CN118214558B - Data circulation processing method, system, device and storage medium - Google Patents

Abstract

The present application discloses a data circulation processing method, system, device and storage medium, which ensures the efficiency and security of the entire transmission process, thereby effectively reducing or avoiding the occurrence of large-scale data leakage incidents and greatly improving the security of data transmission. The present application method includes: the source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, the source system key pair includes a source system public key and a source system private key, the transfer platform key pair includes a transfer platform public key and a transfer platform private key, and the destination system key pair includes a destination system public key and a destination system private key; the transfer platform and the source system perform key negotiation to generate a symmetric key; the source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature.

Description

A data flow processing method, system, device and storage medium

Technical Field

The present application relates to the field of data circulation technology, and in particular to a data circulation processing method, system, device and storage medium.

Background Art

With the rapid development of modern information technology, data exchange between different systems and platforms has become the norm. These systems may cover different industries and domains, such as finance, medical care, education, government agencies, etc. Efficient and secure data flow transmission between these systems is an important foundation for building reliable information services. Traditional data exchange methods usually involve transferring data from the source system to a transit platform, performing necessary processing and conversion on the data on the platform, and then transferring the data to the destination system. The data flow process refers to the entire process from the source to the destination after a series of transmission and processing. This process is continuous, real-time, scalable, diverse and secure.

The current data exchange method usually involves transferring data from the source system to a transit platform, performing necessary processing and conversion on the data, and then transferring the data to the destination system. This method has significant defects. The data is encrypted during transmission. Since the encryption method is relatively simple, there is a risk of data leakage. This link becomes a potential security vulnerability. Once the transit platform is attacked or abused by internal personnel, it may lead to large-scale data leakage incidents, endangering personal privacy and corporate secrets.

Summary of the invention

In order to solve the above technical problems, the present application provides a data flow processing method, system, device and storage medium.

The technical solution provided in this application is described below:

In a first aspect, the present application provides a data circulation processing method, which is applied in three systems: a source system, a transfer platform, and a destination system. The method includes:

The source system, the transit platform and the destination system generate a source system key pair, a transit platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transit platform key pair includes a transit platform public key and a transit platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

The source system and the transfer platform exchange the source system public key and the transfer platform public key;

The source system encrypts the authentication information according to the transfer platform public key, and sends the encrypted authentication information to the transfer platform;

The transfer platform uses the transfer platform private key to decrypt the authentication information;

After the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;

The transfer platform randomly selects a private key dA and calculates the corresponding public key QA = dAtimesG, where G is the base point and times represents multiplication operation;

The transfer platform sends the public key QA to the source system;

The source system randomly selects a private key dB and calculates the corresponding public key QB = dBtimesG, where G is the base point;

The source system sends the public key QB to the transfer platform;

The transfer platform uses the private key dA and the public key QB to calculate the shared key S = dAtimesQB;

The source system uses the private key dB and the public key QA to calculate the shared key S = dBtimesQA;

The source system and the transit platform use the shared key S as a seed and generate a symmetric key through the shared key derivation function KDF;

The source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

The source system sends the encrypted data and the digital signature to the transfer platform;

The transfer platform verifies the digital signature using the source system public key. After determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system.

The transfer platform encrypts the encrypted data using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

The destination system uses the destination system private key to decrypt the target encrypted data to obtain the encrypted data;

The destination system verifies the digital signature on the encrypted data using the source system public key;

After successful verification, the transit platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

Optionally, the source system and the transit platform use a shared key S as a seed and generate a symmetric key through the shared key derivation function KDF, including:

Determine a key derivation function of HMAC, and set the number of iterations and key length information for the key derivation function of HMAC;

Select the target random number D;

Input the target random number D, the shared key S, the iteration number information and the key length information into the key derivation function of the HMAC for derivation processing;

The symmetric key is obtained after the derivation process.

Optionally, the source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature, including:

The source system calculates a hash value of the target data, and combines the hash value with the symmetric key to generate a target symmetric key;

The source system encrypts the target data using the target symmetric key to obtain the encrypted data;

The source system calculates a target hash value of the encrypted data;

The source system encrypts the target hash value using the source system private key to generate a digital signature.

Optionally, the source system calculates a target hash value of the encrypted data, including:

The source system uses the SHA-256 algorithm and the SHA-3 algorithm to calculate a first hash value and a second hash value of the encrypted data respectively;

The source system combines the first hash value and the second hash value to obtain the target hash value.

Optionally, the source system calculates a target hash value of the encrypted data, including:

The source system divides the encrypted data into a plurality of blocks of data, and calculates a hash value of each block of data respectively;

The source system uses a Merkle tree to combine the hash values of each block of data to obtain the target hash value.

Optionally, the source system calculates a target hash value of the encrypted data, including:

The source system calculates a type of hash value of the encrypted data using a SHA-256 algorithm;

The source system uses the SHA-3 algorithm to calculate the second type hash value and the third type hash value of the source system public key and the source system private key;

The source system uses a Merkle tree to combine the first type of hash value, the second type of hash value, and the third type of hash value to obtain the target hash value.

Optionally, before the source system encrypts the authentication information according to the transit platform public key, the method further includes:

The source system and the transfer platform establish a secure data transmission channel based on the call key.

Optionally, the source system generates a source system key pair, including:

Determine the first prime number P1, P1 is the basis of the finite field;

Define the first elliptic curve: , where a and b are curve parameters on the first elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the first elliptic curve;

Select a base point G1 on the first elliptic curve;

Define the source system private key d1, d1 is a randomly defined positive integer, the range of d1 is [1, n-1], where n is the order of the base point G1, that is, the smallest positive integer n;

Calculate the source system public key Q1 according to the point multiplication operation on the first elliptic curve, Q1=d1*G1;

The source system public key Q1 and the source system private key d1 are obtained.

Optionally, the transfer platform generates a transfer platform key pair, including:

Determine the second prime number P2, P2 is the basis of the finite field;

Define the second elliptic curve: , where a and b are curve parameters on the second elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the second elliptic curve;

Select a base point G2 on the second elliptic curve;

Define the transfer platform private key d2, d2 is a randomly defined positive integer, the range of d2 is [1, n-1], where n is the order of the base point G2, that is, the smallest positive integer n;

Calculate the source system public key Q2 according to the point multiplication operation on the second elliptic curve, Q2=d2*G2;

Obtain the transfer platform public key Q2 and the transfer platform private key d2.

Optionally, the destination generates a destination key pair, including:

Determine the third prime number P3, which is the basis of the finite field;

Define the third elliptic curve: , where a and b are curve parameters on the third elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the third elliptic curve;

Select a base point G3 on the third elliptic curve;

Define the destination system private key d3, where d3 is a randomly defined positive integer in the range [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;

Calculate the source system public key Q3 according to the point multiplication operation on the third elliptic curve, Q3=d3*G3;

Acquire the destination public key Q3 and the destination system private key d3.

Optionally, the source system sends the encrypted data and the digital signature to the transfer platform, including:

The source system divides the encrypted data into a plurality of data packets;

The source system determines a number of transmission channels for transmission to the transfer platform;

The source system transmits the plurality of data packets and the digital signatures to the transfer platform through the plurality of transmission channels, and the plurality of data packets each have a corresponding digital signature.

Optionally, the transfer platform verifies the digital signature using the source system public key, including:

The transfer platform receives a plurality of data packets and the digital signatures of a plurality of transmission channels;

The transfer platform retrieves the source system public key;

The transfer platform verifies the digital signatures on several data packets using the source system public key;

After the transfer platform determines that the digital signatures of the plurality of data packets are verified to be correct, the plurality of data packets are combined to generate the encrypted data.

Optionally, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system, including:

The transfer platform determines the destination system according to the identifier on the encrypted data;

The transfer platform sends a receiving instruction to the destination system;

After the transfer platform obtains the confirmation instruction fed back by the destination system, the transfer platform and the destination system establish a secure transmission channel;

The transfer platform sends the transfer platform public key to the destination system through the secure transmission channel;

After the destination system obtains the transfer platform public key, verify whether the IP address of the transfer platform public key is consistent with the IP address of the receiving instruction;

If so, the destination system sends the destination system public key to the transfer platform.

Optionally, the transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data, including:

The transfer platform calls out the destination system public key;

The transfer platform generates a string of random numbers;

The transfer platform uses the target hash function to calculate the hash value hash obtained by combining the destination system public key and the random number;

The transfer platform uses the calculated hash value hash as the input of the key derivation function and generates a target key K;

The transfer platform uses the target key K and the destination system public key to encrypt the encrypted data to obtain the target encrypted data.

Optionally, before sending the target encrypted data and the source system public key to the destination system, the method further includes:

The transfer platform performs key negotiation with the destination system to generate a call key;

The transfer platform and the destination system establish a data transmission channel according to the call key.

Optionally, the transfer platform performs key negotiation with the destination system to generate a call key, including:

The transfer platform determines a prime number p and a base g, and sends the prime number p and the base g to the destination system;

The destination system randomly selects a private key a and calculates its public key A = g^a mod p;

The transfer platform randomly selects a private key b and calculates its public key B = g^b mod p;

The destination system sends its public key a to the transit platform, and the transit platform sends its public key b to the destination system;

When the destination system receives the public key b, it uses the private key a to calculate the shared key S = B^a mod p;

When the transfer platform receives the public key a, it uses its own private key b to calculate the shared key S = A^b mod p;

The transit platform and the destination system use a key derivation function and combine the shared key S and the session ID to generate a session key.

Optionally, before the destination system uses the destination system private key to decrypt the target data packet to obtain the encrypted data, the method further includes:

The destination system receives the target encrypted data and a string of random numbers sent by the transfer platform.

Optionally, the destination system uses the destination system private key to decrypt the target data packet to obtain the encrypted data, including:

The destination system calculates a hash value using the destination system public key and a string of random numbers through the target hash function;

The destination system generates a decryption key using the hash value through a key derivation function;

The destination system decrypts the target encrypted data using the decryption key and the destination system private key to obtain the encrypted data.

Optionally, after the verification is successful and before the transfer platform sends the symmetric key pair to the destination system, the method further includes:

The destination system sends feedback information of successful verification to the transfer platform, wherein the feedback information includes identification information of the encrypted data;

The transfer platform sends the corresponding symmetric key to the destination system according to the identification information in the feedback information.

A second aspect of the present application provides a data circulation processing system, the data circulation processing system comprising:

A source system, a transfer platform and a destination system, wherein the source system, the transfer platform and the destination system perform the following operations:

The source system, the transit platform and the destination system generate a source system key pair, a transit platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transit platform key pair includes a transit platform public key and a transit platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

The source system and the transfer platform exchange the source system public key and the transfer platform public key;

The source system encrypts the authentication information according to the transfer platform public key, and sends the encrypted authentication information to the transfer platform;

The transfer platform uses the transfer platform private key to decrypt the authentication information;

After the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;

The transfer platform randomly selects a private key dA and calculates the corresponding public key QA = dAtimesG, where G is the base point and times represents multiplication operation;

The transfer platform sends the public key QA to the source system;

The source system randomly selects a private key dB and calculates the corresponding public key QB = dBtimesG, where G is the base point;

The source system sends the public key QB to the transfer platform;

The transfer platform uses the private key dA and the public key QB to calculate the shared key S = dAtimesQB;

The source system uses the private key dB and the public key QA to calculate the shared key S = dBtimesQA;

The source system and the transit platform use the shared key S as a seed and generate a symmetric key through the shared key derivation function KDF;

The transit platform and the source system perform key negotiation to generate a symmetric key;

The source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

The source system sends the encrypted data and the digital signature to the transfer platform;

The transfer platform verifies the digital signature using the source system public key. After determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system.

The transfer platform encrypts the encrypted data using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

The destination system uses the destination system private key to decrypt the target data packet to obtain the encrypted data;

The destination system verifies the digital signature on the encrypted data using the source system public key;

After successful verification, the transit platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

A third aspect of the present application provides a data flow processing device, the device comprising:

Processor, memory, input-output unit, and bus;

The processor is connected to the memory, the input and output unit, and the bus;

The memory stores a program, and the processor calls the program to execute the first aspect and any optional method in the first aspect.

A fourth aspect of the present application provides a computer-readable storage medium, on which a program is stored. When the program is executed on a computer, the program executes the first aspect and any optional method in the first aspect.

It can be seen from the above technical solutions that this application has the following advantages:

The data circulation processing method of this application effectively improves the security and efficiency of data transmission. Specifically, the source system, the transit platform and the destination system each generate their own key pairs, and generate symmetric keys through key negotiation to ensure the strength of data encryption. The source system not only uses symmetric keys to encrypt data, but also uses its own private key to generate digital signatures for encrypted data, which increases the security level of data transmission. After verifying that the digital signature is correct, the transit platform is responsible for exchanging public keys with the destination system, and further encrypting the encrypted data with the destination system public key, and then sending it to the destination system. The destination system decrypts the data with its own private key, and then verifies the digital signature with the source system public key, ensuring the integrity of the data and the identity of the sender. Finally, the transit platform securely sends the symmetric key to the destination system to unlock the encrypted data and achieve secure data transmission.

The present application scheme utilizes the advantages of symmetric and asymmetric encryption, and combines digital signatures to ensure the confidentiality, integrity and authenticity of data transmission. The intervention of the transit platform reduces the complexity of key management, while reducing the security risks of direct key exchange, ensuring the efficiency and security of the entire transmission process, thereby effectively reducing or avoiding large-scale data leakage incidents and greatly improving the security of data transmission.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solution in the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of an embodiment of the data circulation processing method of the present application;

FIG2 is a flow chart of a portion of S201 to S209 of an embodiment of the data circulation processing method of the present application;

FIG3 is a flow chart of a portion of S209 to S214 of an embodiment of the data circulation processing method of the present application;

FIG4 is a flow chart of a portion of S301 to S309 of an embodiment of the data circulation processing method of the present application;

FIG5 is a flow chart of a portion of contents from S309 to S313 of an embodiment of the data circulation processing method of the present application;

FIG6 is a flowchart of a portion of S401 to S409 of an embodiment of the data circulation processing method of the present application;

FIG. 7 is a flow chart showing a portion of contents from S409 to S413 of an embodiment of the data circulation processing method of the present application;

FIG8 is a flowchart of a portion of S501 to S510 of an embodiment of the data circulation processing method of the present application;

FIG9 is a flow chart showing a portion of contents from S511 to S513 of an embodiment of the data circulation processing method of the present application;

FIG10 is a schematic diagram of an embodiment of the data circulation processing system of the present application;

FIG. 11 is a schematic diagram of an embodiment of a data circulation processing device of the present application.

DETAILED DESCRIPTION

Please refer to FIG. 1 . The present application first provides an embodiment of a data flow processing method. The data flow processing method is applied to a source system, a transfer platform, and a destination system. The embodiment includes:

S101, the source system, the transit platform and the destination system generate a source system key pair, a transit platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transit platform key pair includes a transit platform public key and a transit platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

In the embodiment of the present application, the components in the system are first introduced:

Source system: multiple systems or platforms that need to securely transfer data to the transit platform;

Transfer platform: a platform responsible for receiving, authenticating, encrypting and transmitting data;

Destination system: The destination system that receives encrypted data from the transit platform.

Before the source system, transit platform and destination system process data, they first generate their own key pairs. The key pair generation usually involves asymmetric encryption technology, the most commonly used methods of which include:

RSA (Rivest-Shamir-Adleman): is one of the earliest and most widely used asymmetric encryption algorithms. RSA is based on a simple number theory fact: it is easy to multiply two large prime numbers, but it is extremely difficult to factorize their product. The security of the RSA algorithm is based on the difficulty of the large number factorization problem.

ECC (Elliptic Curve Cryptography): Compared to RSA, ECC can provide the same level of security while using a shorter key length, which means faster processing speed and lower resource consumption.

DSA (Digital Signature Algorithm): is a standard digital signature algorithm that can also be used to generate key pairs. It is based on the discrete logarithm problem modulo prime numbers and is particularly suitable for signature verification.

Diffie-Hellman key exchange protocol: Although it does not directly generate a key pair itself, it allows two communicating parties without previously shared secrets to generate a common secret key over an insecure communication channel, which can be used to encrypt subsequent communications.

The process of generating a key pair generally involves the following steps:

Select an algorithm: First, select an asymmetric encryption algorithm based on security requirements and application environment;

Generate parameters: For algorithms such as ECC and DSA, an appropriate set of parameters must first be generated or selected;

Generate a key pair: Generate a pair of keys using the selected algorithm and parameters, one of which is called a public key and the other is called a private key. The public key can be shared publicly, while the private key must be kept secret.

For the above-mentioned key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to the actual situation. Preferably, in this application, in order to facilitate the subsequent encryption and decryption between key pairs, this application preferably uses the ECC elliptic encryption algorithm to generate the key pair. Among them, the generated source system key pair contains the source system public key and the source system private key. The source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair contains the transfer platform public key and the transfer platform private key. The transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair contains the destination system public key and the destination system private key. The destination system public key is public, and the destination system private key is private and is only stored in the destination system.

The public keys obtained above can be made public, but the corresponding private keys are stored in various systems and will not be made public.

S102: The source system and the transfer platform exchange the source system public key and the transfer platform public key;

S103: The transfer platform and the source system perform key negotiation to generate a symmetric key;

In the embodiment of the present application, after the source system and the transit platform have generated various key pairs, further, in order to safely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system will first negotiate a key with the source system to generate a symmetric key. The generated symmetric key is only transmitted between the transit platform and the source system. Specifically, the generation of the symmetric key can refer to the following method:

Diffie-Hellman key exchange: This is a very popular method that allows two parties to securely generate symmetric keys over an insecure channel without a shared secret.

RSA key exchange: One party can generate a temporary RSA key pair and send the public key in the RSA key pair to the other party. The recipient uses this public key to encrypt the symmetric key and send it back.

Pre-shared key negotiation: Both parties will share a key in advance. This pre-shared key can be used directly as a symmetric key or used to securely negotiate a new key over an insecure channel.

Transport Layer Security: Although TLS is often used for secure communications between clients and servers, it can also be used for secure key negotiation.

Quantum Key Distribution: QKD represents a method that uses the principles of quantum mechanics to generate and distribute absolutely secure key pairs.

In practical applications, the choice of key negotiation method depends on the specific security requirements, performance requirements, and the capabilities of both parties. For example, in an environment with limited computing resources, a more lightweight key negotiation method will be chosen, while in situations where extremely high security guarantees are required, a more complex protocol will be used.

In the present application, the transit platform and the source system may generate a symmetric key according to a corresponding method, and after generating the symmetric key, further execute step S104.

S104, the source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

In an embodiment of the present application, after the source system and the transfer platform generate a symmetric key, the source system further retrieves the target data that needs to be sent to the destination system, and uses the symmetric key generated by negotiation with the transfer platform to encrypt the target data to obtain encrypted data. Specifically, it is necessary to first ensure that the encrypted data is in a form that can be processed by the encryption algorithm. Data compression is required to reduce the size of the encrypted data. If the size of the encrypted data to be encrypted does not meet the requirements of the encryption algorithm, padding is required to make the data meet the size requirements of the encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data. After the encryption is completed, the generated encrypted data can be safely stored in the source system. Furthermore, to ensure the integrity and security of the encrypted data after it is transmitted to the transit platform, the source system will use the source system private key to encrypt the encrypted data and generate a digital signature. Specifically, the source system uses a hash function to generate a unique hash value for the encrypted data. The hash function is designed as a one-way function. For any given data, a unique hash value of a fixed length will be generated, but the original data cannot be reversely derived from the hash value. After obtaining the hash value of the encrypted data, the source system uses the source system private key to encrypt the hash value and generate the so-called digital signature. In this step, the source system private key is used as the encryption key to ensure that only the recipient with the corresponding public key can verify the signature, that is, only the source system public key can decrypt the hash value.

S105, the source system sends the encrypted data and the digital signature to the transfer platform;

In an embodiment of the present application, after the source system obtains the encrypted data and the corresponding digital signature, in order to safely transmit the encrypted data and the digital signature to the transit platform, a dedicated data transmission channel will be established between the source system and the transit platform. The data transmission channel can be generated based on a symmetric algorithm to ensure that only communication is performed between the source system and the transit platform during data transmission. The source system then packages the encrypted data and the digital signature together and sends them to the transit platform.

S106, the transfer platform verifies the digital signature using the source system public key, and after determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system;

In the implementation of this application, after the transit platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data has not been decrypted or tampered with during the transmission process and to ensure the integrity of the encrypted data, it is necessary to further verify the digital signature. Since the source system uses the source system private key to encrypt the encrypted data to generate a digital signature, it can only be verified by the source system public key. Specifically, the transit platform separates the target data and the digital signature, and then uses the source system public key to decrypt the digital signature to obtain a hash value. Since the source system public key and the source system private key are a matching pair of key pairs, the source system public key can be used to successfully decrypt the signature encrypted by the source system private key, thereby obtaining the original hash value. Furthermore, the transit system recalculates the hash value of the encrypted data. Finally, the source system compares the decrypted hash value and the recalculated hash value. When it is determined that the two hash values are the same, it means that the data has not been tampered with during transmission, and it is determined that the encrypted data comes from the source system.

After the source system determines the integrity of the encrypted data, the transit platform will temporarily store the encrypted data and determine the destination system connected to the transit platform based on the identifier on the encrypted data. After the destination system is determined, the transit platform and the destination system exchange the destination system public key and the transit platform public key, that is, the transit platform sends the transit platform public key to the destination system. After the destination system receives the transit platform public key, the destination system sends the destination system public key to the transit platform based on the identifier or IP address on the transit platform public key, thereby completing the public key exchange between the two parties.

S107, the transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

In the embodiment of the present application, after the transfer platform establishes a communication connection with the destination system and completes the exchange of the transfer platform public key and the transfer platform private key, the transfer platform uses the obtained destination system public key to encrypt the encrypted data, and then obtains the target encrypted data, where it should be noted that the method by which the transfer platform uses the destination system public key to encrypt the encrypted data is similar to the method by which the source system encrypts the target data to obtain the encrypted data, which will not be described in detail here, and can be selected according to the actual situation. After obtaining the target encrypted data, the transfer platform further sends the target encrypted data and the source system public key to the destination system.

S108, the destination system uses the destination system private key to decrypt the target encrypted data to obtain the encrypted data;

In the embodiment of the present application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporarily stores the source system public key. Since the target encrypted data is encrypted using the destination system public key based on the encrypted data, even if the data is stolen during the transmission between the transfer platform and the destination system, the criminals cannot obtain the real target data. The destination system will use the unique destination system private key to decrypt the target encrypted data to obtain the encrypted data. It should be noted that there will be a digital signature generated by the source system on the encrypted data. Before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data and ensure that the encrypted data has not been tampered with before being further encrypted by the destination system, the destination system needs to verify the digital signature and execute step S109.

S109, the destination system verifies the digital signature on the encrypted data using the source system public key;

In an embodiment of the present application, the destination system calls out the source system public key and verifies the digital signature on the encrypted data. For the digital signature verification process, reference can be made to the aforementioned transfer platform using the source system public key to verify the digital signature process, which will not be repeated here.

S110. After successful verification, the transfer platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

In an embodiment of the present application, after the destination system determines that the digital signature verification on the encrypted data is successful, the destination system further sends feedback information of the verification success to the transfer platform, and the feedback information includes identification information of the encrypted data; thereafter, the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information, and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, thereby obtaining the target data transmitted by the source system.

For code examples of the data flow processing method, please refer to the following:

import hashlib

import hmac

from cryptography.hazmat.primitives import serialization

from cryptography.hazmat.primitives.asymmetric import rsa

from cryptography.hazmat.primitives import hashes

from cryptography.hazmat.primitives.asymmetric import padding

from cryptography.hazmat.primitives.ciphers import Cipher,algorithms, modes

from cryptography.hazmat.primitives import padding as symmetric_padding

# Generate a key pair

def generate_key_pair():

private_key =rsa.generate_private_key(public_exponent=65537, key_size=2048)

public_key = private_key.public_key()

return private_key, public_key

# Key Exchange

def exchange_public_keys(source_system, relay_platform):

source_system.public_key = relay_platform.public_key

relay_platform.public_key = source_system.public_key

# Key negotiation

def negotiate_symmetric_key(source_system, relay_platform):

symmetric_key = os.urandom(32)

source_system.symmetric_key = symmetric_key

relay_platform.symmetric_key = symmetric_key

return symmetric_key

# Encrypt target data

def encrypt_data(source_system, data):

cipher = Cipher(algorithms.AES(source_system.symmetric_key),modes.ECB())

encryptor = cipher.encryptor()

padder =symmetric_padding.PKCS7(algorithms.AES.block_size).padder()

padded_data = padder.update(data) + padder.finalize()

encrypted_data = encryptor.update(padded_data) + encryptor.finalize()

return encrypted_data

# Generate digital signature

def sign_data(source_system, data):

signature = source_system.private_key.sign(

data,

padding.PSS(

mgf=padding.MGF1(hashes.SHA256()),

salt_length=padding.PSS.MAX_LENGTH

),

hashes.SHA256()

)

return signature

# Verify digital signature

def verify_signature(destination_system, data, signature):

try:

destination_system.public_key.verify(

signature,

data,

padding.PSS(

mgf=padding.MGF1(hashes.SHA256()),

salt_length=padding.PSS.MAX_LENGTH

),

hashes.SHA256()

)

return True

except:

return False

# Decrypt data

def decrypt_data(destination_system, encrypted_data):

cipher = Cipher(algorithms.AES(destination_system.symmetric_key),modes.ECB())

decryptor = cipher.decryptor()

decrypted_data = decryptor.update(encrypted_data) +decryptor.finalize()

unpadder = symmetric_padding.PKCS7(algorithms.AES.block_size).unpadder()

data = unpadder.update(decrypted_data) + unpadder.finalize()

return data.

This code example involves several encryption and data transmission processes. Specifically, in the security of data transmission, the source system, the transit platform and the destination system each generate an RSA key pair, including a public key and a private key. The source system and the transit platform first exchange public keys, and then the transit platform and the destination system also exchange public keys. The source system and the transit platform generate a symmetric key through negotiation for AES encryption of the target data. The source system uses its own private key to generate a digital signature for the encrypted data to ensure the integrity and identity of the data. The encrypted data and the digital signature are sent to the transit platform. After the transit platform verifies the signature using the public key of the source system, it forwards the encrypted data to the destination system. The transit platform exchanges public keys with the destination system and encrypts the encrypted data again to increase the protection layer. After receiving the data, the destination system uses its own private key to decrypt it to obtain the original encrypted data, and uses the public key of the source system to verify the digital signature. After successful verification, the transit platform transmits the negotiated symmetric key to the destination system, and the destination system uses the key to decrypt the encrypted data to finally obtain the original target data transmitted by the source system. This process ensures the security and integrity of data during transmission through encryption and signature.

The data circulation processing method of this application effectively improves the security and efficiency of data transmission. Specifically, the source system, the transit platform and the destination system each generate their own key pairs, and generate symmetric keys through key negotiation to ensure the strength of data encryption. The source system not only uses symmetric keys to encrypt data, but also uses its own private key to generate digital signatures for encrypted data, which increases the security level of data transmission. After verifying that the digital signature is correct, the transit platform is responsible for exchanging public keys with the destination system, and further encrypting the encrypted data with the destination system public key, and then sending it to the destination system. The destination system decrypts the data with its own private key, and then verifies the digital signature with the source system public key, ensuring the integrity of the data and the identity of the sender. Finally, the transit platform securely sends the symmetric key to the destination system to unlock the encrypted data and achieve secure data transmission.

The present application scheme utilizes the advantages of symmetric and asymmetric encryption, and combines digital signatures to ensure the confidentiality, integrity and authenticity of data transmission. The intervention of the transit platform reduces the complexity of key management, while reducing the security risks of direct key exchange, ensuring the efficiency and security of the entire transmission process, thereby effectively reducing or avoiding large-scale data leakage incidents and greatly improving the security of data transmission.

Please refer to FIG. 2 to FIG. 3 , the present application provides another embodiment of a data flow processing method, the data flow processing method is applied to a source system, a transfer platform and a destination system, and the embodiment includes:

S201, the source system, the transit platform and the destination system generate a source system key pair, a transit platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transit platform key pair includes a transit platform public key and a transit platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

In the embodiment of the present application, the corresponding source system key pair, transfer platform key pair and destination system key pair are generated for the source system, transfer platform and destination system. Specifically, they are generated by the ECC elliptic curve algorithm. The steps and processes of generating by using the ECC elliptic curve algorithm are now described as follows:

The process of generating the source system key pair is as follows:

Determine the first prime number P1, P1 is the basis of the finite field;

Define the first elliptic curve: , where a and b are curve parameters on the first elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the first elliptic curve;

Select a base point G1 on the first elliptic curve;

Define the source system private key d1, d1 is a randomly defined positive integer, the range of d1 is [1, n-1], where n is the order of the base point G1, that is, the smallest positive integer n;

Calculate the source system public key Q1 according to the point multiplication operation on the first elliptic curve, Q1=d1*G1;

Obtain the source system public key Q1 and the source system private key d1;

The process of generating the key pair of the transfer platform:

Determine the second prime number P2, P2 is the basis of the finite field;

Define the second elliptic curve: , where a and b are curve parameters on the second elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the second elliptic curve;

Select a base point G2 on the second elliptic curve;

Define the transfer platform private key d2, d2 is a randomly defined positive integer, the range of d2 is [1, n-1], where n is the order of the base point G2, that is, the smallest positive integer n;

Calculate the source system public key Q2 according to the point multiplication operation on the second elliptic curve, Q2=d2*G2;

Obtain the transfer platform public key Q2 and the transfer platform private key d2.

The process of generating the destination system key pair is as follows:

Determine the third prime number P3, which is the basis of the finite field;

Define the third elliptic curve: , where a and b are curve parameters on the third elliptic curve equation, and a and b must satisfy the following conditions: , to ensure that there is no singular point on the third elliptic curve;

Select a base point G3 on the third elliptic curve;

Define the destination system private key d3, where d3 is a randomly defined positive integer in the range [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;

Calculate the source system public key Q3 according to the point multiplication operation on the third elliptic curve, Q3=d3*G3;

Acquire the destination public key Q3 and the destination system private key d3.

Among them, it should be noted that for generating the source system key pair, the first elliptic curve, the second elliptic curve and the third elliptic curve of the transit platform key pair and the destination system key pair, the same elliptic curve equation can be used or different elliptic curve equations can be used, which can be selected by adjusting a and b on the elliptic curve equation.

Although the ECC elliptic curve algorithm is used to calculate the corresponding key pair, the generated source system key pair, transfer platform key pair and destination system key pair are all different, so that they can be effectively distinguished during the subsequent encryption and transmission process. After obtaining the source system key pair, transfer platform key pair and destination system key pair, step S202 is executed.

S202: The source system and the transfer platform exchange the source system public key and the transfer platform public key;

In the embodiment of the present application, after the source system and the transit platform have generated various key pairs, further, in order to safely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system will first negotiate a key with the source system to generate a symmetric key. The generated symmetric key is only transmitted between the transit platform and the source system. Specifically, the generation of the symmetric key can refer to the following method:

Diffie-Hellman key exchange: This is a very popular method that allows two parties to securely generate symmetric keys over an insecure channel without a shared secret.

RSA key exchange: One party can generate a temporary RSA key pair and send the public key in the RSA key pair to the other party. The recipient uses this public key to encrypt the symmetric key and send it back.

Pre-shared key negotiation: Both parties will share a key in advance. This pre-shared key can be used directly as a symmetric key or used to securely negotiate a new key over an insecure channel.

Transport Layer Security: Although TLS is often used for secure communications between clients and servers, it can also be used for secure key negotiation.

Quantum Key Distribution: QKD represents a method that uses the principles of quantum mechanics to generate and distribute absolutely secure key pairs.

In actual applications, the choice of key negotiation method depends on the specific security requirements, performance requirements and capabilities of both parties. For example, in an environment with limited computing resources, a more lightweight key negotiation method will be selected, while in situations where extremely high security guarantees are required, a more complex protocol will be used. In this application, the transit platform and the source system can generate symmetric keys according to the corresponding methods.

S203, the source system encrypts the authentication information according to the transfer platform public key, and sends the encrypted authentication information to the transfer platform;

In an embodiment of the present application, after the source system sends the source system public key to the transfer platform, and the transfer platform sends the transfer platform public key to the source system, further, before the source system and the transfer platform communicate, both parties need to verify first. Specifically, the source system uses the obtained transfer platform public key to encrypt the authentication information. Specifically, the ECC elliptic curve algorithm or other symmetric algorithms can be used for encryption. This process is to ensure the interaction independence between the source system and the transfer platform. Even if the authentication information is obtained by a third party, the third party cannot accurately obtain the authentication information because it does not have the transfer platform private key, and thus cannot obtain which source system is interacting with the transfer platform, which plays a role in concealing and protecting the source system. After the source system encrypts the authentication information using the transfer platform public key, and sends the encrypted authentication information to the transfer platform, the next step of the authentication process is carried out.

S204, the transfer platform uses the transfer platform private key to decrypt the authentication information;

In an embodiment of the present application, after receiving the authentication information, the transit platform further, when the transit platform learns that it is obtained from the source system, the transit platform directly calls the transit platform private key, and uses the transit platform private key to decrypt the authentication information, thereby obtaining the content of the authentication information, which includes but is not limited to the following information: the IP address of the source system, the type of data to be transmitted by the source system, the authentication information type of the source system, etc.

S205: After the transfer platform verifies that the authentication information is correct, the transfer platform and the source system perform key negotiation to generate a symmetric key;

In the embodiment of the present application, after the transit platform determines that the authentication information is correct, a corresponding data transmission channel is established between the source system and the transit platform, so that the transit platform and the source system perform key negotiation to generate a symmetric key. The process of generating the symmetric key can refer to the following method:

The transfer platform and the source system select the target elliptic curve and a base point G on the target elliptic curve, where the target elliptic curve is jointly selected by the transfer platform and the source system, and the base point is a random point number, and the base point G is recognized by both parties. Then the transfer platform randomly selects a private key dA and calculates the corresponding public key QA = dA times G, where G is the base point, and "times" represents the multiplication operation. "dA times G" can be understood as "multiplying dA by G", which is used to perform mathematical operations and calculate the value of QA. The "times" that appear later are the same and will not be repeated. Then the transfer platform sends the public key QA to the source system; the source system randomly selects a private key dB and calculates the corresponding public key QB = dB times G, where G is the base point; the source system sends the public key QB to the transfer platform;

The transit platform uses the private key dA and the public key QB to calculate the shared key S = dAtimesQB); the source system uses the private key dB and the public key QA to calculate the shared key S = dBtimesQA; according to the algorithm principle, the shared key S calculated by the transit platform and the source system is the same. To further improve the security of the shared key, the source system and the transit platform use the shared key S as a seed and generate a symmetric key through the shared key derivation function KDF.

Further: In generating a symmetric key by using a shared key derivation function KDF, the following method may be specifically referred to:

First, determine the key derivation function of HMAC, and set the number of iterations and key length information for the key derivation function of HMAC. The number of iterations and key length information can be selected in advance, and the selected information is recognized by both parties. Then select the target random number D, and input the target random number D, shared key S, pre-set number of iterations and key length information into the key derivation function of HMAC for derivation processing. After the derivation processing, the symmetric key is obtained.

S206. The source system calculates a hash value of the target data, and combines the hash value with the symmetric key to generate a target symmetric key;

In the embodiment of the present application, after the source system and the transit platform jointly negotiate to generate a symmetric key, the symmetric key will be stored in the source system and the transit platform, and both parties can call it and use the symmetric key for subsequent session communication or data transmission. Specifically, in order to further improve the security of data transmission, the source system first calculates the hash value of the target data, and combines the hash value with the symmetric key to generate a target symmetric key. Since the target symmetric key generated by combining the hash value on the basis of the symmetric key will have strong security, the hash value is a fixed-size number generated by a hash function, usually a combination of a string of letters and numbers. It is a digital "fingerprint" or "summary" of data of any size. The design of the hash function enables it to map input data of indefinite length to output of fixed length, and the hash value is irreversible. After the two are combined, a target symmetric key with strong security can be generated.

S207, the source system encrypts the target data using the target symmetric key to obtain the encrypted data;

In an embodiment of the present application, after obtaining the target symmetric key, the source system will further select a corresponding key encryption algorithm, such as the Advanced Encryption Standard algorithm, the Data Encryption Standard algorithm, and the Triple Data Encryption algorithm, etc. The source system uses the target symmetric key and the selected encryption algorithm to encrypt the target data. In this process, the target data is converted into encrypted data under the action of the selected encryption algorithm and the target symmetric key. The entire target data encryption process usually involves multiple conversion and replacement steps, which together ensure the security of the target data.

S208, the source system calculates a target hash value of the encrypted data;

In the embodiment of the present application, after the source system obtains the encrypted data, in order to improve the integrity of the encrypted data transmitted to the transit platform and enable the transit platform to verify it, specifically, the source system calculates the target hash value of the encrypted data. The target hash value of the encrypted data can be obtained in the following way:

1. The source system uses the SHA-256 algorithm and the SHA-3 algorithm to respectively calculate the first hash value and the second hash value of the encrypted data; the source system combines the first hash value and the second hash value to obtain the target hash value.

In the embodiment of the present application, the source system first uses the SHA-256 algorithm to calculate the first hash value of the encrypted data, and then uses the SHA-3 algorithm to calculate the second hash value of the encrypted data, wherein:

The risk of collision attacks can be reduced by combining the SHA-256 algorithm and the SHA-3 algorithm. The SHA-256 algorithm and the SHA-3 algorithm are based on different design principles. SHA-256 is based on the Merkle-Damgård structure, while SHA-3 is based on the Keccak algorithm. They have different ways of counteracting attacks. This diversity can provide more levels of security. Data can be damaged during transmission or storage. Two independently calculated hash values can provide stronger data integrity checks and reduce the risk of data errors and tampering.

After calculating the first hash value and the second hash value, the source system further combines the first hash value and the second hash value to obtain the target hash value. Specifically, the first hash value and the second hash value can be combined in series. When the two hash values are connected in series, the length of the final target hash value will be the sum of the lengths of the first hash value and the second hash value.

2. The source system divides the encrypted data into several blocks of data and calculates the hash value of each block of data respectively; the source system uses a Merkle tree to combine the hash value of each block of data to obtain the target hash value.

In an embodiment of the present application, after the encrypted data is divided into several blocks of data and the hash value of each block of data is calculated separately, a Merkle tree is applied to combine the hash value of each block of data to obtain a target hash value, wherein the Merkle tree is a binary tree in which each leaf node contains the hash value of the data block, and the non-leaf node stores a combination of the hash values of its child nodes. In this way, the integrity of the data can be verified.

Specifically, when processing encrypted data, the data is first divided into several blocks. The size of each block can be adjusted according to actual needs. The advantage of this is that it can be processed in parallel and improve data processing efficiency. Then the hash value of each block of data is further calculated. The hash value is a fixed-length string that uniquely identifies the content of the data block. Even if the content of the data block changes slightly, its hash value will change significantly, which makes the hash value an important indicator of data integrity and authenticity.

Then, using the structure of the Merkle tree, the hash value of each encrypted data block is used as a leaf node, and the hash values of adjacent leaf nodes are combined through a hash function to generate the hash value of the non-leaf node. This process continues upward until a root node is generated. The hash value of this root node is the so-called "target hash value." This target hash value is a concise representation of the entire data set, which can be used to verify the integrity and authenticity of the entire encrypted data set.

When the encrypted data needs to be verified, the target hash value is calculated and compared with the original target hash value. If the two are consistent, it means that the encrypted data has not been tampered with during transmission or storage and maintains integrity. If the target hash value is inconsistent, it means that there is a problem with the encrypted data and further processing is required. This method of using the Merkle tree not only improves the efficiency of encrypted data processing, but also ensures the security and integrity of encrypted data.

3. The source system uses the SHA-256 algorithm to calculate a first-class hash value of the encrypted data; the source system uses the SHA-3 algorithm to calculate a second-class hash value and a third-class hash value of the source system public key and the source system private key; the source system uses a Merkle tree to combine the first-class hash value, the second-class hash value and the third-class hash value to obtain the target hash value;

In the embodiment of the present application, the source system uses the SHA-256 algorithm to calculate a type of hash value for encrypted data. The SHA-256 algorithm is an advanced cryptographic hash algorithm with extremely high security and stability, and can effectively ensure the integrity and authenticity of the data. Through this algorithm, the source system can convert the encrypted data into a hash value of a fixed length. This hash value has a unique identifier, and even if the original data changes slightly, the hash value will change significantly.

In addition to calculating the encrypted data to obtain the first type of hash value, the source system also uses the SHA-3 algorithm to calculate the second type of hash value and the third type of hash value of the source system public key and the source system private key. By performing hash calculations on the source system public key and the source system private key, the source system can further ensure the security of data transmission and prevent the key from being stolen or tampered with.

To further enhance data security, the source system uses a Merkle tree to combine the first, second, and third hash values to obtain the final target hash value. The Merkle tree is an efficient data structure that can combine multiple hash values into a unique hash value, so that any minor changes to the data can be detected. Through the application of the Merkle tree, the source system can implement end-to-end data integrity verification during data transmission to ensure that the data has not been tampered with or forged during transmission.

Therefore, the source system achieves efficient and secure transmission and verification of data by using SHA-256 and SHA-3 algorithms and Merkle trees to generate target hash values. This mechanism not only has strong encryption and anti-cracking capabilities, but can also promptly detect and respond to the risk of data tampering, providing a solid guarantee for the security of data transmission.

S209, the source system uses the source system private key to encrypt the target hash value to generate a digital signature;

In the embodiment of the present application, after the source system obtains the target hash value, it uses the source system private key to encrypt the target hash value to generate a digital signature. Specifically, the source system first selects the corresponding algorithm from the asymmetric algorithm RSA, ECDSA or DSA, and then passes the target hash value to the selected asymmetric encryption algorithm. The algorithm uses the private key to encrypt the hash value and generates an encrypted output, which is the digital signature. The generated digital signature has extremely high uniqueness and unforgeability, and the digital signature contains the identity information of the source system and the encryption result of the hash value.

S210, the source system sends the encrypted data and the digital signature to the transfer platform;

In an embodiment of the present application, after the source system obtains the encrypted data and the corresponding digital signature, in order to safely transmit the encrypted data and the digital signature to the transit platform, a dedicated data transmission channel will be established between the source system and the transit platform. The data transmission channel can be generated based on a symmetric algorithm to ensure that only communication is performed between the source system and the transit platform during data transmission. The source system then packages the encrypted data and the digital signature together and sends them to the transit platform.

S211, the transfer platform verifies the digital signature using the source system public key. After determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system.

In the implementation of this application, after the transit platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data has not been decrypted or tampered with during the transmission process and to ensure the integrity of the encrypted data, it is necessary to further verify the digital signature. Since the source system uses the source system private key to encrypt the encrypted data to generate a digital signature, it can only be verified by the source system public key. Specifically, the transit platform separates the target data and the digital signature, and then uses the source system public key to decrypt the digital signature to obtain a hash value. Since the source system public key and the source system private key are a matching pair of key pairs, the source system public key can be used to successfully decrypt the signature encrypted by the source system private key, thereby obtaining the original hash value. Furthermore, the transit system recalculates the hash value of the encrypted data. Finally, the source system compares the decrypted hash value and the recalculated hash value. When it is determined that the two hash values are the same, it means that the data has not been tampered with during transmission, and it is determined that the encrypted data comes from the source system.

After the source system determines the integrity of the encrypted data, the transit platform will temporarily store the encrypted data and determine the destination system connected to the transit platform based on the identifier on the encrypted data. After the destination system is determined, the transit platform and the destination system exchange the destination system public key and the transit platform public key, that is, the transit platform sends the transit platform public key to the destination system. After the destination system receives the transit platform public key, the destination system sends the destination system public key to the transit platform based on the identifier or IP address on the transit platform public key, thereby completing the public key exchange between the two parties.

S212, the transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

In the embodiment of the present application, after the transfer platform establishes a communication connection with the destination system and completes the exchange of the transfer platform public key and the transfer platform private key, the transfer platform uses the obtained destination system public key to encrypt the encrypted data, and then obtains the target encrypted data, where it should be noted that the method by which the transfer platform uses the destination system public key to encrypt the encrypted data is similar to the method by which the source system encrypts the target data to obtain the encrypted data, which will not be described in detail here, and can be selected according to the actual situation. After obtaining the target encrypted data, the transfer platform further sends the target encrypted data and the source system public key to the destination system.

S213, the destination system uses the destination system private key to decrypt the target encrypted data to obtain the encrypted data;

In the embodiment of the present application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporarily stores the source system public key. Since the target encrypted data is encrypted using the destination system public key based on the encrypted data, even if the data is stolen during the transmission between the transfer platform and the destination system, the criminals cannot obtain the real target data. The destination system will use the unique destination system private key to decrypt the target encrypted data and obtain the encrypted data. It should be noted that there will be a digital signature generated by the source system on the encrypted data. Before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data and ensure that the encrypted data has not been tampered with before being further encrypted by the destination system, the destination system needs to verify the digital signature.

S214, the destination system verifies the digital signature on the encrypted data using the source system public key;

In an embodiment of the present application, the destination system calls out the source system public key and verifies the digital signature on the encrypted data. For the digital signature verification process, reference can be made to the aforementioned transfer platform using the source system public key to verify the digital signature process, which will not be repeated here.

S215. After successful verification, the transfer platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

In an embodiment of the present application, after the destination system determines that the digital signature verification on the encrypted data is successful, the destination system further sends feedback information of the verification success to the transfer platform, and the feedback information includes identification information of the encrypted data; thereafter, the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information, and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, thereby obtaining the target data transmitted by the source system.

Please refer to FIG. 4 and FIG. 5 , the present application provides another embodiment of a data circulation processing method, the data circulation processing method is applied to a source system, a transfer platform and a destination system, and the embodiment includes:

S301, the source system, the transfer platform and the destination system generate a source system key pair, a transfer platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transfer platform key pair includes a transfer platform public key and a transfer platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

In the embodiment of the present application, the process of generating a key pair generally involves the following steps:

Select an algorithm: First, select an asymmetric encryption algorithm based on security requirements and application environment;

Generate parameters: For algorithms such as ECC and DSA, an appropriate set of parameters must first be generated or selected;

Generate a key pair: Generate a pair of keys using the selected algorithm and parameters, one of which is called a public key and the other is called a private key. The public key can be shared publicly, while the private key must be kept secret.

For the above-mentioned key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to the actual situation. Preferably, in this application, in order to facilitate the subsequent encryption and decryption between key pairs, this application preferably uses the ECC elliptic encryption algorithm to generate the key pair. Among them, the generated source system key pair contains the source system public key and the source system private key. The source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair contains the transfer platform public key and the transfer platform private key. The transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair contains the destination system public key and the destination system private key. The destination system public key is public, and the destination system private key is private and is only stored in the destination system. The above-obtained public keys can be made public, but the corresponding private keys are stored in various systems and will not be made public.

S302: The source system and the transfer platform exchange the source system public key and the transfer platform public key;

S303: The transfer platform and the source system perform key negotiation to generate a symmetric key;

In the embodiment of the present application, after the source system and the transit platform have generated various key pairs, further, in order to safely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system will first negotiate a key with the source system to generate a symmetric key. The generated symmetric key is only transmitted between the transit platform and the source system. Specifically, the generation of the symmetric key can refer to the following method:

Diffie-Hellman key exchange: This is a very popular method that allows two parties to securely generate symmetric keys over an insecure channel without a shared secret.

RSA key exchange: One party can generate a temporary RSA key pair and send the public key in the RSA key pair to the other party. The recipient uses this public key to encrypt the symmetric key and send it back.

Pre-shared key negotiation: Both parties will share a key in advance. This pre-shared key can be used directly as a symmetric key or used to securely negotiate a new key over an insecure channel.

Transport Layer Security: Although TLS is often used for secure communications between clients and servers, it can also be used for secure key negotiation.

Quantum Key Distribution: QKD represents a method that uses the principles of quantum mechanics to generate and distribute absolutely secure key pairs.

In actual applications, the choice of key negotiation method depends on the specific security requirements, performance requirements and capabilities of both parties. For example, in an environment with limited computing resources, a more lightweight key negotiation method will be selected, while in situations where extremely high security guarantees are required, a more complex protocol will be used. In this application, the transit platform and the source system can generate symmetric keys according to the corresponding methods.

S304: The source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

In an embodiment of the present application, after the source system and the transfer platform generate a symmetric key, the source system further retrieves the target data that needs to be sent to the destination system, and uses the symmetric key generated by negotiation with the transfer platform to encrypt the target data to obtain encrypted data. Specifically, it is necessary to first ensure that the encrypted data is in a form that can be processed by the encryption algorithm. Data compression is required to reduce the size of the encrypted data. If the size of the encrypted data to be encrypted does not meet the requirements of the encryption algorithm, padding is required to make the data meet the size requirements of the encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data. After the encryption is completed, the generated encrypted data can be safely stored in the source system. Furthermore, to ensure the integrity and security of the encrypted data after it is transmitted to the transit platform, the source system will use the source system private key to encrypt the encrypted data and generate a digital signature. Specifically, the source system uses a hash function to generate a unique hash value for the encrypted data. The hash function is designed as a one-way function. For any given data, a unique hash value of a fixed length will be generated, but the original data cannot be reversely derived from the hash value. After obtaining the hash value of the encrypted data, the source system uses the source system private key to encrypt the hash value and generate the so-called digital signature. In this step, the source system private key is used as the encryption key to ensure that only the recipient with the corresponding public key can verify the signature, that is, only the source system public key can decrypt the hash value.

S305, the source system divides the encrypted data into a plurality of data packets;

In an embodiment of the present application, after obtaining the encrypted data, the source system needs to first split the encrypted data into several data packets. The data packets will pass through multiple network nodes and transmission media. If the entire encrypted data is transmitted as a whole, once the data packet is intercepted during the transmission process, the attacker will obtain the content of the entire encrypted data, thereby threatening the security of the data. Therefore, by splitting the encrypted data into several data packets, the risk of the data packet being intercepted can be reduced.

During the encrypted data packetization process, the source system will divide the encrypted data into data packets of appropriate size based on factors such as the size of the encrypted data and the bandwidth of the network. Each data packet will contain a portion of the encrypted data and necessary metadata, such as the data packet's sequence number, source address, and destination address. In this way, even if the data packet is lost or damaged during transmission, the receiving system can reconstruct the original encrypted data through the metadata.

In addition, in order to further improve the security of data transmission, some advanced encryption technologies and transmission protocols can be used. For example, public key encryption technology can be used to encrypt each data packet to ensure that only the receiving system with the corresponding private key can decrypt the content of the data packet. At the same time, reliable transmission protocols such as TCP (Transmission Control Protocol) can also be used to ensure that data packets can reach the destination in the correct order and avoid data packets being tampered with or repeated during transmission.

S306, the source system determines a number of transmission channels for transmission to the transfer platform;

In an embodiment of the present application, after the encrypted data is divided into several data packets, in order to further determine the transmission channel between the source system and the transit platform, multiple transmission channels are required so that several data packets can be transmitted to the transit platform through different transmission channels. Each data packet can be sent through a pre-set or dynamically selected transmission channel. It is necessary to ensure load balancing of different transmission channels to avoid delays or data loss caused by overloading of a certain transmission channel. This can be achieved through software defined networking (SDN) or other network load balancing technologies.

It should be noted that all transmission channels should be encrypted using encryption protocols such as TLS or SSL to protect the security and privacy of data during transmission. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) should be deployed in the transmission channels to identify and block potential malicious traffic and attack attempts.

S307, the source system transmits the plurality of data packets and the digital signatures to the transfer platform through the plurality of transmission channels, and the plurality of data packets each have the digital signature;

In an embodiment of the present application, after the transmission channel is established, the source system further transmits several data packets and corresponding digital signatures to the transit platform through the transmission channel. During the transmission, each data packet has a unique serial number so that it can be correctly restored to the original data when assembled on the transit platform, and each data packet needs to undergo an integrity check after arriving at the transit platform to ensure that the data has not been tampered with during transmission. This process can be verified by a digital signature. If a data packet is lost or damaged during transmission, the transit platform will detect this and send a retransmission response to the source system so that the source system resends the data packet to the transit platform.

S308, the transfer platform verifies the digital signature using the source system public key;

In the embodiment of the present application, the transfer platform receives several data packets and digital signatures from several transmission channels. To ensure the integrity of the transmitted data packets, the transfer platform retrieves the source system public key and uses the source system public key to verify the digital signatures on the data packets. After successful verification, the transfer platform will confirm the integrity and authenticity of the data packets, thereby preventing the data from being tampered with or damaged during transmission. At the same time, the transfer platform will also sort and integrate the data packets to ensure that they are re-synthesized into encrypted data in the correct order and format.

S309: After the integrity of the encrypted data is determined, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system;

In an embodiment of the present application, after the transit platform obtains the target encrypted data and determines the integrity of the target encrypted data, the transit platform further sends the encrypted data to the destination system, thereby completing the data transmission from the source system to the destination system. Specifically, the transit platform determines the destination system based on the identifier on the encrypted data, and then the transit platform sends a receiving instruction to the destination system; after the transit platform obtains the confirmation instruction fed back by the destination system, the transit platform and the destination system establish a secure transmission channel; the transit platform sends the transit platform public key to the destination system through the secure transmission channel; after the destination system obtains the transit platform public key, it verifies whether the IP address of the transit platform public key is consistent with the IP address of the receiving instruction; if so, the destination system sends the destination system public key to the transit platform.

After receiving the public key of the destination system, the transfer platform will perform public key verification to ensure the security of data transmission. The verification process includes checking the validity period of the public key, the signature of the public key, etc. Once the verification is passed, the transfer platform can use the public key and private key to perform encryption and decryption operations to ensure the security of data during transmission.

S310, the transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

In the embodiment of the present application, after the transfer platform establishes a communication connection with the destination system and completes the exchange of the transfer platform public key and the transfer platform private key, the transfer platform uses the obtained destination system public key to encrypt the encrypted data, and then obtains the target encrypted data, where it should be noted that the method by which the transfer platform uses the destination system public key to encrypt the encrypted data is similar to the method by which the source system encrypts the target data to obtain the encrypted data, which will not be described in detail here, and can be selected according to the actual situation. After obtaining the target encrypted data, the transfer platform further sends the target encrypted data and the source system public key to the destination system.

S311, the destination system uses the destination system private key to decrypt the target encrypted data to obtain the encrypted data;

In the embodiment of the present application, the destination system receives the target encrypted data and the source system public key sent by the transfer platform, and then temporarily stores the source system public key. Since the target encrypted data is encrypted using the destination system public key based on the encrypted data, even if the data is stolen during the transmission between the transfer platform and the destination system, the criminals cannot obtain the real target data. The destination system will use the unique destination system private key to decrypt the target encrypted data to obtain the encrypted data. It should be noted that there will be a digital signature generated by the source system on the encrypted data. Before the destination system opens the encrypted data, in order to further verify the integrity of the encrypted data and ensure that the encrypted data has not been tampered with before being further encrypted by the destination system, the destination system needs to verify the digital signature and execute step S312.

S312, the destination system verifies the digital signature on the encrypted data using the source system public key;

In an embodiment of the present application, the destination system calls out the source system public key and verifies the digital signature on the encrypted data. For the digital signature verification process, reference can be made to the aforementioned transfer platform using the source system public key to verify the digital signature process, which will not be repeated here.

S313. After successful verification, the transfer platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

In an embodiment of the present application, after the destination system determines that the digital signature verification on the encrypted data is successful, the destination system further sends feedback information of the verification success to the transfer platform, and the feedback information includes identification information of the encrypted data; thereafter, the transfer platform calls out the corresponding symmetric key according to the identification information in the feedback information, and sends the corresponding symmetric key to the destination system, so that the destination system uses the symmetric key to unlock the encrypted data, thereby obtaining the target data transmitted by the source system.

The data circulation processing method of this application effectively improves the security and efficiency of data transmission. Specifically, the source system, the transit platform and the destination system each generate their own key pairs, and generate symmetric keys through key negotiation to ensure the strength of data encryption. The source system not only uses symmetric keys to encrypt data, but also uses its own private key to generate digital signatures for encrypted data, which increases the security level of data transmission. After verifying that the digital signature is correct, the transit platform is responsible for exchanging public keys with the destination system, and further encrypting the encrypted data with the destination system public key, and then sending it to the destination system. The destination system decrypts the data with its own private key, and then verifies the digital signature with the source system public key, ensuring the integrity of the data and the identity of the sender. Finally, the transit platform securely sends the symmetric key to the destination system to unlock the encrypted data and achieve secure data transmission.

Please refer to FIG. 6 and FIG. 7 , the present application provides another embodiment of a data flow processing method, the data flow processing method is applied to a source system, a transfer platform and a destination system, and the embodiment includes:

S401, the source system, the transfer platform and the destination system generate a source system key pair, a transfer platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transfer platform key pair includes a transfer platform public key and a transfer platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

Before the source system, transit platform and destination system process data, the source system, transit platform and destination system first generate their own key pairs. The key pair generation usually involves asymmetric encryption technology, the most commonly used methods of which include:

RSA (Rivest-Shamir-Adleman): is one of the earliest and most widely used asymmetric encryption algorithms. RSA is based on a simple number theory fact: it is easy to multiply two large prime numbers, but it is extremely difficult to factorize their product. The security of the RSA algorithm is based on the difficulty of the large number factorization problem.

ECC (Elliptic Curve Cryptography): Compared to RSA, ECC can provide the same level of security while using a shorter key length, which means faster processing speed and lower resource consumption.

DSA (Digital Signature Algorithm): is a standard digital signature algorithm that can also be used to generate key pairs. It is based on the discrete logarithm problem modulo prime numbers and is particularly suitable for signature verification.

Diffie-Hellman key exchange protocol: Although it does not directly generate a key pair itself, it allows two communicating parties without previously shared secrets to generate a common secret key over an insecure communication channel, which can be used to encrypt subsequent communications.

The process of generating a key pair generally involves the following steps:

Select an algorithm: First, select an asymmetric encryption algorithm based on security requirements and application environment;

Generate parameters: For algorithms such as ECC and DSA, an appropriate set of parameters must first be generated or selected;

Generate a key pair: Generate a pair of keys using the selected algorithm and parameters, one of which is called a public key and the other is called a private key. The public key can be shared publicly, while the private key must be kept secret.

For the above-mentioned key pair generation method, the source system, the transfer platform and the destination system can select the corresponding key pair generation method to generate the key pair according to the actual situation. Preferably, in this application, in order to facilitate the subsequent encryption and decryption between key pairs, this application preferably uses the ECC elliptic encryption algorithm to generate the key pair. Among them, the generated source system key pair contains the source system public key and the source system private key. The source system public key is public, and the source system private key is private and is only stored in the source system; the generated transfer platform key pair contains the transfer platform public key and the transfer platform private key. The transfer platform public key is public, and the transfer platform private key is private and is only stored in the transfer platform; similarly, the generated destination system key pair contains the destination system public key and the destination system private key. The destination system public key is public, and the destination system private key is private and is only stored in the destination system.

The public keys obtained above can be made public, but the corresponding private keys are stored in various systems and will not be made public.

S402: The source system and the transfer platform exchange the source system public key and the transfer platform public key;

S403: The transfer platform and the source system perform key negotiation to generate a symmetric key;

In the embodiment of the present application, after the source system and the transit platform have generated various key pairs, further, in order to safely transmit the target data to the transit platform, so that the transit platform transmits the target data to the destination system, the source system will first negotiate a key with the source system to generate a symmetric key. The generated symmetric key is only transmitted between the transit platform and the source system. Specifically, the generation of the symmetric key can refer to the following method:

Diffie-Hellman key exchange: This is a very popular method that allows two parties to securely generate symmetric keys over an insecure channel without a shared secret.

RSA key exchange: One party can generate a temporary RSA key pair and send the public key in the RSA key pair to the other party. The recipient uses this public key to encrypt the symmetric key and send it back.

Pre-shared key negotiation: Both parties will share a key in advance. This pre-shared key can be used directly as a symmetric key or used to securely negotiate a new key over an insecure channel.

Transport Layer Security: Although TLS is often used for secure communications between clients and servers, it can also be used for secure key negotiation.

Quantum Key Distribution: QKD represents a method that uses the principles of quantum mechanics to generate and distribute absolutely secure key pairs.

In practical applications, the key negotiation method selected depends on the specific security requirements, performance requirements and the capabilities of both parties. For example, in an environment with limited computing resources, a more lightweight key negotiation method will be selected, while in the case of extremely high security guarantees, a more complex protocol will be used. In this application, the transit platform and the source system can generate a symmetric key according to the corresponding method, and after generating the symmetric key, step S403 is further performed.

S404: The source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

In an embodiment of the present application, after the source system and the transfer platform generate a symmetric key, the source system further retrieves the target data that needs to be sent to the destination system, and uses the symmetric key generated by negotiation with the transfer platform to encrypt the target data to obtain encrypted data. Specifically, it is necessary to first ensure that the encrypted data is in a form that can be processed by the encryption algorithm. Data compression is required to reduce the size of the encrypted data. If the size of the encrypted data to be encrypted does not meet the requirements of the encryption algorithm, padding is required to make the data meet the size requirements of the encryption algorithm block. Then the selected symmetric encryption algorithm and symmetric key encrypt the target data. After the encryption is completed, the generated encrypted data can be safely stored in the source system. Furthermore, to ensure the integrity and security of the encrypted data after it is transmitted to the transit platform, the source system will use the source system private key to encrypt the encrypted data and generate a digital signature. Specifically, the source system uses a hash function to generate a unique hash value for the encrypted data. The hash function is designed as a one-way function. For any given data, a unique hash value of a fixed length will be generated, but the original data cannot be reversely derived from the hash value. After obtaining the hash value of the encrypted data, the source system uses the source system private key to encrypt the hash value and generate the so-called digital signature. In this step, the source system private key is used as the encryption key to ensure that only the recipient with the corresponding public key can verify the signature, that is, only the source system public key can decrypt the hash value.

S405, the source system sends the encrypted data and the digital signature to the transfer platform;

In an embodiment of the present application, after the source system obtains the encrypted data and the corresponding digital signature, in order to safely transmit the encrypted data and the digital signature to the transit platform, a dedicated data transmission channel will be established between the source system and the transit platform. The data transmission channel can be generated based on a symmetric algorithm to ensure that only communication is performed between the source system and the transit platform during data transmission. The source system then packages the encrypted data and the digital signature together and sends them to the transit platform.

S406: The transfer platform verifies the digital signature using the source system public key. After determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system.

In the implementation of this application, after the transit platform receives the encrypted data and the corresponding digital signature sent by the source system, in order to further verify that the encrypted data has not been decrypted or tampered with during the transmission process and to ensure the integrity of the encrypted data, it is necessary to further verify the digital signature. Since the source system uses the source system private key to encrypt the encrypted data to generate a digital signature, it can only be verified by the source system public key. Specifically, the transit platform separates the target data and the digital signature, and then uses the source system public key to decrypt the digital signature to obtain a hash value. Since the source system public key and the source system private key are a matching pair of key pairs, the source system public key can be used to successfully decrypt the signature encrypted by the source system private key, thereby obtaining the original hash value. Furthermore, the transit system recalculates the hash value of the encrypted data. Finally, the source system compares the decrypted hash value and the recalculated hash value. When it is determined that the two hash values are the same, it means that the data has not been tampered with during transmission, and it is determined that the encrypted data comes from the source system.

After the source system determines the integrity of the encrypted data, the transit platform will temporarily store the encrypted data and determine the destination system connected to the transit platform based on the identifier on the encrypted data. After the destination system is determined, the transit platform and the destination system exchange the destination system public key and the transit platform public key, that is, the transit platform sends the transit platform public key to the destination system. After the destination system receives the transit platform public key, the destination system sends the destination system public key to the transit platform based on the identifier or IP address on the transit platform public key, thereby completing the public key exchange between the two parties.

S407, the transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data;

In the implementation of this application, the transit platform calls out the destination system public key and generates a corresponding string of random numbers; the transit platform uses the target hash function to calculate the hash value hash obtained by combining the destination system public key and the random number, and then the transit platform uses the calculated hash value hash as the input of the key derivation function and generates the target key K; the transit platform uses the target key K and the destination system public key to encrypt the encrypted data to obtain the target encrypted data.

Target encrypted data is the key to ensuring the security of data during transmission. By encrypting the original data and re-encrypting it with the target key K and the destination system public key, it can be ensured that only the destination system with the corresponding private key can decrypt and access the data. This double encryption method greatly enhances the security of the data. Even if the data is intercepted during transmission, the attacker cannot directly obtain the content of the original data.

S408, the transfer platform negotiates a key with the destination system to generate a call key;

In an embodiment of the present application, after the transit platform encrypts the encrypted data according to the destination system public key and the target key K to obtain the target encrypted data, in order to further ensure the data transmission between the transit platform and the destination system, the transit platform negotiates a key with the destination system to generate a call key. Specifically, the transit platform determines a prime number p and a base g, and sends the prime number p and the base g to the destination system; the destination system randomly selects a private key a, and calculates its public key A = g^a mod p, the transit platform randomly selects a private key b, calculates its public key B = g^b mod p, the destination system sends its public key a to the transit platform, and the transit platform sends its public key b to the destination system; when the destination system receives the transit platform public key b, it uses the private key a to calculate the shared key S = B^a mod p; when the transit platform receives the destination system public key a, it uses its own private key b to calculate the shared key S = A^b mod p; Since the shared key calculated by the destination system and the transit platform is the same, the transit platform and the destination system use a key derivation function and combine the shared key S and the session ID to generate a call key, so that the transit platform and the destination system build a data transmission channel based on the call key.

S409, the transfer platform sends the target encrypted data and the source system public key to the destination system;

In an embodiment of the present application, after the transit platform and the destination system establish a data transmission channel based on the call key, the transit platform further sends the target encrypted data and the source system public key to the destination system through the data transmission channel, and the destination system temporarily stores the received target encrypted data and the source system public key, and uses them to perform subsequent data processing.

S410, the destination system uses the destination system private key to decrypt the target encrypted data to obtain the encrypted data;

S411, the destination system verifies the digital signature on the encrypted data using the source system public key;

S412. After successful verification, the transfer platform sends the symmetric key pair to the destination system; the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

In the implementation of this application, steps S410 to S412 are similar to the aforementioned steps S108 to S110 and will not be repeated here.

Please refer to FIG. 8 and FIG. 9 . The present application provides another embodiment of a data circulation processing method. The data circulation processing method is applied to a source system, a transfer platform and a destination system. The embodiment includes:

S501, the source system, the transfer platform and the destination system generate a source system key pair, a transfer platform key pair and a destination system key pair respectively, the source system key pair includes a source system public key and a source system private key, the transfer platform key pair includes a transfer platform public key and a transfer platform private key, and the destination system key pair includes a destination system public key and a destination system private key;

S502: The source system and the transfer platform exchange the source system public key and the transfer platform public key;

S503: The transfer platform and the source system perform key negotiation to generate a symmetric key;

S504: The source system uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the source system private key to encrypt the encrypted data and generate a digital signature;

S505, the source system sends the encrypted data and the digital signature to the transfer platform;

S506: The transfer platform verifies the digital signature using the source system public key. After determining the integrity of the target encrypted data, the transfer platform exchanges the destination system public key and the transfer platform public key with the destination system.

S507: The transfer platform uses the destination system public key to encrypt the encrypted data to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

In the embodiment of the present application, steps S501 to S507 are similar to the aforementioned steps S101 to S107 and are not described again here.

S508, the destination system receives the target encrypted data and a string of random numbers sent by the transfer platform;

In an embodiment of the present application, after the transfer platform sends the target encrypted data and the source system public key to the destination system, it further sends a string of random numbers to the destination system, so that the destination system receives the target encrypted data, a string of random numbers and the source system public key from the transfer platform.

Specifically, after sending the target encrypted data and the source system public key to the destination system, the transit platform takes further security measures. In order to enhance the security of data transmission, the transit platform also generates a string of random numbers and sends it to the destination system together with the target encrypted data and the source system public key. In this way, when the destination system receives the data, it can not only obtain the target encrypted data and the source system public key, but also obtain this string of random numbers, thereby ensuring the integrity and security of data transmission.

Specifically, this string of random numbers plays an important role in the data transmission process. First, it can be used as a verification mechanism to verify the integrity of the data. When the destination system receives the data, it can determine whether the data has been tampered with or damaged during the transmission process by comparing the random numbers held by the transit platform. If the random numbers are consistent, then the data can be considered intact; if the random numbers are inconsistent, it means that there is a problem with the data during transmission and corresponding processing is required.

Secondly, this string of random numbers can also be used as an encryption mechanism to enhance data security. Before sending the data, the transit platform can use this string of random numbers to further encrypt the target encrypted data to ensure that the data is not illegally intercepted or tampered with during the transmission process. When the destination system receives the encrypted data, it can use the corresponding decryption algorithm and this string of random numbers to perform decryption operations to restore the original target encrypted data. In this way, even if the data is illegally intercepted during the transmission process, the attacker cannot directly obtain the content of the target encrypted data, thereby ensuring the security of the data.

In addition, this string of random numbers can also be used as an authentication mechanism to confirm the identity of the transit platform and the destination system. Before the transit platform sends data, the transit platform can attach this string of random numbers as authentication information to the target encrypted data. When the destination system receives the target encrypted data, it can confirm whether the sender's identity is correct by verifying whether the string of random numbers is consistent with the expected one. Similarly, the transit platform can also confirm whether the receiver's identity is correct by verifying the random numbers held by the destination system. In this way, it can effectively prevent attackers who impersonate others from performing illegal operations.

S509, the destination system uses the destination system public key and a string of random numbers to calculate a hash value through the target hash function;

In an embodiment of the present application, this string of random numbers is used as part of the input and passed to the target hash function together with the destination system public key. Through such an operation, a hash value can be obtained. This hash value is unique and unpredictable. The hash function is one-way, that is, the original input cannot be reversed through the hash value, which makes the hash value a very effective data verification mechanism that can ensure the integrity of the data and that it has not been tampered with.

S510, the destination system generates a decryption key using a hash value through a key derivation function;

In the embodiment of the present application, the method of using hash value and key derivation function to generate decryption key ensures both the security and integrity of the data. It allows only the recipient with the correct key and hash value to decrypt and read the data, thereby effectively preventing illegal access and tampering of the data.

S511, the destination system uses the decryption key and the destination system private key to decrypt the target encrypted data to obtain encrypted data;

In the embodiment of the present application, the decrypted encrypted data plays a key role in the destination system. This data not only represents the core of the original information, but also is the key to ensure that the information has not been tampered with during transmission. In order to ensure the integrity and security of the data, the destination system uses advanced encryption technology to protect the data.

During the decryption process, the destination system first uses the decryption key to unlock the outer protection layer of the target encrypted data. This step is crucial because it ensures that only the recipient with the correct key can access the content of the data. Once the outer protection layer is unlocked, the system will expose the true face of the encrypted data.

Next, the destination system uses its own private key to further decrypt the decrypted data. The private key is unique to the destination system, which ensures that only the system can access and decrypt the data. This step not only enhances the security of the data, but also ensures the privacy of the data.

The decrypted data can now flow freely in the destination system, but the system will still be strictly monitored and managed. By implementing a series of security measures such as access control, data auditing and encrypted storage, the destination system ensures that the decrypted data will not be obtained or abused by unauthorized third parties.

S512, the destination system verifies the digital signature on the encrypted data using the source system public key;

S513. After successful verification, the transfer platform sends the symmetric key pair to the destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

In the embodiment of the present application, steps S512 to S513 are similar to the aforementioned steps S109 to S110 and are not described in detail herein.

Referring to FIG. 10 , the second aspect of the present application provides a data circulation processing system, the data circulation processing system comprising:

The source system 1, the transfer platform 2 and the destination system 3 perform the following operations:

The source system 1, the transfer platform 2 and the destination system 3 generate a source system 1 key pair, a transfer platform 2 key pair and a destination system 3 key pair respectively, the source system 1 key pair includes a source system 1 public key and a source system 1 private key, the transfer platform 2 key pair includes a transfer platform 2 public key and a transfer platform 2 private key, and the destination system 3 key pair includes a destination system 3 public key and a destination system 3 private key;

The source system 1 and the transfer platform 2 exchange the source system public key and the transfer platform public key;

The transfer platform 2 and the source system 1 perform key negotiation to generate a symmetric key;

The source system 1 uses the symmetric key to encrypt the target data to obtain encrypted data, and uses the private key of the source system 1 to encrypt the encrypted data and generate a digital signature;

The source system 1 sends the encrypted data and the digital signature to the transfer platform 2;

The transfer platform 2 verifies the digital signature using the public key of the source system 1. After determining the integrity of the target encrypted data, the transfer platform 2 exchanges the public key of the destination system 3 and the public key of the transfer platform 2 with the destination system 3.

The transfer platform 2 uses the public key of the destination system 3 to encrypt the encrypted data to obtain target encrypted data, and sends the target encrypted data and the public key of the source system 1 to the destination system 3;

The destination system 3 uses the destination system 3 private key to decrypt the target data packet to obtain the encrypted data;

The destination system 3 verifies the digital signature on the encrypted data using the source system 1 public key;

After successful verification, the transfer platform 2 sends the shared key pair to the destination system 3, so that the destination system 3 uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system 1.

Please refer to FIG. 11 , the present application also provides a data flow processing device, including:

Processor 701, memory 702, input and output unit 703, bus 704;

The processor 701 is connected to the memory 702, the input and output unit 703 and the bus 704;

The memory 702 stores a program, and the processor 701 calls the program to execute any of the above methods.

The present application also relates to a computer-readable storage medium on which a program is stored, wherein when the program is run on a computer, the computer is caused to execute any of the above methods.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims (22)

1. A data flow processing method, wherein the data flow processing method is applied to three systems of a source system, a transit platform and a destination system, and the method comprises the following steps:

The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;

Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;

The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;

the transfer platform decrypts the authentication information by using the transfer platform private key;

after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;

the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;

The transit platform sends the public key QA to the source system;

the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;

The source system sends the public key QB to the transfer platform;

The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;

the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;

The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;

The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;

the source system sends the encrypted data and the digital signature to the transit platform;

the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;

The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

the destination system decrypts the target encrypted data by using the destination system private key to obtain the encrypted data;

The destination system verifies the digital signature on the encrypted data using a source system public key;

After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

2. The data flow processing method according to claim 1, wherein the source system and the transit platform use a shared key S as a seed, and generating a symmetric key by the shared key derivation function KDF comprises:

Determining a key derivation function of the HMAC, and setting iteration times and key length information for the key derivation function of the HMAC;

Selecting a target random number D;

inputting the target random number D, the shared secret key S, the iteration number information and the secret key length information into a secret key derivation function of the HMAC to carry out derivation processing;

and obtaining the symmetric key after the deriving process.

3. The data flow processing method according to claim 1, wherein the encrypting the target data by the source system using the symmetric key to obtain encrypted data, and encrypting and generating a digital signature on the encrypted data by using a source system private key, comprises:

the source system calculates a hash value of the target data and combines the hash value with the symmetric key to generate a target symmetric key;

The source system encrypts the target data through the target symmetric key to obtain the encrypted data;

The source system calculates a target hash value of the encrypted data;

the source system encrypts the target hash value using the source system private key to generate a digital signature.

4. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:

the source system calculates a first hash value and a second hash value of the encrypted data by using an SHA-256 algorithm and an SHA-3 algorithm respectively;

and the source system combines the first hash value and the second hash value to obtain the target hash value.

5. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:

the source system divides the encrypted data into a plurality of blocks of data and calculates the hash value of each block of data respectively;

The source system combines the hash values of each block of data using a merck tree to obtain the target hash value.

6. A data flow-through processing method according to claim 3, wherein the source system calculating a target hash value of the encrypted data comprises:

The source system calculates a hash value of the encrypted data by using an SHA-256 algorithm;

the source system calculates a second-class hash value and a third-class hash value of the source system public key and the source system private key by using an SHA-3 algorithm;

The source system combines the one type of hash value, the two types of hash values, and the three types of hash values using a merck tree to obtain the target hash value.

7. The data flow processing method according to claim 1, wherein before the source system encrypts authentication information according to the transit platform public key, the method further comprises:

and the source system and the transfer platform construct a data security transmission channel based on the call key.

8. The data flow processing method of claim 1, wherein the source system generates a source system key pair comprising:

determining a first prime number P1, wherein P1 is the basis of a finite field;

defining a first elliptic curve: wherein a and b are curve parameters on the first elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the first elliptic curve;

selecting a base point G1 on the first elliptic curve;

Defining a source system private key d1, d1 as a randomly defined positive integer, the range [1, n-1] of d1, wherein n is the order of the base point G1, i.e. the smallest positive integer n;

Calculating a source system public key Q1 according to the point multiplication operation on the first elliptic curve, wherein Q1=d1×G1;

and acquiring the source system public key Q1 and the source system private key d1.

9. The data flow processing method according to claim 1, wherein the relay platform generates a relay platform key pair, comprising:

determining a second prime number P2, wherein P2 is the basis of the finite field;

Defining a second elliptic curve: wherein a and b are curve parameters on the second elliptic curve equation, and a and b need to satisfy the following conditions: To ensure that there are no irregularities on the second elliptic curve;

Selecting a base point G2 on the second elliptic curve;

Defining a transit platform private key d2, d2 as a randomly defined positive integer, and d2 is in the range [1, n-1] of n, wherein n is the order of the base point G2, namely the smallest positive integer n;

Calculating a source system public key Q2 according to the point multiplication operation on the second elliptic curve, wherein Q2=d2×G2;

and acquiring the transit platform public key Q2 and the transit platform private key d2.

10. The data flow processing method according to claim 1, wherein the destination system generates a destination key pair, comprising:

Determining a third prime number P3, wherein P3 is the basis of the finite field;

Defining a third elliptic curve: Wherein a and b are curve parameters on the third elliptic curve equation, and a and b need to satisfy the following conditions: to ensure that there are no irregularities on the third elliptic curve;

selecting a base point G3 on the third elliptic curve;

Defining a destination system private key d3, d3 as a randomly defined positive integer, d3 ranging from [1, n-1], where n is the order of the base point G3, i.e. the smallest positive integer n;

calculating a source system public key Q3 according to the point multiplication operation on the third elliptic curve, wherein Q3=d3×G3;

The destination public key Q3 and the destination system private key d3 are acquired.

11. The data flow processing method of claim 1, wherein the source system sending the encrypted data and the digital signature to the staging platform comprises:

the source system divides the encrypted data into a plurality of data packets;

the source system determines a plurality of transmission channels transmitted to the transit platform;

The source system transmits the data packets and the digital signature to the transfer platform through the transmission channels, and the digital signature is corresponding to the data packets.

12. The data flow processing method of claim 11, wherein the relay platform verifies the digital signature using the source system public key, comprising:

the transfer platform receives a plurality of data packets of a plurality of transmission channels and the digital signature;

The intermediate transfer platform invokes the source system public key;

The transfer platform verifies digital signatures on a plurality of data packets using the source system public key;

and after the transfer platform determines that the digital signature of the data packets is verified to be correct, combining the data packets to generate the encrypted data.

13. The data flow processing method according to claim 1, wherein the relay platform exchanges a destination system public key and a relay platform public key with the destination system, comprising:

the transfer platform determines a destination system according to the identification on the encrypted data;

The transfer platform sends a receiving instruction to the destination system;

After the transfer platform acquires a confirmation instruction fed back by the destination system, the transfer platform and the destination system construct a safe transmission channel;

The transfer platform sends the public key of the transfer platform to the destination system through the secure transmission channel;

After the destination system acquires the public key of the transfer platform, verifying whether the IP address of the public key of the transfer platform is consistent with the IP address of the receiving instruction;

If yes, the destination system sends the destination system public key to the transit platform.

14. The method for processing data circulation according to claim 1, wherein the step of encrypting the encrypted data by the relay platform using the destination system public key to obtain the target encrypted data includes:

The transfer platform calls out the public key of the destination system;

the transfer platform generates a series of random numbers;

the transfer platform calculates a hash value hash obtained by combining a destination system public key and a random number by using a target hash function;

The transfer platform uses the calculated hash value hash as the input of a key derivation function and generates a target key K;

and the transfer platform encrypts the encrypted data by using the target secret key K and the destination system public key to obtain target encrypted data.

15. The data flow processing method of claim 1, wherein prior to sending the target encrypted data and the source system public key to the destination system, the method further comprises:

the transfer platform performs key negotiation with the destination system to generate a call key;

and the transit platform and the destination system construct a data transmission channel according to the call key.

16. The data flow processing method of claim 15, wherein the staging platform performing key agreement with the destination system to generate a session key comprises:

The transit platform determines a prime number p and a base number g and sends the prime number p and the base number g to the destination system;

The destination system randomly selects a private key a and calculates a public key A=ga mod p;

The transfer platform randomly selects a private key B and calculates a public key B=gb mod p;

The destination system sends the public key a to a transfer platform, and the transfer platform sends the public key b to the destination system;

when the destination system receives the public key B, calculating a shared key s=b≡a mod p by using the private key a;

when the transit platform receives the public key a, the private key b of the transit platform is used for calculating a shared secret key S=A≡mod p;

the transit platform and the destination system use a key derivation function and combine a shared key S and a session ID to generate a session key.

17. The data flow processing method of claim 1, wherein prior to the destination system decrypting the target data packet using the destination system private key to obtain the encrypted data, the method further comprises:

And the destination system receives the target encrypted data and a series of random numbers sent by the transfer platform.

18. The data flow processing method of claim 17, wherein the destination system decrypting the target data packet using the destination system private key to obtain the encrypted data, comprising:

The destination system calculates a hash value through the target hash function by using a destination system public key and a series of random numbers;

The destination system generates a decryption key through a key derivation function using the hash value;

And the destination system decrypts the target encrypted data by using the decryption key and the destination system private key to obtain the encrypted data.

19. The data flow processing method of claim 1, wherein after verification is successful, the staging platform sends the symmetric key pair to a destination system before the method further comprises:

the destination system sends feedback information which is successfully verified to the transfer platform, wherein the feedback information comprises identification information of the encrypted data;

And the transfer platform sends the corresponding symmetric key to the destination system according to the identification information in the feedback information.

20. A data flow processing system, the data flow processing system comprising:

A source system, a relay platform, and a destination system, the source system, the relay platform, and the destination system performing the following operations:

The source system, the transfer platform and the destination system respectively generate a source system key pair, a transfer platform key pair and a destination system key pair, wherein the source system key pair comprises a source system public key and a source system private key, the transfer platform key pair comprises a transfer platform public key and a transfer platform private key, and the destination system key pair comprises a destination system public key and a destination system private key;

Exchanging the public key of the source system and the public key of the transfer platform between the source system and the transfer platform;

The transfer platform and the source system conduct key negotiation to generate a symmetric key;

The source system encrypts the target data by using the symmetric key to obtain encrypted data, and encrypts the encrypted data by using a private key of the source system to generate a digital signature;

the source system sends the encrypted data and the digital signature to the transit platform;

the transfer platform verifies the digital signature by using the public key of the source system, and after the integrity of the target encrypted data is determined, the transfer platform exchanges the public key of the destination system and the public key of the transfer platform with the destination system;

The source system encrypts the authentication information according to the public key of the transfer platform and sends the encrypted authentication information to the transfer platform;

the transfer platform decrypts the authentication information by using the transfer platform private key;

after the transfer platform verifies that the authentication information is correct, the transfer platform and the source system select a target elliptic curve and a base point G on the target elliptic curve;

the transfer platform randomly selects a private key dA and calculates a corresponding public key QA= dAtimesG, wherein G is a base point, and times represents multiplication operation;

The transit platform sends the public key QA to the source system;

the source system randomly selects a private key dB and calculates a corresponding public key qb= dBtimesG, wherein G is a base point;

The source system sends the public key QB to the transfer platform;

The transfer platform calculates a shared secret key S= dAtimesQB by using a private key dA and a public key QB;

the source system calculates a shared key s= dBtimesQA using a private key dB and a public key QA;

The source system and the transfer platform use a shared secret key S as a seed, and generate a symmetric secret key through a shared secret key derivation function KDF;

The transfer platform encrypts the encrypted data by using the destination system public key to obtain target encrypted data, and sends the target encrypted data and the source system public key to the destination system;

the destination system decrypts the target data packet by using the private key of the destination system to obtain the encrypted data;

The destination system verifies the digital signature on the encrypted data using a source system public key;

After verification is successful, the transfer platform sends the symmetric key pair to a destination system, so that the destination system uses the symmetric key pair to unlock the encrypted data to obtain the target data transmitted by the source system.

21. A data flow processing apparatus, the apparatus comprising:

a processor, a memory, an input-output unit, and a bus;

the processor is connected with the memory, the input/output unit and the bus;

the memory holds a program which the processor invokes to perform the method of any one of claims 1 to 19.

22. A computer readable storage medium having a program stored thereon, which when executed on a computer performs the method of any of claims 1 to 19.