CN112073370B - Client encryption communication method - Google Patents

Abstract

The invention relates to a client encrypted communication method, including an encryption method for the first information transmission of a first client, a decryption method for the first information reception of a second client, an encryption method for replying information of the second client, and a method for the first information reception and decryption of the first client , the method for encrypting the first information sent by the first client includes the following steps: generating a first virtual data header; generating first user data; generating a second virtual data header, adding the first data receiving whitelist; establishing a first mapping relationship table and storing ; generate the first ciphertext and send it; generate the second user data; encrypt the data body of the second user data to obtain the third user data and send it. The invention has the advantages of: ensuring that the original data header information is not leaked and can inform the opposite client of the virtual data header corresponding to the original data header; preventing hackers from intercepting the data header for data counterfeiting; avoiding the inability to determine the ciphertext due to the encryption of the data header size and when to start decryption.

Description

A client-side encrypted communication method

technical field

The invention relates to the technical field of communication security, in particular to a client encrypted communication method.

Background technique

Since the 20th century, with the development of computer technology, network transmission technology has become an important means of information transmission in the fields of industry, agriculture and national defense, and gradually began to enter other fields of society. As the network gradually penetrates into people's life, work and entertainment, information security issues during network transmission have increasingly become a focus of attention. In order to improve the security of user information in network transmission, network transmission data encryption technology has gradually become a research hotspot. At present, the commonly used data encryption technologies include digital signature authentication, personal identity authentication, and electronic seal. Although we have been able to achieve a relatively secure network data environment through these methods, there are still incidents of data being stolen and websites being attacked by hackers.

Currently, end-to-end encryption methods are widely used in computer network data transmission encryption methods, and end-to-end encryption methods are always in the form of ciphertext from the sender to the receiver during the data transmission process. Therefore, the entire process of data transmission can be protected. In the encrypted transmission of wireless network data, the user data at the application layer is generally encrypted. The user data of the application layer includes a data header and a data body, wherein the data header contains some important information related to the data body, such as version number, data length, and data type. At present, when encrypting user data, only the data body is mostly encrypted, and the data header containing some important information related to the data is not encrypted. At this time, if hacker attacks or field tampering and other illegal acts occur, hackers will be able to intercept or modify some important information related to user data. For example, if the data header is not encrypted, if the hacker intercepts the information in the data header at this time, it may send some junk information with the same data header as the normal data body to the receiving end, occupying data transmission resources and thus cause business failure. If the data header is encrypted, the receiver cannot determine the length of the data body, the size of the ciphertext, and when to start decryption.

SUMMARY OF THE INVENTION

The main existing encryption scheme of the present invention only encrypts the data body, but does not encrypt the data body, so that the hacker can affect the business by intercepting the data header, and the encryption of the data header will solve the problem of the communication business. And the virtual data header will change in real time based on the encrypted communication method of the application layer.

The technical solution adopted by the present invention to solve the technical problem is, a client encrypted communication method for mutual communication between a first client and a second client, including an encryption method for the first client to send information, a second A method for decrypting information received by a client for the first time, a method for encrypting information replying to a second client, and a method for decrypting information received by a first client for the first time. The encryption method for sending information for the first time on the first client includes the following steps:

S01: generate a first virtual data header;

S02: take the original data header as the data header, take the first virtual data header as the data body to generate the first user data, and the original data header is the actual data header of the client;

S03: Generate a second virtual data header according to the first virtual data header, and add the second virtual data header to the first data receiving whitelist;

S04: establish and store a first mapping relationship table between the original data header and the first virtual data header and the second virtual data header;

S05: Encrypt the data header and data body of the first user data to generate a first ciphertext;

S06: Send the first ciphertext by using the UDP protocol;

S07: use the first virtual data header as the data header, and use the data input from the user data as the data body to generate the second user data;

S08: Encrypt the data body of the second user data to obtain the third user data and send it.

When establishing communication, first inform the other party of the original data header and virtual data header information, and then use the virtual data header to communicate, and each virtual data header is only used once to prevent hackers from intercepting the data header and attacking; UDP protocol is used for ciphertext After sending, the decryption starts only after the information is completely received by the second client, which avoids the problem that the size of the ciphertext and when to start decryption cannot be determined due to the encryption of the data header.

As a preferred solution of the above solution, the method for decrypting the first information received by the second client includes the following steps:

S11: Screen the received data, and retain the first type of user data whose data header and data body are both ciphertext;

S12: Decrypt the first type of user data to obtain the original data header and the first virtual data header;

S13: establish and store a second mapping relationship table between the original data header and the first virtual data header;

S14: adding the first virtual data header to the second data receiving whitelist, and waiting to receive user data whose data header is the first virtual data header;

S13: after receiving the user data whose data header is the first virtual data header, decrypt the data body of the user data;

S16: generate a second virtual data header according to the data header of the user data and add the second virtual data header to the second mapping relationship table;

S17: Add the second virtual data header to the second data receiving white list.

As a preferred solution of the above solution, the second client information reply encryption method includes the following steps:

S21: Generate fourth user data with the second virtual data header as the data header and the second client user input information as the data body;

S22: Encrypt the data body of the fourth user data to obtain the fifth user data and send it

S23: Generate a third virtual data header according to the second virtual data header;

S24: Add the third virtual data header to the second mapping relationship table and the second data receiving whitelist;

S25: Delete the second dummy data header from the second data receiving whitelist.

As a preferred solution of the above solution, the method for first receiving and decrypting information of the first client includes the following steps:

S31: Screen the received data, and retain the user data whose data header is the second virtual data header;

S32: Decrypt the data body of the user data;

S33: Generate a third virtual data header according to the second virtual data header;

S34: Add the third virtual data header to the first mapping relationship table and the first data receiving whitelist;

S35: Delete the second virtual data header from the first data receiving whitelist.

As a preferred solution of the above solution, the virtual data header includes a version number, a data length and a data type, and the data length is the length of the data body that forms user data with the virtual data header. The version number and data type Change according to preset rules.

As a preferred solution of the above solution, during the communication process between the first client and the second client, different data headers are used for each user data communication.

As a preferred solution of the above solution, after one of the first client and the second client receives the information, the first data receiving whitelist and the second data receiving whitelist are the same, and the first mapping relationship table It is the same as the second mapping relationship table.

The advantages of the present invention are: the application data composed of the original data header and the virtual data header is encrypted as a whole and sent to the other party, thereby establishing a communication relationship, ensuring that the original data header information is not leaked, and can inform the counterparty client of the corresponding original data header. Virtual data header; after the communication relationship is established, the virtual data header is used for communication and the virtual data header changes with the information transmission, which can prevent hackers from intercepting the data header for data counterfeiting; using the UDP protocol for cipher text transmission, when the information is completely blocked by the second client Decryption starts after the terminal receives it, which avoids the problem that the size of the ciphertext and when to start decryption cannot be determined due to the encryption of the data header.

Description of drawings

FIG. 1 is a schematic flowchart of a method for encrypting first information transmission by a first client in an embodiment.

FIG. 2 is a schematic flowchart of a method for decrypting information received by a second client for the first time in an embodiment.

FIG. 3 is a schematic flowchart of a method for encrypting information replying to a second client in an embodiment.

FIG. 4 is a schematic flowchart of a method for decrypting information received by a first client for the first time in an embodiment.

Detailed ways

The technical solutions of the present invention will be further described below through examples and in conjunction with the accompanying drawings.

Example:

In this embodiment, a client-side encrypted communication method is used for mutual communication between a first client and a second client, including an encryption method for the first client to send information, a second client to receive and decrypt for the first time, and a second The client-side information reply encryption method and the first client's first-time information receiving and decrypting method, the first client-side first-time information sending encryption method includes as shown in Figure 1, the following steps:

S01: generate a first virtual data header, the virtual data header includes a version number, a data length and a data type, the data length is the length of a data body that forms user data with the virtual data header, and the version number and the data type are according to preset The rules are changed, and the same rules are stored in the first client and the second client, that is, after the first virtual data header is known, the first client and the second client generate the second virtual data header according to the first virtual data header. The virtual data header is the same, which realizes the synchronization of the virtual data header between the two clients, and provides a basis for the communication between the two clients using the virtual data header;

S02: generating the first user data with the original data header as the data header and the first virtual data header as the data body;

S03: Generate a second virtual data header according to the first virtual data header, and add the second virtual data header to the first data receiving whitelist;

S04: establish and store a first mapping relationship table between the original data header, the first virtual data header and the second virtual data header; the original data header corresponding to the virtual data header can be determined through the first mapping relationship table, so as to facilitate the storage of communication data ;

S05: Encrypt the data header and data body of the first user data to generate a first ciphertext;

S06: The first ciphertext is sent by using the UDP protocol; when the UDP protocol is transmitted, the receiving end has only two situations: complete data is received and no data is received. If the data is lost during transmission, the sender needs to retransmit. Therefore, the second client will not start decryption until the complete data is received, to avoid the inability to determine the size of the ciphertext and when to start due to the encryption of the data header. decryption problem;

S07: use the first virtual data header as the data header, and use the data input from the user data as the data body to generate the second user data;

S08: Encrypt the data body of the second user data to obtain the third user data and send it.

As shown in Figure 2, the method for decrypting the first information received by the second client includes the following steps:

S11: Screen the received data, and retain the first type of user data whose data header and data body are both ciphertext;

S12: Decrypt the first type of user data to obtain the original data header and the first virtual data header;

S13: establish and store a second mapping relationship table between the original data header and the first virtual data header;

S14: adding the first virtual data header to the second data receiving whitelist, and waiting to receive user data whose data header is the first virtual data header;

S13: after receiving the user data whose data header is the first virtual data header, decrypt the data body of the user data;

S16: generate a second virtual data header according to the data header of the user data and add the second virtual data header to the second mapping relationship table;

S17: Add the second virtual data header to the second data receiving white list.

As shown in FIG. 3, the second client information reply encryption method includes the following steps:

S21: Generate fourth user data with the second virtual data header as the data header and the second client user input information as the data body;

S22: Encrypt the data body of the fourth user data to obtain the fifth user data and send it

S23: Generate a third virtual data header according to the second virtual data header;

S24: Add the third virtual data header to the second mapping relationship table and the second data receiving whitelist;

S25: Delete the second dummy data header from the second data receiving whitelist.

As shown in FIG. 4 , the method for decrypting information received by the first client for the first time includes the following steps:

S31: Screen the received data, and retain the user data whose data header is the second virtual data header;

S32: Decrypt the data body of the user data;

S33: Generate a third virtual data header according to the second virtual data header;

S34: Add the third virtual data header to the first mapping relationship table and the first data receiving whitelist;

S35: Delete the second virtual data header from the first data receiving whitelist.

When the first client communicates with the second client for the first time and immediately sends the next message to the second client, the following steps are performed:

S41: Generate user data with the second virtual data header as the data header and the user input information of the first client as the data body;

S42: Encrypt the data body of the user data to obtain the encrypted user data and send it

S43: Generate a third virtual data header according to the second virtual data header;

S44: Add the third virtual data header to the first mapping relationship table and the first data receiving whitelist;

S45: Delete the second virtual data header from the first data receiving whitelist.

That is, during the communication process between the first client and the second client, different data headers are used for each user data communication. For example, after the first communication, the first client continuously sends 5 messages to the second client. The data headers of these 5 messages are data header a, data header b, data header c, data header d, data header The header e and the data header b are generated on the basis of the data header a according to preset rules, the data header c is generated on the basis of the data header b according to the preset rules, and so on. At the same time, after receiving the information, the second client also generates the next data header according to the data header of the information in order to receive the next information from the first client or send the information to the first client. Similarly, when the first client After the client receives or sends a message, it will generate a new data header according to the data header of the message, so as to send or receive the message again, that is, either the first client or the second client receives the message. After that, the first data receiving whitelist and the second data receiving whitelist are the same, and the first mapping relationship table and the second mapping relationship table are the same.

The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which the present invention pertains can make various modifications or additions to the described specific embodiments or substitute in similar manners, but will not deviate from the spirit of the present invention or go beyond the definitions of the appended claims range.

Claims (6)

1. A client-side encrypted communication method, used for mutual communication between the first client and the second client, is characterized in that: comprising the first client's first information sending encryption method, the second client's first information receiving decryption method , the second client information reply encryption method and the first client first information reception decryption method, the first client first information transmission encryption method comprises the following steps: S01: generate a first virtual data header; S02: generating the first user data with the original data header as the data header and the first virtual data header as the data body; S03: Generate a second virtual data header according to the first virtual data header, and add the second virtual data header to the first data receiving whitelist; S04: establish and store a first mapping relationship table between the original data header and the first virtual data header and the second virtual data header; S05: Encrypt the data header and data body of the first user data to generate a first ciphertext; S06: Send the first ciphertext by using the UDP protocol; S07: use the first virtual data header as the data header, and use the data input from the user data as the data body to generate the second user data; S08: Encrypt the data body of the second user data to obtain the third user data and send; The method for decrypting the first information received by the second client includes the following steps: S11: Screen the received data, and retain the first type of user data whose data header and data body are both ciphertext; S12: Decrypt the first type of user data to obtain the original data header and the first virtual data header; S13: establish and store a second mapping relationship table between the original data header and the first virtual data header; S14: adding the first virtual data header to the second data receiving whitelist, and waiting to receive user data whose data header is the first virtual data header; S15: after receiving the user data whose data header is the first virtual data header, decrypt the data body of the user data; S16: generate a second virtual data header according to the data header of the user data in step S15 and add the second virtual data header to the second mapping relationship table; S17: Add the second virtual data header to the second data receiving white list. 2. A client-side encrypted communication method according to claim 1, wherein: the second client-side information reply encryption method comprises the following steps: S21: Use the second virtual data header as the data header, and use the second client user input information as the data body to generate fourth user data; S22: Encrypt the data body of the fourth user data to obtain the fifth user data and send it S23: Generate a third virtual data header according to the second virtual data header; S24: Add the third virtual data header to the second mapping relationship table and the second data receiving whitelist; S25: Delete the second dummy data header from the second data receiving whitelist. 3. A kind of client encrypted communication method according to claim 2, is characterized in that: described first client first information reception decryption method, comprises the following steps: S31: Screen the received data, and retain the user data whose data header is the second virtual data header; S32: Decrypt the data body of the user data; S33: Generate a third virtual data header according to the second virtual data header; S34: Add the third virtual data header to the first mapping relationship table and the first data receiving whitelist; S35: Delete the second virtual data header from the first data receiving whitelist. 4. A client encrypted communication method according to claim 1, 2 or 3, wherein the virtual data header includes a version number, a data length and a data type, and the data length is the same as the virtual data header. The length of the data body constituting the user data, the version number and the data type are changed according to preset rules. 5 . The client-side encrypted communication method according to claim 1 , wherein in the communication process between the first client and the second client, different data headers are used for each user data communication. 6 . 6. A client-side encrypted communication method according to claim 3, wherein after one of the first client and the second client receives the information, the first data receiving whitelist and the first data The second data receiving white list is the same, and the first mapping relationship table and the second mapping relationship table are the same.

Images