CN118018226A - Data transmission method and related products - Google Patents

Abstract

The application discloses a data transmission method and related products, the method comprises the following steps: the method comprises the steps that an originating device obtains account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the originating device and a receiving device; encrypting the service data and calculating an authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code; and sending a data message to the receiving end equipment, wherein the data message carries the encrypted data and the first authentication code. The application can solve the problems of longer time delay and reduced communication efficiency of communication establishment in the prior art.

Description

Data transmission method and related products

Technical Field

The embodiments of the present application relate to the field of terminal technology, and are related to but not limited to a data transmission method and related products.

Background technique

With the development of terminal technology, various terminal devices have been deeply applied to people's lives. For the convenience of management, users currently use the same account to record information on various terminal devices. For example, a mobile phone, iPad and bracelet use one user account to record and manage information.

However, in practice, it is found that the communication connection between terminal devices with the same account is established based on a two-way account certificate, which needs to rely on the account certificate mechanism. Specifically, it is necessary to check whether the certificate provided by the other device is issued by a feasible device and whether the account identifier in the certificate is the same user account as itself, which leads to a longer delay in establishing communication and reduces communication efficiency.

Summary of the invention

In view of this, a data transmission method and related products provided in an embodiment of the present application can solve the problems of long delay in communication establishment and reduced communication efficiency existing in the prior art.

In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to a transmitting device, and the method includes:

Acquire account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the transmitting device and the receiving device;

Encrypt the business data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code;

A data message is sent to the receiving device, where the data message carries the encrypted data and the first authentication code.

In a second aspect, an embodiment of the present application provides another data transmission method, which is applied to a receiving device, and the method includes:

Receive a data message sent by a transmitting device, the data message carrying encrypted data and a first authentication code, the encrypted data and the first authentication code being obtained by encrypting the service data to be transmitted and calculating the authentication code according to shared key information of a user account, the user account being an account shared by the transmitting device and the receiving device;

After the first authentication code is successfully authenticated, the encrypted data is decrypted to obtain the business data.

In a third aspect, an embodiment of the present application provides a data transmission system, including a transmitting device and a receiving device, wherein:

The originating device is configured to obtain account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the originating device and the receiving device; encrypt the service data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code; and send a data message to the receiving device, wherein the data message carries the encrypted data and the first authentication code;

The receiving device is used to receive the data message, and after successfully authenticating the first authentication code, decrypt the encrypted data to obtain the business data.

In a fourth aspect, an embodiment of the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, the method provided in the first aspect or the second aspect of the embodiment of the present application is implemented.

In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method provided in the first aspect or the second aspect of the embodiment of the present application.

Compared with the prior art, this application has at least the following beneficial effects:

In the embodiment of the present application, the originating device obtains account key information and business data to be transmitted, the account key information is the shared key information of the user account, and the user account is the account shared by the originating device and the receiving device; the business data is encrypted and the authentication code is calculated according to the account key information to obtain the corresponding encrypted data and the first authentication code; a data message is sent to the receiving device, and the data message carries the encrypted data and the first authentication code. It can be seen that the present application can carry out data communication between each other based on the account key information of the user account shared by the originating device and the receiving device. Compared with the prior art, it avoids the account certificate, avoids hackers from maliciously issuing account certificates, and causes communication insecurity, and also reduces the R&D cost of the terminal, and reduces the storage and maintenance expenses of the account key information on the device side. Thereby, data security is guaranteed, and the convenience and efficiency of data transmission can be improved. At the same time, it can also solve the problem of long delay in communication establishment and reduced communication efficiency in the prior art.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

FIG. 1 is a schematic diagram of a process of issuing an account certificate provided by the prior art.

FIG. 2 is a flow chart of a data transmission method provided by the prior art.

FIG3 is a schematic diagram of the structure of a data transmission system provided in an embodiment of the present application.

FIG4 is a schematic diagram of a process for obtaining account key information provided in an embodiment of the present application.

FIG5 is a flow chart of a data transmission method provided in an embodiment of the present application.

FIG6 is a flow chart of another data transmission method provided in an embodiment of the present application.

FIG. 7 is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present application.

FIG8 is a schematic diagram of the structure of another data transmission device provided in an embodiment of the present application.

FIG. 9 is a schematic diagram of the structure of a data transmission system provided in an embodiment of the present application.

Detailed ways

In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the specific technical scheme of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

It should be pointed out that the terms "first\second\third" involved in the embodiments of the present application are used to distinguish similar or different objects, and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

In the process of filing this application, the applicant also found that in the business scenarios of terminal device interconnection (such as FaceTime video chat on mobile phones, and the phone communication of mobile phones being taken over by tablets and iPads), secure communication between different terminal devices bound to the same user account in a near-field environment is often involved. The terminal devices include, but are not limited to, mobile phones, tablets, watches, and smart speakers. The communication implementation plan is as follows:

Please refer to Figure 1, which is a schematic diagram of a process of issuing an account certificate provided by the prior art. The process shown in Figure 1 includes the following steps:

S101. A user logs in to a user account (U_ID) at terminal A, and a server S of a terminal OEM manufacturer performs login authentication.

S102. The user operates on terminal A to randomly generate a public-private key pair bound to the user account, recorded as (U_A_private_key, U_A_public_key).

S103. The user securely stores the account private key U_A_public_key on terminal A.

S104: The user sends a certificate issuance request to the server S at the terminal A, and the request is used to apply for the issuance of an account certificate. The request carries information such as U_ID and U_A_public_key.

S105. Server S issues an account certificate to the user, which is bound to terminal A, and is recorded as U_A_Cert. The account certificate carries information such as U_ID and U_A_public_key.

S106. Server S returns the account certificate U_A_Cert to terminal A.

S107. Terminal A securely stores the account certificate U_A_Cert.

In actual applications, if the user needs to unbind on the terminal A side in the future, that is, to unbind the terminal A from the user account, the server S will revoke/cancel the account certificate U_A_Cert. Similar to the process shown in Figure 1 above, the user can also generate an account public and private key pair on the terminal B side, recorded as (U_B_private_key, U_B_public_key) and obtain the account certificate U_B_Cert, which will not be repeated here.

Please refer to Figure 2, which is a flowchart of a data transmission method provided by the prior art. The method shown in Figure 2 includes the following implementation steps:

S201. Terminal A initiates a Transport Layer Security (TLS) secure connection request to terminal B. For the content of the TLS protocol, please refer to the relevant introduction in the international standard RFC8446, which will not be described in detail in this application.

S202. Terminal B loads its own account private key U_B_private_key, and returns the account certificate U_B_Cert to terminal A.

S203, terminal A checks that the certificate trust chain of the account certificate U_B_Cert comes from a trusted OEM manufacturer (it can also check that the certificate trust chain comes from the server S that issued the certificate), and the user account U_ID in the certificate is the same as the user account currently bound to terminal A. If they are different, terminate this communication.

S204. Terminal A loads its own account private key U_A_private_key, and returns the account certificate U_A_Cert to terminal B.

S205. Terminal B checks that the certificate trust chain of the account certificate U_A_Cert comes from a trusted OEM manufacturer, and that the user account U_ID in the certificate is the same as the user account currently bound to terminal B. If they are different, the communication is terminated.

S206. After both parties have successfully checked, terminal A and terminal B successfully establish a TLS communication connection and conduct secure communication, specifically transmitting user business data, etc. to each other.

However, in practice, it is found that the existing scheme has the following shortcomings: the determination of the same-account terminal strongly relies on the account certificate mechanism, resulting in high R&D costs on the terminal side. The terminal checks whether the certificate trust chain provided by the communication counterpart is from a trusted OEM manufacturer and whether the user account in the certificate is the same as its own account. The authentication process is complicated and inconvenient, which reduces communication efficiency. The communication connection between the same-account terminal is a TLS connection established based on a two-way account certificate, and the delay in establishing communication is relatively long. In addition, since the account certificate depends on the issuance of the OEM manufacturer's server S, if there is a security incident such as a hacker intrusion on server S, the account certificate U_C_Cert may be issued to terminal C without the user's knowledge. When terminal A and terminal B do not have other auxiliary security mechanisms, hackers establish secure communication with terminal A or B by invading the certificate U_C_Cert issued by server S, resulting in user data leakage and reducing the security of data transmission.

To solve the above problems, the present application proposes a data transmission method and related products. The present application will derive universal account key information for each device under the same user account, and the same account terminals can communicate securely based on the account key information.

First, the system embodiment applicable to the present application is introduced. Please refer to FIG3 for a structural diagram of a data transmission system provided by an embodiment of the present application. The system shown in FIG3 includes: a transmitting device 100 and a receiving device 200, and optionally also includes a server 300. Any two devices in the system can communicate with each other through a network according to business requirements.

The transmitting device 100 of the present application may also be referred to as the transmitting end, which usually refers to the information source end. The receiving device 200 may also be referred to as the receiving end, which usually refers to the information destination end. There is usually an interaction of business data between the transmitting device 100 and the receiving device 200, which is described in detail below in this application. The transmitting device 100 and the receiving device 200 in the present application may both refer to terminal devices, which may include but are not limited to, for example, smart phones (such as Android phones, IOS phones, etc.), personal computers, tablet computers, PDAs, e-readers, mobile Internet devices (MID, Mobile Internet Devices), wearable smart devices or other devices with communication functions.

The server 300 of the present application is used to negotiate the corresponding account key information with the terminal device (specifically, the transmitting device 100 or the receiving device 200), which is described in detail below in the present application. The server 300 of the present application can refer to a local server or a cloud server. Moreover, the present application does not limit the number of the above-mentioned transmitting device 100, receiving device 200 and server 300, which can be determined according to actual needs.

Next, the key derivation embodiment involved in this application is introduced. Please refer to Figure 4, which is a schematic diagram of a process of obtaining account key information provided by an embodiment of this application. In the figure, the user derives/obtains account key information on the originating device 100 as an example to introduce the relevant content, but it does not constitute a limitation. The process shown in Figure 4 includes the following implementation steps:

S401: The originating device 100 sends an account binding request to the server 300, wherein the account binding request carries the account identifier and the user identity code of the user account. Accordingly, the server 300 receives the account binding request.

In a specific implementation, the user logs in to the user account (whose account identifier can be recorded as U_ID) on the originating device 100 side, and the server 300 of the device OEM manufacturer performs login authentication. The user enters the user identity identification number (PIN) code on the originating device 100 side, and submits an account binding request to the server 300 based on the PIN code, which is recorded as U_KeyPair_Reqest. In actual applications, the account binding request may carry the account identifier and PIN code of the user account, and may optionally carry some public key parameters generated/produced by the originating device 100 based on its own business data.

S402: The server 300 derives a key generation parameter based on the account identifier of the user account and the user identity identification code.

The server 300 may respond to the account binding request and derive corresponding key generation parameters based on the account identifier, PIN code and other information (such as the server's own secret value S_secret, etc.). The key generation parameters are used to generate corresponding account key information for the user account.

The present application does not limit the specific implementation method of deriving the key generation parameters, for example, using a preset key generation algorithm to generate the key, etc. The key generation algorithm is a system or user-defined setting, and the present application does not limit it.

S403, the server 300 sends an account binding response to the originating device 100. Accordingly, the originating device 100 receives the account binding response, which carries a key generation parameter generated by the server according to the account identifier and the user identity code.

The server 300 may generate a corresponding account binding response based on the key generation parameters, recorded as U_KeyPair_Response, and return the account binding response to the originating device 100. In actual applications, the account binding response carries at least the key generation parameters, and may optionally carry other information according to actual needs.

S404: The originating device 100 derives the account key information based on the key generation parameters.

After obtaining the account binding response, the originating device 100 of the present application can generate the corresponding account key information for the user account based on the key generation parameters in the response and in combination with other information (such as the private key parameters generated by the originating device 100). The account key information may include the account public-private key pair (specifically including the account shared private key and the account shared public key), recorded as (U_private_key, U_public_key); and the account symmetric key, recorded as U_symmetric_key and other information.

This application does not limit the implementation method for deriving account key information, for example, it can be derived using the derivation mechanism specified in the international standard OPAQUE.

S405. The originating device 100 securely stores the account shared private key and the account symmetric key.

In this application, the user can securely store the account shared private key U_private_key and the account symmetric key U_symmetric_key on the originating device 100 side.

S406: The originating device 100 sends the account shared public key to the server 300. Correspondingly, the server 300 receives and stores the account shared public key.

The user can securely submit the account shared public key U_public_key to the server 300 on the originating device 100 side. In actual applications, if the user unbinds the originating device 100 from the user account in the future, that is, unbinds the originating device 100 from the user account, the server 300 can delete the account shared public key U_public_key. If the user needs to modify the PIN code, the user needs to negotiate with the server 300 on the originating device 100 side to generate new account key information. Similar to the process shown in Figure 4 above, the user can also negotiate with the server 300 on the receiving device 200 side to obtain the account key information of the user account, which will not be repeated in this application.

Based on the above embodiment, please refer to Figure 5 which is a flow chart of a data transmission method provided by an embodiment of the present application. The method shown in Figure 5 includes the following implementation steps:

S501, the originating device 100 obtains account key information and business data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the originating device 100 and the receiving device 200.

This application does not limit the implementation method for obtaining account key information. For example, the account key information of a user account can be obtained by using the process shown in Figure 4 above. The account key information involved in this application refers to relevant information of a user account, which may include but is not limited to information such as the public and private key pair of the user account (specifically, it may include an account shared public key and an account shared private key) and an account symmetric key.

The present application does not limit the implementation method for obtaining business data. For example, the business data to be transmitted can be directly obtained from the database, or after detecting the user's selection operation, the data corresponding to the selection operation can be used as the business data to be transmitted, etc. The present application does not limit it.

S502: The originating device 100 encrypts the service data and calculates an authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code.

S503: The transmitting device 100 sends a data message to the receiving device 200, wherein the data message carries the encrypted data and the first authentication code. Correspondingly, the receiving device 200 receives the data message.

S504: After successfully authenticating the first authentication code, the receiving device 200 decrypts the encrypted data to obtain the business data.

The first authentication code of the present application is used to authenticate the identity of the originating device 100. After the authentication is successful, the receiving device 200 can parse the encrypted data to obtain the service data sent by the originating device 10.

By implementing the embodiment of the present application, the originating device obtains the account key information and the business data to be transmitted, the account key information is the shared key information of the user account, and the user account is the account shared by the originating device and the receiving device; the business data is encrypted and the authentication code is calculated according to the account key information to obtain the corresponding encrypted data and the first authentication code; a data message is sent to the receiving device, and the data message carries the encrypted data and the first authentication code. It can be seen that the present application can carry out data communication between each other based on the account key information of the user account shared by the originating device and the receiving device. Compared with the prior art, it avoids the account certificate, avoids hackers from maliciously issuing account certificates, and causes the problem of insecure communication, and also reduces the R&D cost of the terminal, and reduces the storage and maintenance expenses of the account key information on the device side. Thereby, data security is guaranteed, and the convenience and efficiency of data transmission can be improved. At the same time, it can also solve the problem of long delay in communication establishment and reduced communication efficiency in the prior art.

Please refer to Figure 6, which is a flowchart of another data transmission method provided by an embodiment of the present application. The method shown in Figure 6 includes the following implementation steps:

S601, the originating device 100 obtains account key information and business data to be transmitted, the account key information is the shared key information of the user account, the user account is an account shared by the originating device 100 and the receiving device 200, and the account key information includes an account shared public key and an account symmetric key.

S602: The originating device 100 encrypts the business data according to the account shared public key to obtain encrypted data.

This application does not limit the specific implementation method of encryption. For example, a preset encryption algorithm can be used to use the account shared public key U_public_key to encrypt the business data Data in a digital envelope to obtain encrypted data, which is recorded as Data_Envelope. The encryption algorithm is a system-defined encryption algorithm, which may include but is not limited to the digital envelope function/algorithm specified in the international standard ECIES.

S603: The originating device 100 calculates an authentication code on the encrypted data according to the account symmetric key to obtain a first authentication code.

This application can use the account symmetric key U_symmetric_key to calculate the message authentication code of the encrypted data Data_Envelope to obtain a first authentication code, which is recorded as Data_Envelope_MAC. Among them, this application does not limit the specific implementation method of the authentication code calculation, for example, it is calculated using the relevant message authentication code function specified in the international standards HMAC and CMAC.

S604: The originating device 100 sends a data message to the receiving device 200, where the data message carries the encrypted data and the first authentication code.

The transmitting device 100 of the present application may send the encrypted data Data_Envelope and the first authentication code Data_Envelope_MAC to the receiving device 200. Specifically, the encrypted data Data_Envelope and the first authentication code Data_Envelope_MAC may be carried in a data message and sent to the receiving device 200. Accordingly, the receiving device 200 may receive the encrypted data and the first authentication code, and record them as (Recv_Data_Envelope, Recv_Data_Envelope_MAC).

S605. The receiving device 200 obtains the account key information of the user account, where the account key information at least includes an account symmetric key and an account shared private key.

In this application, the receiving device 200 does not limit the implementation method for obtaining the account key information. For example, in one example, after the receiving device 200 and the transmitting device 100 establish mutual trust, the account key information of the user account can be obtained from the transmitting device 100. In another example, the receiving device 200 can adopt a process similar to that shown in FIG. 4 above to negotiate with the server 300 to obtain the account key information of the user account. The content of the account key information can be referred to the relevant introduction in the above-mentioned embodiment, and will not be repeated here.

S606. The receiving device 200 calculates an authentication code for the encrypted data according to the account symmetric key to obtain a second authentication code.

The receiving device 200 uses the account symmetric key U_symmetric_key to calculate the message authentication code for the received encrypted data Recv_Data_Envelope to obtain a second authentication code, which is recorded as Data_Envelope_MAC2.

S607: The receiving device 200 authenticates the first authentication code based on the second authentication code.

The receiving device 200 compares the first authentication code Recv_Data_Envelope_MAC with the second authentication code Data_Envelope_MAC2. When the first authentication code and the second authentication code are the same, it can be determined that the first authentication code authentication is successful, and the step S608 is continued. On the contrary, when the first authentication code and the second authentication code are different, it can be determined that the first authentication code authentication fails, and the step S609 is continued.

S608. After successfully authenticating the first authentication code, the receiving device 200 decrypts the encrypted data according to the account shared private key to obtain the business data.

The receiving device 200 uses the account shared private key U_private_key to decrypt the received encrypted data Recv_Data_Envelope, thereby obtaining the business data Data sent by the originating device 100.

This application does not limit the specific implementation method of decryption, such as using a preset decryption algorithm for decryption, etc. The decryption algorithm is customized by the system or user, and this application does not limit it.

S609: After the first authentication code fails to be authenticated, the receiving device 200 sends a failure message to the sending device 100, where the failure message is used to indicate that the service data fails to be sent. Accordingly, the sending device 100 receives the failure message.

S610. After receiving the failure message sent by the receiving device 200, the sending device 100 repeats the above steps S601-S609.

After the receiving device 200 fails to authenticate the first authentication code, it can return a failure message to the transmitting device 100 to inform that the service data transmission fails and terminate the communication. After receiving the failure message, the transmitting device 100 can repeat the above steps S601-S609 to encrypt and transmit the service data again. For the contents not introduced or described in the embodiments of the present application, please refer to the relevant introduction in the above embodiments, which will not be repeated here.

It can be seen that the present application provides a lightweight same-account terminal security communication solution, which derives the common account key information (such as the account public and private key pair) of each terminal device under the user account by the user inputting the PIN code and the server cooperating with each other, so that different devices under the user account can establish secure communication based on the account key information. It avoids the risk of hackers invading the server and maliciously issuing user account certificates in the traditional certificate solution. Moreover, compared with the existing account certificate chain security check and the account identification comparison mechanism in the certificate, it reduces the research and development cost of the terminal device and reduces the cost of account key storage and maintenance on the device side. In addition, the present application establishes two-way secure communication between each terminal device under the same account based on the account key information, and the communication protocol adopted is not limited, for example, the international standard SIGMA protocol can be selected. In addition, the present application adopts a lightweight digital envelope and message authentication code mechanism to establish secure communication, which effectively reduces the size of the data packet and reduces the delay in connection establishment compared to the traditional two-way account certificate to establish a TLS connection.

In other words, this application can perform data communication between the transmitting device and the receiving device based on the account key information of the user account shared by the transmitting device and the receiving device. Compared with the prior art, it avoids the account certificate, avoids hackers from maliciously issuing account certificates, and prevents the problem of communication insecurity. It also reduces the R&D cost of the terminal and reduces the storage and maintenance costs of the account key information on the device side. This ensures data security and improves the convenience and efficiency of data transmission. At the same time, it can also solve the problem of long delay in communication establishment and reduced communication efficiency in the prior art.

It should be understood that, although the various steps in the flow charts of Fig. 4-Fig. 6 are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in Fig. 4 to Fig. 6 may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

Based on the foregoing embodiments, the embodiments of the present application provide several possible data transmission devices, which include the modules included and the units included in the modules, and can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

Please refer to Figure 7, which is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present application. The device shown in Figure 7 is applied to a transmitting device 100, and the device includes an acquisition module 701, a calculation module 702 and a sending module 703; wherein:

The acquisition module 701 is used to acquire account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the transmitting device and the receiving device;

The calculation module 702 is used to encrypt the business data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code;

The sending module 703 is used to send a data message to the receiving device, where the data message carries the encrypted data and the first authentication code.

Please refer to FIG8 for a schematic diagram of another data transmission device provided in an embodiment of the present application. The device shown in FIG8 is applied to a receiving device 200, and the device includes a receiving module 801 and a processing module 802; wherein:

The receiving module 801 is used to receive a data message sent by a transmitting device, wherein the data message carries encrypted data and a first authentication code, wherein the encrypted data and the first authentication code are both obtained by encrypting the service data to be transmitted and calculating the authentication code according to the shared key information of the user account, and the user account is an account shared by the transmitting device and the receiving device;

The processing module 802 is used to decrypt the encrypted data to obtain the business data after the first authentication code is successfully authenticated.

The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

It should be noted that the division of modules by the data processing device shown in Figures 7 and 8 in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. It may also be implemented in the form of a combination of software and hardware.

It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

An embodiment of the present application provides a data transmission system, which includes a transmitting device 100 and a receiving device 200. Optionally, a server 300 (not shown) may also be included. Both the transmitting device 100 and the receiving device 200 may be computer devices, and their internal structure diagram may be shown in Figure 9. The computer device includes a processor, a memory, and a network interface connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data transmission method is implemented.

An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the above embodiment are implemented.

An embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps of the method provided in the above method embodiment.

Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

In one embodiment, the apparatus provided by the present application can be implemented in the form of a computer program, and the computer program can be run on a receiving device or a transmitting device as shown in FIG9. The memory of the device can store various program modules constituting the sampling apparatus, such as the acquisition module, the calculation module and the transmission module shown in FIG7, and the receiving module and the processing module shown in FIG8. The computer program composed of various program modules enables the processor to execute the steps of the data processing method of various embodiments of the present application described in this specification.

In one embodiment, a transmitting device 100 is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:

Acquire account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the transmitting device and the receiving device;

Encrypt the business data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code;

A data message is sent to the receiving device, where the data message carries the encrypted data and the first authentication code.

In one embodiment, the account key information includes an account shared public key and an account symmetric key, and the encryption of the business data and the calculation of the authentication code according to the account key information to obtain the corresponding encrypted data and the first authentication code includes:

Encrypting the business data according to the account shared public key to obtain encrypted data;

An authentication code is calculated on the encrypted data according to the account symmetric key to obtain a first authentication code.

In one embodiment, when the processor executes the computer program, the following steps are also implemented:

After receiving the failure message sent by the receiving device, repeat the steps of obtaining the account key information and the business data to be transmitted.

In one embodiment, before obtaining the account key information, the processor further implements the following steps when executing the computer program:

Sending an account binding request to the server, wherein the account binding request carries the account identifier and user identity code of the user account;

Receiving an account binding response returned by the server, wherein the account binding response carries a key generation parameter, and the key generation parameter is generated by the server according to the account identifier and the user identity identification code;

The account key information is derived based on the key generation parameters.

In one embodiment, the account key information includes an account shared public key, and the processor further implements the following steps when executing the computer program:

The account shared public key is sent to the server.

In one embodiment, a receiving device 200 is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:

Receive a data message sent by a transmitting device, the data message carrying encrypted data and a first authentication code, the encrypted data and the first authentication code being obtained by encrypting the service data to be transmitted and calculating the authentication code according to shared key information of a user account, the user account being an account shared by the transmitting device and the receiving device;

After the first authentication code is successfully authenticated, the encrypted data is decrypted to obtain the business data.

In one embodiment, the account key information further includes an account shared private key, and the decrypting of the encrypted data to obtain the business data includes:

The encrypted data is decrypted according to the account shared private key to obtain the business data.

In one embodiment, when the processor executes the computer program, the following steps are also implemented:

After the authentication of the first authentication code fails, a failure message is sent to the originating device, where the failure message is used to indicate that the service data has failed to be sent.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, part or all of the contents of the above-mentioned method are implemented.

By implementing the embodiment of the present application, the originating device obtains the account key information and the business data to be transmitted, the account key information is the shared key information of the user account, and the user account is the account shared by the originating device and the receiving device; the business data is encrypted and the authentication code is calculated according to the account key information to obtain the corresponding encrypted data and the first authentication code; a data message is sent to the receiving device, and the data message carries the encrypted data and the first authentication code. It can be seen that the present application can carry out data communication between each other based on the account key information of the user account shared by the originating device and the receiving device. Compared with the prior art, it avoids the account certificate, avoids hackers from maliciously issuing account certificates, and causes the problem of insecure communication, and also reduces the R&D cost of the terminal, and reduces the storage and maintenance expenses of the account key information on the device side. Thereby, data security is guaranteed, and the convenience and efficiency of data transmission can be improved. At the same time, it can also solve the problem of long delay in communication establishment and reduced communication efficiency in the prior art.

It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium, storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similarities can be referenced to each other. For the sake of brevity, this article will not repeat them.

The term "and/or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, object A and/or object B can mean: object A exists alone, object A and object B exist at the same time, and object B exists alone.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple modules or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

The modules described above as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules; they may be located in one place or distributed on multiple network units; some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

In addition, all functional modules in the embodiments of the present application may be integrated into one processing unit, or each module may be a separate unit, or two or more modules may be integrated into one unit; the above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories (ROM), magnetic disks or optical disks.

Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (12)

1. A data transmission method, characterized in that it is applied to a source device, the method comprising: Acquire account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the transmitting device and the receiving device; Encrypt the business data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code; A data message is sent to the receiving device, where the data message carries the encrypted data and the first authentication code. 2. The method according to claim 1, characterized in that the account key information includes an account shared public key and an account symmetric key, and the encrypting the business data and calculating the authentication code according to the account key information to obtain the corresponding encrypted data and the first authentication code includes: Encrypting the business data according to the account shared public key to obtain encrypted data; An authentication code is calculated on the encrypted data according to the account symmetric key to obtain a first authentication code. 3. The method according to claim 2, characterized in that the method further comprises: After receiving the failure message sent by the receiving device, repeat the steps of obtaining the account key information and the business data to be transmitted. 4. The method according to claim 1, characterized in that before obtaining the account key information, the method further comprises: Sending an account binding request to the server, wherein the account binding request carries the account identifier and user identity code of the user account; Receiving an account binding response returned by the server, wherein the account binding response carries a key generation parameter, and the key generation parameter is generated by the server according to the account identifier and the user identity identification code; The account key information is derived based on the key generation parameters. 5. The method according to claim 4, characterized in that the account key information includes an account shared public key, and the method further comprises: The account shared public key is sent to the server. 6. A data transmission method, characterized in that it is applied to a receiving device, the method comprising: Receive a data message sent by a transmitting device, the data message carrying encrypted data and a first authentication code, the encrypted data and the first authentication code being obtained by encrypting the service data to be transmitted and calculating the authentication code according to shared key information of a user account, the user account being an account shared by the transmitting device and the receiving device; After the first authentication code is successfully authenticated, the encrypted data is decrypted to obtain the business data. 7. The method according to claim 6, characterized in that before decrypting the encrypted data, the method further comprises: Acquire account key information of the user account, wherein the account key information at least includes an account symmetric key; Calculate the authentication code on the encrypted data according to the account symmetric key to obtain a second authentication code; When the first authentication code and the second authentication code are the same, determining that the first authentication code authentication is successful; When the first authentication code and the second authentication code are different, it is determined that the first authentication code authentication fails. 8. The method according to claim 7, characterized in that the account key information also includes an account shared private key, and the decrypting the encrypted data to obtain the business data includes: The encrypted data is decrypted according to the account shared private key to obtain the business data. 9. The method according to any one of claims 6 to 8, characterized in that the method further comprises: After the authentication of the first authentication code fails, a failure message is sent to the originating device, where the failure message is used to indicate that the service data has failed to be sent. 10. A data transmission system, comprising a transmitting device and a receiving device, wherein: The originating device is configured to obtain account key information and service data to be transmitted, wherein the account key information is shared key information of a user account, and the user account is an account shared by the originating device and the receiving device; encrypt the service data and calculate the authentication code according to the account key information to obtain corresponding encrypted data and a first authentication code; and send a data message to the receiving device, wherein the data message carries the encrypted data and the first authentication code; The receiving device is used to receive the data message, and after successfully authenticating the first authentication code, decrypt the encrypted data to obtain the business data. 11. A computer device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the program, the method described in any one of claims 1 to 5 is implemented, or the method described in any one of claims 6 to 9 is implemented. 12. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented, or the method according to any one of claims 6 to 9 is implemented.