希值、第一哈希值和第一长度；
    s2)所述设备根据自身储存的第一公钥对所述第一数据进行验签，判断是否验签成功，如果是，向上位机返回验签成功响应，执行步骤s3；否则，向上位机返回验签失败响应，结束；
    s3)所述设备等待接收所述上位机发送的数据块，当接收到数据块时，根据所述第一哈希值和所述第一长度对当前接收到的所述数据块进行验证，判断是否验证成功，如果是，执行步骤s4；否则，向上位机返回验证失败响应，结束；
    s4)所述设备解析当前接收到的所述数据块获取有效载荷数据、第二长度和第二哈希值，解密所述有效载荷数据得到有效载荷数据明文，保存所述有效载荷数据明文，判断所述第二长度是否为第一预设值，如果是，执行步骤s5；否则，向上位机返回数据块验证成功响应，用所述第二长度替换所述第一长度，用所述第二哈希值替换所述第一哈希值，返回步骤s3；以及
    s5)所述设备对所述有效载荷数据明文作哈希运算得到第二内容哈希值，判断所述第一内容哈希值是否等于所述第二内容哈希值，如果是，判定数据传输成功，向所述上位机返回数据传输成功响应，结束；否则，判定数据传输失败，向所述上位机返回数据传输失败响应，结束。
  2. 如权利要求1所述的方法，其特征在于，所述步骤s1具体包括：
    所述设备开机，等待接收所述上位机发送的所述第一数据，当接收到所述第一数据时，解析所述第一数据获取所述第一哈希值、所述第一长度、第一签名值、初始向量以及所述第一内容哈希值。
  3. 如权利要求2所述的方法，其特征在于，所述步骤s2中所述设备根据自身储存的第一公钥对第一数据进行验签具体包括一些步骤：
    s2-1)所述设备顺序拼接所述第一哈希值、所述第一长度、所述初始向量以及所述第一内容哈希值得到拼接数据，对所述拼接数据进行哈希运算得到第一哈希运算结果；
    s2-2)所述设备使用所述自身储存的第一公钥对所述第一签名值进行解密获得第一解密值；以及
    s2-3)所述设备判断所述第一哈希运算结果与所述第一解密值是否相同，如果是，所述第一数据验签成功；否则，所述第一数据验签失败。
  4. 如权利要求1所述的方法，其特征在于，所述步骤s3中所述根据所述第一哈希值和所述第一长度对当前接收的所述数据块进行验证，判断是否验证成功具体包括以下步骤：
    s3-1)所述设备获取当前接收到的数据块的长度，判断所述当前接收到的数据块的长度和所述第一长度是否相同，如果是，执行步骤s3-2；否则，所述接收到的当前数据块验证失败；
    s3-2)所述设备计算当前接收到的数据块的哈希值，判断所述当前接收到的数据块的哈希值和所述第一哈希值是否相同，如果是，当前接收到的所述数据块验证成功；否则，当前接收到的所述数据块验证失败。
  5. 如权利要求1所述的方法，其特征在于，判断出所述第二长度为所述第一预设值后，所述步骤s4还包括：
    所述设备判断所述第二哈希值是否为第二预设值，如果是，执行步骤s5；否则，向上位机返回错误响应，结束。
  6. 一种数据传输设备，其特征在于，包括：
    接收模块，用于设备开机后，接收上位机发送的第一数据；
    解析模块，用于当所述接收模块接收到所述第一数据时，解析所述第一数据获取第一内容哈希值、第一哈希值和第一长度；
    验签模块，用于根据设备自身储存的第一公钥对所述接收模块接收到的所述第一数据进行验签；
    返回模块，用于当所述验签模块判断出所述第一数据验签成功时，向上位机返回验签成功响应；还用于当所述验签模块判断出所述第一数据验签失败时，向上位机返回验签失败响应；
    所述接收模块还用于接收上位机发送的数据块；
    验证模块，用于当所述接收模块接收到所述上位机发送的所述数据块时，根据所述解析模块获取的所述第一哈希值和所述第一长度对当前接收的所述数据块进行验证，判断是否验证成功；
    解析模块还用于当所述验证模块判断出当前接收到的所述数据块验证成功时，解析当前接收到的所述数据块获取有效载荷数据、第二长度和第二哈希值；
    解密模块，用于解密所述解析模块获取的所述有效载荷数据得到有效载荷数据明文；
    保存模块，用于保存所述解密模块得到的所述有效载荷数据明文；
    判断模块，用于判断所述解析模块获取的所述第二长度是否为第一预设值；
    所述返回模块还用于当所述判断模块判断出所述第二长度不为所述第一预设值时，向所述上位机返回数据块验证成功响应；
    替换模块用于当所述判断模块判断出所述第二长度不为所述第一预设值时，用所述第二长度替换所述第一长度，用所述第二哈希值替换所述第一哈希值，触发所述接收模块；
    哈希模块，用于当所述判断模块判断出所述第二长度为第一预设值时，对所述有效载荷数据明文作哈希运算得到第二内容哈希值；以及
    所述判断模块还用于当所述哈希模块得到所述第二内容哈希值后，判断所述第一内容哈希值是否等于所述第二内容哈希值。
  7. 如权利要求6所述的设备，其特征在于，所述解析模块具体用于当所述接收模块接收到所述第一数据时，解析所述第一数据获取所述第一哈希值、所述第一长度、第一签名值、初始向量以及所述第一内容哈希值。
  8. 如权利要求7所述的设备，其特征在于，所述验签模块包括：
    拼接子模块，用于顺序拼接所述第一哈希值、所述第一长度、所述初始向量以及所述第一内容哈希值得到拼接数据；
    哈希子模块，用于对所述拼接子模块得到的所述拼接数据进行哈希运算得到第一哈希运算结果；
    解密子模块，用于使用所述自身储存的第一公钥对所述第一签名值进行解密得到第一解密值；以及
    第一判断子模块，用于判断所述第一哈希运算结果与所述第一解密值是否相同；
  9. 如权利要求6所述的设备，其特征在于，所述验证模块包括：
    获取子模块，用于获取所述当前接收的所述数据块的长度；
    第二判断子模块，用于判断所述获取子模块获取到的所述当前接收的所述数据块的长度和所述第一长度是否相同；
    计算子模块，用于计算当前接收到的所述数据块的哈希值；以及
    所述第二判断子模块还用于判断当前接收到的所述数据块的哈希值和所述第一哈希值是否相同。
  10. 如权利要求6所述的设备，其特征在于，所述判断模块还用于当判断出所述第二长度为第一预设值后，判断所述第二哈希值是否为第二预设值。
PCT/CN2021/116235 2020-09-14 2021-09-02 一种数据传输方法及数据传输设备 WO2022052859A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/785,978 US20230336354A1 (en) 2020-09-14 2021-09-02 Data transmission method and data transmission device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010957981.4A CN111818106B (zh) 2020-09-14 2020-09-14 一种数据传输的方法及设备
CN202010957981.4 2020-09-14

Publications (1)

Publication Number Publication Date
WO2022052859A1 true WO2022052859A1 (zh) 2022-03-17

Family

ID=72859227

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/116235 WO2022052859A1 (zh) 2020-09-14 2021-09-02 一种数据传输方法及数据传输设备

Country Status (3)

Country Link
US (1) US20230336354A1 (zh)
CN (1) CN111818106B (zh)
WO (1) WO2022052859A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111818106B (zh) * 2020-09-14 2020-12-11 飞天诚信科技股份有限公司 一种数据传输的方法及设备

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102761420A (zh) * 2012-08-08 2012-10-31 飞天诚信科技股份有限公司 一种安全认证方法
CN103490894A (zh) * 2013-09-09 2014-01-01 飞天诚信科技股份有限公司 一种确定智能密钥设备生命周期的实现方法及装置
CN104993932A (zh) * 2015-06-19 2015-10-21 飞天诚信科技股份有限公司 一种提高签名安全性的方法
CN110019278A (zh) * 2019-01-31 2019-07-16 阿里巴巴集团控股有限公司 一种数据验证方法、装置及设备
CN111221764A (zh) * 2019-10-18 2020-06-02 浙江中控技术股份有限公司 一种跨链路数据传输方法及系统
US20200228346A1 (en) * 2018-07-31 2020-07-16 Kabushiki Kaisha Toshiba Encrypted data generation device, digital signature generation device, digital signature-attached data generation device, and digital signature-attached data generation system
CN111818106A (zh) * 2020-09-14 2020-10-23 飞天诚信科技股份有限公司 一种数据传输的方法及设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009296190A (ja) * 2008-06-04 2009-12-17 Panasonic Corp 秘匿通信方法
CN104090790B (zh) * 2014-06-30 2017-05-17 飞天诚信科技股份有限公司 一种安全终端的双芯片方案的固件更新方法
CN105450419B (zh) * 2015-05-05 2018-07-27 北京天诚盛业科技有限公司 提高生物识别安全性的方法、装置和系统
CN107634859B (zh) * 2017-09-30 2021-07-02 飞天诚信科技股份有限公司 一种固件升级方法及装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102761420A (zh) * 2012-08-08 2012-10-31 飞天诚信科技股份有限公司 一种安全认证方法
CN103490894A (zh) * 2013-09-09 2014-01-01 飞天诚信科技股份有限公司 一种确定智能密钥设备生命周期的实现方法及装置
CN104993932A (zh) * 2015-06-19 2015-10-21 飞天诚信科技股份有限公司 一种提高签名安全性的方法
US20200228346A1 (en) * 2018-07-31 2020-07-16 Kabushiki Kaisha Toshiba Encrypted data generation device, digital signature generation device, digital signature-attached data generation device, and digital signature-attached data generation system
CN110019278A (zh) * 2019-01-31 2019-07-16 阿里巴巴集团控股有限公司 一种数据验证方法、装置及设备
CN111221764A (zh) * 2019-10-18 2020-06-02 浙江中控技术股份有限公司 一种跨链路数据传输方法及系统
CN111818106A (zh) * 2020-09-14 2020-10-23 飞天诚信科技股份有限公司 一种数据传输的方法及设备

Also Published As

Publication number Publication date
CN111818106B (zh) 2020-12-11
US20230336354A1 (en) 2023-10-19
CN111818106A (zh) 2020-10-23

Similar Documents

Publication Publication Date Title
CN104301113B (zh) 一种基于多证书多用途的数字签名方法和系统
CN110198214B (zh) 身份标识生成方法、验证方法及装置
EP2442482B1 (en) Method and device for implementing stream cipher
US20100172501A1 (en) Secure key system
WO2022052859A1 (zh) 一种数据传输方法及数据传输设备
CN103051682B (zh) 车载终端的无线交互方法
CN101625653A (zh) 一种多媒体产品本地数据处理校验方法
CN110061848B (zh) 一种安全导入支付终端密钥的方法、支付终端及系统
WO2022078078A1 (zh) 一种外接设备模拟键盘的实现方法、装置及系统
US20100040226A1 (en) Device, program and method for generating hash values
do Nascimento et al. FlexAEAD-A lightweight cipher with integrated authentication
CN115348101A (zh) 基于混沌分组密码的数据加密方法及系统
Smyshlyaev et al. The security evaluated standardized password-authenticated key exchange (SESPAKE) protocol
US6377687B1 (en) Methods and apparatus for enhanced CMEA employing enhanced transformations
Tang et al. Awareness and control of personal data Based on the Cyber-I privacy model
CN1607764A (zh) 计算暂时密钥集成协议s盒值的装置及其方法
CN114189324B (zh) 一种消息安全签名方法、系统、设备及存储介质
CN112528349A (zh) 一种数据处理方法、装置、电子设备及可读存储介质
Kaplarević Tema: Kriptoanaliza algoritma Oryx
Ding et al. Cryptanalysis of Loiss stream cipher
CN116132020A (zh) 一种单字节数据加解密算法
Isobe et al. Key Committing Security Analysis of AEGIS
CN114710285B (zh) 一种面向异构并行架构的高性能sm4比特切片优化方法
Shao-Hui et al. Security analysis of lightweight authentication protocol from wistp 2013
CN117499018A (zh) 一种基于拉丁方的8比特s盒构造方法及应用

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21865913

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21865913

Country of ref document: EP

Kind code of ref document: A1