CN119030693A - Data transmission method and device, storage medium and electronic device - Google Patents

Abstract

The embodiment of the disclosure provides a data transmission method and device, a storage medium, an electronic device method and device, comprising the following steps: generating a communication key that matches the target satellite communication link; transmitting a communication key to a target terminal over a target satellite communication link; under the condition that the target terminal receives the communication key, encrypting the communication data to be transmitted according to the communication key to obtain target ciphertext data; and sending the target ciphertext data to the target terminal through the target network communication link. By the method and the device, the problem of low safety of the key negotiation process before the existing communication process is solved, and the technical effect of improving the safety of the communication key negotiation process is achieved.

Description

Data transmission method and device, storage medium and electronic device

Technical Field

The embodiments of the present disclosure relate to the field of communications, and in particular, to a data sending method and device, a storage medium, and an electronic device method and device.

Background Art

With the popularity of IMS, short messages, voice messages, and general Internet data are all transmitted on mobile networks via IP datagrams. However, the foundation of IMS is still the IP network, with an all-IP architecture based on the Session Initiation Protocol (SIP). The inherent defects and security vulnerabilities of the IP protocol make IMS vulnerable to attacks. The introduction of IMS also introduces security issues of IP networks. With the development of various information services, the transmission of various confidentiality, sensitivity, and privacy will also increase greatly, which puts higher requirements on network security.

The current existing method is to use symmetric encryption technology for SIP data packets, such as DES, AES, IDEA, etc., that is, both parties in communication have a pre-shared key, one party uses the key to encrypt SIP data, and the other party uses the key to decrypt the encrypted data. However, since the key negotiation process also uses the IMS network for transmission, the pre-shared key can be easily stolen by a third party during the negotiation process. Therefore, the communication key negotiation process before the existing communication process has a technical problem of low security.

With respect to the above-mentioned technical problems, the prior art has not yet provided an effective solution.

Summary of the invention

The embodiments of the present disclosure provide a data sending method and device, a storage medium, and an electronic device to at least solve the problem of low security in the negotiation process of communication keys in the related art.

According to one embodiment of the present disclosure, a data sending method is provided, comprising: generating a communication key matching a target satellite communication link; sending the communication key to a target terminal via the target satellite communication link; upon determining that the target terminal has received the communication key, encrypting the communication data to be sent according to the communication key to obtain target ciphertext data; and sending the target ciphertext data to the target terminal via the target network communication link.

Optionally, the above-mentioned generation of a communication key matching the target satellite communication link includes: when the above-mentioned target network communication link is a first type of communication link, generating a symmetric communication key matching the above-mentioned target satellite communication link; when the above-mentioned target network communication link is a second type of communication link, generating an asymmetric communication key pair matching the above-mentioned target satellite communication link; wherein the link bandwidth of the above-mentioned first type of communication link is greater than or equal to a target bandwidth threshold, and the link bandwidth of the above-mentioned second type of communication link is less than the above-mentioned target bandwidth threshold.

Optionally, in the case where the target network communication link is a first type of communication link, after generating the symmetric communication key matching the target satellite communication link, it also includes: obtaining a reference asymmetric communication key pair; encrypting the symmetric communication key using the reference asymmetric communication key pair to obtain a target key ciphertext; and sending the target key ciphertext to the target terminal via the target satellite communication link.

Optionally, in the case where the target network communication link is a second type of communication link, after the asymmetric communication key pair matching the target satellite communication link is generated, it also includes: sending the first public key included in the asymmetric communication key pair to the target terminal through the target satellite communication link, wherein the asymmetric communication key pair includes the first public key and the first private key, the first private key is used to encrypt the communication data in the current terminal to obtain reference ciphertext data, and the first public key is used to decrypt the reference ciphertext data in the target terminal; when the target terminal receives the first public key, receiving the second public key included in the asymmetric communication key pair sent by the target terminal through the target satellite communication link, wherein the asymmetric communication key pair sent by the target terminal includes the second public key and the second private key, the second public key is used to encrypt the reference ciphertext data in the current terminal to obtain the target ciphertext data, and the second private key is used to decrypt the target ciphertext data in the target terminal.

Optionally, when the target terminal receives the communication key, the communication data to be sent is encrypted according to the communication key to obtain the target ciphertext data, including: performing a first encryption operation on the communication data using the first private key to obtain reference ciphertext data; performing a second encryption operation on the reference ciphertext data using the second public key to obtain the target ciphertext data.

Optionally, after sending the target ciphertext data to the target terminal through the target network communication link, the method further includes: when receiving response ciphertext data sent by the target terminal through the target network communication link, performing a first decryption operation on the response ciphertext data according to the first private key to obtain reference response ciphertext data; performing a second decryption operation on the reference response ciphertext data according to the second public key to obtain response communication data.

Optionally, sending the above-mentioned communication key to the target terminal through the above-mentioned target satellite communication link includes: adding the above-mentioned communication key to the target Beidou short message in the current terminal; sending the above-mentioned target Beidou short message to the target Beidou satellite terminal through the current terminal, wherein the above-mentioned target Beidou satellite terminal is used to forward the above-mentioned target Beidou short message to the above-mentioned target terminal.

Optionally, the above-mentioned generation of a communication key matching the target satellite communication link includes: determining a key generation parameter based on a first terminal state parameter of the current terminal and/or a second terminal state parameter of the above-mentioned target Beidou satellite terminal; and generating the above-mentioned communication key matching the above-mentioned target satellite communication link through a key generation algorithm based on the above-mentioned key generation parameters.

Optionally, after sending the target ciphertext data to the target terminal via the target network communication link, the method further includes: deleting the communication key when the communication session between the current terminal and the target terminal ends.

According to another embodiment of the present disclosure, a data sending device is provided, characterized in that it includes: a generation unit for generating a communication key matching a target satellite communication link; a first sending unit for sending the communication key to a target terminal via the target satellite communication link; an encryption unit for encrypting communication data to be sent according to the communication key to obtain target ciphertext data when it is determined that the target terminal has received the communication key; and a second sending unit for sending the target ciphertext data to the target terminal via a target network communication link.

Optionally, the above-mentioned generation unit includes: a first generation module, used to generate a symmetric communication key matching the above-mentioned target satellite communication link when the above-mentioned target network communication link is a first type of communication link; a second generation module, used to generate an asymmetric communication key pair matching the above-mentioned target satellite communication link when the above-mentioned target network communication link is a second type of communication link; wherein the link bandwidth of the above-mentioned first type of communication link is greater than or equal to the target bandwidth threshold, and the link bandwidth of the above-mentioned second type of communication link is less than the above-mentioned target bandwidth threshold.

Optionally, the above-mentioned first generation module includes: an acquisition submodule, used to obtain a reference asymmetric communication key pair; an encryption submodule, used to encrypt the above-mentioned symmetric communication key using the above-mentioned reference asymmetric communication key pair to obtain a target key ciphertext; and a sending submodule, used to send the above-mentioned target key ciphertext to the above-mentioned target terminal through the above-mentioned target satellite communication link.

Optionally, the second generation module includes: a sending submodule, used to send the first public key included in the asymmetric communication key pair to the target terminal through the target satellite communication link, wherein the asymmetric communication key pair includes the first public key and the first private key, and the first private key is used to encrypt the communication data in the current terminal to obtain reference ciphertext data, and the first public key is used to decrypt the reference ciphertext data in the target terminal; a receiving submodule, used to receive the second public key included in the asymmetric communication key pair sent by the target terminal through the target satellite communication link when the target terminal receives the first public key, wherein the asymmetric communication key pair sent by the target terminal includes the second public key and the second private key, and the second public key is used to encrypt the reference ciphertext data in the current terminal to obtain the target ciphertext data, and the second private key is used to decrypt the target ciphertext data in the target terminal.

Optionally, the encryption unit includes: a first encryption module, used to perform a first encryption operation on the communication data using the first private key to obtain reference ciphertext data; a second encryption module, used to perform a second encryption operation on the reference ciphertext data using the second public key to obtain the target ciphertext data.

Optionally, the above-mentioned data sending device also includes: a first decryption module, which is used to perform a first decryption operation on the above-mentioned response ciphertext data according to the above-mentioned first private key to obtain reference response ciphertext data when the response ciphertext data sent by the above-mentioned target terminal is received through the above-mentioned target network communication link; a second decryption module, which is used to perform a second decryption operation on the above-mentioned reference response ciphertext data according to the above-mentioned second public key to obtain response communication data.

Optionally, the above-mentioned first sending unit includes: an adding module, used to add the above-mentioned communication key to the target Beidou short message; a sending module, used to send the above-mentioned target Beidou short message to the target Beidou satellite terminal, wherein the above-mentioned target Beidou satellite terminal is used to forward the above-mentioned target Beidou short message to the above-mentioned target terminal.

Optionally, the above-mentioned generation unit includes: a determination module, used to determine the key generation parameters according to the first terminal state parameters of the current terminal and/or the second terminal state parameters of the above-mentioned target Beidou satellite terminal; a generation module, used to generate the above-mentioned communication key matching the above-mentioned target satellite communication link through a key generation algorithm according to the above-mentioned key generation parameters.

Optionally, the data sending device further includes: a deleting unit, configured to delete the communication key when the communication session between the current terminal and the target terminal ends.

According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when running.

According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

Through the above-mentioned implementation mode of the present disclosure, by generating a communication key matching the target satellite communication link; sending the communication key to the target terminal through the target satellite communication link; in the case of determining that the target terminal has received the communication key, encrypting the communication data to be sent according to the communication key to obtain the target ciphertext data; sending the target ciphertext data to the target terminal through the target network communication link, thereby realizing the encrypted transmission of the communication data and ensuring the communication security. In addition, in the above-mentioned implementation mode, the communication key is negotiated through the satellite communication link, thereby avoiding sharing the same communication link with the network communication link, and realizing the physical isolation between the key negotiation path and the network communication path on the physical network system, thereby avoiding the risk of key leakage caused by sharing the same communication link between the negotiation process and the communication process, thereby solving the technical problem of low security in the key negotiation process of the prior art, and achieving the technical effect of improving the security of the key negotiation process.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a hardware structure block diagram of a mobile terminal according to a data sending method according to an embodiment of the present disclosure;

FIG2 is a flow chart of a data sending method according to an embodiment of the present disclosure;

FIG3 is a flow chart of another data sending method according to an embodiment of the present disclosure;

FIG4 is a flow chart of another data sending method according to an embodiment of the present disclosure;

FIG5 is a timing diagram of a data sending method according to an embodiment of the present disclosure;

FIG6 is a timing diagram of another data sending method according to an embodiment of the present disclosure;

FIG7 is a flowchart of another data sending method according to an embodiment of the present disclosure;

FIG8 is a schematic structural diagram of a data sending device according to an embodiment of the present disclosure.

DETAILED DESCRIPTION

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

Example 1

The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, FIG1 is a hardware structure block diagram of a mobile terminal of a data sending method of an embodiment of the present disclosure. As shown in FIG1 , the mobile terminal may include one or more (only one is shown in FIG1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input/output device 108 for communication functions. It can be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in FIG1 , or have a configuration different from that shown in FIG1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data transmission method in the embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

In this embodiment, a data sending method is provided. FIG. 2 is a flow chart of the data sending method according to an embodiment of the present disclosure. As shown in FIG. 2 , the flow chart includes the following steps:

S202, generating a communication key matching the target satellite communication link;

S204, sending a communication key to a target terminal via a target satellite communication link;

S206, when it is determined that the target terminal has received the communication key, encrypt the communication data to be sent according to the communication key to obtain target ciphertext data;

S208, sending the target ciphertext data to the target terminal through the target network communication link.

Optionally, in this embodiment, the above steps can be applied to a data sending terminal, and by implementing the above steps on the above information sending terminal, data can be exchanged with another data receiving terminal. It can be understood that in this embodiment, the above data sending terminal can be configured with the ability to receive data through the above satellite communication link, for example, it can be the ability to use the above satellite communication link for navigation and positioning, or it can be the ability to use the above satellite communication link for communication. In this embodiment, the specific communication capability type of the above receiving terminal is not limited.

It should be noted that the target satellite communication link in the above step S202 may include but is not limited to a communication link based on a global navigation satellite system (GNSS), or a communication link based on an independent satellite navigation and positioning system, such as but not limited to one or more satellite navigation systems such as the Beidou Navigation Satellite System (BDS), the Global Positioning System (GPS), the GLONASS, and the Galileo Satellite Navigation System (GALILEO). In this embodiment, the specific satellite navigation system type corresponding to the above target satellite communication link is not limited.

Further, in the above step S204, the above communication key may include but is not limited to an asymmetric key, such as an asymmetric key pair determined based on the RSA algorithm, an asymmetric key pair determined by DSA (Digital Signature Algorithm), and an asymmetric key pair determined based on an elliptic curve algorithm; the above communication key may also be a symmetric key, such as a key determined based on DES (Data Encryption Standard) or a key determined based on IDEA (International Data Encryption Algorithm). In this embodiment, the specific type of the above communication key is not limited.

It can be understood that, through the above-mentioned steps S202 and S204, when the communication key generated by this end is sent based on the target satellite communication link, and when it is determined that the receiving end has received the communication key sent by this end, encrypted communication can be performed on the target network communication link based on the communication key known to both ends.

Through the above-mentioned implementation mode of the present disclosure, by generating a communication key matching the target satellite communication link; sending the communication key to the target terminal through the target satellite communication link; in the case of determining that the target terminal has received the communication key, encrypting the communication data to be sent according to the communication key to obtain the target ciphertext data; sending the target ciphertext data to the target terminal through the target network communication link, thereby realizing the encrypted transmission of the communication data and ensuring the communication security. In addition, in the above-mentioned implementation mode, the communication key is negotiated through the satellite communication link, thereby avoiding sharing the same communication link with the network communication link, and realizing the physical isolation between the key negotiation path and the network communication path on the physical network system, thereby avoiding the risk of key leakage caused by sharing the same communication link between the negotiation process and the communication process, thereby solving the technical problem of low security in the key negotiation process of the prior art, and achieving the technical effect of improving the security of the key negotiation process.

As an optional implementation, the above step S202 generates a communication key matching the target satellite communication link, including:

S11, when the target network communication link is a communication link of the first type, generating a symmetric communication key matching the target satellite communication link;

S12, when the target network communication link is a second type of communication link, generating an asymmetric communication key pair that matches the target satellite communication link;

The link bandwidth of the first type of communication link is greater than or equal to the target bandwidth threshold, and the link bandwidth of the second type of communication link is less than the target bandwidth threshold.

It is understandable that in this embodiment, the key type of the communication key used in the communication process can be determined according to the link type of the current target network communication link. The above link type can also be determined according to the current communication scenario. For example, in the voice communication scenario, the ordinary voice packet is sent every 20 milliseconds, which contains 20 milliseconds of voice data. Depending on the voice compression rate, it generally ranges from a few KB to tens of KB, that is, the transmission rate is generally 1MBps, that is, when the bandwidth of the network communication link is small, that is, the amount of data allowed to be exchanged between the terminal and the other end is small, the exchanged data content can be encrypted by the generated asymmetric key; in the video browsing scenario or file upload and download scenario, the bandwidth of the network communication link is large, that is, the amount of data allowed to be exchanged between the terminal and the other end is large, and the exchanged data content can be encrypted by the generated symmetric key.

Specifically, the first type of communication link may be an IMS (IP Multimedia Subsystem) network based on LTE/NR. The network link has high requirements for communication security and a small amount of data. Therefore, an asymmetric key pair may be used to encrypt the data sent each time to improve the security of data transmission. The second type of communication link may be a network link for transmitting a large amount of data. During data transmission in the second type of network link, due to the large amount of data, for example, symmetric encryption may be used to improve data transmission efficiency.

In another optional implementation, a corresponding type of communication key may be generated in response to a selection operation of an encryption mode;

In another optional implementation, a communication key corresponding to the data type may be generated in response to a selection operation of the data type of the data to be transmitted. For example, when the data type of the data to be transmitted indicates that the data is exchanged frequently and the amount of data exchanged each time is small, such as voice type data and text type data, an asymmetric key pair may be generated to improve communication security; when the data type of the data to be transmitted indicates that the amount of data is large, such as video type data, a symmetric key may be generated to improve communication efficiency.

Through the above-mentioned implementation mode of the present application, a communication key of a type corresponding to the target network communication link is generated, thereby adapting to the requirements of different network links for communication efficiency and security.

As an optional implementation, as shown in FIG3, in the case where the target network communication link is a communication link of the first type, after generating a symmetric communication key matching the target satellite communication link, the method further includes:

S302, obtaining a reference asymmetric communication key pair;

S304, encrypting the symmetric communication key using the reference asymmetric communication key pair to obtain a target key ciphertext;

S306, sending the target key ciphertext to the target terminal via the target satellite communication link.

It can be understood that in this embodiment, when the generated key is a symmetric key, a reference asymmetric key can be obtained first to encrypt the symmetric key to be transmitted to the other end through the target satellite communication link, so as to avoid the symmetric key sent to the other end from being transmitted in plain text in the network link, thereby improving the security of the key transmission process.

As an optional implementation, as shown in FIG4 , in the case where the target network communication link is a communication link of the second type, after generating an asymmetric communication key pair matching the target satellite communication link, the method further includes:

S402, sending a first public key included in the asymmetric communication key pair to a target terminal via a target satellite communication link;

The asymmetric communication key pair includes a first public key and a first private key, the first private key is used to encrypt the communication data in the current terminal to obtain reference ciphertext data, and the first public key is used to decrypt the reference ciphertext data in the target terminal;

S404, when the target terminal receives the first public key, receiving a second public key included in the asymmetric communication key pair sent by the target terminal through the target satellite communication link;

Among them, the asymmetric communication key pair sent by the target terminal includes a second public key and a second private key, the second public key is used to encrypt the reference ciphertext data in the current terminal to obtain the target ciphertext data, and the second private key is used to decrypt the target ciphertext data in the target terminal.

It can be understood that in this embodiment, respective asymmetric key pairs can be generated at the data sending end (current terminal) and the receiving end (target terminal), and the public key in the asymmetric key pair can be sent to the other end, thereby realizing the negotiation of the asymmetric key pairs at both ends.

The negotiation process of the asymmetric key pair is described below in conjunction with FIG5. As shown in FIG5, in a specific implementation, terminal A and terminal B may perform key negotiation via a satellite network communication link implemented based on a satellite terminal. Specifically, the steps may include:

S502, terminal A generates a public-private key pair using an asymmetric key pair generation algorithm, including APrivate and APublic;

S504, terminal A sends APublic (i.e., a public key generated by terminal A) to terminal B via a satellite communication link (i.e., a satellite communication link established by a satellite terminal);

S506, in response to receiving Apublic, terminal B generates a public-private key pair using an asymmetric key pair generation algorithm, including BPrivate and BPublic;

S508, terminal B sends BPublic (i.e., the public key generated by terminal B) to terminal A via the satellite communication link;

S510, terminal A determines, based on the received BPublic, that terminal B has successfully received the APublic.

The negotiation process of the symmetric key is described below in conjunction with FIG6. As shown in FIG6, in a specific implementation, terminal A and terminal B may perform key negotiation via a satellite network communication link implemented based on a satellite terminal. Specifically, the steps may include:

S602, terminal A generates a public symmetric key;

S604, terminal A uses BPublic to encrypt the public symmetric key to obtain a key ciphertext; wherein BPublic is the public key in the asymmetric key pair generated by terminal B;

S606, terminal A sends a key ciphertext to terminal B via a satellite communication link;

S608: In response to receiving the key ciphertext, terminal B uses BPrivate to decrypt the key ciphertext to obtain a public symmetric key.

It is understandable that BPrivate and BPublic used in FIG6 can be the asymmetric key pair known in advance by the above-mentioned terminal A and terminal B through negotiation, or can be the key pair determined through negotiation in the process of negotiating the above-mentioned symmetric key pair. For example, in an optional manner, the method shown in FIG5 can be first used to enable terminal A and terminal B to complete the exchange of asymmetric key pairs, and then the method in FIG6 can be executed to encrypt the collaborative process of the symmetric key using the asymmetric key pair determined through negotiation; in another optional manner, after executing step S602 in FIG6, S502 to S510 in FIG5 can be sequentially executed to complete the negotiation of the asymmetric key pair, and then steps S606 to S608 can be executed, so as to realize the negotiation of the asymmetric key pair in the collaborative process of the symmetric key pair, and then encrypt the collaborative process of the symmetric key pair.

The method and steps or the combination of the steps shown in FIG. 5 and FIG. 6 are only examples and do not limit the specific key negotiation process.

As an optional implementation manner, in the case where the target terminal receives the communication key, encrypting the communication data to be sent according to the communication key to obtain the target ciphertext data includes:

S41, performing a first encryption operation on the communication data using the first private key to obtain reference ciphertext data;

S42, using the second public key to perform a second encryption operation on the reference ciphertext data to obtain target ciphertext data.

It can be understood that in this embodiment, after generating respective asymmetric key pairs at the data sending end (current terminal) and the receiving end (target terminal) and completing the negotiation of the asymmetric key pairs, the encryption of communication data can be completed at the current terminal through the above embodiment.

Specifically, it includes at least two encryption steps as above. First, the communication data can be encrypted for the first time by using the first private key generated by the current terminal to obtain reference ciphertext data (i.e., digital signature); then, the reference ciphertext data is encrypted for the second time by using the second public key generated by the opposite terminal to obtain the target ciphertext data to be sent;

It is understandable that, when the other end receives the target ciphertext data, the target ciphertext data can be decrypted in a corresponding manner. Specifically, the target ciphertext data can be first decrypted by the target terminal using the second private key generated by the target terminal itself to obtain the reference ciphertext data (i.e., digital signature); then the reference ciphertext data can be decrypted for the second time using the first public key received by the target terminal to verify the digital signature and obtain the restored communication data.

As an optional implementation manner, after sending the target ciphertext data to the target terminal through the target network communication link, the method further includes:

S51, when receiving response ciphertext data sent by the target terminal through the target network communication link, performing a first decryption operation on the response ciphertext data according to the first private key to obtain reference response ciphertext data;

S52, performing a second decryption operation on the reference response ciphertext data according to the second public key to obtain response communication data.

It is understandable that, when the current terminal receives the response ciphertext data returned by the target terminal, the received response ciphertext data can be decrypted in a corresponding manner. Specifically, the response ciphertext data can be first decrypted by the second public key sent by the target terminal to obtain the reference response ciphertext data (i.e., digital signature); then the reference response ciphertext data can be decrypted for the second time using the first private key of the current terminal itself to verify the digital signature and obtain the restored response communication data.

As an optional implementation manner, the sending of the communication key to the target terminal through the target satellite communication link includes:

S61, adding the communication key to the target Beidou short message in the current terminal;

S62, sending the target Beidou short message to the target Beidou satellite terminal through the current terminal, wherein the target Beidou satellite terminal is used to forward the target Beidou short message to the target terminal.

It can be understood that in this embodiment, the Beidou short message can be used to complete the above-mentioned key negotiation using a network link based on the BDS system. For example, when constructing the short message, a reserved byte in the Beidou short message protocol header can be used to identify that the short message is used for confidential communication. A reserved byte has been reserved in the current Beidou protocol, and the byte has a size of 8 bits. For example, you can use something like '0100 0001' for identification, counting from the right to the left, the 7th bit identifies that this is a Beidou short message for confidential communication, and the 1 in the 1st bit identifies that this is the first key negotiation short message, which can be used to contain the exchanged key.

As an optional implementation manner, the above-mentioned generation of a communication key matching the target satellite communication link includes:

S71, determining a key generation parameter according to a first terminal state parameter of the current terminal and/or a second terminal state parameter of the target Beidou satellite terminal;

S72, generating a communication key matching the target satellite communication link through a key generation algorithm according to the key generation parameters.

Specifically, the communication key generated can be based on the first terminal status parameter of the current terminal and/or the second terminal status parameter of the target Beidou satellite to determine the communication key used for subsequent encrypted communication. For example, the first terminal status parameter that can be obtained may include but is not limited to: the signal strength of the network of the terminal at this time, the signal-to-noise ratio, the underlying hardware crystal oscillator frequency, the number of heartbeats of the operating system, and the terminal battery power; the second terminal status parameter that can be obtained may include but is not limited to: satellite orbit parameters, differential data and other information; when the above-mentioned first terminal status parameter or the second terminal status parameter is obtained, a random number can be constructed through operations such as shifting and XOR. Since the above-mentioned information itself has the characteristics of a true random number, using the random number as the input of the key generation algorithm can significantly improve the security of the generated key.

As an optional implementation, after sending the target ciphertext data to the target terminal through the target network communication link, the method further includes: deleting the communication key when the communication session between the current terminal and the target terminal ends.

It can be understood that in this embodiment, after the confidential communication is completed, the two interacting terminals destroy their respective public and private key pairs; and newly generated public and private keys are used in each communication to ensure one-time one-key, that is, the keys used for each communication are different, thereby improving security performance.

A complete implementation of the present application is described below in conjunction with FIG7 . It should be noted that the present implementation may be a method for bidirectional encrypted confidential communication based on Beidou short message key transmission. The specific steps are as follows:

S702, user A initiates VoLTE secure communication on the dialing interface of the mobile terminal;

Specifically, the calling user (referred to as user A) chooses to initiate a confidential call based on Beidou short message on the dialing interface of the mobile terminal. A separate call initiation button can be set on the interface for this type of confidential call. In response to the triggering operation of the call initiation button, step S704 is executed.

S704, the terminal obtains information such as network signal strength, signal-to-noise ratio, and terminal battery power in real time to construct a random number as an input to the key generation algorithm;

In the above step S704, after receiving the user's confidential call request, the mobile terminal immediately obtains the network's signal strength, signal-to-noise ratio, underlying hardware crystal frequency, operating system heartbeat count, and terminal battery power at this time; and satellite orbit parameters, differential data and other information received from the Beidou satellite are used to construct a random number through operations such as shift and XOR. It can be understood that since the above information itself has the characteristics of a true random number, the random number constructed based on the above information has higher security; after the above random number is constructed, the random number is used as the input of the public key generation algorithm;

S706, the public key generation algorithm generates a public and private key pair of user A, referred to as APrivate, APublic;

S708: User A uses a Beidou short message to carry APublic and sends it to user B.

Specifically, the mobile terminal of user A sends APublic to the called user, referred to as user B, via a Beidou short message; when constructing the short message, a reserved byte in the Beidou short message protocol header can be used to identify that the short message is used for confidential communication. Since a reserved byte has been reserved in the current Beidou protocol, the byte includes 8 bits, and the 8 bits can be used to identify confidential communication. For example, you can use something like '0100 0001' for identification. Counting from the right to the left, the 7th bit identifies that this is a Beidou short message for confidential communication, and the 1 in the 1st bit identifies that this is the first key negotiation short message, which contains user A's public key APublic;

S710, determine whether user B supports confidential communication based on Beidou short message; specifically, after receiving the call from user A, if user B supports confidential communication based on Beidou short message as described in this article, the mobile terminal of user B can receive the Beidou short message containing user A's APublic through its own Beidou short message module, and confirm that the short message contains APublic according to the identification field described in step 708; then continue with step S710-1; on the contrary, if the mobile terminal used by user B does not support confidential communication based on Beidou short message as described in this article, APublic from user A cannot be successfully received;

If user B does not support Beidou-based secure communication, execute steps S710-2 and S710-2-1, and user B responds as a normal incoming call; if user A does not receive the public key fed back by user B within a certain period of time, it prompts the called party that the user does not support Beidou-based secure communication and continues to use normal VoLTE voice communication;

Specifically, the mobile terminal of user A prompts the called user in the display interface and voice at the same time that the current confidential communication is not supported. The user can choose to hang up the call or use non-encrypted ordinary VoLTE voice communication.

S710-1, user B receives Apublic sent by user A via BeiDou short message, and starts its own public key generation algorithm to generate user B's public and private key pair, referred to as BPrivate, BPublic;

Specifically, user B supports the confidential communication based on Beidou short message described in this article. After receiving APublic sent by user A through Beidou short message, user B immediately starts its own key generation process. This step is consistent with the public-private key pair generation method of user A in step 704, and generates user B's public key BPublic and private key BPrivate;

S712, user B sends its own BPublic to calling user A using the Beidou short message system;

User B sends BPublic to the caller, i.e. user A, in the same way as in step 708. When constructing the Beidou short message, user B also uses the reserved bytes of the Beidou short message header for identification. For example, you can use something like '0100 0010' for identification. Counting from the right to the left, the 7th bit indicates that this is a Beidou short message for confidential communication, and the 1 in the 2nd bit indicates that this is the second key negotiation short message, which contains the public key BPublic of user B.

S714, the calling party and the called party start confidential communication;

After user A receives BPublic, the confidential communication between user A and user B can begin; VoLTE voice data is transmitted through RTP data packets; user A uses APrivate to encrypt the original voice data packet for the first time, that is, digitally sign it, and then uses BPublic to encrypt the generated ciphertext for the second time, and then sends the second encrypted ciphertext to user B through the voice communication network link; user B receives the communication ciphertext and obtains it, first uses BPrivate to decrypt it for the first time, and then uses APublic to decrypt the obtained data for the second time to verify user A's digital signature; the above process is the processing flow for the voice data sent by user A to user B, and the voice data sent by user B to user A is also processed according to the same process;

S716, after the confidential communication is completed, user A and user B both destroy their respective public-private key pairs; it is understandable that after the confidential communication is completed, user A and user B destroy their respective public-private key pairs; each communication uses a newly generated public-private key to ensure one-time one-key, thereby improving security performance.

It is understandable that the above implementation can be applied to confidential communications of mobile terminals, specifically, mainly used in encrypted calls between mobile terminals. The two mobile terminals encrypt their respective voice data packets and transmit them on the mobile IMS network, and use the short message service of the Beidou satellite to transfer the encryption and decryption keys.

The security of confidential communication in the above implementation can be achieved in two aspects. First, the key is transmitted through the Beidou short message system, so that the encryption and decryption keys, digital signatures and public key algorithm keys are transmitted through Beidou satellites; and the specific encrypted voice data is transmitted through the mobile IMS network; the two are isolated in the entire system of the access network and the core network; second, the security of the communication process can be improved through the security of the asymmetric encryption process. Therefore, in mobile terminals that support the Beidou system, the security of the confidential communication system is greatly enhanced with minor modifications, and it can be completed by the mobile terminal itself without a third party.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present disclosure.

Example 2

In the present embodiment, a data transmission device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" can implement a combination of software and/or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

FIG8 is a structural block diagram of a data sending device according to an embodiment of the present disclosure. As shown in FIG8 , the device includes:

A generating unit 82, for generating a communication key matching a target satellite communication link;

A first sending unit 84, used to send a communication key to a target terminal via a target satellite communication link;

An encryption unit 86 is used to encrypt the communication data to be sent according to the communication key to obtain target ciphertext data when it is determined that the target terminal has received the communication key;

The second sending unit 88 is used to send the target ciphertext data to the target terminal through the target network communication link.

Optionally, the above-mentioned generation unit includes: a first generation module, used to generate a symmetric communication key matching the target satellite communication link when the target network communication link is a first type of communication link; a second generation module, used to generate an asymmetric communication key pair matching the target satellite communication link when the target network communication link is a second type of communication link; wherein the link bandwidth of the first type of communication link is greater than or equal to the target bandwidth threshold, and the link bandwidth of the second type of communication link is less than the target bandwidth threshold.

Optionally, the above-mentioned first generation module includes: an acquisition submodule, used to obtain a reference asymmetric communication key pair; an encryption submodule, used to encrypt the symmetric communication key using the reference asymmetric communication key pair to obtain a target key ciphertext; and a sending submodule, used to send the target key ciphertext to the target terminal via the target satellite communication link.

Optionally, the above-mentioned second generation module includes: a sending submodule, used to send a first public key included in an asymmetric communication key pair to a target terminal through a target satellite communication link, wherein the asymmetric communication key pair includes a first public key and a first private key, the first private key is used to encrypt communication data in a current terminal to obtain reference ciphertext data, and the first public key is used to decrypt the reference ciphertext data in the target terminal; a receiving submodule, used to receive a second public key included in an asymmetric communication key pair sent by the target terminal through a target satellite communication link when the target terminal receives the first public key, wherein the asymmetric communication key pair sent by the target terminal includes a second public key and a second private key, the second public key is used to encrypt reference ciphertext data in the current terminal to obtain target ciphertext data, and the second private key is used to decrypt the target ciphertext data in the target terminal.

Optionally, the encryption unit includes: a first encryption module, used to perform a first encryption operation on the communication data using a first private key to obtain reference ciphertext data; a second encryption module, used to perform a second encryption operation on the reference ciphertext data using a second public key to obtain target ciphertext data.

Optionally, the above-mentioned data sending device also includes: a first decryption module, which is used to perform a first decryption operation on the response ciphertext data according to a first private key to obtain reference response ciphertext data when response ciphertext data sent by the target terminal is received through the target network communication link; a second decryption module, which is used to perform a second decryption operation on the reference response ciphertext data according to a second public key to obtain response communication data.

Optionally, the above-mentioned first sending unit includes: an adding module, used to add a communication key to a target Beidou short message; a sending module, used to send the target Beidou short message to a target Beidou satellite terminal, wherein the target Beidou satellite terminal is used to forward the target Beidou short message to a target terminal.

Optionally, the above-mentioned generation unit includes: a determination module, used to determine the key generation parameters according to the first terminal state parameters of the current terminal and/or the second terminal state parameters of the target Beidou satellite terminal; a generation module, used to generate a communication key matching the target satellite communication link through a key generation algorithm according to the key generation parameters.

Optionally, the above-mentioned data sending device further includes: a deleting unit, configured to delete the communication key when the communication session between the current terminal and the target terminal ends.

Example 3

An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

Example 4

An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

Obviously, those skilled in the art should understand that the above modules or steps of the present disclosure can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (17)

1. A data transmission method, comprising:

generating a communication key that matches the target satellite communication link;

transmitting the communication key to a target terminal over the target satellite communication link;

Under the condition that the target terminal receives the communication key, encrypting communication data to be sent according to the communication key to obtain target ciphertext data;

and sending the target ciphertext data to the target terminal through a target network communication link.

2. The method of claim 1, wherein the generating a communication key that matches the target satellite communication link comprises:

Generating a symmetric communication key that matches the target satellite communication link if the target network communication link is a first type of communication link;

generating an asymmetric communication key pair that matches the target satellite communication link if the target network communication link is a second type of communication link;

wherein the link bandwidth of the communication link of the first type is greater than or equal to a target bandwidth threshold and the link bandwidth of the communication link of the second type is less than the target bandwidth threshold.

3. The method of claim 2, wherein, in the case where the target network communication link is a first type of communication link, after the generating the symmetric communication key that matches the target satellite communication link, further comprises:

Acquiring a reference asymmetric communication key pair;

encrypting the symmetric communication key by using the reference asymmetric communication key pair to obtain a target key ciphertext;

and sending the target key ciphertext to the target terminal through the target satellite communication link.

4. The method of claim 2, wherein, in the case where the target network communication link is a second type of communication link, after the generating of the asymmetric communication key pair that matches the target satellite communication link, further comprising:

Transmitting a first public key included in the asymmetric communication key pair to the target terminal through the target satellite communication link, wherein the asymmetric communication key pair comprises the first public key and a first private key, the first private key is used for encrypting the communication data in the current terminal so as to obtain reference ciphertext data, and the first public key is used for decrypting the reference ciphertext data in the target terminal;

And under the condition that the target terminal receives the first public key, receiving a second public key included in an asymmetric communication key pair sent by the target terminal through the target satellite communication link, wherein the asymmetric communication key pair sent by the target terminal comprises the second public key and a second private key, the second public key is used for encrypting the reference ciphertext data in the current terminal to obtain target ciphertext data, and the second private key is used for decrypting the target ciphertext data in the target terminal.

5. The method according to claim 4, wherein encrypting the communication data to be transmitted according to the communication key in the case that the target terminal receives the communication key, to obtain target ciphertext data includes:

Performing a first encryption operation on the communication data by using the first private key to obtain the reference ciphertext data;

And performing a second encryption operation on the reference ciphertext data by using the second public key to obtain the target ciphertext data.

6. The method of claim 4, wherein after the sending the target ciphertext data to the target terminal over a target network communication link, further comprises:

Under the condition that response ciphertext data sent by the target terminal are received through the target network communication link, performing first decryption operation on the response ciphertext data according to the first private key to obtain reference response ciphertext data;

And performing a second decryption operation on the reference response ciphertext data according to the second public key to obtain response communication data.

7. The method of claim 1, wherein said transmitting the communication key to a target terminal over the target satellite communication link comprises:

Adding the communication key into a target Beidou short message in a current terminal;

And sending the target Beidou short message to a target Beidou satellite terminal through the current terminal, wherein the target Beidou satellite terminal is used for forwarding the target Beidou short message to the target terminal.

8. The method of claim 7, wherein the generating a communication key that matches the target satellite communication link comprises:

determining a key generation parameter according to a first terminal state parameter of a current terminal and/or a second terminal state parameter of the target Beidou satellite terminal;

And generating the communication key matched with the target satellite communication link through a key generation algorithm according to the key generation parameter.

9. The method of claim 1, wherein after the sending the target ciphertext data to the target terminal over a target network communication link, further comprises:

And deleting the communication key when the communication session between the current terminal and the target terminal is ended.

10. A data transmission apparatus, comprising:

A generation unit for generating a communication key matching the target satellite communication link;

A first transmitting unit configured to transmit the communication key to a target terminal through the target satellite communication link;

The encryption unit is used for encrypting the communication data to be sent according to the communication key to obtain target ciphertext data under the condition that the target terminal receives the communication key;

And the second sending unit is used for sending the target ciphertext data to the target terminal through a target network communication link.

11. The apparatus of claim 10, wherein the generating unit comprises:

A first generation module, configured to generate a symmetric communication key that matches the target satellite communication link when the target network communication link is a first type of communication link;

The second generation module is used for generating an asymmetric communication key pair matched with the target satellite communication link under the condition that the target network communication link is a second type communication link;

wherein the link bandwidth of the communication link of the first type is greater than or equal to a target bandwidth threshold and the link bandwidth of the communication link of the second type is less than the target bandwidth threshold.

12. The apparatus of claim 11, wherein the first generation module comprises:

An acquisition sub-module for acquiring a reference asymmetric communication key pair;

The encryption sub-module is used for encrypting the symmetric communication key by using the reference asymmetric communication key pair to obtain a target key ciphertext;

And the sending sub-module is used for sending the target key ciphertext to the target terminal through the target satellite communication link.

13. The apparatus of claim 11, wherein the second generating module comprises:

A transmitting sub-module, configured to transmit, to the target terminal through the target satellite communication link, a first public key included in the asymmetric communication key pair, where the asymmetric communication key pair includes the first public key and a first private key, the first private key is used to encrypt the communication data in the current terminal to obtain reference ciphertext data, and the first public key is used to decrypt the reference ciphertext data in the target terminal;

And the receiving sub-module is used for receiving a second public key included in the asymmetric communication key pair sent by the target terminal through the target satellite communication link under the condition that the target terminal receives the first public key, wherein the asymmetric communication key pair sent by the target terminal comprises the second public key and a second private key, the second public key is used for encrypting the reference ciphertext data in the current terminal to obtain target ciphertext data, and the second private key is used for decrypting the target ciphertext data in the target terminal.

14. The apparatus of claim 10, wherein the first transmitting unit comprises:

the adding module is used for adding the communication key into the target Beidou short message;

The sending module is used for sending the target Beidou short message to a target Beidou satellite terminal, wherein the target Beidou satellite terminal is used for forwarding the target Beidou short message to the target terminal.

15. The apparatus of claim 14, wherein the generating unit comprises:

The determining module is used for determining a key generation parameter according to the first terminal state parameter of the current terminal and/or the second terminal state parameter of the target Beidou satellite terminal;

And the generation module is used for generating the communication key matched with the target satellite communication link through a key generation algorithm according to the key generation parameter.

16. A computer readable storage medium, characterized in that a computer program is stored in the computer readable storage medium, wherein the computer program, when being executed by a processor, implements the steps of the method according to any of the claims 1 to 9.

17. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method as claimed in any one of claims 1 to 9 when the computer program is executed.