Data processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a data processing method and device, electronic equipment and a storage medium. According to the embodiment of the invention, a code package pulling request can be sent; obtaining a returned code packet and a digital signature, wherein the digital signature is obtained by encrypting a message digest of the code packet by a private key of the root certificate; generating a new message abstract of the code package, and decrypting the digital signature by adopting a public key of the root certificate to obtain decrypted data; and if the new message digest of the code package is the same as the decrypted data, loading the code package. In the embodiment of the invention, the public key of the root certificate is set at the client, and the private key of the root certificate is set at the server, so that the authenticity and integrity of the code packet can be verified before loading according to the digital signature encrypted based on the private key and returned by the server when the client requests the code packet from the server. Therefore, according to the scheme, the security of the data processing method can be improved.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically to a data processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] A mini-program is a lightweight application that can be used without downloading or installation. It is typically embedded in mobile application platforms, allowing users to quickly access and use its functions. When a user uses a mini-program, the front-end client requests the mini-program's code package from the back-end server and loads that package locally to implement the mini-program's functionality. Through front-end and back-end interaction, the mini-program dynamically acquires and updates data, thereby providing rich application features and a smooth user experience. This mechanism enables mini-programs to quickly respond to user needs and provide services without consuming a large amount of device storage space.

[0003] However, due to the large number of mini-programs and their rapid update frequency, and the fact that the code packages of mini-programs cannot be pre-embedded in the installation package of mobile applications to avoid tampering during the process, there is a risk that the code packages of mini-programs may be hijacked and tampered with during the real-time retrieval process. Therefore, the security of data processing is currently low. Summary of the Invention

[0004] This application provides a data processing method, apparatus, electronic device, and storage medium that can improve the security of data processing.

[0005] This application provides a data processing method applicable to a client, wherein the client has an embedded public key of a root certificate, including:

[0006] Send a code package fetch request;

[0007] The returned code package and digital signature are obtained. The digital signature, which serves as the identifier of the code package, is obtained by encrypting the message digest of the code package using the private key of the root certificate.

[0008] Generate a new message digest of the code package, and use the public key of the root certificate to decrypt the digital signature to obtain the decrypted data;

[0009] If the new message digest of the code package is the same as the decrypted data, then load the code package.

[0010] This application provides a data processing method applicable to a server, wherein the server stores the private key of the root certificate, including:

[0011] Generate a corresponding message digest for each code package;

[0012] The message digest of each code packet is encrypted using the private key of the root certificate to obtain a digital signature for each code packet, which is then used as the identifier of the code packet.

[0013] In response to a code package pull request, it returns the code package indicated by the code package pull request, along with the digital signature of the code package indicated by the code package pull request, so that the client can verify the digital signature based on the public key of the root certificate and thus load the code package.

[0014] This application also provides a data processing apparatus suitable for a client, wherein the client has an embedded public key of a root certificate, and the apparatus includes:

[0015] Request unit, used to send code package pull request;

[0016] The acquisition unit is used to retrieve the returned code package and digital signature. The digital signature, which serves as the identifier of the code package, is obtained by encrypting the message digest of the code package using the private key of the root certificate.

[0017] The generation unit is used to generate a new message digest of the code package, and to decrypt the digital signature using the public key of the root certificate to obtain the decrypted data;

[0018] The loading unit is used to load the code package if the new message digest of the code package is the same as the decrypted data.

[0019] This application also provides a data processing apparatus suitable for a server, wherein the server stores the private key of the root certificate, and the apparatus includes:

[0020] The digest unit is used to generate a corresponding message digest for each code package;

[0021] The signature unit is used to encrypt the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet, so that the digital signature can be used as the identifier of the code packet;

[0022] The return unit is used to respond to a code package pull request, returning the code package indicated by the code package pull request, as well as the digital signature of the code package indicated by the code package pull request, so that the client can verify the digital signature based on the public key of the root certificate, thereby loading the code package.

[0023] This application also provides an electronic device, including a memory storing multiple instructions; the processor loads instructions from the memory to execute steps in any of the data processing methods provided in this application.

[0024] This application also provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute steps in any of the data processing methods provided in this application.

[0025] This application embodiment can send a code package retrieval request; obtain the returned code package and digital signature, the digital signature serving as the identifier of the code package, which is obtained by encrypting the message digest of the code package using the private key of the root certificate; generate a new message digest of the code package, and decrypt the digital signature using the public key of the root certificate to obtain decrypted data; if the new message digest of the code package is the same as the decrypted data, then load the code package.

[0026] Because message digests can only verify data integrity, not its origin. For example, an attacker could tamper with the data and recalculate the message digest, then replace the original message digest with the new one. When the receiver compares the tampered hash value, it will mistakenly believe that the data is complete and undisturbed.

[0027] Digital signatures are only suitable for smaller amounts of data, such as hash values, rather than entire files. Signing the entire code package directly would consume a lot of computing resources and time, making it inefficient and unsuitable for the use cases of mini programs.

[0028] Therefore, in this embodiment, by combining digital signatures and message digests, the problems of being unable to verify the data source, being easily tampered with, and having to recalculate hash values ​​that arise from using message digests alone can be avoided. Furthermore, digital signatures alone are not suitable for the use cases of mini-programs. Digital signatures can verify the authenticity of the message digest source, while message digests can verify the integrity of the code package. Thus, by setting the public and private keys of the root certificate in both the client and server, this embodiment ensures that any tampering during transmission can be detected, improving the security of data processing. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1a This is a data interaction diagram of the data processing method provided in the embodiments of this application;

[0031] Figure 1b This is a schematic diagram of a scenario illustrating the data processing method provided in an embodiment of this application;

[0032] Figure 1c This is a flowchart illustrating the data processing method provided in an embodiment of this application;

[0033] Figure 2a This is a flowchart illustrating the data processing method provided in an embodiment of this application;

[0034] Figure 2b This is a schematic diagram illustrating the application of the data processing method provided in this application embodiment in a mini-program scenario;

[0035] Figure 3a This is a schematic diagram of the structure of the data processing apparatus provided in the embodiments of this application;

[0036] Figure 3b This is a schematic diagram of the structure of the data processing apparatus provided in the embodiments of this application;

[0037] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] This application provides a data processing method, apparatus, electronic device, and storage medium.

[0040] Specifically, the data processing device can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet, smart Bluetooth device, laptop, or personal computer (PC); the server can be a single server or a server cluster consisting of multiple servers.

[0041] In some embodiments, the data processing apparatus may also be integrated into multiple electronic devices, such as multiple servers, with the data processing method of this application being implemented by the multiple servers.

[0042] In some embodiments, the server may also be implemented as a terminal.

[0043] For example, refer to Figure 1a The electronic device can be a client and a server. The client has the public key of the root certificate embedded in it, and the server stores the private key of the root certificate, wherein:

[0044] The server can pre-generate a corresponding message digest for each code packet and encrypt the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet, so that the digital signature can be used as the identifier of the code packet.

[0045] When the server receives a code package retrieval request from the client's mini-program, it responds by returning the code package indicated in the code package retrieval request, along with the digital signature of the code package indicated in the code package retrieval request, to the client so that the client can verify the digital signature based on the public key of the root certificate and thus load the code package.

[0046] After receiving the code packet and digital signature returned by the server, the client generates a new message digest for the code packet and uses the public key of the root certificate to decrypt the digital signature to obtain the decrypted data. If the new message digest of the code packet is the same as the decrypted data, it indicates that the code packet has not been tampered with and can be loaded. If the new message digest of the code packet is different from the decrypted data, it indicates that the code packet may have been tampered with and loading the code packet should be refused.

[0047] Digital signatures are encrypted tokens used to verify the authenticity of data origin.

[0048] The message digest is a fixed-length string obtained after processing data, used to quickly verify the integrity of the data.

[0049] Among them, the root certificate is a certificate that is self-signed by the certificate authority (CA). Self-signed means that it is cryptographically signed by its own private key, which can be used to ensure the authenticity of the data source when data is exchanged.

[0050] In this key pair, the public key and the private key can form a key pair. Data encrypted with the public key can only be decrypted with the corresponding private key, and data signed with the private key can be verified with the corresponding public key.

[0051] In this embodiment, by combining digital signatures and message digests, the problems of data source verification failure and easy tampering and recalculation of hash values ​​caused by using message digests alone can be avoided. Furthermore, digital signatures alone are not suitable for the use cases of mini-programs. Digital signatures can verify the authenticity of the message digest source, while message digests can verify the integrity of the code package. Therefore, by setting the public and private keys of the root certificate in both the client and server, this embodiment ensures that any tampering during transmission can be detected, thus improving data processing security.

[0052] The data processing method proposed in this application can achieve security detection without the user's awareness, for example, referring to... Figure 1b When a user clicks to enter the "Delicious Restaurant Ordering" mini-program using the client, the client sends a code package retrieval request to the server. The server responds to the code package retrieval request by returning the code package indicated in the code package retrieval request, as well as the digital signature of the code package indicated in the code package retrieval request. After obtaining the code package and digital signature returned by the server, the client generates a new message digest of the code package and uses the public key of the root certificate to decrypt the digital signature to obtain the decrypted data. If the new message digest of the code package is the same as the decrypted data, it indicates that the code package has not been tampered with and can be loaded, thereby displaying the page of the "Delicious Restaurant Ordering" mini-program based on the code package.

[0053] The following sections provide detailed descriptions of each example. It should be noted that the sequence numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0054] In this embodiment, a data processing method is provided for a client that has an embedded public key of the root certificate, such as... Figure 1c As shown, the specific flow of this data processing method can be as follows:

[0055] 110. Send a code package retrieval request.

[0056] The code package retrieval request can be used to request a specified code package from the server. In some embodiments, this solution can be applied to any application code package loading scenario, such as the loading scenario of a mini-program in an instant messaging application, that is, step 110 can be sending a code package retrieval request for the mini-program.

[0057] For example, in order to obtain or update the code package of a mini-program so that users can use the latest version of the mini-program, the user's mobile terminal can be equipped with an instant messaging application client, through which a request to pull the code package of the mini-program can be sent to the server.

[0058] There are several ways to trigger a code package pull request. For example, when a user selects a specific mini-program on the client page, the client can generate and send a code package pull request for that mini-program; or when a user is refreshing the page of a mini-program they are browsing, the client can generate and send a code package pull request for that mini-program.

[0059] In some embodiments, to further enhance the security of data processing, communication between the client and the server can be achieved by establishing a secure connection.

[0060] For example, communication connections can be established using protocols such as HTTPS, FTPS, and POP3 to ensure the security and integrity of data transmission.

[0061] For example, the code package retrieval request can be an HTTPS-based request, which may include necessary header information and parameters. For instance, the request header may include the user's authentication information, and the request parameters may include the unique identifier of the corresponding mini-program, the version number of the code package, and so on.

[0062] 120. Obtain the returned code package and digital signature. The digital signature serves as the identifier of the code package and is obtained by encrypting the message digest of the code package using the private key of the root certificate.

[0063] In this context, digital signatures serve as identifiers for code packets, ensuring the authenticity of the packet's origin and preventing tampering during transmission. In some embodiments, digital signatures can also serve as unique identifiers for the code packets, further enhancing the authenticity of their origin.

[0064] In some embodiments, the digital signature is obtained by encrypting the message digest of the code packet using the private key of the root certificate. The message digest of the code packet is a fixed-length string generated by performing a one-way hash calculation on the code packet. The message digest can be used to ensure the data integrity of the code packet; any modification to the code packet will result in a change to the message digest.

[0065] 130. Generate a new message digest of the code package, and use the public key of the root certificate to decrypt the digital signature to obtain the decrypted data.

[0066] In some embodiments, there are multiple ways to generate a message digest for a code packet. For example, the hash value of the code packet can be used as a message digest using hash functions such as MD5, SHA-1, SHA-256, etc.; for example, the statistical features of the code packet can be used as a message digest using feature extraction algorithms such as term frequency, TF-IDF value, part-of-speech tagging, word vectors, etc.; for example, the code packet can be represented as a graph structure using graph theory-based algorithms, and then the most important nodes or paths can be extracted as a message digest using graph theory algorithms.

[0067] In some embodiments, to prevent step 130 from still being executed in the event of digital signature forgery, the integrity of the digital signature can also be determined based on the message digest, based on the same principle, to prevent tampering with the digital signature. Therefore, step 130 includes the following steps:

[0068] Get the message digest of the returned digital signature;

[0069] Generate a new message digest with a digital signature;

[0070] If the returned message digest of the digital signature is the same as the new message digest of the digital signature, then a new message digest of the code packet is generated, and the digital signature is decrypted using the public key of the root certificate to obtain the decrypted data;

[0071] If the returned message digest of the digital signature is different from the new message digest of the digital signature, then the steps of generating a new message digest of the code package and decrypting the digital signature using the public key of the root certificate are not performed to obtain the decrypted data.

[0072] Before executing step 130, the message digest of the digital signature obtained from the server is compared with the new message digest of the digital signature calculated by the client. If the two are consistent, it indicates that the digital signature has not been tampered with and step 130 can be executed; if the two are inconsistent, it indicates that the digital signature may have been tampered with and step 130 cannot be executed.

[0073] In some embodiments, if the two are inconsistent, i.e., the digital signature may have been tampered with, an anomaly alert can be performed to report the situation to the user and the developers.

[0074] 140. If the new message digest of the code package is the same as the decrypted data, then load the code package.

[0075] If the new message digest of the code package is the same as the decrypted data, it means that the code package data is complete and has not been tampered with, and the code package can be loaded.

[0076] In some embodiments, if the new message digest of the code package is different from the decrypted data, the code package can be refused to be loaded.

[0077] If the new message digest of the code packet differs from the decrypted data, it indicates that the code packet data may have been tampered with and the code packet cannot be loaded. For example, during transmission, a malicious third party may intervene and modify the data content of the code packet, causing the MD5 value calculated by the client to differ from the MD5 value returned by the server. The MD5 value returned by the server is the decrypted data obtained by decrypting the digital signature.

[0078] In some embodiments, if the new message digest of the code package is different from the decrypted data, an exception alert can also be performed to report the situation to the user and the developer.

[0079] As can be seen from the above, the embodiments of this application can send a code package retrieval request; obtain the returned code package and digital signature, whereby the digital signature, as the identifier of the code package, is obtained by encrypting the message digest of the code package using the private key of the root certificate; generate a new message digest of the code package, and decrypt the digital signature using the public key of the root certificate to obtain decrypted data; if the new message digest of the code package is the same as the decrypted data, then the code package is loaded. Therefore, this solution can improve the security of data processing.

[0080] In this embodiment, a data processing method is provided for a server, where the private key of the root certificate is stored, such as... Figure 2a As shown, the specific flow of this data processing method can be as follows:

[0081] 210. Generate a corresponding message digest for each code package.

[0082] For example, by using a suitable hash algorithm, such as MD5, SHA-1, or SHA-256, the code package of each mini-program can be hashed to obtain a hash value. This hash value can then be stored as a unique message digest of the code package for future verification of its integrity or for other security operations.

[0083] 220. Using the private key of the root certificate, encrypt the message digest of each code packet to obtain a digital signature for each code packet, so that the digital signature can be used as a unique identifier for the code packet.

[0084] For example, the hash value of each code package can be encrypted using the private key of the root certificate to obtain the digital signature of each code package.

[0085] The public key of the root certificate can be pre-embedded in the client.

[0086] The following describes the generation of root certificate key pairs and the preprocessing of the key pairs. In some embodiments, this data processing method further includes:

[0087] 211. Generate a key pair for the root certificate, which includes a public key and a private key;

[0088] 212. Embed the public key in the client;

[0089] 213. Store the private key.

[0090] One can use encryption tools or programming libraries to generate key pairs for the root certificate, such as using OpenSSL, the MakeCert tool in the Microsoft Windows SDK, or Java Keytool.

[0091] To ensure that the client has the ability to verify messages signed by the root certificate's private key, the public key can be embedded in the client's source code or configuration file, and then the client with the embedded public key can be installed on the user's terminal.

[0092] In some embodiments, the public key can be embedded as a string in the source code as part of the source code to ensure that clients with embedded public keys can run on any terminal and have the ability to verify messages signed by the root certificate private key.

[0093] For example, step 212 includes the following steps:

[0094] Get the client's code data;

[0095] The root certificate is encoded into the client's code data, resulting in a client with an embedded public key.

[0096] In some embodiments, the server uses its private key to digitally sign the certificate issuance request, which can ensure the authenticity and trustworthiness of the final generated root certificate, that is, ensure that the root certificate has not been tampered with and has been issued by the server.

[0097] Therefore, step 211 may include the following steps:

[0098] Generate a key pair, which includes a public key and a private key;

[0099] Obtain application information;

[0100] Generate a certificate issuance request, which includes the public key and application information;

[0101] The root certificate is obtained by signing the certificate issuance request using the private key.

[0102] In some embodiments, different encryption algorithms can be selected to generate key pairs, such as RSA, DSA, ECDSA, etc.

[0103] The Certificate Signing Request (CSR) is used to request the generation of a root certificate. The CSR can include a public key and application information, which refers to the identity information of the applicant for the root certificate, such as name, department name, organization, and geographical location.

[0104] 230. In response to a code package pull request, return the code package indicated by the code package pull request, as well as the digital signature of the code package indicated by the code package pull request, so that the client can verify the digital signature based on the public key of the root certificate and thus load the code package.

[0105] For example, a code package pull request can be parsed to determine the name, version number, and other information of the code package indicated by the pull request.

[0106] In some embodiments, to prevent the sent digital signature from being intercepted or tampered with, a message digest can be generated for the digital signature and sent so that the client can verify whether the digital signature is complete or has been tampered with based on the message digest. Therefore, step 220 may also include the following steps:

[0107] Generate a message digest for the digital signature;

[0108] In some embodiments, step 230 may further include the following steps:

[0109] Returns a message digest of the digital signature.

[0110] As can be seen from the above, the embodiments of this application can generate a corresponding message digest for each code package; encrypt the message digest of each code package using the private key of the root certificate to obtain a digital signature for each code package, so that the digital signature can be used as a unique identifier for the code package; in response to a code package retrieval request, return the code package indicated by the code package retrieval request, as well as the digital signature of the code package indicated by the code package retrieval request, so that the client can verify the digital signature based on the public key of the root certificate, thereby loading the code package. Therefore, this solution can improve the security of data processing.

[0111] The method described in the above embodiments will be further described in detail below.

[0112] In this embodiment, the method of this application embodiment will be described in detail using the loading scenario of a mini-program as an example.

[0113] If a mobile application client needs to implement mini-program functionality, it needs to request and load the code package of a specific mini-program from the backend service when the user clicks on it within the client's interface. Because there are so many mini-programs and they are updated very frequently, the mini-program code package cannot be pre-embedded in the mobile application's installation package.

[0114] This application embodiment pre-creates a root certificate, embeds the public key of the root certificate in the mobile application's code, and finally compiles it into binary. The private key of the root certificate is stored in the backend service. When the mobile application pulls the mini-program code package, the backend service uses the private key to encrypt the MD5 of the mini-program code package into a digital signature, and returns it to the mobile application along with the code package. After the mobile application receives the code package and digital signature, the mobile application's client uses the public key to decrypt the digital signature and compares it with the calculated MD5 of the mini-program code package based on the decrypted data. If they match, the mini-program code package is loaded.

[0115] In this application embodiment, unless a malicious attacker completely decompiles and cracks the code of the entire mobile application, and simultaneously tamperes with the root certificate public key, digital signature and MD5, and intercepts the code package pull request to sign it with their own private key, no modification can be made to the mini-program code package during transmission.

[0116] The following describes the preprocessing:

[0117] First, a root certificate is created. The public key of the root certificate is embedded in the mobile application's code and eventually compiled into binary. The private key of the root certificate is stored in a backend service. For example:

[0118] A key pair is generated using the RSA algorithm. The key pair includes a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data.

[0119] Using the key pair, create a Certificate Signing Request (CSR), sign the CSR using the private key, and generate a self-signed root certificate;

[0120] Hardcode the root certificate into the mobile application's code so that the mobile application can use the root certificate to verify the server's certificate when the mobile application runs.

[0121] In some embodiments, the process of hardcoding the root certificate into the mobile application's code can be completed during the application's compilation phase. That is, the developer converts the root certificate into a format that can be recognized by the compiler and then writes the contents of this format into the code. When the application is compiled and packaged, the contents of the root certificate are included in the application's binary file, and this root certificate can be accessed regardless of which device the application is installed on.

[0122] In some embodiments, when the application is running, the mobile application can read the root certificate and then use the root certificate to verify the server's certificate. If the server's certificate can be verified by the root certificate, it indicates that the server is trustworthy, and the mobile application can then begin establishing secure communication with the server. If the server's certificate cannot be verified by the root certificate, it indicates that the server is untrustworthy, and the application refuses to communicate with the server to prevent user information from being stolen by an unauthorized server.

[0123] Every step in the preprocessing stage is designed to ensure secure communication between the mobile application and the server. By using asymmetric encryption and digital signatures, it's ensured that both parties are trustworthy and that the content of the communication cannot be intercepted or tampered with by third parties. Furthermore, by hard-coding the root certificate into the application's code, it prevents unauthorized replacement of the root certificate, thus preventing users from being redirected to malicious servers. In this way, users can use the mobile application securely without worrying about their information being stolen.

[0124] like Figure 2b As shown, the specific process of a data processing method is as follows:

[0125] (i) When a user clicks on any mini-program, the mobile application client requests the code package of that mini-program from the backend service.

[0126] When a user clicks on any mini-program, the mobile application client establishes a connection with the mobile application server, and the mobile application client requests the code package of the mini-program from the backend service.

[0127] (ii) After the backend service finds the code package of the mini-program, it uses the private key to encrypt the code package with MD5 to obtain a digital signature.

[0128] The backend service can find the specified mini-program code package in the database or file system. The code package contains all the code and resource files of the mini-program.

[0129] Then, the backend service uses the private key to encrypt the MD5 hash value of the mini-program code package to obtain a digital signature. This digital signature is the unique identifier of the mini-program code package. Any modification to the code package will cause the MD5 hash value to change, thus invalidating the digital signature.

[0130] (iii) The backend service returns the mini-program's code package and digital signature to the mobile application's client.

[0131] (iv) The mobile application client verifies the validity of the root certificate, decrypts the digital signature using the public key, and compares the decryption result with the MD5 of the newly calculated code packet by the client.

[0132] The mobile application first recalculates the MD5 hash of the code packet and then uses the public key to decrypt the digital signature to obtain the decryption result.

[0133] Then, the decryption result is compared with the MD5 hash of the newly calculated code packet to ensure that the digital signature has not been tampered with.

[0134] (v) If the comparison is consistent, the code package of the mini-program will be loaded so that the mini-program can be displayed to the user.

[0135] If the decryption result matches the newly calculated MD5 of the code package, it means that the code package has not been tampered with. Then, the code package of the mini-program is loaded so that the mini-program can be displayed to the user.

[0136] If the decryption result does not match the newly calculated MD5 of the code package, it means that the code package has been tampered with. Therefore, the code package of the mini-program will be refused to be loaded, and an error will be reported to the developers and users.

[0137] By using digital signatures and public-key cryptography, the mobile application can ensure that the mini-program code package received by the user is original and has not been tampered with. Simultaneously, by checking the MD5 hash of the digital signature, the mobile application can ensure that the digital signature was generated by the backend service and has not been replaced. In this way, users can use the mini-program securely without worrying about the security risks associated with code package tampering.

[0138] As can be seen from the above, the embodiments of this application can prevent malicious attackers from tampering with the mini-program code package, thereby ensuring the integrity and trustworthiness of the code and improving the security of data processing.

[0139] It is understood that, in the specific implementation of this application, application information and other related data are involved. When the following embodiments of this application are applied to specific products or technologies, permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0140] To better implement the above methods, this application also provides a data processing device, which can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, personal computer, etc.; the server can be a single server or a server cluster composed of multiple servers.

[0141] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the example of a data processing device specifically integrated into the client and the client embedding the public key of the root certificate.

[0142] For example, such as Figure 3aAs shown, the data processing device may include a request unit 301, an acquisition unit 302, a generation unit 303, and a loading unit 304, as follows:

[0143] (a) Request Unit 301.

[0144] Request unit 301 is used to send a code package retrieval request.

[0145] (ii) Acquisition Unit 302.

[0146] The acquisition unit 302 is used to acquire the returned code packet and digital signature. The digital signature, as the identifier of the code packet, is obtained by encrypting the message digest of the code packet with the private key of the root certificate.

[0147] (III) Generation Unit 303.

[0148] The generation unit 303 is used to generate a new message digest of the code packet and to decrypt the digital signature using the public key of the root certificate to obtain decrypted data.

[0149] In some embodiments, the generating unit 303 is configured to:

[0150] Get the message digest of the returned digital signature;

[0151] Generate a new message digest with a digital signature;

[0152] If the returned message digest of the digital signature is the same as the new message digest of the digital signature, then a new message digest of the code packet is generated, and the digital signature is decrypted using the public key of the root certificate to obtain the decrypted data;

[0153] If the returned message digest of the digital signature is different from the new message digest of the digital signature, then the steps of generating a new message digest of the code package and decrypting the digital signature using the public key of the root certificate are not performed to obtain the decrypted data.

[0154] (iv) Loading unit 304.

[0155] The loading unit 304 is used to load the code package if the new message digest of the code package is the same as the decrypted data.

[0156] In some embodiments, the data processing apparatus may further include a rejection unit 305.

[0157] The rejection unit 305 is used to refuse to load the code package if the new message digest of the code package is different from the decrypted data.

[0158] As can be seen from the above, the data processing apparatus of this embodiment consists of: a request unit sending a code packet retrieval request; an acquisition unit acquiring the returned code packet and digital signature, the digital signature serving as the identifier of the code packet and obtained by encrypting the message digest of the code packet using the private key of the root certificate; a generation unit generating a new message digest of the code packet and decrypting the digital signature using the public key of the root certificate to obtain decrypted data; and a loading unit loading the code packet if the new message digest of the code packet is the same as the decrypted data. Therefore, this embodiment can improve the security of data processing.

[0159] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the example of a data processing device specifically integrated into a server, in which the private key of the root certificate is stored.

[0160] For example, such as Figure 3b As shown, the data processing device may include a digest unit 311, a signature unit 312, and a return unit 313, as follows:

[0161] (I) Abstract Unit 311.

[0162] The digest unit 311 is used to generate a corresponding message digest for each code package.

[0163] (ii) Signature unit 312.

[0164] The signature unit 312 is used to encrypt the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet, so as to use the digital signature as the identifier of the code packet.

[0165] In some embodiments, the signature unit 312 is further configured to:

[0166] Generate a message digest for the digital signature;

[0167] Return unit 313 is also used for:

[0168] Returns a message digest of the digital signature.

[0169] (III) Return to Unit 313.

[0170] The return unit 313 is used to respond to the code package retrieval request, return the code package indicated by the code package retrieval request, and the digital signature of the code package indicated by the code package retrieval request, so that the client can verify the digital signature based on the public key of the root certificate, thereby loading the code package.

[0171] In some embodiments, the data processing apparatus is further configured to:

[0172] Generate a key pair for the root certificate, which includes a public key and a private key;

[0173] Embed the public key into the client;

[0174] Store the private key.

[0175] In some embodiments, generating a key pair for the root certificate, comprising a public key and a private key, includes the following steps:

[0176] Generate a key pair, which includes a public key and a private key;

[0177] Obtain application information;

[0178] Generate a certificate issuance request, which includes the public key and application information;

[0179] The root certificate is obtained by signing the certificate issuance request using the private key.

[0180] In some embodiments, embedding the public key into the client includes the following steps:

[0181] Get the client's code data;

[0182] The root certificate is encoded into the client's code data, resulting in a client with an embedded public key.

[0183] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0184] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0185] As described above, the data processing apparatus of this embodiment generates a corresponding message digest for each code packet by the digest unit; the signature unit encrypts the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet, which is then used as the identifier of the code packet; and the return unit responds to the code packet retrieval request by returning the code packet indicated by the code packet retrieval request, along with the digital signature of the code packet indicated by the code packet retrieval request, so that the client can verify the digital signature based on the public key of the root certificate and thus load the code packet. Therefore, this embodiment of the application can improve the security of data processing.

[0186] This application also provides an electronic device, which can be a terminal, a server, or other similar device. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, personal computer, etc.; the server can be a single server or a server cluster composed of multiple servers, etc.

[0187] In some embodiments, the data processing apparatus may also be integrated into multiple electronic devices, such as multiple servers, with the data processing method of this application being implemented by the multiple servers.

[0188] In this embodiment, the electronic device will be used as an example of a client and a server for detailed description. For example, ... Figure 4 As shown, it illustrates a structural schematic diagram of the electronic device involved in the embodiments of this application, specifically:

[0189] The electronic device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, an input module 404, and a communication module 405. Those skilled in the art will understand that... Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0190] The processor 401 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 402, and by calling data stored in the memory 402, it performs various functions and processes data, thereby performing overall detection of the electronic device. In some embodiments, the processor 401 may include one or more processing cores; in some embodiments, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 401.

[0191] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0192] The electronic device also includes a power supply 403 that supplies power to the various components. In some embodiments, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0193] The electronic device may also include an input module 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0194] The electronic device may also include a communication module 405. In some embodiments, the communication module 405 may include a wireless module, through which the electronic device can perform short-range wireless transmission, thereby providing users with wireless broadband internet access. For example, the communication module 405 can be used to help users send and receive emails, browse web pages, and access streaming media.

[0195] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 401 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 runs the applications stored in the memory 402 to realize various functions.

[0196] For example, in some embodiments, applicable to the client, the client has embedded the public key of the root certificate, which can achieve the following functions:

[0197] Send a code package fetch request;

[0198] The returned code package and digital signature are obtained. The digital signature, which serves as the identifier of the code package, is obtained by encrypting the message digest of the code package using the private key of the root certificate.

[0199] Generate a new message digest of the code package, and use the public key of the root certificate to decrypt the digital signature to obtain the decrypted data;

[0200] If the new message digest of the code package is the same as the decrypted data, then load the code package.

[0201] For example, in some embodiments, this applies to a server that stores the private key of the root certificate, enabling the following functionality:

[0202] Generate a corresponding message digest for each code package;

[0203] The message digest of each code packet is encrypted using the private key of the root certificate to obtain a digital signature for each code packet, which is then used as the identifier of the code packet.

[0204] In response to a code package pull request, it returns the code package indicated by the code package pull request, along with the digital signature of the code package indicated by the code package pull request, so that the client can verify the digital signature based on the public key of the root certificate and thus load the code package.

[0205] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0206] As can be seen from the above, the embodiments of this application can improve the security of data processing.

[0207] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0208] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the data processing methods provided in embodiments of this application.

[0209] For example, in some embodiments, applicable to a client that has embedded the public key of the root certificate, the instruction can perform the following steps:

[0210] Send a code package fetch request;

[0211] The returned code package and digital signature are obtained. The digital signature, which serves as the identifier of the code package, is obtained by encrypting the message digest of the code package using the private key of the root certificate.

[0212] Generate a new message digest of the code package, and use the public key of the root certificate to decrypt the digital signature to obtain the decrypted data;

[0213] If the new message digest of the code package is the same as the decrypted data, then load the code package.

[0214] For example, in some embodiments, applicable to a server that stores the private key of the root certificate, the instruction can perform the following steps:

[0215] Generate a corresponding message digest for each code package;

[0216] The message digest of each code packet is encrypted using the private key of the root certificate to obtain a digital signature for each code packet, which is then used as the identifier of the code packet.

[0217] In response to a code package pull request, it returns the code package indicated by the code package pull request, along with the digital signature of the code package indicated by the code package pull request, so that the client can verify the digital signature based on the public key of the root certificate and thus load the code package.

[0218] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0219] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the applet loading or code package transfer aspects provided in the above embodiments.

[0220] Since the instructions stored in the storage medium can execute the steps of any of the data processing methods provided in the embodiments of this application, the beneficial effects that any of the data processing methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0221] The foregoing has provided a detailed description of a data processing method, apparatus, electronic device, and computer-readable storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A data processing method, characterized in that, Applicable to a client that has an embedded public key for the root certificate, the method includes: Send a code package fetch request; Obtain the returned code package and digital signature. The digital signature serves as the identifier of the code package and is obtained by encrypting the message digest of the code package using the private key of the root certificate. Generate a new message digest for the code package, and use the public key of the root certificate to decrypt the digital signature to obtain decrypted data; If the new message digest of the code package is the same as the decrypted data, then the code package is loaded.

2. The data processing method as described in claim 1, characterized in that, The process of generating a new message digest for the code package and decrypting the digital signature using the public key of the root certificate to obtain decrypted data includes: Get the message digest of the returned digital signature; Generate a new message digest of the digital signature; If the returned message digest of the digital signature is the same as the new message digest of the digital signature, then a new message digest of the code package is generated, and the digital signature is decrypted using the public key of the root certificate to obtain decrypted data; If the returned message digest of the digital signature is different from the new message digest of the digital signature, then the steps of generating the new message digest of the code package and decrypting the digital signature using the public key of the root certificate are not performed to obtain decrypted data.

3. A data processing method, characterized in that, Applicable to a server, wherein the server stores the private key of the root certificate, the method includes: Generate a corresponding message digest for each code package; Using the private key of the root certificate, the message digest of each code packet is encrypted to obtain the digital signature of each code packet; In response to a code package retrieval request, the system returns the code package indicated by the code package retrieval request, along with the digital signature of the code package indicated by the code package retrieval request, so that the client can verify the digital signature based on the public key of the root certificate and thereby load the code package.

4. The data processing method as described in claim 3, characterized in that, Also includes: Generate a key pair for the root certificate, the key pair including a public key and a private key; Embed the public key into the client; Store the private key.

5. The data processing method as described in claim 4, characterized in that, The key pair for generating the root certificate, the key pair including a public key and a private key, includes: Generate a key pair, which includes a public key and a private key; Obtain application information; Generate a certificate issuance request, the certificate issuance request including the public key and the application information; The certificate issuance request is signed using the private key to obtain the root certificate.

6. The data processing method as described in claim 5, characterized in that, The step of embedding the public key into the client includes: Get the client's code data; The root certificate is encoded into the client's code data to obtain a client with the public key embedded.

7. The data processing method as described in claim 3, characterized in that, The step of encrypting the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet also includes: Generate the message digest of the digital signature; The step of responding to a code package pull request and returning the code package indicated by the code package pull request further includes: Return the message digest of the digital signature.

8. A data processing apparatus, characterized in that, For a client, the client having an embedded public key of the root certificate, the device includes: Request unit, used to send code package pull request; The acquisition unit is used to acquire the returned code package and digital signature, wherein the digital signature serves as the identifier of the code package and is obtained by encrypting the message digest of the code package using the private key of the root certificate; The generation unit is used to generate a new message digest of the code package and to decrypt the digital signature using the public key of the root certificate to obtain decrypted data; A loading unit is configured to load the code package if the new message digest of the code package is the same as the decrypted data.

9. The data processing apparatus as described in claim 8, characterized in that, The generation unit is used for: Get the message digest of the returned digital signature; Generate a new message digest of the digital signature; If the returned message digest of the digital signature is the same as the new message digest of the digital signature, then a new message digest of the code package is generated, and the digital signature is decrypted using the public key of the root certificate to obtain decrypted data; If the returned message digest of the digital signature is different from the new message digest of the digital signature, then the steps of generating the new message digest of the code package and decrypting the digital signature using the public key of the root certificate are not performed to obtain decrypted data.

10. A data processing apparatus, characterized in that, Suitable for a server, wherein the server stores the private key of the root certificate, the device includes: The digest unit is used to generate a corresponding message digest for each code package; The signature unit is used to encrypt the message digest of each code packet using the private key of the root certificate to obtain a digital signature for each code packet; The return unit is configured to respond to a code package retrieval request by returning the code package indicated by the code package retrieval request, as well as the digital signature of the code package indicated by the code package retrieval request, so that the client can verify the digital signature based on the public key of the root certificate and thereby load the code package.

11. The data processing apparatus as claimed in claim 10, characterized in that, The data processing device is further configured to: Generate a key pair for the root certificate, the key pair including a public key and a private key; Embed the public key into the client; Store the private key.

12. The data processing apparatus as claimed in claim 11, characterized in that, The key pair for generating the root certificate, the key pair including a public key and a private key, includes: Generate a key pair, which includes a public key and a private key; Obtain application information; Generate a certificate issuance request, the certificate issuance request including the public key and the application information; The certificate issuance request is signed using the private key to obtain the root certificate.

13. The data processing apparatus as claimed in claim 10, characterized in that, The signature unit is also used for: Generate the message digest of the digital signature; The return unit is also used for: Return the message digest of the digital signature.

14. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing multiple instructions; the processor loads instructions from the memory to perform the steps of the data processing method as described in any one of claims 1 to 7.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the steps of the data processing method according to any one of claims 1 to 7.

Images