Data transmission method and device, storage medium and equipment

Abstract

The embodiment of the invention discloses a data transmission method and device, a storage medium and equipment, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. Sending a handshake request to the server through a special transport layer security protocol between the small program end and the server; a dynamic key returned by the server according to the handshake request and an encrypted string obtained through encryption processing based on the dynamic key are received through a dedicated transport layer security protocol; obtaining target data to be sent, and encrypting the target data through the dynamic key to generate a corresponding ciphertext; and sending the ciphertext and the encrypted string to a server through a general transport layer security protocol, so that the server performs second decryption processing on the ciphertext according to a dynamic key recovered by performing first decryption processing on the encrypted string to obtain target data. Therefore, the dynamic key is prevented from being transmitted in a plaintext form, the dynamic key is prevented from being cracked, and the security of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data transmission method, apparatus, storage medium and device. Background Art

[0002] Hypertext Transfer Protocol Secure (HTTPS) is a transmission protocol for secure communication over a computer network. HTTPS communicates via HTTP, but uses the universal Transport Layer Security (TLS) protocol to encrypt data packets. It is an HTTP channel with security as its goal, and guarantees the security of the transmission process through transmission encryption and identity authentication based on HTTP.

[0003] In related technologies, TLS can encrypt data packets using symmetric encryption, that is, the server sends the static key to the client through TLS, so that the client and the server share the same static key. The data transmission party encrypts the plaintext (that is, the original data) and the static key together through a special encryption algorithm, so that the plaintext becomes a complex ciphertext and sends it to the data recipient. After the data recipient receives the ciphertext, it decrypts the ciphertext using the static key and the inverse algorithm of the special encryption algorithm and restores it to readable plaintext to ensure the security of data transmission.

[0004] However, since static keys are easy to analyze and crack, they can be obtained by attackers through attack methods. At the same time, since static keys are fixed, once attackers successfully obtain them, all ciphertexts can be easily cracked, causing data leakage. Summary of the invention

[0005] The embodiments of the present application provide a data transmission method, apparatus, storage medium and device, which can improve the security of data transmission.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] A data transmission method, comprising:

[0008] Sending a handshake request to the server through a dedicated transport layer security protocol between the applet end and the server, wherein the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0009] Receiving, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request and an encrypted string obtained by encrypting the dynamic key;

[0010] Acquire target data to be sent, and encrypt the target data using the dynamic key to generate corresponding ciphertext;

[0011] The ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

[0012] A data transmission method, comprising:

[0013] Receiving a handshake request sent by the applet end through a dedicated transport layer security protocol, wherein the dedicated transport layer security protocol has higher security than a general transport layer security protocol;

[0014] Generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string;

[0015] Returning the dynamic key and the encrypted string to the mini-program end through the dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key;

[0016] Receiving the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol;

[0017] The encrypted string is subjected to a first decryption process to recover the dynamic key, and the ciphertext is subjected to a second decryption process based on the dynamic key to obtain the target data.

[0018] In some implementations, when the identity and the timestamp are verified, performing a second decryption process on the ciphertext according to the dynamic key to obtain the target data includes:

[0019] Obtaining the current identity of the mini-program end that sends the ciphertext and the encrypted string, and the generation time of the ciphertext;

[0020] Obtaining the effective end time indicated by the timestamp;

[0021] When it is detected that the identity identifier matches the current identity identifier and the generation time is before the effective expiration time, a second decryption process is performed on the ciphertext according to the dynamic key to obtain the target data.

[0022] A data transmission device, comprising:

[0023] A first sending unit, configured to send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server, wherein the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0024] A first receiving unit, configured to receive, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request, and an encrypted string obtained by encrypting the dynamic key;

[0025] An encryption unit, used for acquiring target data to be sent, and encrypting the target data by using the dynamic key to generate corresponding ciphertext;

[0026] The second sending unit is used to send the ciphertext and the encrypted string to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

[0027] In some implementations, the encryption unit includes:

[0028] An acquisition subunit, used for acquiring target data to be sent, and generating an encryption initialization vector corresponding to the target data;

[0029] The encryption subunit is used to encrypt the target data according to the dynamic key and the encryption initialization vector to generate corresponding ciphertext.

[0030] In some embodiments, the acquisition subunit is used to:

[0031] Get the target data to be sent;

[0032] Generate random numbers;

[0033] Generate a message sequence number of the target data according to the generation order of the target data;

[0034] The random number is combined with the message sequence number to generate a corresponding encryption initialization vector.

[0035] In some embodiments, the encryption subunit is used to:

[0036] Dividing the target data into a plurality of data groups;

[0037] For a first data packet, performing an XOR operation on the encryption initialization vector and the first data packet to obtain a first XOR result of the first data packet;

[0038] Encrypting the first XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the first data group;

[0039] For other data groups, performing XOR operation on the sub-ciphertext corresponding to the previous data group of the other data group and the other data group to obtain a second XOR result of the other data group;

[0040] Encrypting the second XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the other data group;

[0041] The sub-ciphertexts corresponding to the multiple data groups are combined into a ciphertext.

[0042] In some implementations, the second sending unit is configured to:

[0043] The encryption initialization vector, the ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key and the encryption initialization vector restored by performing a first decryption process on the encrypted string to obtain the target data.

[0044] In some implementations, the handshake request carries a scenario type;

[0045] The first receiving unit is used for:

[0046] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0047] The effective time is the time determined by the server according to the scenario type carried in the handshake request.

[0048] In some embodiments, the apparatus further comprises a first retransmission unit, configured to:

[0049] Determine the corresponding effective expiration time according to the effective time;

[0050] When it is detected that the current time reaches the valid expiration time, a handshake request is sent to the server through the dedicated transport layer security protocol between the mini program end and the server again to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

[0051] In some embodiments, the apparatus further includes a second retransmission unit, configured to:

[0052] When a change in the scene type is detected, deleting the dynamic key, the validity period corresponding to the dynamic key, and the encrypted string obtained by encrypting the dynamic key;

[0053] Re-execute sending a handshake request to the server through the dedicated transport layer security protocol between the applet end and the server to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

[0054] In some implementations, the handshake request carries a scenario type and an application privacy level;

[0055] The first receiving unit is used for:

[0056] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0057] The effective time is the time determined by the server according to the scenario type and application privacy level carried in the handshake request.

[0058] A data transmission device, comprising:

[0059] A first receiving unit, configured to receive a handshake request sent by the mini-program end through a dedicated transport layer security protocol, wherein the dedicated transport layer security protocol has higher security than a general transport layer security protocol;

[0060] A generating unit, configured to generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string;

[0061] A returning unit, configured to return the dynamic key and the encrypted string to the mini-program end through the dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key;

[0062] A second receiving unit, used to receive the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol;

[0063] The decryption unit is used to perform a first decryption process on the encrypted string to recover the dynamic key, and perform a second decryption process on the ciphertext based on the dynamic key to obtain the target data.

[0064] In some embodiments, the generating unit comprises:

[0065] A generating subunit, configured to generate a random dynamic key according to the handshake request and determine a validity period of the dynamic key;

[0066] a determination subunit, configured to determine a timestamp of the dynamic key based on the validity time;

[0067] The encryption subunit is used to obtain the identity of the mini program terminal, and encrypt the dynamic key, identity and timestamp according to the preset key to obtain a corresponding encrypted string.

[0068] In some embodiments, the encryption subunit is used to:

[0069] Encrypting the dynamic key, identity identifier and timestamp according to a preset key to obtain an initial encrypted string;

[0070] The initial encrypted string is coded and converted using a preset number of printable characters to obtain a corresponding encrypted string.

[0071] In some embodiments, the handshake request carries a scenario type;

[0072] The generating subunit is used for:

[0073] Generating a random dynamic key according to the handshake request;

[0074] According to the scenario type, the matching is performed with a preset mapping table to determine the corresponding validity period of the dynamic key;

[0075] The preset mapping table includes mapping relationships between different scene types and corresponding times.

[0076] In some embodiments, the handshake request carries a scenario type and an application privacy level;

[0077] The generating subunit is used for:

[0078] Generating a random dynamic key according to the handshake request;

[0079] According to the scenario type, the scene is matched with a preset mapping table to determine the initial validity period of the dynamic key;

[0080] The preset mapping table includes mapping relationships between different scene types and corresponding times;

[0081] A corresponding weight is determined according to the application privacy level, and the initial validity time is processed based on the weight to obtain a corresponding validity time of the dynamic key.

[0082] In some embodiments, the return unit is used to:

[0083] The dynamic key, the corresponding validity period of the dynamic key and the encrypted string are returned to the mini-program end through a dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key within the effective expiration time determined by the validity period.

[0084] In some embodiments, the decryption unit comprises:

[0085] A first decryption subunit, configured to perform a first decryption process on the encrypted string using a preset key to restore the dynamic key, identity identifier and timestamp;

[0086] The second decryption subunit is used to perform a second decryption process on the ciphertext according to the dynamic key to obtain the target data when the identity identifier and the timestamp are verified.

[0087] In some embodiments, the second decryption subunit is used to:

[0088] When the identity and the timestamp are verified, receiving the encryption initialization vector sent by the mini program end;

[0089] The ciphertext is subjected to a second decryption process according to the dynamic key and the encryption initial vector to obtain the target data.

[0090] In some implementations, the second decryption subunit is further configured to:

[0091] Obtaining the current identity of the mini-program end that sends the ciphertext and the encrypted string, and the generation time of the ciphertext;

[0092] Obtaining the effective end time indicated by the timestamp;

[0093] When it is detected that the identity identifier matches the current identity identifier and the generation time is before the effective expiration time, a second decryption process is performed on the ciphertext according to the dynamic key to obtain the target data.

[0094] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for a processor to load to execute the steps in the above-mentioned data transmission method.

[0095] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the above data transmission method when executing the computer program.

[0096] A computer program product or a computer program, the computer program product or the computer program comprises computer instructions, the computer instructions are stored in a storage medium. A processor of a computer device reads the computer instructions from the storage medium, and the processor executes the computer instructions, so as to implement the steps in the above data transmission method.

[0097] The embodiment of the present application sends a handshake request to the server through a dedicated transport layer security protocol between the mini-program end and the server, and the dedicated transport layer security protocol has higher security than the general transport layer security protocol; receives the dynamic key returned by the server according to the handshake request and the encrypted string obtained by encryption based on the dynamic key through the dedicated transport layer security protocol; obtains the target data to be sent, and encrypts the target data through the dynamic key to generate the corresponding ciphertext; sends the ciphertext and the encrypted string to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by the first decryption process on the encrypted string to obtain the target data. In this way, the dynamic key is received through a dedicated transport layer with higher security than the general transport layer security protocol, as well as the encrypted string obtained by encryption processing based on the dynamic key. The target data to be sent is encrypted by the dynamic key to generate the corresponding ciphertext, and the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol, so that the server performs a second decryption processing on the ciphertext with the dynamic key restored by performing a first decryption processing on the encrypted string to obtain the target data. Compared with the scheme of realizing symmetric encryption through static keys in the related art, the embodiment of the present application can receive the dynamic key through a more secure dedicated transport layer security protocol to ensure that the dynamic key is not intercepted by attackers, and send the dynamic key to the server in the form of an encrypted string through the general transport layer security protocol, avoiding the dynamic key from being transmitted in plain text, effectively preventing the dynamic key from being cracked, and improving the security of data transmission.

[0098] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0100] Figure 1A schematic diagram of the protocol structure of the data transmission method provided in an embodiment of the present application.

[0101] Figure 2 A schematic diagram of a data transmission system according to an embodiment of the present invention.

[0102] Figure 3 A scenario diagram of the login system provided in an embodiment of the present application.

[0103] Figure 4 A scenario diagram of a virtual resource payment system provided in an embodiment of the present application.

[0104] Figure 5 A flowchart of a data transmission method provided in an embodiment of the present application.

[0105] Figure 6 A schematic diagram of a scenario of a data transmission method provided in an embodiment of the present application.

[0106] Figure 7 for Figure 5 Another specific flow chart of step 203;

[0107] Figure 8 A schematic diagram of another scenario of the data transmission method provided in an embodiment of the present application.

[0108] Fig. 9 A flowchart of a data transmission method provided in an embodiment of the present application.

[0109] Fig.10 for Fig. 9 Another specific flow chart of step 405;

[0110] Fig.11 An interactive schematic diagram of a data transmission method provided in an embodiment of the present application.

[0111] Fig.12 An interactive flow chart of the data transmission method provided in an embodiment of the present application.

[0112] Fig.13 It is a structural diagram of the data transmission device provided in an embodiment of the present application.

[0113] Fig.14 It is a structural diagram of the data transmission device provided in an embodiment of the present application.

[0114] Fig.15 It is a schematic diagram of the structure of the terminal provided in the embodiment of the present application.

[0115] Fig.16 It is a schematic diagram of the structure of the server provided in the embodiment of the present application. DETAILED DESCRIPTION

[0116] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0117] It is understandable that in the specific implementation of this application, related data such as target data is involved. When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0118] In addition, when the embodiment of the present application needs to obtain target data and other related data, a separate license or separate consent for the target data and other related data will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining a separate license or separate consent for the target data and other related data, the necessary target data and other related data required to enable the normal operation of the embodiment of the present application will be obtained.

[0119] It should be noted that in some processes described in the specification, claims and the above-mentioned drawings, multiple steps appearing in a specific order are included, but it should be clearly understood that these steps may not be executed in the order in which they appear in this document or may be executed in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second" or "preset" in this document are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0120] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0121] Transmission Control Protocol / Internet Protocol (TCP / IP) refers to a protocol suite that can realize information transmission between multiple different networks. TCP / IP protocol does not only refer to TCP and IP protocols, but also refers to a protocol suite composed of File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), TCP, User Datagram Protocol (UDP), Internet Protocol (IP) and other protocols. It is called TCP / IP protocol just because TCP and IP are the most representative in TCP / IP protocol. It is also called network communication protocol, which is the most basic communication protocol in the use of network.

[0122] Hypertext Transfer Protocol (HTTP) is an application layer protocol for distributed, collaborative and hypermedia information systems. It is a request-and-response, stateless, application layer protocol that transmits data based on the TCP / IP protocol. HTTP allows the transmission of any type of data object.

[0123] Mini Program: An application that can be used in an instant messaging client without downloading or installing.

[0124] Symmetric encryption refers to the process of encrypting and decrypting data using the same key.

[0125] Uniform resource locator (URL) is a method of indicating the location of information on the World Wide Web service program of the Internet, which can be understood as an access URL.

[0126] The general-purpose Transport Layer Security protocol (TLS) is used to provide confidentiality and data integrity between two communicating applications.

[0127] MMTLS, a TLS protocol implemented in instant messaging clients, provides confidentiality and data integrity between instant messaging clients and servers.

[0128] It should be noted that the MMTLS will not trust self-signed certificates, but only the certificates carried by the instant messaging client. In addition, the entire MMTLS protocol is highly customized, so existing packet capture tools cannot perform packet capture analysis. That is, because MMTLS is customized, existing packet capture tools cannot capture the specific content of MMTLS, so the subsequent transmission of dynamic keys through the MMTLS is safe.

[0129] For a better understanding of MMTLS, please also refer to Figure 1 As shown, Figure 1 : is a schematic diagram of the protocol structure of the data transmission method provided in the embodiment of the present application. The TCP / IP adopts a layered design mode and divides the protocol into four levels from top to bottom, namely:

[0130] Application Layer A: Application Layer A is the highest level protocol in the TCP / IP protocol family. It provides communication services between object interfaces and applications. For example, HTTP is in the application layer, as well as FTP, SMTP and other protocols. Application layer protocols are protocols that interact directly with objects. They process specific types of data and hand it over to the next layer of protocols for processing.

[0131] Transport Layer B: Transport Layer B provides end-to-end data transmission services, such as TCP and UDP protocols. The transport layer protocol is responsible for transferring data from the application layer to the network layer and ensuring data transmission reliability, flow control, error detection and other functions.

[0132] Network Layer C: Network Layer C mainly provides data packet transmission services in the network, such as IP protocol. The network layer protocol is responsible for transferring data packets from the source host to the destination host, and realizes data transmission between different networks through technologies such as routing selection and forwarding.

[0133] Link Layer D: Link Layer D refers to the transmission of data on the physical layer, such as Ethernet, Wi-Fi and other protocols. The link layer protocol is responsible for transferring data from the network layer to the physical layer, and then transmitting it to the receiving host through the physical layer.

[0134] The physical layer (unlabeled) is responsible for the transmission of bit streams between nodes, that is, responsible for physical transmission. The protocol of this layer is related to both the link and the transmission medium. In layman's terms, it is the physical means of connecting computers.

[0135] Among them, the MMTLS is between the application layer and the network layer, does not affect the original network strategy, and is implemented based on TCP.

[0136] The handshake protocol, as the name suggests, is to negotiate the algorithm suite and encryption key used for encryption before encrypted communication, which is similar to the courtesy handshake that is usually required before two strangers start chatting.

[0137] In computer network communication scenarios, communication is generally carried out through HTTPS, which is based on HTTP communication and only uses the general transport layer security protocol to encrypt data packets.

[0138] In the related technology, TLS can encrypt data packets using symmetric encryption, that is, the server sends the static key to the client through TLS, so that the client and the server share the same static key. The data transmission party encrypts the plaintext and the static key together through a special encryption algorithm, so that the plaintext becomes a complex ciphertext and sends it to the data recipient. After the data recipient receives the ciphertext, it decrypts the ciphertext through the static key and the inverse algorithm of the special encryption algorithm and restores it to readable plaintext to ensure the security of data transmission.

[0139] However, the static key used in this data transmission method is easily analyzed and cracked because it is directly transmitted through TLS, and can be obtained by attackers through attack methods. At the same time, since the static key is fixed, once the attacker successfully obtains it, all ciphertexts will be easily cracked, causing data leakage.

[0140] In order to solve the above problems, the embodiments of the present application propose a method of transmitting dynamic keys through a more secure dedicated transport layer security protocol, and an encrypted string obtained by encryption processing based on the dynamic key, encrypting the target data to be sent through a static key to generate a corresponding ciphertext, and sending the ciphertext and the encrypted string to the server through a general transport layer security protocol, so that the server performs a second decryption processing on the ciphertext based on the dynamic key restored by the first decryption processing of the encrypted string to obtain the target data, thereby ensuring that the dynamic key is not intercepted by an attacker, and sending the dynamic key to the server in the form of an encrypted string through a general transport layer security protocol, avoiding the dynamic key from being transmitted in plain text, effectively preventing the dynamic key from being cracked, and improving the security of data transmission.

[0141] Please continue reading Figure 2 , Figure 2 A scenario diagram of a data transmission system provided in an embodiment of the present application includes a terminal 140, the Internet 130, a gateway 120, a server 110, etc.

[0142] The terminal 140 includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc. In addition, it can be a single device or a combination of multiple devices. For example, multiple desktop computers are interconnected through a local area network, share a display, etc. to work together, and together constitute a terminal 140. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.

[0143] The server 110 refers to a computer system that can provide certain services to the terminal 140. Compared with the ordinary terminal 140, the server 110 has higher requirements in terms of stability, security, performance, etc. The server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0144] The gateway 120 is also called an internetwork connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a converter. The gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the terminal 140 to the server 110 must be sent to the corresponding server 110 through the gateway 120. The message sent by the server 110 to the terminal 140 must also be sent to the corresponding terminal 140 through the gateway 120.

[0145] The embodiments of the present application can be applied in various scenarios, such as Figure 3 The scenario of logging into the system shown and Figure 4 Scenario of the virtual resource payment system shown.

[0146] (I) System login scenario

[0147] The login system can realize the login function and complete login-related services, such as Figure 3As shown, on the interface 11 of the terminal's login system, the object can enter the account and password to implement the login function. The interface 11 can be the interface of the mini-program end. When the interface 11 of the login system is opened and displayed, the terminal will generate a corresponding handshake request and send a handshake request to the server through a dedicated transport layer security protocol between the mini-program end and the server. The dedicated transport layer security protocol has higher security than the general transport layer security protocol; the dynamic key returned by the server according to the handshake request and the encrypted string obtained by encryption based on the dynamic key are received through the dedicated transport layer security protocol; the target data to be sent (which can be understood as the login account data and password data) is obtained, and the target data is encrypting through the dynamic key to generate a corresponding ciphertext; the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key recovered by the first decryption process on the encrypted string to obtain the target data.

[0148] 2. Scenario of Virtual Resource Payment System

[0149] The virtual resource payment system can realize payment functions and complete payment-related services, such as Figure 4 As shown, on the interface 12 of the virtual resource payment system of the terminal, the object can enter the virtual resources required to pay for the goods, such as 1000, and the payment password, such as 123456, and click the order button to realize the payment function. The interface 12 can be the interface of the mini program end. When the interface 12 of the virtual resource payment system is opened and displayed, the terminal will generate a corresponding handshake request, and send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server. The dedicated transport layer security protocol has higher security than the general transport layer security protocol; receive the dynamic key returned by the server according to the handshake request and the encrypted string obtained by encryption based on the dynamic key through the dedicated transport layer security protocol; obtain the target data to be sent (which can be understood as the virtual resource data and payment password data of the payment), and encrypt the target data through the dynamic key to generate the corresponding ciphertext; send the ciphertext and the encrypted string to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by the first decryption process on the encrypted string to obtain the target data.

[0150] It should be noted that Figure 2The scenario diagram of the data transmission system shown is merely an example. The data transmission system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the data transmission system and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is equally applicable to similar technical problems.

[0151] In this embodiment, it will be described from the perspective of a data transmission device. The data transmission device can be specifically integrated in a computer device that has a storage unit and a microprocessor and has computing capabilities. The computer device can be a terminal, and an instant messaging client can be installed in the terminal. A small program end can be run on the instant messaging client. In this embodiment, the small program end installed on the terminal is used for explanation.

[0152] See also Figure 5 , Figure 5 : is a flow chart of a data transmission method provided in an embodiment of the present application. The data transmission method includes:

[0153] In step 201, a handshake request is sent to the server via a dedicated transport layer security protocol between the applet end and the server.

[0154] Related technology, TLS can use symmetric encryption to encrypt data packets, that is, the server sends the static key to the client through TLS, so that the client and the server share the same static key. The data transmission party encrypts the plaintext and the static key together through a special encryption algorithm, so that the plaintext becomes a complex ciphertext and sends it to the data recipient. After the data recipient receives the ciphertext, it decrypts the ciphertext through the static key and the inverse algorithm of the special encryption algorithm and restores it to readable plaintext to ensure the security of data transmission.

[0155] However, the static key used in this data transmission method is easily analyzed and cracked due to direct transmission through TLS, and can be analyzed and obtained by attackers through attack methods. At the same time, since the static key is fixed, once the attacker successfully obtains it, all ciphertexts will be easily cracked, causing data leakage. TLS can only provide security at the transport layer. However, with the advancement of packet capture and analysis tools, the simple use of TLS cannot resist packet capture and analysis tools based on self-signed certificates and is still vulnerable to attacks.

[0156] It should be noted that the mini program end in the embodiment of the present application relies on the instant messaging client, that is, the instant messaging client can serve as the running container of the mini program end, and the mini program end runs on the instant messaging client, so the mini program end can directly call the corresponding dedicated transport layer security protocol of the instant messaging client.

[0157] Therefore, in order to solve the above-mentioned problems and ensure the security of data transmission, the embodiment of the present application can send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server, that is, a dedicated transport layer security protocol. The handshake request can carry the mini program identifier and instant messaging client version of the mini program end, so that the server can identify whether the handshake request is sent by a mini program end and an instant messaging client version that can be used normally based on the mini program identifier and the instant messaging client version.

[0158] Since the entire dedicated transport layer security protocol is highly customized, existing packet capture tools cannot perform packet capture analysis. That is, because the dedicated transport layer security protocol is customized, existing packet capture tools cannot capture the handshake request of the dedicated transport layer security protocol, preventing attackers from monitoring the handshake request on the mini program side. Therefore, the dedicated transport layer security protocol has higher security than the general transport layer security protocol.

[0159] To better illustrate the embodiments of this application, please refer to Figure 6 As shown, the mini program end on the terminal 140 can send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server to ensure the privacy of the handshake request.

[0160] In step 202, a dynamic key returned by the server according to the handshake request and an encrypted string obtained by encryption processing based on the dynamic key are received through a dedicated transport layer security protocol.

[0161] Among them, after the server receives the handshake request sent by the applet end through the dedicated transport layer security protocol, it can generate a random dynamic key according to the handshake request. The dynamic key can be randomly generated by a secure random number generator in the server, and the length can be 128 or 256 bits, etc. Different from the related art, the embodiment of the present application generates different dynamic keys based on different handshake requests, that is, the dynamic key changes in real time, so as to better resist cracking by attackers.

[0162] It should be noted that due to the limited transmission capacity of the dedicated transport layer security protocol, subsequent data transmission still needs to be transmitted through the general transport layer security protocol. In order to avoid the dynamic key being transmitted in plain text on the general transport layer security protocol, the server can encrypt the dynamic key according to the set encryption rules to obtain the corresponding encrypted string.

[0163] Furthermore, the server can return the dynamic key and the encrypted string to the mini-program end in the embodiment of the present application through the dedicated transport layer security protocol. In this way, the embodiment of the present application can receive the dynamic key returned by the server through the dedicated transport layer security protocol, and the encrypted string obtained by encryption based on the dynamic key, to achieve handshake, that is, to establish a connection between the mini-program end and the server. Correspondingly, since the entire dedicated transport layer security protocol is highly customized, existing packet capture tools cannot perform packet capture analysis. That is, because the dedicated transport layer security protocol is customized, existing packet capture tools cannot capture the dynamic key and encrypted string transmitted by the dedicated transport layer security protocol, which better ensures the security of the dynamic key.

[0164] Please continue reading Figure 6 As shown, the server 110 can generate a random dynamic key according to the handshake request, and generate an encrypted string token based on the secret (i.e., the dynamic key) through the aes_encrypt(token, secret) function, and transmit the dynamic key and the encrypted string containing the dynamic key to the mini program end on the terminal 140 through a dedicated transport layer security protocol. Correspondingly, the mini program end on the terminal 140 can receive the dynamic key and the encrypted string containing the dynamic key.

[0165] In one embodiment, in order to achieve better data protection, it can be stipulated that each dynamic key has a corresponding validity period, that is, after the dynamic key reaches the validity period, the dynamic key will become invalid accordingly, and the mini program end needs to resend the handshake request and re-receive the updated dynamic key and encryption string through the dedicated transport layer security protocol, so that the dynamic key can be updated regularly to better avoid analysis by attackers. The validity period can be set manually, for example 15 minutes or 30 minutes.

[0166] In some embodiments, the mini program end can be applied to different scenarios, such as login scenarios, ordering scenarios, and information browsing scenarios. The login scenario represents that the object implements account login through the mini program end, the ordering scenario represents that the object implements product ordering through the mini program end, and the information browsing scenario represents that the object implements information browsing through the mini program end. Each scenario has different security requirements. For example, the security required for the login scenario is higher than that for the ordering scenario, and the security required for the ordering scenario is higher than that for the information browsing scenario. Based on this, different validity periods can be set for the dynamic keys allocated in each scenario.

[0167] Based on this, the handshake request can carry a corresponding scenario type, which indicates the corresponding scenario of the mini program side when the handshake request is generated. The scenario type may include but is not limited to a login scenario type, an ordering scenario type, or an information browsing scenario type. When the mini program side generates a handshake request in a login scenario, the scenario type carried by the handshake request is a login scenario type. When the mini program side generates a handshake request in an ordering scenario, the scenario type carried by the handshake request is an ordering scenario type. Correspondingly, when the mini program side generates a handshake request in an information browsing scenario, the scenario type carried by the handshake request is an information browsing scenario type.

[0168] Thus, the dynamic key returned by the server according to the handshake request received through the dedicated transport layer security protocol and the encrypted string obtained by encrypting the dynamic key may include:

[0169] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0170] The effective time is the time determined by the server according to the scenario type carried in the handshake request.

[0171] Specifically, since the handshake request carries the corresponding scene type, the server can automatically match the corresponding valid time according to the scene type while determining the corresponding dynamic key. The mapping relationship between the scene type and the valid time is shown in Table 1. Table 1 is a preset mapping table, which includes the mapping relationship between different scene types and corresponding times. Assuming that the scene type is a login scene type, the valid time obtained is 5 minutes. Assuming that the scene type is an ordering scene type, the valid time obtained is 10 minutes. Assuming that the scene type is an information browsing scene type, the valid time obtained is 30 minutes.

[0172] Scene Type Validity period Login scenario type 5 minutes Order scenario type 10 minutes Information browsing scenario type 30 minutes

[0173] Table 1

[0174] Based on this, the server can return the dynamic key, the corresponding validity time of the dynamic key and the encrypted string to the mini program end through a dedicated transport layer security protocol. Correspondingly, the mini program end can receive the dynamic key, the corresponding validity time of the dynamic key, and the encrypted string obtained by encrypting the dynamic key returned by the server according to the handshake request through a dedicated transport layer security protocol. In this way, the validity time of the corresponding dynamic key can be flexibly set according to the security requirements of different scenario types when the mini program end initiates a handshake request, thereby improving the flexibility of the validity time setting.

[0175] In some implementations, since the application scenario of the mini program end can change in real time, for example, the application scenario of the mini program end switches from the ordering scenario type to the login scenario type, the requirements for the validity period of the dynamic key are also different due to the change in scenario. Therefore, after the mini program end receives the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key through a dedicated transport layer security protocol, it is also necessary to monitor the change of the scenario type in real time to ensure the real-time update of the dynamic key, which specifically includes the following methods:

[0176] When a change in the scene type is detected, the dynamic key, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key are deleted;

[0177] Re-execute the handshake request sent to the server through the dedicated transport layer security protocol between the applet end and the server to re-receive the updated dynamic key, validity time and encryption string through the dedicated transport layer security protocol.

[0178] Specifically, the mini program end can continuously detect whether the scene type has changed. When a change in the scene type is detected, it indicates that the scene has changed, and the currently stored dynamic key, the corresponding validity period of the dynamic key, and the encrypted string obtained by encryption based on the dynamic key need to be deleted.

[0179] Furthermore, in order to achieve better security, the dynamic key needs to be updated. Therefore, the above embodiment can be re-executed to re-receive the updated dynamic key, validity period and encryption string under the changed scenario type. In this way, it is ensured that the dynamic key can change in real time as the scenario of the mini-program application changes, thereby improving the flexibility of the dynamic key update.

[0180] In some embodiments, the mini program end can be applied to different scenarios, such as login scenarios, ordering scenarios, and information browsing scenarios. The login scenario represents that the object implements account login through the mini program end, the ordering scenario represents that the object implements product ordering through the mini program end, and the information browsing scenario represents that the object implements information browsing through the mini program end, and each scenario has different security requirements. For example, the security required for the login scenario is higher than that for the ordering scenario, and the security required for the ordering scenario is higher than that for the information browsing scenario.

[0181] At the same time, there are many types of mini program terminals, such as office-type mini program terminals, game-type mini program terminals or life-type mini program terminals, and each type of mini program terminal has different security requirements. For example, the security required for the office-type mini program terminal is higher than that for the life-type mini program terminal, and the security required for the life-type mini program terminal is higher than that for the game-type mini program terminal. Based on this, different effective times can be flexibly set in combination with the mini program application scenarios and the mini program types.

[0182] Based on this, the handshake request can carry both the scenario type and the application privacy level. The scenario type indicates the corresponding scenario on the mini program side when the handshake request is generated. The scenario type may include but is not limited to the login scenario type, the ordering scenario type, or the information browsing scenario type. When the mini program side generates a handshake request in the login scenario, the scenario type carried by the handshake request is the login scenario type. When the mini program side generates a handshake request in the ordering scenario, the scenario type carried by the handshake request is the ordering scenario type. Correspondingly, when the mini program side generates a handshake request in the information browsing scenario, the scenario type carried by the handshake request is the information browsing scenario type.

[0183] The application privacy level indicates the privacy level corresponding to the type of the mini program end when generating a handshake request. The application privacy level includes but is not limited to high, medium and low levels. In this way, the application privacy level of the office type mini program end can be set to high, the application privacy level of the life type mini program end can be set to medium, and the application privacy level of the game type mini program end can be set to low. When the type of the mini program end is office type and a handshake request is generated, the application privacy level carried by the handshake request is high. When the type of the mini program end is life type and a handshake request is generated, the application privacy level carried by the handshake request is medium. When the type of the mini program end is game type and a handshake request is generated, the application privacy level carried by the handshake request is low.

[0184] Thus, the dynamic key returned by the server according to the handshake request received through the dedicated transport layer security protocol and the encrypted string obtained by encrypting the dynamic key may include:

[0185] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0186] The effective time is the time determined by the server according to the scenario type and application privacy level carried in the handshake request.

[0187] Specifically, since the handshake request can carry both the scene type and the application privacy level, when the server determines the corresponding dynamic key, it can match the scene type with Table 1 (i.e., the preset mapping table) to determine the initial validity period of the dynamic key. Assuming that the scene type carried by the handshake request is an order scene type, it can be determined that the initial validity period of the dynamic key is 10 minutes.

[0188] Furthermore, the server can also automatically match the corresponding weight according to the application privacy level. The mapping relationship between the application privacy level and the weight is shown in Table 2. Assuming that the application privacy level is high, the weight obtained is 0.6. Assuming that the application privacy level is medium, the weight obtained is 0.8. Assuming that the application privacy level is low, the weight obtained is 1, that is, the higher the application privacy level, the lower the weight, and the lower the application privacy level, the higher the weight.

[0189] Application privacy level Weight high 0.6 middle 0.8 Low 1

[0190] Table 2

[0191] Based on the weights matched in Table 2, the initial valid time obtained by the previous match is weighted to obtain the final valid time of the dynamic key. Assuming that the application privacy level carried by the handshake request is medium, the initial valid time of 10 minutes is weighted according to the weight 0.8 obtained by the match, and the final valid time is 8 minutes.

[0192] Based on this, the server can return the dynamic key, the corresponding validity time of the dynamic key and the encrypted string to the mini program end through a dedicated transport layer security protocol. Correspondingly, the mini program end can receive the dynamic key, the corresponding validity time of the dynamic key, and the encrypted string obtained by encryption based on the dynamic key returned by the server according to the handshake request through a dedicated transport layer security protocol. In this way, the security requirements of different scenario types and the type of mini program end when the mini program end initiates a handshake request can be comprehensively considered, and the validity time of the corresponding dynamic key can be flexibly set, which further enhances the flexibility of setting the validity time.

[0193] In some implementations, the mini program end may receive the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key through a dedicated transport layer security protocol, and further needs to monitor the validity period of the dynamic key in real time to ensure the real-time update of the dynamic key, specifically including the following methods:

[0194] Determine the corresponding effective expiration time according to the effective time;

[0195] When it is detected that the current time reaches the valid expiration time, the handshake request is sent to the server through the dedicated transport layer security protocol between the mini program end and the server again to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

[0196] Specifically, the server can also send the generation time of the dynamic key to the mini program end at the same time, so that the mini program end can calculate the effective expiration time based on the generation time and effective time of the dynamic key. For example, when the generation time of the dynamic key is 11:51:00 on October 8, 2023, and the effective time is 8 minutes, then the effective expiration time is 11:59:00 on October 8, 2023.

[0197] In this way, the mini program end can continuously detect whether the current time has reached the effective expiration time. When it is detected that the current time has not reached the effective expiration time, it means that the dynamic key is still valid. On the contrary, when it is detected that the current time has reached the effective expiration time, it means that the dynamic key has expired. In order to achieve better security, the dynamic key needs to be updated. Therefore, the above embodiment can be re-executed to re-receive the updated dynamic key, effective time and encryption string. In this way, it is ensured that the dynamic key can be updated regularly according to the effective time, the variability of the dynamic key is increased, and the difficulty of cracking is increased.

[0198] In some embodiments, after the server generates a dynamic key and obtains the effective time of the dynamic key, it can determine the timestamp of the dynamic key according to the effective time, and the timestamp can include the dynamic key production time (issue atime, iat) and expiration time (expire atime, exp), for example, the production time is 11:51:00 on October 8, 2023, assuming that the effective time is 8 minutes, then the expiration time is 11:59:00 on October 8, 2023. And obtain the identity of the mini program end, which can be the account ID logged in on the instant messaging client that the mini program end relies on, such as account ID 12345, and then obtain the triple of [dynamic key, identity ID, timestamp], and can perform symmetric encryption processing on the [dynamic key, identity ID, timestamp] based on the preset key to obtain the corresponding encrypted string, so that the dynamic key can be subsequently transmitted in the form of an encrypted string on the general transport layer security protocol, avoiding the dynamic key from being transmitted in plain text, and improving the security of dynamic key transmission.

[0199] It should be noted that the symmetric encryption processing can be an AES (Advanced Encryption Standard) encryption algorithm (Advanced Encryption Standard algorithm). The AES encryption algorithm can use 128-bit, 192-bit or 256-bit keys to encrypt and decrypt data, and has the advantages of high strength, high speed and easy implementation. The preset key is a 128-bit, 192-bit or 256-bit key used for encryption, and unlike the symmetric encryption in the related technology, the preset key does not need to be transmitted to the terminal, but only needs to be retained inside the server, which can prevent the preset key from being leaked.

[0200] In step 203, the target data to be sent is obtained, and the target data is encrypted by a dynamic key to generate a corresponding ciphertext.

[0201] Among them, the target data is the plaintext to be sent, which is the data that the mini program needs to send to the server. It can be the login account password, or the password used for payment. This data is very confidential to the object. If it is transmitted directly in plain text, it can be easily intercepted and analyzed by attackers, and the confidential data of the object can be easily obtained, causing economic losses to the object and data leakage.

[0202] In order to solve the above-mentioned problem, the embodiment of the present application can symmetrically encrypt the target data through the dynamic key received through the dedicated transport layer security protocol to generate the corresponding ciphertext. In this way, even if the attacker intercepts the ciphertext, he will not be able to crack it because he does not have the dynamic key, thereby avoiding economic losses and data leakage to the target.

[0203] In some implementations, the target data may be encrypted using a dynamic key based on the AES encryption algorithm and using the CBC (Cipher BlockChaining) mode, i.e., referring to Figure 7 , step 203 comprises:

[0204] Step 301, obtaining target data to be sent, and generating an encryption initialization vector corresponding to the target data;

[0205] Step 302: encrypt the target data according to the dynamic key and the encryption initialization vector to generate corresponding ciphertext.

[0206] It should be noted that the full name of CBC is Cipher Block Chaining mode (ciphertext grouping linking mode). "Grouping" means that both the encryption and decryption processes are performed in the form of groups. The size of each group is 128 bits (16 bytes). If the length of the plaintext is not an integer multiple of 16 bytes, the last group needs to be padded (padding) so that the length of the last group is 16 bytes. "Link" means that the ciphertext groups are connected to each other like a chain. In this CBC mode, an initialization vector IV is required (that is, the encryption initial vector in the embodiment of the present application). Therefore, the target data to be sent (that is, plaintext) can be obtained, and the encryption initial vector can be generated according to the target data. The encryption initial vector can randomly generate a value for the mini program end, and the value is converted into an encryption initial vector. The conversion method can use the One-Hot encoding conversion method. One-Hot encoding, for sequence data with discrete values, One-Hot encoding can be used to represent each value as a vector.

[0207] In some implementations, generating an encryption initialization vector corresponding to the target data may further include:

[0208] Generate random numbers;

[0209] Generate a message sequence number of the target data according to the generation order of the target data;

[0210] The random number is combined with the message sequence number to generate a corresponding encryption initialization vector.

[0211] Specifically, a random number Nonce may be generated, such as 20 or 30, and a message sequence number Seq of the target data may be generated according to the generation order of the target data, such as 1, 2 or 3, etc. Correspondingly, Nonce+Seq may be combined to generate a corresponding encryption initialization vector through One-Hot encoding. Since the random number and the message sequence number are both dynamically changing, the encryption initialization vector is also constantly changing, ensuring that the same plaintext is encrypted multiple times in real time, and the ciphertext obtained in the end is also different, which increases the difficulty for attackers to crack.

[0212] Accordingly, after obtaining the encryption initialization vector, the target can be encrypted in CBC mode in combination with the dynamic key to obtain the final ciphertext. Specifically, step 302 includes:

[0213] Dividing the target data into a plurality of data groups;

[0214] For a first data group, performing an XOR operation on the encryption initialization vector and the first data group to obtain a first XOR result of the first data group;

[0215] Encrypting the first XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the first data group;

[0216] For other data groups, perform XOR on the sub-ciphertext corresponding to the previous data group of the other data group and the other data group to obtain a second XOR result of the other data group;

[0217] The second XOR result is encrypted by the dynamic key to obtain a sub-ciphertext corresponding to the other data group;

[0218] The sub-ciphertexts corresponding to a plurality of the data groups are combined into a ciphertext.

[0219] Specifically, the target data can be grouped in a manner that each group size is 128 bits (i.e., 16 bytes). It should be noted that if the length of the plaintext is not an integer multiple of 16 bytes, the last group will be padded so that the length of the last group is also 16 bytes. Figure 8 As shown, the target data can be divided into multiple data packets with each packet size being 16 bytes.

[0220] It should be noted that exclusive OR, abbreviated as xor, is a mathematical operator. It is used in logical operations. The mathematical symbol of exclusive OR is The computer symbol is "xor". Its operation rules are: That is, if the values ​​of a and b are different, the XOR result is 1. If the values ​​of a and b are the same, the XOR result is 0. XOR is also called half-addition operation, and its operation rule is equivalent to binary addition without carry.

[0221] For the first data group, the encryption initial vector can be XORed with the first data group to obtain a first XOR result of the first data group, and the first XOR result is sent to the block cipher encryption module and encrypted in combination with the dynamic key to obtain the sub-ciphertext corresponding to the first data group.

[0222] For other data groups, the sub-ciphertext corresponding to the previous data group may be XORed with the other data groups to obtain a second XOR result of the other data groups.

[0223] Furthermore, the second XOR result can be sent to the block cipher encryption module and encrypted in combination with the dynamic key to obtain sub-ciphertexts of other data groups. For example, for the second data group, the sub-ciphertext corresponding to the first data group can be XORed with the second data group to obtain a second XOR result of the second data group, and the corresponding second XOR result can be sent to the block cipher encryption module and encrypted in combination with the dynamic key to obtain the sub-ciphertext of the second data group. For the third data group, the sub-ciphertext corresponding to the second data group can be XORed with the third data group to obtain the second XOR result of the third data group, and the corresponding second XOR result can be sent to the block cipher encryption module and encrypted in combination with the dynamic key to obtain the sub-ciphertext of the third data group. And so on, the sub-ciphertext of each other data group can be obtained.

[0224] Correspondingly, the sub-ciphertexts corresponding to each data group can be concatenated to obtain the final ciphertext.

[0225] In step 204, the ciphertext and the encrypted string are sent to the server via the general transport layer security protocol.

[0226] Among them, since the transmission capacity of the dedicated transport layer security protocol is limited, the transmission of ciphertext and encrypted string needs to be transmitted through the general transport layer security protocol, that is, the mini program end can send the ciphertext and encrypted string to the server through the general transport layer security protocol.

[0227] Since the ciphertext is obtained through dynamic key encryption and the encrypted string is obtained through preset key encryption, neither the dynamic key nor the target data will be transmitted in plain text on the general transport layer security protocol, and the dynamic key is securely transmitted through a dedicated transport layer security protocol, while the preset key only exists on the server. Therefore, even if an attacker intercepts the ciphertext and encrypted string, he cannot perform the corresponding decryption. In this way, data security is protected and the security of data transmission is improved.

[0228] Please continue reading Figure 6 As shown, the terminal 140 encrypts the target data with a dynamic key to obtain a corresponding ciphertext, and transmits the ciphertext to the server 110 through the universal transport layer security protocol, and the encrypted string token can be placed in the URL and transmitted to the server 110.

[0229] After receiving the ciphertext and encrypted string, the server can perform a first decryption process on the encrypted string according to the preset key, and recover the dynamic key in the encrypted string. Thereby, the ciphertext can be decrypted for a second time according to the dynamic key to obtain the corresponding target data (i.e., plain text), thereby achieving secure communication and effectively protecting the integrity and security of the target data from the mini program to the server, preventing attackers from decrypting and cracking the target data.

[0230] In some implementations, since the mini program end uses the AES encryption algorithm and the CBC (Cipher BlockChaining) mode to encrypt the target data with a dynamic key, the mini program end also needs to send the encryption initial vector to the server, that is, step 204, including:

[0231] The encryption initialization vector, the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol.

[0232] Among them, the mini program end can send the encryption initial vector, ciphertext and the encrypted string to the server through the transport layer security protocol, so that after receiving the encryption initial vector, ciphertext and the encrypted string, the server can perform a first decryption process on the encrypted string according to the preset key, restore the dynamic key, combine the dynamic key with the encryption initial vector, and perform a second decryption process on the ciphertext. The specific second decryption process is:

[0233] The ciphertext is grouped in a manner that each group size is 128 bits (i.e., 16 bytes) to obtain multiple ciphertext subgroups. For the first ciphertext subgroup, it is decrypted by the dynamic key to obtain a first decryption result, and the first decryption result is XORed with the encryption initial vector to obtain a sub-plaintext corresponding to the first ciphertext subgroup. For the second ciphertext subgroup, it can be decrypted by the dynamic key to obtain a second decryption result, and the sub-ciphertext of the previous ciphertext subgroup (i.e., the first ciphertext subgroup) is XORed with the second decryption result to obtain a sub-plaintext corresponding to the second ciphertext subgroup. For the third ciphertext subgroup, it can be decrypted by the dynamic key to obtain a third decryption result, and the sub-ciphertext of the previous ciphertext subgroup (i.e., the second ciphertext subgroup) is XORed with the third decryption result to obtain a sub-plaintext corresponding to the third ciphertext subgroup. By analogy, the sub-plaintext of each ciphertext subgroup can be obtained.

[0234] Correspondingly, the sub-plaintexts of each ciphertext subgroup can be concatenated to obtain the target data.

[0235] From the above, it can be seen that the embodiment of the present application sends a handshake request to the server through a dedicated transport layer security protocol between the mini-program end and the server, and the dedicated transport layer security protocol has higher security than the general transport layer security protocol; receives the dynamic key returned by the server according to the handshake request and the encrypted string obtained by encryption based on the dynamic key through the dedicated transport layer security protocol; obtains the target data to be sent, and encrypts the target data through the dynamic key to generate the corresponding ciphertext; sends the ciphertext and the encrypted string to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by the first decryption process on the encrypted string to obtain the target data. In this way, the dynamic key is received through a dedicated transport layer with higher security than the general transport layer security protocol, as well as the encrypted string obtained by encryption processing based on the dynamic key. The target data to be sent is encrypted by the dynamic key to generate the corresponding ciphertext, and the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol, so that the server performs a second decryption processing on the ciphertext with the dynamic key restored by performing a first decryption processing on the encrypted string to obtain the target data. Compared with the scheme of realizing symmetric encryption through static keys in the related art, the embodiment of the present application can receive the dynamic key through a more secure dedicated transport layer security protocol to ensure that the dynamic key is not intercepted by attackers, and send the dynamic key to the server in the form of an encrypted string through the general transport layer security protocol, avoiding the dynamic key from being transmitted in plain text, effectively preventing the dynamic key from being cracked, and improving the security of data transmission.

[0236] In combination with the method described in the above embodiment, the method will be further described in detail with examples below.

[0237] In this embodiment, the description will be made from the perspective of a data transmission device. The data transmission device can be specifically integrated in a computer device having a storage unit and a microprocessor installed therein and having computing capabilities. The computer device can be a server, that is, a server is used for description in this embodiment.

[0238] Please also read Fig. 9 , Fig. 9 A schematic diagram of a data transmission method provided in an embodiment of the present application. The method may include:

[0239] In step 401, a handshake request sent by the applet end through a dedicated transport layer security protocol is received.

[0240] Among them, the server can receive a handshake request sent by the mini program end through a dedicated transport layer security protocol. The handshake request can carry the mini program identifier and instant messaging client version of the mini program end. In this way, the server can verify whether the mini program identifier and instant messaging client version can be used normally. When it is verified that the mini program identifier or the instant messaging client version cannot be used normally, for example, the mini program identifier is wrong or the instant messaging client version is too low, the handshake request will not be responded to.

[0241] Correspondingly, when it is verified that the applet identifier and the instant messaging client can be used normally, the handshake request is responded to and step 402 is executed.

[0242] In step 402, a random dynamic key is generated according to the handshake request, and encryption processing is performed based on the dynamic key to obtain a corresponding encrypted string.

[0243] Among them, the server responds to the handshake request and generates a random dynamic key according to a secure random number generator, and the length of the dynamic key can be 128 bits or 256 bits, etc. That is, the dynamic key changes in real time and can better resist cracking by attackers.

[0244] It should be noted that due to the limited transmission capacity of the dedicated transport layer security protocol, the data transmitted by the subsequent mini program end still needs to be transmitted through the general transport layer security protocol. In order to avoid the dynamic key from being transmitted in plain text on the general transport layer security protocol, the server can encrypt the dynamic key according to the set encryption rules to obtain the corresponding encrypted string.

[0245] In one embodiment, in order to achieve better data protection, it can be stipulated that the dynamic key has a corresponding validity period, that is, after the dynamic key reaches the validity period, the dynamic key will become invalid accordingly, and the mini program end needs to resend the handshake request. The server will generate an updated dynamic key and encryption string based on the resent handshake request and send it to the mini program end, so that the dynamic key is updated regularly to better avoid analysis by attackers.

[0246] That is, step 402 may include:

[0247] Generate a random dynamic key according to the handshake request, and determine the validity period of the dynamic key;

[0248] Determining a timestamp of the dynamic key based on the validity time;

[0249] The identity of the mini program end is obtained, and the dynamic key, identity and timestamp are encrypted according to the preset key to obtain the corresponding encrypted string.

[0250] Among them, the validity period can be set manually, for example, the default is 15 minutes or 30 minutes. In the embodiment of the present application, 30 minutes is taken as an example. The server can respond to the handshake request, generate a random 256-bit dynamic key, and determine that the validity period of the dynamic key is 30 minutes.

[0251] Correspondingly, based on the valid time of 30 minutes, in order to subsequently verify the validity of the encrypted string, the timestamp of the dynamic key can be determined based on the valid time. The timestamp can include the dynamic key production time (issueatime, iat) and expiration time (expire atime, exp). For example, if the production time is 11:50:00 on October 8, 2023 and the valid time is 30 minutes, then the expiration time is 12:20:00 on October 8, 2023.

[0252] Furthermore, in order to subsequently authenticate the encrypted string, the identity identifier of the mini program end that sends the handshake request can also be obtained. The identity identifier can be the account identifier logged in on the instant messaging client that the mini program end relies on, such as account identifier 12345, and then the triplet of [dynamic key, identity identifier, timestamp] can be obtained, and the [dynamic key, identity identifier, timestamp] can be symmetrically encrypted based on the preset key to obtain the corresponding encrypted string. In this way, the dynamic key can be subsequently transmitted in the form of an encrypted string on the general transport layer security protocol, avoiding the transmission of the dynamic key in plain text, thereby improving the security of dynamic key transmission.

[0253] It should be noted that the symmetric encryption processing can be an AES (Advanced Encryption Standard) encryption algorithm (Advanced Encryption Standard algorithm). The AES encryption algorithm will use 128-bit, 192-bit or 256-bit keys to encrypt and decrypt data. It has the advantages of high strength, high speed and easy implementation. The preset key is a 128-bit, 192-bit or 256-bit key used for encryption. Unlike the symmetric encryption in the related technology, the preset key does not need to be transmitted to the terminal, but only needs to be retained inside the server, which can prevent the preset key from being leaked.

[0254] In some implementations, the encrypted string can be a binary ciphertext, and the length of the data will be very large, affecting the transmission speed. In addition, since the applet end needs to place the encrypted string in the URL and transmit it back to the server, and the URL only supports a limited character set and cannot encode binary, it is also necessary to simplify the encrypted string, that is, encrypt the dynamic key, identity and timestamp according to the preset key to obtain the corresponding encrypted string, including:

[0255] The dynamic key, the identity identifier and the timestamp are encrypted according to the preset key to obtain an initial encrypted string;

[0256] The initial encrypted string is converted into an encoding using a preset number of printable characters to obtain a corresponding encrypted string.

[0257] It should be noted that the preset number of printable characters can be understood as Base64 encoding, which is one of the most common encoding methods for transmitting 8-bit bytecodes. It is a method of representing binary data based on 64 printable characters. The encoding set consists of 64 characters: 26 uppercase letters A to Z, 26 lowercase letters a to z, 10 numbers 0 to 9, the symbol "+" and the symbol " / ".

[0258] Specifically, based on the preset key, the [dynamic key, identity, timestamp] is symmetrically encrypted to obtain an initial encrypted string, which is a binary ciphertext. In order to facilitate subsequent transmission, the initial encrypted string can be encoded and converted through Base64 encoding. Specifically, the initial encrypted string can be divided into groups of three bytes each, and each group is a total of 24 binary bits. Then the 24 binary bits are divided into 4 groups according to 6 bits each (i.e., 6×4=24 binary bits). Then add 00 in front of each group to expand it into 8×4=32 binary bits, i.e., four bytes (because there are 2 0s in front of each byte, the maximum value of each byte is 63, and the two 0s added in the front are just to make up a byte, and the value will not change). Finally, according to the Base64 encoding table, the code value of the four bytes is converted into the corresponding Base64 characters to obtain the corresponding encrypted string.

[0259] In some embodiments, the mini program end can be applied to different scenarios, such as login scenarios, ordering scenarios, and information browsing scenarios. The login scenario represents that the object implements account login through the mini program end, the ordering scenario represents that the object implements product ordering through the mini program end, and the information browsing scenario represents that the object implements information browsing through the mini program end. Each scenario has different security requirements. For example, the security required for the login scenario is higher than that for the ordering scenario, and the security required for the ordering scenario is higher than that for the information browsing scenario. Based on this, different validity periods can be set for the dynamic keys allocated in each scenario.

[0260] Based on this, the handshake request sent by the mini program end can carry the corresponding scenario type, which indicates the corresponding scenario of the mini program end when the handshake request is generated. The scenario type may include but is not limited to the login scenario type, the ordering scenario type or the information browsing scenario type. When the mini program end generates a handshake request in the login scenario, the scenario type carried by the handshake request is the login scenario type. When the mini program end generates a handshake request in the ordering scenario, the scenario type carried by the handshake request is the ordering scenario type. Correspondingly, when the mini program end generates a handshake request in the information browsing scenario, the scenario type carried by the handshake request is the information browsing scenario type.

[0261] Thus, determining the validity period of the dynamic key may include:

[0262] According to the scenario type, the scene is matched with the preset mapping table to determine the corresponding validity period of the dynamic key;

[0263] The preset mapping table includes mapping relationships between different scene types and corresponding times.

[0264] Specifically, the preset mapping table can refer to the previous Table 1, and the server can quickly match the corresponding validity period of the generated dynamic key according to the scenario type carried in the handshake request. Assuming that the scenario type carried by the handshake request is an order scenario type, it can be determined that the initial validity period of the dynamic key is 10 minutes.

[0265] In some embodiments, the mini program end can be applied to different scenarios, such as login scenarios, ordering scenarios, and information browsing scenarios. The login scenario represents that the object implements account login through the mini program end, the ordering scenario represents that the object implements product ordering through the mini program end, and the information browsing scenario represents that the object implements information browsing through the mini program end, and each scenario has different security requirements. For example, the security required for the login scenario is higher than that for the ordering scenario, and the security required for the ordering scenario is higher than that for the information browsing scenario.

[0266] At the same time, there are many types of mini program terminals, such as office-type mini program terminals, game-type mini program terminals or life-type mini program terminals, and each type of mini program terminal has different security requirements. For example, the security required for the office-type mini program terminal is higher than that for the life-type mini program terminal, and the security required for the life-type mini program terminal is higher than that for the game-type mini program terminal. Based on this, different effective times can be flexibly set in combination with the mini program application scenarios and the mini program types.

[0267] Based on this, the handshake request can carry both the scenario type and the application privacy level. The scenario type indicates the corresponding scenario on the mini program side when the handshake request is generated. The scenario type may include but is not limited to the login scenario type, the ordering scenario type, or the information browsing scenario type. When the mini program side generates a handshake request in the login scenario, the scenario type carried by the handshake request is the login scenario type. When the mini program side generates a handshake request in the ordering scenario, the scenario type carried by the handshake request is the ordering scenario type. Correspondingly, when the mini program side generates a handshake request in the information browsing scenario, the scenario type carried by the handshake request is the information browsing scenario type.

[0268] The application privacy level indicates the privacy level corresponding to the type of the mini program end when generating a handshake request. The application privacy level includes but is not limited to high, medium and low levels. In this way, the application privacy level of the office type mini program end can be set to high, the application privacy level of the life type mini program end can be set to medium, and the application privacy level of the game type mini program end can be set to low. When the type of the mini program end is office type and a handshake request is generated, the application privacy level carried by the handshake request is high. When the type of the mini program end is life type and a handshake request is generated, the application privacy level carried by the handshake request is medium. When the type of the mini program end is game type and a handshake request is generated, the application privacy level carried by the handshake request is low.

[0269] Thus, determining the validity period of the dynamic key may also include:

[0270] According to the scenario type, the preset mapping table is matched to determine the initial validity period of the dynamic key;

[0271] The preset mapping table includes mapping relationships between different scene types and corresponding times;

[0272] A corresponding weight is determined according to the privacy level of the application, and the initial validity time is processed based on the weight to obtain a corresponding validity time of the dynamic key.

[0273] Specifically, the preset mapping table can refer to the previous Table 1, and the server can quickly match the initial validity period of the generated dynamic key according to the scenario type carried in the handshake request. Assuming that the scenario type carried by the handshake request is an order scenario type, it can be determined that the initial validity period of the dynamic key is 10 minutes.

[0274] Furthermore, the server can also automatically match the corresponding weight according to the application privacy level. Please refer to Table 2 for the mapping relationship between the application privacy level and the weight. For example, if the application privacy level carried by the handshake request is medium, then the initial valid time of 10 minutes is weighted according to the matched weight of 0.8, and the final valid time is 8 minutes.

[0275] In step 403, the dynamic key and the encrypted string are returned to the mini-program end via a dedicated transport layer security protocol.

[0276] Among them, the server can return the dynamic key and the encrypted string to the mini-program end in the embodiment of the present application through the dedicated transport layer security protocol. The mini-program end can receive the dynamic key returned by the server through the dedicated transport layer security protocol, and the encrypted string obtained by encryption based on the dynamic key, to achieve handshake, that is, to establish a connection between the mini-program end and the server, so that the mini-program end can encrypt the target data to be sent (i.e., plain text) according to the dynamic key. Correspondingly, since the entire dedicated transport layer security protocol is highly customized, the existing packet capture tools cannot perform packet capture analysis. That is, because the dedicated transport layer security protocol is customized, the existing packet capture tools cannot capture the dynamic key and encrypted string transmitted by the dedicated transport layer security protocol, which better ensures the security of dynamic key transmission.

[0277] In some implementations, the server may also return the validity period of the dynamic key to the mini-program end, that is, return the dynamic key and the encrypted string to the mini-program end through a dedicated transport layer security protocol, including:

[0278] The dynamic key, the corresponding validity period of the dynamic key and the encrypted string are returned to the applet end through a dedicated transport layer security protocol.

[0279] Specifically, the server can return the dynamic key, the corresponding validity period of the dynamic key, and the encrypted string to the mini program end through a dedicated transport layer security protocol. Correspondingly, the mini program end can receive the dynamic key, the corresponding validity period of the dynamic key, and the encrypted string obtained by encryption based on the dynamic key returned by the server according to the handshake request through a dedicated transport layer security protocol, so that the mini program end can encrypt the target data to be sent according to the dynamic key within the effective expiration time determined by the validity period.

[0280] In step 404, the encrypted ciphertext and encrypted string sent by the mini-program end through the universal transport layer security protocol are received.

[0281] Among them, the mini program end can symmetrically encrypt the target data (i.e., plain text) according to the dynamic key received through the dedicated transport layer security protocol, generate the corresponding ciphertext, and send the ciphertext and encrypted string to the server through the general transport layer security protocol. Correspondingly, the server can receive the ciphertext and encrypted string sent by the mini program end through the general transport layer security protocol. It should be noted that the encrypted string can be placed in the URL for transmission by the mini program end.

[0282] Since the ciphertext is obtained through dynamic key encryption and the encrypted string is also encrypted, the dynamic key and the target data will not be transmitted in plain text on the general transport layer security protocol, and the dynamic key is securely transmitted through a dedicated transport layer security protocol. The preset key only exists on the server. Therefore, even if the attacker intercepts the ciphertext and encrypted string, he cannot perform the corresponding decryption. In this way, data security is protected and the security of data transmission is improved.

[0283] In step 405, a first decryption process is performed on the encrypted string to recover the dynamic key, and a second decryption process is performed on the ciphertext based on the dynamic key to obtain the target data.

[0284] Among them, after receiving the ciphertext and encrypted string, the server can perform a first decryption process on the encrypted string to recover the dynamic key in the encrypted string. Thereby, the ciphertext can be decrypted for a second time according to the dynamic key to obtain the corresponding target data (i.e., plain text), thereby realizing secure communication and effectively protecting the integrity and security of the target data from the mini program to the server, preventing attackers from decrypting and cracking the target data.

[0285] In one implementation, when the encrypted string is obtained by Base64 encoding, it is necessary to first restore the encrypted string to binary ciphertext and then decrypt the encrypted string.

[0286] In some implementations, the server stores a preset key that was previously used to symmetric encrypt the dynamic key, so the encrypted string needs to be first decrypted using the preset key, i.e., referring to Fig.10 , step 405 comprises:

[0287] Step 501, performing a first decryption process on the encrypted string using a preset key to restore the dynamic key, identity and timestamp;

[0288] Step 502: When the identity and the timestamp are verified, a second decryption process is performed on the ciphertext according to the dynamic key to obtain the target data.

[0289] Among them, after receiving the ciphertext and the encrypted string, the server can perform a first decryption process on the encrypted string according to the preset key, and recover the [dynamic key, identity identifier, timestamp] triple in the encrypted string. In this way, the server can authenticate the sender according to the identity identifier obtained by the first decryption process, and perform time verification through the timestamp obtained by the first decryption process. For example, the server can obtain the sender's identity identifier to be verified, and compare the identity identifier to be verified with the identity identifier obtained by the first decryption process. When the two match, it is determined that the identity authentication is passed, and when the two do not match, it is determined that the identity authentication is failed. The generation time of the ciphertext can also be obtained to determine whether the generation time is within the valid time range indicated by the timestamp. When the generation time is within the valid time range indicated by the timestamp, it is determined that the timestamp verification is passed, and when the generation time is not within the valid time range indicated by the timestamp, it is determined that the timestamp verification is failed.

[0290] Furthermore, when both the identity and timestamp are verified, that is, the identity authentication and time verification are both passed, the ciphertext can be decrypted for the second time according to the dynamic key to obtain the corresponding target data (i.e., plain text), thereby achieving secure communication and effectively protecting the integrity and security of the target data from the mini-program to the server, and preventing attackers from decrypting and cracking the target data. In this way, the server does not need to store the identity and dynamic key, but only needs to decrypt the encrypted string to obtain the identity and dynamic key, thereby saving the server's storage resources.

[0291] In some implementations, in order to prevent identity tampering attacks and replay attacks, before performing the second decryption process on the ciphertext, identity verification and time verification are required, that is, when the identity identifier and the timestamp verification pass, the ciphertext is subjected to the second decryption process according to the dynamic key to obtain the target data, including:

[0292] Obtain the current identity of the applet end that sent the ciphertext and the encrypted string, as well as the generation time of the ciphertext;

[0293] Get the effective end time indicated by the timestamp;

[0294] When it is detected that the identity identifier matches the current identity identifier and the generation time is before the effective end time, a second decryption process is performed on the ciphertext according to the dynamic key to obtain the target data.

[0295] It should be noted that an identity tampering attack refers to an attacker intercepting data sent by the mini program through the general transport layer security protocol and sending data as the attacker's client to attack. A replay attack refers to a type of attack in which the attacker does not need to decrypt the actual data packet, but records the data request itself and replays the data request after a period of time.

[0296] In order to prevent the above-mentioned identity tampering attacks and replay attacks, the embodiment of the present application will perform identity verification and time verification. Specifically, the server can obtain the current identity of the mini-program end that sends the ciphertext and encrypted string and the generation time of the ciphertext.

[0297] Furthermore, the current identity identifier and the identity identifier obtained by the first decryption process can be compared. When the two are the same, it is determined that the identity identifier and the current identity identifier match. When the two are different, it is determined that the identity identifier and the current identity identifier do not match, and the identity has been tampered. Correspondingly, the effective expiration time of the dynamic key can also be determined based on the expiration time in the timestamp. Detect whether the generation time is before the effective expiration time. When it is detected that the generation time is before the effective expiration time, it means that the time verification is passed, and when it is detected that the generation time is not before the effective expiration time, it means that the time verification fails, which is a replay attack. Based on this, when it is detected that the identity identifier and the current identity identifier match and the generation time is before the effective expiration time, that is, when the identity authentication and time verification are passed at the same time, the second decryption process of the ciphertext is performed according to the dynamic key to obtain the target data. In this way, identity tampering attacks and replay attacks can be prevented, and the security of data transmission can be better protected.

[0298] In some implementations, since the method by which the mini program end encrypts the target data may be based on the AES encryption algorithm and uses the CBC (Cipher Block Chaining) mode to encrypt the target data using a dynamic key, the server end also needs to decrypt the encrypted initial vector when performing a second decryption process on the ciphertext using the dynamic key, that is, performing a second decryption process on the ciphertext according to the dynamic key to obtain the target data includes:

[0299] Receive the encrypted initialization vector sent by the mini program;

[0300] According to the dynamic key and the encryption initial vector, a second decryption process is performed on the ciphertext to obtain the target data.

[0301] Specifically, the server can also receive the encryption initialization vector sent by the mini program end, group the ciphertext in a manner that each group size is 128 bits (i.e., 16 bytes), and obtain multiple ciphertext subgroups. For the first ciphertext subgroup, decrypt it by using the dynamic key to obtain the first decryption result, and perform XOR on the first decryption result and the encryption initialization vector to obtain the sub-plaintext corresponding to the first ciphertext subgroup. For the second ciphertext subgroup, decrypt it by using the dynamic key to obtain the second decryption result, and perform XOR on the sub-ciphertext of the previous ciphertext subgroup (i.e., the first ciphertext subgroup) and the second decryption result to obtain the sub-plaintext corresponding to the second ciphertext subgroup. For the third ciphertext subgroup, decrypt it by using the dynamic key to obtain the third decryption result, and perform XOR on the sub-ciphertext of the previous ciphertext subgroup (i.e., the second ciphertext subgroup) and the third decryption result to obtain the sub-plaintext corresponding to the third ciphertext subgroup. By analogy, the sub-plaintext of each ciphertext subgroup can be obtained.

[0302] Correspondingly, the sub-plaintexts of each ciphertext subgroup can be concatenated to obtain the target data.

[0303] To better illustrate the embodiments of this application, please refer to Fig.11 To understand, Fig.11 Interaction diagram of the data transmission method provided by the embodiment of the present application. In the handshake stage, the server can generate a dynamic key according to the handshake request, and symmetrically encrypt the dynamic key identity and timestamp according to the preset key to generate a corresponding encrypted string. The dynamic key and encrypted string are sent to the mini program end through a dedicated transport layer security protocol.

[0304] During the encryption stage, the mini program end can perform stacked encryption processing on the target data (i.e., plain text) based on the encryption initial vector and the dynamic key to obtain the corresponding ciphertext, and send the encryption initial vector, ciphertext, and encrypted string to the server through the general transport layer security protocol.

[0305] In the decryption stage, the server performs a first decryption process on the encrypted string through a preset key, recovers the dynamic key, identity and timestamp, and after the identity and timestamp are verified, performs a second decryption process on the ciphertext through the dynamic key combined with the encryption initial vector to obtain the corresponding target data. In this way, the dynamic key is transmitted through a dedicated transport layer with higher security than the general transport layer security protocol, and the encrypted string obtained by encryption processing based on the dynamic key is encrypted by the dynamic key to generate the corresponding ciphertext, and the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key recovered by the first decryption process of the encrypted string to obtain the target data. Compared with the solution of realizing symmetric encryption through static keys in the related art, the embodiment of the present application can receive the dynamic key through a more secure dedicated transport layer security protocol to ensure that the dynamic key is not intercepted by an attacker, and the dynamic key is sent to the server through the general transport layer security protocol in the form of an encrypted string, avoiding the dynamic key from being transmitted in plain text, effectively preventing the dynamic key from being cracked, and improving the security of data transmission.

[0306] To better illustrate the embodiments of this application, please refer to Fig.12 To understand, Fig.12 This is an interactive flow chart of the data transmission method provided in the embodiment of the present application. Fig.12 , and details the specific interaction process of the data transmission method of the embodiment of the present application. The process includes but is not limited to the following steps 601 to 613.

[0307] Step 601, the applet end of the terminal 140 sends a handshake request to the server 110 through a dedicated transport layer security protocol between the applet end and the server.

[0308] Step 602, the server 110 receives a handshake request sent by the mini program end through a dedicated transport layer security protocol, and generates a random dynamic key according to the handshake request.

[0309] Step 603: The server 110 matches the scene type with the preset mapping table to determine the corresponding validity period of the dynamic key.

[0310] In step 604, the server 110 determines a timestamp of the dynamic key based on the validity time.

[0311] In step 605, the server 110 obtains the identity of the mini program end, and encrypts the dynamic key, the identity and the timestamp according to the preset key to obtain an initial encrypted string.

[0312] In step 606, the server 110 performs encoding conversion on the initial encrypted string using a preset number of printable characters to obtain a corresponding encrypted string.

[0313] Step 607, the server 110 returns the dynamic key, the corresponding validity period of the dynamic key, and the encrypted string to the mini-program end of the terminal 140 through a dedicated transport layer security protocol.

[0314] Step 608, the mini program end on the terminal 140 receives the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and the encrypted string obtained by encryption processing based on the dynamic key through a dedicated transport layer security protocol.

[0315] In step 609, the mini program on the terminal 140 obtains the target data to be sent, generates a random number, generates a message sequence number of the target data according to the generation order of the target data, combines the random number and the message sequence number, and generates a corresponding encryption initialization vector.

[0316] In step 610, the mini program end on the terminal 140 divides the target data into multiple data groups. For the first data group, the encryption initial vector is XORed with the first data group to obtain a first XOR result of the first data group, and the first XOR result is encrypted by a dynamic key to obtain a sub-ciphertext corresponding to the first data group. For other data groups, the sub-ciphertext corresponding to the previous data group of the other data groups is XORed with the other data groups to obtain a second XOR result of the other data groups, and the second XOR result is encrypted by a dynamic key to obtain a sub-ciphertext corresponding to the other data groups. The sub-ciphertexts corresponding to the multiple data groups are combined into a ciphertext.

[0317] In step 611, the mini program on the terminal 140 sends the encryption initialization vector, ciphertext and encrypted string to the server 110 via the universal transport layer security protocol.

[0318] In step 612, the server 110 receives the encrypted ciphertext, encryption initialization vector and encryption string sent by the mini program end through the universal transport layer security protocol.

[0319] In step 613, the server 110 performs a first decryption process on the encrypted string using a preset key to restore the dynamic key, identity and timestamp. When the identity and timestamp are verified, a second decryption process is performed on the ciphertext based on the dynamic key and the encryption initial vector to obtain the target data.

[0320] The meanings of the terms are the same as those in the above-mentioned data transmission method. For specific implementation details, please refer to the description in the method embodiment, which will not be repeated here.

[0321] In order to better implement the data transmission method provided in the embodiment of the present application, the embodiment of the present application also provides a device based on the above data transmission method. The meanings of the terms are the same as those in the above data transmission method, and the specific implementation details can refer to the description in the method embodiment.

[0322] See also Fig.13 , Fig.13 A structural schematic diagram of a data transmission device provided in an embodiment of the present application, wherein the data transmission device is applied to a terminal, wherein the data transmission device may include a first sending unit 701, a first receiving unit 702, an encryption unit 703, and a second sending unit 704, etc.

[0323] The first sending unit 701 is used to send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol.

[0324] The first receiving unit 702 is used to receive, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, and an encrypted string obtained by encrypting the dynamic key.

[0325] In some implementations, the handshake request carries a scenario type;

[0326] The first receiving unit 702 is configured to:

[0327] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0328] The effective time is the time determined by the server according to the scenario type carried in the handshake request.

[0329] In some implementations, the handshake request carries a scenario type and an application privacy level;

[0330] The first receiving unit 702 is configured to:

[0331] Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key;

[0332] The effective time is the time determined by the server according to the scenario type and application privacy level carried in the handshake request.

[0333] In some implementations, the apparatus further includes a first retransmission unit (not labeled) configured to:

[0334] Determine the corresponding effective expiration time according to the effective time;

[0335] When it is detected that the current time reaches the valid expiration time, the handshake request is sent to the server through the dedicated transport layer security protocol between the mini program end and the server again to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

[0336] In some implementations, the apparatus further includes a second retransmission unit (not labeled) configured to:

[0337] When a change in the scene type is detected, the dynamic key, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key are deleted;

[0338] Re-execute the handshake request sent to the server through the dedicated transport layer security protocol between the applet end and the server to re-receive the updated dynamic key, validity time and encryption string through the dedicated transport layer security protocol.

[0339] The encryption unit 703 is used to obtain the target data to be sent, and encrypt the target data using the dynamic key to generate corresponding ciphertext.

[0340] In some implementations, the encryption unit 703 includes:

[0341] An acquisition subunit (not identified), used to acquire target data to be sent and generate an encryption initialization vector corresponding to the target data;

[0342] The encryption subunit (not identified) is used to encrypt the target data according to the dynamic key and the encryption initialization vector to generate corresponding ciphertext.

[0343] In some embodiments, the acquisition subunit (not identified) is used to:

[0344] Get the target data to be sent;

[0345] Generate random numbers;

[0346] Generate a message sequence number of the target data according to the generation order of the target data;

[0347] The random number is combined with the message sequence number to generate a corresponding encryption initialization vector.

[0348] In some embodiments, the encryption subunit (not identified) is used to:

[0349] Dividing the target data into a plurality of data groups;

[0350] For a first data group, performing an XOR operation on the encryption initialization vector and the first data group to obtain a first XOR result of the first data group;

[0351] Encrypting the first XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the first data group;

[0352] For other data groups, perform XOR on the sub-ciphertext corresponding to the previous data group of the other data group and the other data group to obtain a second XOR result of the other data group;

[0353] The second XOR result is encrypted by the dynamic key to obtain a sub-ciphertext corresponding to the other data group;

[0354] The sub-ciphertexts corresponding to a plurality of the data groups are combined into a ciphertext.

[0355] The second sending unit 704 is used to send the ciphertext and the encrypted string to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

[0356] In some implementations, the second sending unit 704 is configured to:

[0357] The encryption initialization vector, the ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key and the encryption initialization vector restored by performing a first decryption process on the encrypted string to obtain the target data.

[0358] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0359] See also Fig.14 , Fig.14 A structural schematic diagram of a data transmission device provided in an embodiment of the present application, wherein the data transmission device is applied to a terminal, wherein the data transmission device may include a first receiving unit 801, a generating unit 802, a returning unit 803, a second receiving unit 804 and a decryption unit 805, etc.

[0360] The first receiving unit 801 is used to receive a handshake request sent by the mini program end through a dedicated transport layer security protocol, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol.

[0361] The generating unit 802 is used to generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string.

[0362] In some implementations, the generating unit 802 includes:

[0363] A generating subunit (unidentified), configured to generate a random dynamic key according to the handshake request and determine a validity period of the dynamic key;

[0364] a determination subunit (not identified) for determining a timestamp of the dynamic key based on the validity time;

[0365] The encryption subunit (unidentified) is used to obtain the identity of the mini program end, and encrypt the dynamic key, identity and timestamp according to the preset key to obtain a corresponding encrypted string.

[0366] In some embodiments, the encryption subunit (not identified) is used to:

[0367] The dynamic key, the identity identifier and the timestamp are encrypted according to the preset key to obtain an initial encrypted string;

[0368] The initial encrypted string is converted into an encoding using a preset number of printable characters to obtain a corresponding encrypted string.

[0369] In some embodiments, the handshake request carries a scenario type;

[0370] The generating subunit (not identified) is used to:

[0371] Generate a random dynamic key according to the handshake request;

[0372] According to the scenario type, the scene is matched with the preset mapping table to determine the corresponding validity period of the dynamic key;

[0373] The preset mapping table includes mapping relationships between different scene types and corresponding times.

[0374] In some embodiments, the handshake request carries a scenario type and an application privacy level;

[0375] The generating subunit (not identified) is used to:

[0376] Generate a random dynamic key according to the handshake request;

[0377] According to the scenario type, the preset mapping table is matched to determine the initial validity period of the dynamic key;

[0378] The preset mapping table includes mapping relationships between different scene types and corresponding times;

[0379] A corresponding weight is determined according to the privacy level of the application, and the initial validity time is processed based on the weight to obtain a corresponding validity time of the dynamic key.

[0380] The returning unit 803 is used to return the dynamic key and the encrypted string to the mini program end through the dedicated transport layer security protocol, so that the mini program end encrypts the target data to be sent according to the dynamic key.

[0381] In some embodiments, the returning unit 803 is used to:

[0382] The dynamic key, the corresponding validity period of the dynamic key, and the encrypted string are returned to the mini-program end through a dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key within the effective expiration time determined by the validity period.

[0383] The second receiving unit 804 is used to receive the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol.

[0384] The decryption unit 805 is used to perform a first decryption process on the encrypted string to recover the dynamic key, and perform a second decryption process on the ciphertext based on the dynamic key to obtain the target data.

[0385] In some embodiments, the decryption unit 805 includes:

[0386] A first decryption subunit (not identified), configured to perform a first decryption process on the encrypted string using a preset key to restore the dynamic key, the identity identifier, and the timestamp;

[0387] The second decryption subunit (unidentified) is used to perform a second decryption process on the ciphertext according to the dynamic key to obtain the target data when the identity identifier and the timestamp are verified.

[0388] In some embodiments, the second decryption subunit (not identified) is used to:

[0389] When the identity and the timestamp are verified, the encrypted initialization vector sent by the mini program is received;

[0390] According to the dynamic key and the encryption initial vector, a second decryption process is performed on the ciphertext to obtain the target data.

[0391] In some implementations, the second decryption subunit (not identified) is further configured to:

[0392] Obtain the current identity of the applet end that sent the ciphertext and the encrypted string, as well as the generation time of the ciphertext;

[0393] Get the effective end time indicated by the timestamp;

[0394] When it is detected that the identity identifier matches the current identity identifier and the generation time is before the effective end time, a second decryption process is performed on the ciphertext according to the dynamic key to obtain the target data.

[0395] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0396] The present application also provides a computer device, which may be a terminal. Fig.15 As shown, it shows a schematic diagram of the structure of the terminal involved in the embodiment of the present application, specifically:

[0397] The computer device may include a radio frequency (RF) circuit 901, a memory 902 including one or more computer-readable storage media, an input unit 903, a display unit 904, a sensor 905, an audio circuit 906, a wireless fidelity (WiFi) module 907, a processor 908 including one or more processing cores, and a power supply 909. Those skilled in the art will appreciate that Fig.15 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0398] The RF circuit 901 can be used for receiving and sending signals during the process of sending and receiving information or making calls. In particular, after receiving the downlink information of the base station, it is handed over to one or more processors 908 for processing; in addition, the data related to the uplink is transmitted to the base station. Generally, the RF circuit 901 includes but is not limited to an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 901 can also communicate with the network and other devices through wireless communication. Wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0399] The memory 902 can be used to store software programs and modules, and the processor 908 executes various functional applications and information retrieval by running the software programs and modules stored in the memory 902. The memory 902 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the terminal (such as audio data, a phone book, etc.), etc. In addition, the memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 902 may also include a memory controller to provide the processor 908 and the input unit 903 with access to the memory 902.

[0400] The input unit 903 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to object setting and function control. Specifically, in a specific embodiment, the input unit 903 may include a touch-sensitive surface and other input devices. The touch-sensitive surface, also known as a touch display screen or a touch pad, can collect touch operations of an object on or near it (such as operations of an object using any suitable object or accessory such as a finger, a stylus, etc. on or near the touch-sensitive surface), and drive the corresponding connection device according to a pre-set program. Optionally, the touch-sensitive surface may include a touch detection device and a touch controller. Among them, the touch detection device detects the touch orientation of the object, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the touch point coordinates, and then sends it to the processor 908, and can receive and execute commands sent by the processor 908. In addition, the touch-sensitive surface can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch-sensitive surface, the input unit 903 may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0401] The display unit 904 can be used to display information input by the object or information provided to the object and various graphic object interfaces of the terminal, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit 904 may include a display panel. Optionally, the display panel may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch-sensitive surface may cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it is transmitted to the processor 908 to determine the type of touch event. Subsequently, the processor 908 provides a corresponding visual output on the display panel according to the type of touch event. Although in Fig.15 In the embodiment, the touch-sensitive surface and the display panel are implemented as two independent components to realize input and output functions, but in some embodiments, the touch-sensitive surface and the display panel can be integrated to realize input and output functions.

[0402] The terminal may also include at least one sensor 905, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel according to the brightness of the ambient light, and the proximity sensor may turn off the display panel and / or backlight when the terminal is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the terminal, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0403] The audio circuit 906, the speaker, and the microphone can provide an audio interface between the object and the terminal. The audio circuit 906 can transmit the electrical signal converted from the received audio data to the speaker, which is converted into a sound signal for output; on the other hand, the microphone converts the collected sound signal into an electrical signal, which is received by the audio circuit 906 and converted into audio data, and then the audio data is processed by the output processor 908 and sent to another terminal through the RF circuit 901, or the audio data is output to the memory 902 for further processing. The audio circuit 906 may also include an earplug jack to provide communication between an external headset and the terminal.

[0404] WiFi is a short-range wireless transmission technology. The terminal can help the object to send and receive emails, browse web pages and access streaming media through the WiFi module 907. It provides the object with wireless broadband Internet access. Fig.15 A WiFi module 907 is shown, but it is understandable that it is not an essential component of the terminal and can be omitted as needed without changing the essence of the invention.

[0405] The processor 908 is the control center of the terminal. It uses various interfaces and lines to connect various parts of the entire mobile phone. By running or executing software programs and / or modules stored in the memory 902 and calling data stored in the memory 902, it executes various functions of the terminal and processes data, thereby monitoring the mobile phone as a whole. Optionally, the processor 908 may include one or more processing cores; preferably, the processor 908 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, object interface and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 908.

[0406] The terminal also includes a power supply 909 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 908 through a power management system, so that the power management system can manage charging, discharging, and power consumption management. The power supply 909 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0407] Although not shown, the terminal may also include a camera, a Bluetooth module, etc., which will not be described in detail here. Specifically in this embodiment, the processor 908 in the terminal will load the executable files corresponding to the processes of one or more applications into the memory 902 according to the following instructions, and the processor 908 will run the applications stored in the memory 902 to implement various functions:

[0408] Send a handshake request to the server through a dedicated transport layer security protocol between the applet end and the server, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0409] Receiving, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request and an encrypted string obtained by encrypting the dynamic key;

[0410] Obtaining target data to be sent, and encrypting the target data using the dynamic key to generate corresponding ciphertext;

[0411] The ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

[0412] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the file transmission method above, and will not be repeated here.

[0413] From the above, it can be seen that the computer device of the embodiment of the present application can send a handshake request to the server through a dedicated transport layer security protocol between the mini-program end and the server, and the dedicated transport layer security protocol has higher security than the general transport layer security protocol; receive the dynamic key returned by the server according to the handshake request and the encrypted string obtained by encryption based on the dynamic key through the dedicated transport layer security protocol; obtain the target data to be sent, and encrypt the target data through the dynamic key to generate the corresponding ciphertext; send the ciphertext and the encrypted string to the server through the general transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by the first decryption process on the encrypted string to obtain the target data. In this way, the dynamic key is received through a dedicated transport layer with higher security than the general transport layer security protocol, as well as the encrypted string obtained by encryption processing based on the dynamic key. The target data to be sent is encrypted by the dynamic key to generate the corresponding ciphertext, and the ciphertext and the encrypted string are sent to the server through the general transport layer security protocol, so that the server performs a second decryption processing on the ciphertext with the dynamic key restored by performing a first decryption processing on the encrypted string to obtain the target data. Compared with the scheme of realizing symmetric encryption through static keys in the related art, the embodiment of the present application can receive the dynamic key through a more secure dedicated transport layer security protocol to ensure that the dynamic key is not intercepted by attackers, and send the dynamic key to the server in the form of an encrypted string through the general transport layer security protocol, avoiding the dynamic key from being transmitted in plain text, effectively preventing the dynamic key from being cracked, and improving the security of data transmission.

[0414] The present application also provides a computer device, which may be a server. Fig.16 As shown, it shows a schematic diagram of the structure of the server involved in the embodiment of the present application, specifically:

[0415] The computer device may include components such as a processor 1010 with one or more processing cores, a memory 1020 with one or more computer-readable storage media, a power supply 1030, and an input unit 1040. Those skilled in the art will appreciate that Fig.16 The computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Among them:

[0416] The processor 1010 is the control center of the computer device. It uses various interfaces and lines to connect various parts of the entire computer device. By running or executing software programs and / or modules stored in the memory 1020 and calling data stored in the memory 1020, it executes various functions of the computer device and processes data, thereby monitoring the computer device as a whole. Optionally, the processor 1010 may include one or more processing cores; optionally, the processor 1010 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1010.

[0417] The memory 1020 can be used to store software programs and modules. The processor 1010 executes various functional applications and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the server, etc. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 1020 may also include a memory controller to provide the processor 1010 with access to the memory 1020.

[0418] The computer device also includes a power supply 1030 for supplying power to various components. Optionally, the power supply 1030 can be logically connected to the processor 1010 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. The power supply 1030 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0419] The computer device may further include an input unit 1040, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0420] Although not shown, the computer device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 1010 in the computer device will load the executable files corresponding to the processes of one or more application programs into the memory 1020 according to the following instructions, and the processor 1010 will run the application programs stored in the memory 1020, thereby implementing the various method steps provided in the aforementioned embodiments, as follows:

[0421] Receiving a handshake request sent by the applet end through a dedicated transport layer security protocol, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0422] Generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string;

[0423] Returning the dynamic key and the encrypted string to the applet end through the dedicated transport layer security protocol, so that the applet end encrypts the target data to be sent according to the dynamic key;

[0424] Receiving the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol;

[0425] The encrypted string is subjected to a first decryption process to recover the dynamic key, and the ciphertext is subjected to a second decryption process based on the dynamic key to obtain the target data.

[0426] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the queue processing method above, and will not be repeated here.

[0427] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0428] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any one of the data transmission methods provided in the embodiments of the present application. For example, the instructions can execute the following steps:

[0429] Send a handshake request to the server through a dedicated transport layer security protocol between the applet end and the server, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0430] Receiving, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request and an encrypted string obtained by encrypting the dynamic key;

[0431] Obtaining target data to be sent, and encrypting the target data using the dynamic key to generate corresponding ciphertext;

[0432] The ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

[0433] Receiving a handshake request sent by the applet end through a dedicated transport layer security protocol, where the dedicated transport layer security protocol has higher security than the general transport layer security protocol;

[0434] Generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string;

[0435] Returning the dynamic key and the encrypted string to the applet end through the dedicated transport layer security protocol, so that the applet end encrypts the target data to be sent according to the dynamic key;

[0436] Receiving the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol;

[0437] The encrypted string is subjected to a first decryption process to recover the dynamic key, and the ciphertext is subjected to a second decryption process based on the dynamic key to obtain the target data.

[0438] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations provided in the above embodiments.

[0439] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0440] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0441] Since the instructions stored in the computer-readable storage medium can execute the steps in any one of the data transmission methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any one of the data transmission methods provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0442] The above is a detailed introduction to a data transmission method, device, storage medium and equipment provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data transmission method, characterized in that: include: Sending a handshake request to the server through a dedicated transport layer security protocol between the applet end and the server, wherein the dedicated transport layer security protocol has higher security than the general transport layer security protocol; Receiving, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request and an encrypted string obtained by encrypting the dynamic key; Acquire target data to be sent, and encrypt the target data using the dynamic key to generate corresponding ciphertext; The ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

2. The data transmission method according to claim 1, characterized in that: The step of obtaining the target data to be sent and encrypting the target data by using the dynamic key to generate corresponding ciphertext includes: Acquire target data to be sent, and generate an encryption initialization vector corresponding to the target data; The target data is encrypted according to the dynamic key and the encryption initialization vector to generate corresponding ciphertext.

3. The data transmission method according to claim 2, characterized in that: The generating of the encryption initialization vector corresponding to the target data includes: Generate random numbers; Generate a message sequence number of the target data according to the generation order of the target data; The random number is combined with the message sequence number to generate a corresponding encryption initialization vector.

4. The data transmission method according to claim 3, characterized in that: The step of encrypting the target data according to the dynamic key and the encryption initial vector to generate corresponding ciphertext includes: Dividing the target data into a plurality of data groups; For a first data packet, performing an XOR operation on the encryption initialization vector and the first data packet to obtain a first XOR result of the first data packet; Encrypting the first XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the first data group; For other data groups, performing XOR operation on the sub-ciphertext corresponding to the previous data group of the other data group and the other data group to obtain a second XOR result of the other data group; Encrypting the second XOR result by using the dynamic key to obtain a sub-ciphertext corresponding to the other data group; The sub-ciphertexts corresponding to the multiple data groups are combined into a ciphertext.

5. The data transmission method according to any one of claims 2 to 4, characterized in that: The step of sending the ciphertext and the encrypted string to the server through the universal transport layer security protocol comprises: The encryption initialization vector, the ciphertext and the encrypted string are sent to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key and the encryption initialization vector restored by performing a first decryption process on the encrypted string to obtain the target data.

6. The data transmission method according to claim 1, characterized in that: The handshake request carries a scenario type; The receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, and the encrypted string obtained by encrypting the dynamic key, comprises: Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key; The effective time is the time determined by the server according to the scenario type carried in the handshake request.

7. The data transmission method according to claim 6, characterized in that: After receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key, the method further includes: Determine the corresponding effective expiration time according to the effective time; When it is detected that the current time reaches the valid expiration time, a handshake request is sent to the server through the dedicated transport layer security protocol between the mini program end and the server again to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

8. The data transmission method according to claim 6, characterized in that: After receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and the encrypted string obtained by encrypting the dynamic key, the method further includes: When a change in the scene type is detected, deleting the dynamic key, the validity period corresponding to the dynamic key, and the encrypted string obtained by encrypting the dynamic key; Re-execute sending a handshake request to the server through the dedicated transport layer security protocol between the applet end and the server to re-receive the updated dynamic key, valid time and encryption string through the dedicated transport layer security protocol.

9. The data transmission method according to claim 1, characterized in that: The handshake request carries a scenario type and an application privacy level; The receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, and the encrypted string obtained by encrypting the dynamic key, comprises: Receiving, through the dedicated transport layer security protocol, the dynamic key returned by the server according to the handshake request, the corresponding validity period of the dynamic key, and an encrypted string obtained by encrypting the dynamic key; The effective time is the time determined by the server according to the scenario type and application privacy level carried in the handshake request.

10. A data transmission method, characterized in that: include: Receiving a handshake request sent by the applet end through a dedicated transport layer security protocol, wherein the dedicated transport layer security protocol has higher security than a general transport layer security protocol; Generate a random dynamic key according to the handshake request, and perform encryption processing based on the dynamic key to obtain a corresponding encrypted string; Returning the dynamic key and the encrypted string to the mini-program end through the dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key; Receiving the encrypted ciphertext and the encrypted string sent by the mini program end through the universal transport layer security protocol; The encrypted string is subjected to a first decryption process to recover the dynamic key, and the ciphertext is subjected to a second decryption process based on the dynamic key to obtain the target data.

11. The data transmission method according to claim 10, characterized in that: The generating a random dynamic key according to the handshake request, and performing encryption processing based on the dynamic key to obtain a corresponding encrypted string, includes: Generate a random dynamic key according to the handshake request, and determine the validity period of the dynamic key; Determining a timestamp of the dynamic key based on the validity time; The identity of the mini program terminal is obtained, and the dynamic key, the identity and the timestamp are encrypted according to a preset key to obtain a corresponding encrypted string.

12. The data transmission method according to claim 11, characterized in that: The step of encrypting the dynamic key, the identity identifier and the timestamp according to the preset key to obtain a corresponding encrypted string includes: Encrypting the dynamic key, identity identifier and timestamp according to a preset key to obtain an initial encrypted string; The initial encrypted string is coded and converted using a preset number of printable characters to obtain a corresponding encrypted string.

13. The data transmission method according to claim 11, characterized in that: The handshake request carries a scenario type; Determining the validity period of the dynamic key includes: According to the scenario type, the matching is performed with a preset mapping table to determine the corresponding validity period of the dynamic key; The preset mapping table includes mapping relationships between different scene types and corresponding times.

14. The data transmission method according to claim 11, characterized in that: The handshake request carries a scenario type and an application privacy level; Determining the validity period of the dynamic key includes: According to the scenario type, the scene is matched with a preset mapping table to determine the initial validity period of the dynamic key; The preset mapping table includes mapping relationships between different scene types and corresponding times; A corresponding weight is determined according to the application privacy level, and the initial validity time is processed based on the weight to obtain a corresponding validity time of the dynamic key.

15. The data transmission method according to claim 11, characterized in that: The step of returning the dynamic key and the encrypted string to the applet end through the dedicated transport layer security protocol comprises: The dynamic key, the corresponding validity period of the dynamic key and the encrypted string are returned to the mini-program end through a dedicated transport layer security protocol, so that the mini-program end encrypts the target data to be sent according to the dynamic key within the effective expiration time determined by the validity period.

16. The data transmission method according to claim 11, characterized in that: The first decryption processing is performed on the encrypted string to recover the dynamic key, and the second decryption processing is performed on the ciphertext based on the dynamic key to obtain the target data, including: Performing a first decryption process on the encrypted string using a preset key to restore the dynamic key, identity identifier and timestamp; When the identity identifier and the timestamp are verified, the ciphertext is subjected to a second decryption process according to the dynamic key to obtain the target data.

17. The data transmission method according to claim 16, characterized in that: The performing a second decryption process on the ciphertext according to the dynamic key to obtain the target data includes: Receive the encrypted initialization vector sent by the mini program; The ciphertext is subjected to a second decryption process according to the dynamic key and the encryption initial vector to obtain the target data.

18. A data transmission device, characterized in that: include: A first sending unit, configured to send a handshake request to the server through a dedicated transport layer security protocol between the mini program end and the server, wherein the dedicated transport layer security protocol has higher security than the general transport layer security protocol; A first receiving unit, configured to receive, through the dedicated transport layer security protocol, a dynamic key returned by the server according to the handshake request, and an encrypted string obtained by encrypting the dynamic key; An encryption unit, used for acquiring target data to be sent, and encrypting the target data by using the dynamic key to generate corresponding ciphertext; The second sending unit is used to send the ciphertext and the encrypted string to the server through the universal transport layer security protocol, so that the server performs a second decryption process on the ciphertext according to the dynamic key restored by performing a first decryption process on the encrypted string to obtain the target data.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the data transmission method according to any one of claims 1 to 17.

20. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the data transmission method according to any one of claims 1 to 17 are implemented.

Images