Dual-encryption data processing method and device, equipment, medium and product

Abstract

The embodiment of the invention discloses a dual-encryption data processing method and device, equipment, a storage medium and a product, which are applied to a data sending end, and are characterized in that when a data transmission request is detected to be initiated, a first symmetric key is generated, and a request parameter corresponding to the data transmission request is encrypted based on the first symmetric key to obtain an encrypted request parameter; the first symmetric key is encrypted based on a public key in the asymmetric key to obtain a first encrypted key, and the public key in the asymmetric key is generated and fed back by the request processing end; and sending the encryption request parameter and the first encryption key as the target transmission parameter in the data transmission request to the request processing end, so that the request processing end determines the response data after decrypting the target transmission parameter, and feeds back the encrypted response data after encryption processing, thereby improving the security of the data.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of secure communication technology, and in particular to a double-encrypted data processing method, device, equipment, medium and product. Background Art

[0002] With the continuous development of the field of secure communications, encryption technology is an important means to achieve information confidentiality, which can prevent confidential data transmitted between the data sender and the request processor from being leaked or tampered with.

[0003] Interface encryption technology mainly relies on common algorithms such as symmetric encryption algorithms and asymmetric encryption algorithms. Although symmetric encryption algorithms have simple encryption and decryption processes and high computational efficiency, and are suitable for transmitting large amounts of data, they present great challenges in key management and distribution. In particular, during the key transmission process, if the key is leaked, data security will be completely invalidated; asymmetric encryption algorithms have high security and can provide identity authentication and data integrity protection, but they have high computational complexity, especially when the amount of data is large, which has a greater impact on system performance and is suitable for processing small amounts of data. Summary of the invention

[0004] The embodiments of the present invention provide a double-encrypted data processing method, apparatus, device, medium and product to fully utilize the high computational efficiency of symmetric encryption algorithms and the high reliability of asymmetric encryption algorithms, thereby achieving the purpose of improving the security of request parameters and response data.

[0005] In a first aspect, an embodiment of the present invention provides a double-encrypted data processing method, which is applied to a data sending end, and the method includes:

[0006] When a data transmission request is detected, a first symmetric key is generated to encrypt a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter;

[0007] Encrypting the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end;

[0008] The encryption request parameter and the first encryption key are sent to the request processing end as the target transmission parameter in the data transmission request, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process.

[0009] Furthermore, when a data transmission request is detected, a first symmetric key is generated.

[0010] In response to a triggering operation on the first control in the data sending end, initiating the data transmission request;

[0011] A first symmetric key is generated in the data sending end based on a preset symmetric encryption algorithm.

[0012] Furthermore, the method further comprises:

[0013] Upon receiving the encrypted response data fed back by the request processing end, decrypting the second encryption key in the encrypted response data based on the public key to obtain a second symmetric key; wherein the second encryption key is a key obtained by encrypting the generated second symmetric key by the request processing end;

[0014] The encrypted response data is decrypted based on the second symmetric key to obtain target data corresponding to the data transmission request.

[0015] In a second aspect, an embodiment of the present invention provides a double-encrypted data processing method, which is applied to a request processing end, and the method includes:

[0016] Receiving a data transmission request initiated by a data sending end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key;

[0017] decrypting the first encryption key based on the private key in the asymmetric key to obtain the first symmetric key, and decrypting the encryption request parameter based on the first symmetric key to obtain the request parameter in the data transmission request;

[0018] The target data corresponding to the request parameter is determined, and the encrypted response data is obtained after encrypting the target data.

[0019] Further, after encrypting the target data, the encrypted response data is obtained, and the method includes:

[0020] generating a second symmetric key;

[0021] Encrypting the target data based on the second symmetric key to obtain encrypted response data, and encrypting the second symmetric encryption key based on the private key to obtain a second encryption key;

[0022] The second encryption key is sent to the data sending end as data in the encrypted response data, so that the data sending end decrypts the encrypted response data to obtain the target data corresponding to the data transmission request.

[0023] A third aspect: An embodiment of the present invention further provides a double-encrypted data processing device, which is applied to a data sending end, and the device includes:

[0024] A request parameter generation module, configured to generate a first symmetric key when a data transmission request is detected, and to encrypt a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter;

[0025] A first encryption key generation module, configured to encrypt the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end;

[0026] The target transmission parameter sending module is used to send the encryption request parameter and the first encryption key as the target transmission parameter in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process.

[0027] In a fourth aspect, an embodiment of the present invention further provides a double-encrypted data processing device, which is applied to a request processing end, and the device includes:

[0028] A data request receiving module, configured to receive a data transmission request initiated by a data transmitting end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key;

[0029] a request parameter decryption module, configured to decrypt the first encryption key based on a private key in the asymmetric key to obtain the first symmetric key, and decrypt the encrypted request parameter based on the first symmetric key to obtain the request parameter in the data transmission request;

[0030] The encrypted response data generating module is used to determine the target data corresponding to the request parameters, and obtain the encrypted response data after encrypting the target data.

[0031] In a fifth aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0032] at least one processor;

[0033] and with said at least one memory;

[0034] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any double-encrypted data processing method described in any embodiment of the present invention.

[0035] In a sixth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the double-encrypted data processing method as described in any of the embodiments of the present disclosure.

[0036] In a seventh aspect, an embodiment of the present invention further provides a computer program product, comprising a computer program, which, when processed and executed, implements a double-encrypted data processing method as described in any one of the embodiments of the present invention.

[0037] The technical solution of the embodiment of the present invention, when applied to a data sending end, generates a first symmetric key when a data transmission request is detected, and encrypts the request parameters corresponding to the data transmission request based on the first symmetric key to obtain encrypted request parameters; encrypts the first symmetric key based on the public key in the asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end; sends the encrypted request parameters and the first encryption key to the request processing end as the target transmission parameters in the data transmission request, so that the request processing end decrypts the target transmission parameters, determines the response data, and feeds back the encrypted response data after encryption. The technical solution provided by this embodiment improves the security of the request parameters of the data sending end by doubly encrypting the request parameters, and reduces the possibility of interception or tampering during the transmission of the request parameters; the technical solution of the embodiment of the present invention, when applied to the request processing end, receives the data transmission request initiated by the data sending end; wherein the data transmission request includes the encrypted request parameters after encrypting the request parameters in the data transmission request based on the first symmetric key, and the first encryption key after encrypting the first symmetric key; the first encryption key is decrypted based on the private key in the asymmetric key to obtain the first symmetric key, and the encrypted request parameters are decrypted based on the first symmetric key to obtain the request parameters in the data transmission request; the target data corresponding to the request parameters is determined, and the encrypted response data is obtained after the target data is encrypted. The technical solution provided by this embodiment obtains the corresponding data by decrypting and processing the target transmission parameters. Then, the corresponding data is encrypted to obtain the encrypted response data, which improves the security of the response data and reduces the possibility of interception or tampering during the transmission of the response data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 is a schematic diagram of a symmetric key provided by an embodiment of the present invention;

[0040] Figure 2 is a schematic diagram of an asymmetric key provided by an embodiment of the present invention;

[0041] Figure 3 is a flow chart of a double-encrypted data processing method applied to a data sending end provided by an embodiment of the present invention;

[0042] Figure 4 A flowchart of obtaining target data corresponding to transmission data provided by an embodiment of the present invention;

[0043] Figure 5 is a flow chart of a double-encrypted data processing method applied to a request processing end provided by an embodiment of the present invention;

[0044] Figure 6 It is a schematic diagram of a display process applied to a data sending end and a data processing end provided by an embodiment of the present invention;

[0045] Figure 7 It is a structural schematic diagram of a double-encrypted data processing device applied to a data sending end provided by an embodiment of the present invention;

[0046] Figure 8 It is a structural schematic diagram of a double-encrypted data processing device applied to a request processing end provided by an embodiment of the present invention;

[0047] Fig. 9 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0050] When introducing the solution provided by the embodiment of the present invention, the application scenario can be explained exemplarily first. The solution provided by the embodiment of the present invention can be applied to any scenario that requires data encryption processing. That is, as long as data encryption processing is involved, the solution provided by the embodiment of the present invention can be used to process it.

[0051] Before performing data encryption processing operations based on the solution provided in the embodiment of the present invention, the data encryption processing method and the data decryption processing method can be introduced first. Information that needs to be kept confidential is called "plaintext", and information after encryption is called "ciphertext". Data encryption processing is to encrypt data by using an encryption algorithm to achieve the effect of protecting the privacy of the encrypted data. The basic process of data encryption processing is to process the original data according to a certain algorithm to generate unreadable "ciphertext"; decryption is the process of converting "ciphertext" into "plaintext".

[0052] Next, we will introduce the symmetric encryption algorithms and asymmetric encryption algorithms that are mainly relied on in the encryption and decryption data processing methods.

[0053] like Figure 1 As shown in the figure, symmetric encryption is an encryption algorithm. When the sender uses a symmetric encryption algorithm to send a request to the receiver, the key is also sent to the receiver. Therefore, in symmetric encryption, the sender and the receiver use the same key to encrypt and decrypt data, so the symmetric encryption algorithm is an encryption technology that uses the same key for encryption and decryption. Common symmetric encryption algorithms include Advanced Encryption Standard (AES) and Data Encryption Standard (DES).

[0054] In symmetric encryption, the encryption and decryption process is as follows: First, the sender uses the key to encrypt the plaintext to generate the ciphertext. Then, the receiver uses the same key to decrypt the ciphertext and restore it to the plaintext. The advantages of symmetric encryption are fast speed, simple encryption and decryption process, and high encryption efficiency, so it is suitable for transmitting large amounts of data. However, symmetric encryption has some security disadvantages. First, the security of the key is critical. If the key is leaked, the encrypted data will be cracked. Second, symmetric encryption cannot provide identity authentication and data integrity protection, that is, it is impossible to determine whether the sender of the message is trustworthy and whether the data has been tampered with.

[0055] like Figure 2 As shown in the figure, asymmetric encryption is another encryption algorithm. Asymmetric encryption keys include private keys and public keys. In asymmetric encryption, data is encrypted using a public key and decrypted using the corresponding private key. The sender's private key can only be held by the owner of the key and kept secret. So unlike symmetric encryption, asymmetric encryption uses a pair of different keys for encryption and decryption. If the key is generated by the sender, the sender will save the private key and broadcast all the public keys to the receiver; if the key is generated by the receiver, the receiver will save the private key and broadcast all the public keys to the sender.

[0056] Asymmetric encryption algorithms are characterized by high security and the ability to provide identity authentication and data integrity protection. Commonly used asymmetric encryption algorithms include Rivest Shamir Adleman (RSA) and Elliptic Curve Cryptography (ECC). In asymmetric encryption, the encryption and decryption process is as follows: the sender uses the receiver's public key to encrypt the plaintext and generate the ciphertext. The receiver uses its own private key pair to decrypt the ciphertext and restore it to plaintext. The advantage of asymmetric encryption is that it is highly secure and can provide identity authentication and data integrity protection. Since only the holder of the private key can decrypt, asymmetric encryption can securely transmit the public key in an insecure communication channel. However, asymmetric encryption is characterized by slow speed and relatively complex encryption and decryption processes, and is suitable for processing small amounts of data.

[0057] In actual applications, based on symmetric encryption and asymmetric encryption algorithms, data sending end requests and request processing end data are processed. There are certain differences in the tasks performed by the data sending end and the request processing end. Now take the data sending end as an example to illustrate.

[0058] The data sending end is the entity responsible for sending requests in network communication. The data sending end can be a client or a server. Exemplarily, after the two ends establish a connection based on the transmission control protocol, one end can be used as the data sending end and the other end as the request processing end.

[0059] Embodiment 1

[0060] Figure 3 It is a flow chart of a double-encrypted data processing method applied to a data sending end provided in Embodiment 1 of the present invention. The disclosed embodiment is applicable to any scenario where data encryption processing is required during data transmission or reception. The method can be executed by a double-encrypted data processing device, which can be implemented in the form of software / or hardware. Optionally, the double-encrypted data processing device applied to the data sending end can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0061] like Figure 3 As shown, the method includes:

[0062] S110. When a data transmission request is detected, a first symmetric key is generated to encrypt a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter.

[0063] Among them, the data transmission request is initiated by the data sending end. The purpose of initiating the data transmission request is to require the request processing end to execute a request for a certain event, or to require the request processing end to feedback the corresponding data of the request. The data transmission request is generated based on certain trigger operations of the data sending end. For example, the data sending end pre-sets the corresponding control input by the command line, and the control is used to enter instructions in the command line. When the data sending end clicks the confirmation control, the computer generates a request based on the edited content and sends the request to the request processing end to obtain the data corresponding to the request.

[0064] Among them, request parameters refer to the data submitted by the browser to the server through the request. The request parameters can mainly include the address corresponding to the data initiator, the type of data required, and the specific content, etc. Request parameters are used to represent the data or information carried by the data sender when sending a request to the request processor. According to the different types and uses of request parameters, the data sender can send requests to the server in a flexible way. Request parameters include obtaining, updating or submitting data, etc.

[0065] The first symmetric key is a pair of symmetric keys generated by the data sending end when the data sending end detects a data transmission request. The first symmetric key is used to encrypt the request parameters corresponding to the data transmission request. Exemplarily, the data sending end may be a client, and the symmetric key may be a random AES key. The generation of the AES key usually uses a high-quality random number generator to ensure unpredictability and security.

[0066] In this embodiment, when it is detected that the data sending end initiates a data transmission request, a first symmetric key is generated, and based on the symmetric key, the request parameters corresponding to the data transmission request are encrypted to obtain encrypted request parameters.

[0067] In this embodiment, the first symmetric key is generated when a data transmission request is detected. The first symmetric key is generated in response to a trigger operation on the first control in the data sending end to initiate a data transmission request; the first symmetric key is generated in the data sending end based on a preset symmetric encryption algorithm.

[0068] S120. Encrypt the first symmetric key based on the public key in the asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end.

[0069] Among them, the asymmetric key includes a public key and a private key. When the data sending end sends a request to the request processing end, it obtains the public key of the request processing end; or the data sending end sends a request and the data sending end obtains the public key. The public key will be used to encrypt the first symmetric key to obtain the first encryption key to ensure that the first symmetric key will not be intercepted or tampered with during the transmission process. Since the asymmetric key has the characteristics of slow speed and relatively complex encryption and decryption process, we can use the asymmetric key to encrypt the symmetric key to ensure confidentiality when the amount of encrypted data is small.

[0070] S130, sending the encryption request parameter and the first encryption key as the target transmission parameter in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process.

[0071] The target transmission parameters in the data transmission request include the encryption request parameters encrypted by the first symmetric key and the first encryption key encrypted by the first symmetric key.

[0072] Response data refers to the data corresponding to the request obtained by the request processing end after decrypting the target transmission parameters. Encrypted response data is the encrypted response data.

[0073] In this embodiment, the result of the response data includes processing results, information generated by the server, status information, etc.

[0074] Exemplarily, after the encryption request parameter and the first encryption key are sent to the server as target transmission parameters, the server performs a decryption operation on them, determines the response data, encrypts the response data, and then sends it to the client.

[0075] In this embodiment, when a data transmission request is detected, a first symmetric key is generated, and the request parameters corresponding to the data transmission request are encrypted based on the first symmetric key to obtain encrypted request parameters, and then the first symmetric key is encrypted based on the public key in the asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end, thereby sending the encrypted request parameters and the first encryption key as the target transmission parameters in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameters, determines the response data, and feeds back the encrypted response data after encryption. The technical solution provided by this embodiment, when the data transmission request is initiated by the data sending end, generates a symmetric key and an asymmetric key respectively to keep the data and the first symmetric key confidential, thereby improving the security of the data.

[0076] Embodiment 2

[0077] Figure 4 It is a flowchart of obtaining target data corresponding to the transmission data provided by the second embodiment of the present invention. The embodiment of the present disclosure is applicable to any scenario where data encryption processing is required during the process of data transmission or reception. The method can be executed by a double-encrypted data processing device, which can be implemented in the form of software / or hardware. Optionally, the double-encrypted data processing device applied to the data sending end can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc. The specific implementation method can refer to the detailed description of this embodiment, wherein the technical terms that are the same as or corresponding to the above embodiment are not repeated in this embodiment.

[0078] like Figure 4 As shown, the method includes:

[0079] S210: Receive the encrypted response data fed back by the request processing end.

[0080] The request processing end is the end that receives the request parameters. The request processing end also processes the information and returns the response data to the data sending end to indicate the response.

[0081] In this embodiment, the request processing end decrypts the encrypted request parameters sent by the data sending end, and then processes to obtain the response data. The response data is doubly encrypted by the request processing end until the encrypted response data is received by the request processing end.

[0082] S220. Decrypt the second encryption key in the encrypted response data based on the public key to obtain a second symmetric key.

[0083] The second symmetric key is a key generated by the request processing end when the response data is encrypted. The second symmetric key is used to encrypt the request parameters corresponding to the data transmission request. Exemplarily, the data sending end may be a client, and the symmetric key may be a random AES key. The generation of the AES key usually uses a high-quality random number generator to ensure unpredictability and security.

[0084] The second encryption key is a key obtained by encrypting the generated second symmetric key by the request processing end.

[0085] For example, the request processing end obtains data corresponding to the request and encrypts it into encrypted response data, and transmits the confidential response data to the data sending end. The data sending end decrypts the encrypted response data using the public key to obtain the second symmetric key.

[0086] S230. Decrypt the encrypted response data based on the second symmetric key to obtain target data corresponding to the data transmission request.

[0087] The response data is first encrypted by the second symmetric key at the request processing end, and then encrypted by the private key of the asymmetric key. After receiving the encrypted response data, it is first decrypted based on the public key of the asymmetric key to obtain the second symmetric key, and then the second symmetric key is decrypted to obtain the target data corresponding to the data transmission request.

[0088] Exemplarily, after the response data encrypted based on the second symmetric key is sent to the client as encrypted response data, the client performs a decryption operation on the response data to determine the target data corresponding to the data transmission request.

[0089] In this embodiment, the result of the target data includes processing results, information generated by the server, status information, etc.

[0090] In this embodiment, the encrypted response data fed back by the request processing end is received, and then the second encryption key in the encrypted response data is decrypted based on the public key to obtain the second symmetric key, thereby decrypting the encrypted response data based on the second symmetric key to obtain the target data corresponding to the data transmission request. The technical solution provided by this embodiment is to decrypt the symmetric key based on the public key of the second encryption key for the encrypted response data fed back by the request processing end, and then use the key to decrypt the symmetric key to obtain the encrypted response data, so as to obtain the target data corresponding to the request parameters more accurately and securely.

[0091] Embodiment 3

[0092] Figure 5 It is a flow chart of a double-encrypted data processing method applied to a request processing end provided in Embodiment 3 of the present invention. The disclosed embodiment is applicable to any scenario where data encryption processing is required during data transmission or reception. The method can be executed by a double-encrypted data processing device, which can be implemented in the form of software / or hardware. Optionally, the double-encrypted data processing device applied to the request processing end can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0093] like Figure 5 As shown, the method includes:

[0094] S310, receiving a data transmission request initiated by a data sending end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key.

[0095] In this embodiment, the request processing end receives a data transmission request initiated by the data sending end. The request processing end receives the target transmission parameter after double encryption from the data sending end. Double encryption of data transmission means: firstly encrypting the request parameter based on the first symmetric key to obtain the encrypted request parameter, and then encrypting the first symmetric key to obtain the first encryption key.

[0096] S320. Decrypt the first encryption key based on the private key in the asymmetric key to obtain the first symmetric key, and decrypt the encryption request parameter based on the first symmetric key to obtain the request parameter in the data transmission request.

[0097] Among them, after the request processing end receives the double-encrypted target transmission parameters sent by the data sending end, it uses the private key in the asymmetric key to decrypt the first encryption key to obtain the first symmetric key, and then uses the first symmetric key to decrypt the encrypted request parameters to obtain the request parameters, thereby ensuring the security and integrity of the request parameters.

[0098] S330: Determine target data corresponding to the request parameters, and encrypt the target data to obtain the encrypted response data.

[0099] The process of encrypting the target data to obtain the encrypted response data includes:

[0100] generating a second symmetric key;

[0101] Encrypting the target data based on a second symmetric key to obtain encrypted response data, and encrypting the second symmetric encryption key based on a private key to obtain a second encryption key;

[0102] The second encryption key is sent to the data sending end as data in the encrypted response data, so that the data sending end decrypts the encrypted response data to obtain the target data corresponding to the data transmission request.

[0103] Among them, after the return result corresponding to the request parameter is determined, it is first encrypted by the second symmetric key to obtain an encrypted return result; then the second symmetric key is encrypted using the private key of the asymmetric key to obtain a second encryption key; the second encryption key is further sent to the data sending end as the encrypted response data, so that the data sending end finally obtains the target data.

[0104] In this embodiment, a data transmission request initiated by a data transmission end is received, wherein the data transmission request includes an encrypted request parameter after encrypting the request parameter in the data transmission request based on a first symmetric key, and a first encryption key after encrypting the first symmetric key, and then the first encryption key is decrypted based on a private key in an asymmetric key to obtain the first symmetric key, and the encrypted request parameter is decrypted based on the first symmetric key to obtain the request parameter in the data transmission request, thereby determining the target data corresponding to the request parameter, and encrypting the target data to obtain the encrypted response data. The technical solution provided by this embodiment is that after the request processing end receives the data transmission request initiated by the data transmission end, it decrypts the symmetric key based on the private key of the asymmetric key, and then decrypts the request parameter based on the symmetric key, thereby improving the security of the data.

[0105] Embodiment 4

[0106] As an optional embodiment of the above embodiment, the data sending end of this embodiment is the client; the request processing end of this embodiment is the server, and the interaction between the client and the server is taken as an example for detailed description; wherein the request in this embodiment is to initiate an http request. Among them, the algorithms used for the first symmetric key and the second symmetric key in this embodiment are both AES keys. The asymmetric algorithms used to generate the first encryption key and the second encryption key in this embodiment are both RSA keys; wherein the public key and private key of the RSA key are both generated by the server. Its specific implementation method can be combined with Figure 6 And the following text to understand.

[0107] The double-encrypted data processing method applied to the client includes:

[0108] When it is detected that the client initiates an http request, the client first generates a random AES key. This AES key encrypts the request parameters corresponding to the transmission request to obtain the AES encrypted request parameters. The AES key is generated using a high-quality random number generator to ensure the unpredictability and security of the AES key.

[0109] The AES key is encrypted based on the public key of the RSA key generated by the client, thereby obtaining the double-encrypted encrypted request parameters;

[0110] The encryption request parameters and the AES key generated by the client are sent to the server as the target transmission parameters in the data transmission request. After the server receives it, the server decrypts the target transmission parameters, determines the return result, and encrypts the encrypted response data processed by the server.

[0111] When the user terminal detects that an http request is initiated, an AES key is generated. In response to the triggering operation of the first control in the server terminal, a data transmission request is initiated;

[0112] A first symmetric key is generated in the client based on the AES algorithm.

[0113] When receiving the encrypted response data fed back by the server, the AES key in the encrypted response data is decrypted based on the RSA public key to obtain the AES key;

[0114] The encrypted response data is decrypted based on the AES key to obtain the return result corresponding to the initiated http request.

[0115] Among them, the double-encrypted data processing method applied to the server includes:

[0116] The server receives a data transmission request initiated by the client, wherein the data transmission request includes an encrypted request parameter of http initiated by the client based on an AES key generated by the client, and an AES key encrypted by an RSA key;

[0117] Decrypt the AES key based on the private key in the RSA key to obtain the AES key, and use the AES key to decrypt the http request initiated by the client to obtain the client's request parameters;

[0118] The target data corresponding to the http request is determined, and after encrypting the target data, encrypted response data is obtained.

[0119] The encrypted response data is obtained after encrypting the target data, including:

[0120] Generate the second pair of RSA keys;

[0121] Encrypting the target data based on the RSA key to obtain encrypted response data, and encrypting the AES key based on the private key of the RSA key;

[0122] The RSA key is used as data in the encrypted response data and sent to the client, so that the client decrypts the encrypted response data and obtains the target data corresponding to the initiated http request.

[0123] Embodiment 5

[0124] Figure 7 The present invention provides a schematic diagram of a double data encryption processing device for a data sending end provided in an embodiment of the present invention. The device can implement the double data encryption method for a data sending end provided in an embodiment of the present invention. The double data encryption device for a data sending end can be implemented in the form of software and / or hardware and can be configured in an electronic device, which can be a mobile terminal, a PC or a server. The specific structure of the device is as follows:

[0125] like Figure 7 As shown, the data double encryption device applied to the data sending end includes: a request parameter generating module 410, a first encryption key generating module 420 and a target transmission parameter sending module 430.

[0126] The request parameter generation module 410 generates a first symmetric key when a data transmission request is detected, and encrypts a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter;

[0127] A first encryption key generation module 420, configured to encrypt the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end;

[0128] The target transmission parameter sending module 430 is used to send the encryption request parameters and the first encryption key as the target transmission parameters in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameters, determines the response data, and feeds back the encrypted response data after the encryption processing.

[0129] In this embodiment, optionally, the request parameter generating module 410 includes:

[0130] A transmission request sending unit, configured to initiate the data transmission request in response to a triggering operation on the first control in the data sending end;

[0131] The first key generation unit is used to generate a first symmetric key in the data sending end based on a preset symmetric encryption algorithm.

[0132] In this embodiment, optionally, the data double encryption device further includes: a target data determination module; the target data determination module includes:

[0133] A second key determination unit is configured to, upon receiving the encrypted response data fed back by the request processing end, decrypt the second encryption key in the encrypted response data based on the public key to obtain a second symmetric key; wherein the second encryption key is a key obtained by encrypting the generated second symmetric key by the request processing end;

[0134] The target data determination unit is used to decrypt the encrypted response data based on the second symmetric key to obtain target data corresponding to the data transmission request.

[0135] In an embodiment of the present invention, a first symmetric key is generated when a data transmission request is detected, wherein the first symmetric key encrypts the request parameters corresponding to the data transmission request to obtain an encrypted request parameter, and then the first symmetric key is encrypted based on the public key in the asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end, and further, the encrypted request parameter and the first encryption key are sent to the request processing end as the target transmission parameter in the data transmission request, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after encryption. The technical solution of the embodiment of the present disclosure not only encrypts the request parameters by the symmetric key, thereby improving the work efficiency and protecting the request parameters, but also encrypts the symmetric key by the public key in the asymmetric key, thereby further protecting the security of the request parameter data, achieving the expected protection effect, and improving the security of data transmission.

[0136] The double data encryption processing device applied to the data sending end provided in the embodiment of the present invention can execute the double data encryption processing method applied to the data sending end provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. The contents not described in detail in this embodiment can refer to the description in any method embodiment of the present invention.

[0137] Embodiment 6

[0138] Figure 8The present invention provides a schematic diagram of a double data encryption processing device for a request processing end provided in an embodiment of the present invention. The device can implement the double data encryption method for the request processing end of the present invention. The double data encryption device for the request processing end can be implemented in the form of software and / or hardware, and can be configured in an electronic device, which can be a mobile terminal, a PC end or a server, etc. The specific structure of the device is as follows:

[0139] like Figure 8 As shown, the data double encryption device applied to the request processing end includes: a data request receiving module 510, a request parameter decryption module 520 and an encrypted response data generating module 530.

[0140] The data request receiving module 510 is used to receive a data transmission request initiated by a data transmitting end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key;

[0141] A request parameter decryption module 520, configured to decrypt the first encryption key based on a private key in the asymmetric key to obtain the first symmetric key, and decrypt the encrypted request parameter based on the first symmetric key to obtain the request parameter in the data transmission request;

[0142] The encrypted response data generating module 530 is used to determine the target data corresponding to the request parameters, and obtain the encrypted response data after encrypting the target data.

[0143] In this embodiment, optionally, the encrypted response data generating module 530 includes:

[0144] A second key generating unit, used to generate a second symmetric key;

[0145] an encryption key determination unit, configured to encrypt the target data based on the second symmetric key to obtain encrypted response data, and to encrypt the second symmetric encryption key based on the private key to obtain a second encryption key;

[0146] The target data determination unit is used to send the second encryption key as data in the encrypted response data to the data sending end, so that the data sending end decrypts the encrypted response data to obtain the target data corresponding to the data transmission request.

[0147] In an embodiment of the present invention, a data transmission request initiated by a data sending end is received, wherein the data transmission request includes an encrypted request parameter obtained by encrypting the request parameter in the data transmission request based on a first symmetric key, and a first encryption key encrypted with the first symmetric key. Then, the first encryption key is decrypted based on a private key in an asymmetric key to obtain the first symmetric key, and the encrypted request parameter is decrypted based on the first symmetric key to obtain the request parameter in the data transmission request. Furthermore, target data corresponding to the request parameter is determined, and after encrypting the target data, encrypted response data is obtained, thereby improving data transmission security.

[0148] The double data encryption processing device applied to the request processing end provided in the embodiment of the present invention can execute the double data encryption processing method applied to the request processing end provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. The contents not described in detail in this embodiment can refer to the description in any method embodiment of the present invention.

[0149] Embodiment 7

[0150] Fig. 9 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Fig. 9 , which shows an electronic device (eg, Fig. 9 The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0151] like Fig. 9 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An edit / output (I / O) interface 605 is also connected to the bus 604.

[0152] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Fig. 9 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0153] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0154] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0155] The electronic device provided by the embodiment of the present disclosure and the double-encrypted data processing method provided in the above embodiment applied to the data sending end or the request processing end belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0156] The disclosed embodiment also provides a computer storage medium on which a computer program is stored. When the program is executed by a processor, a double-encrypted data processing method provided in the above embodiment and applied to a data sending end or a request processing end is implemented.

[0157] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0158] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0159] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0160] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0161] A double-encrypted data processing method applied to a data sending end generates a first symmetric key when a data transmission request is detected, and encrypts a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter;

[0162] Encrypting the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end;

[0163] Sending the encryption request parameter and the first encryption key as the target transmission parameter in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process; or

[0164] Receiving a data transmission request initiated by a data sending end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key;

[0165] decrypting the first encryption key based on the private key in the asymmetric key to obtain the first symmetric key, and decrypting the encryption request parameter based on the first symmetric key to obtain the request parameter in the data transmission request;

[0166] The target data corresponding to the request parameter is determined, and the encrypted response data is obtained after encrypting the target data.

[0167] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0168] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0169] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0170] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0171] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0172] The embodiments of the present disclosure also provide a computer program product, including a computer program, which, when executed by a processor, implements a double-encrypted data processing method applied to a data sending end or a data requesting end as provided in any embodiment of the present disclosure.

[0173] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code for the disclosed operation, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0174] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0175] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0176] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A double encrypted data processing method, characterized in that: Applied to a data sending end, the method comprises: When a data transmission request is detected, a first symmetric key is generated to encrypt a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter; Encrypting the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end; The encryption request parameter and the first encryption key are sent to the request processing end as the target transmission parameter in the data transmission request, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process.

2. The method according to claim 1, characterized in that The step of generating a first symmetric key when a data transmission request is detected includes: In response to a triggering operation on the first control in the data sending end, initiating the data transmission request; A first symmetric key is generated in the data sending end based on a preset symmetric encryption algorithm.

3. The method according to claim 1, characterized in that The method further comprises: Upon receiving the encrypted response data fed back by the request processing end, decrypting the second encryption key in the encrypted response data based on the public key to obtain a second symmetric key; wherein the second encryption key is a key obtained by encrypting the generated second symmetric key by the request processing end; The encrypted response data is decrypted based on the second symmetric key to obtain target data corresponding to the data transmission request.

4. A double encrypted data processing method, characterized in that: Applied to the request processing end, the method includes: Receiving a data transmission request initiated by a data sending end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key; decrypting the first encryption key based on the private key in the asymmetric key to obtain the first symmetric key, and decrypting the encryption request parameter based on the first symmetric key to obtain the request parameter in the data transmission request; The target data corresponding to the request parameter is determined, and the encrypted response data is obtained after encrypting the target data.

5. The method according to claim 4, characterized in that After encrypting the target data, the encrypted response data is obtained, including: generating a second symmetric key; Encrypting the target data based on the second symmetric key to obtain encrypted response data, and encrypting the second symmetric encryption key based on the private key to obtain a second encryption key; The second encryption key is sent to the data sending end as data in the encrypted response data, so that the data sending end decrypts the encrypted response data to obtain the target data corresponding to the data transmission request.

6. A double-encrypted data processing device, characterized in that: Applied to the data sending end, including: A request parameter generation module, configured to generate a first symmetric key when a data transmission request is detected, and to encrypt a request parameter corresponding to the data transmission request based on the first symmetric key to obtain an encrypted request parameter; A first encryption key generation module, configured to encrypt the first symmetric key based on a public key in an asymmetric key to obtain a first encryption key, wherein the public key in the asymmetric key is generated and fed back by the request processing end; The target transmission parameter sending module is used to send the encryption request parameter and the first encryption key as the target transmission parameter in the data transmission request to the request processing end, so that the request processing end decrypts the target transmission parameter, determines the response data, and feeds back the encrypted response data after the encryption process.

7. A double-encrypted data processing device, characterized in that: Applied to the request processing end, including: A data request receiving module, configured to receive a data transmission request initiated by a data transmitting end; wherein the data transmission request includes an encrypted request parameter obtained by encrypting a request parameter in the data transmission request based on a first symmetric key, and a first encryption key obtained by encrypting the first symmetric key; a request parameter decryption module, configured to decrypt the first encryption key based on a private key in the asymmetric key to obtain the first symmetric key, and decrypt the encrypted request parameter based on the first symmetric key to obtain the request parameter in the data transmission request; The encrypted response data generating module is used to determine the target data corresponding to the request parameters, and obtain the encrypted response data after encrypting the target data.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and with said at least one memory; Wherein, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the double-encrypted data processing method described in any one of claims 1-3 or 4-5.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable the computer to execute the double-encrypted data processing method according to any one of claims 1-3 or 4-5.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the double-encrypted data processing method according to any one of claims 1 to 3 or 4 to 5.

Images