Data encryption method, risk data processing method, device and computer equipment

Abstract

This application relates to a data encryption method, a risky data processing method, an apparatus, a computer device, and a storage medium. The method includes: acquiring application source code data; compiling the application source code data to obtain first application compiled data; replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data. If a data encryption request is received, the method acquires the data to be processed corresponding to the data encryption request, restores the second application compiled data to the first application compiled data, and performs encryption and signature processing on the data to be processed based on the signature encryption public key in the first application compiled data to obtain encrypted signature data. This method can reduce the risk of leakage of the signature encryption public key, as well as information leakage and resource loss to the platform and users, and improve the efficiency of information security protection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data encryption method, a risky data processing method, an apparatus, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the development of computer technology and the widespread application of various applications or platforms, in order to ensure the information security of applications or platforms and avoid situations such as web crawlers mass-grabbing platform object information leading to information leakage, or replay attacks on the platform leading to malicious authorization and resource loss, signature verification methods have emerged to filter illegal calls and only respond to requests from clients whose signature verification has passed.

[0003] The signature verification method used in traditional technology involves signing and encrypting the login information and environment information when the client initiates a resource request to the server to obtain signature data. The resource request and signature data are sent to the server at the same time. When the server receives the resource request, it must first verify the signature data. If the verification is successful, it will respond to the resource request and perform the corresponding resource processing or resource feedback operation.

[0004] However, current signature verification methods further compile the encryption algorithm and encryption function when encrypting the verification information to obtain a compiled file. However, in this compiled file, the encryption function or encryption key is still stored in plaintext, which is easy to be discovered and illegally extracted. This still poses information security risks to the platform and users, and the information security protection efficiency is low. Summary of the Invention

[0005] Therefore, it is necessary to provide a data encryption method, risk data processing method, device, computer equipment, computer-readable storage medium, and computer program product that can reduce information security risks to platforms and users, reduce information leakage and resource loss, and improve the efficiency of information security protection, in response to the above-mentioned technical problems.

[0006] In a first aspect, this application provides a data encryption method, comprising: acquiring application source code data, compiling the application source code data to obtain first application compiled data; replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data; if a data encryption request is received, acquiring the data to be processed corresponding to the data encryption request, and restoring the second application compiled data to the first application compiled data, so as to perform encryption and signature processing on the data to be processed according to the signature encryption public key in the first application compiled data to obtain encrypted signature data.

[0007] Secondly, this application also provides a data encryption device, comprising: an application source code data compilation module, configured to acquire application source code data, compile the application source code data, and obtain first application compiled data; a public key replacement module, configured to replace the signature encryption public key in the first application compiled data with the simulated public key, and obtain second application compiled data; and an encryption signature processing module, configured to, if a data encryption request is received, acquire the data to be processed corresponding to the data encryption request, and restore the second application compiled data to the first application compiled data, so as to perform encryption signature processing on the data to be processed according to the signature encryption public key in the first application compiled data, and obtain encryption signature data.

[0008] Thirdly, this application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: acquiring application source code data, compiling the application source code data to obtain first application compiled data; replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data; if a data encryption request is received, acquiring the data to be processed corresponding to the data encryption request, and restoring the second application compiled data to the first application compiled data, so as to perform encryption and signature processing on the data to be processed according to the signature encryption public key in the first application compiled data to obtain encrypted signature data.

[0009] Fourthly, this application also provides a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, performs the following steps: obtaining application source code data, compiling the application source code data to obtain first application compiled data; replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data; if a data encryption request is received, obtaining the data to be processed corresponding to the data encryption request, and restoring the second application compiled data to the first application compiled data, so as to perform encryption and signature processing on the data to be processed according to the signature encryption public key in the first application compiled data to obtain encrypted signature data.

[0010] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps: acquiring application source code data, compiling the application source code data to obtain first application compiled data; replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data; if a data encryption request is received, acquiring the data to be processed corresponding to the data encryption request, and restoring the second application compiled data to the first application compiled data, so as to perform encryption and signature processing on the data to be processed according to the signature encryption public key in the first application compiled data to obtain encrypted signature data.

[0011] In the aforementioned data encryption methods, devices, computer equipment, computer-readable storage media, and computer program products, by obtaining application source code data, compiling the application source code data to obtain first application compiled data, and replacing the signature encryption public key in the first application compiled data with a simulated public key to obtain second application compiled data, when an unauthorized external object intercepts or saves data, what it obtains is the simulated public key in the second application compiled data, rather than the real signature encryption public key. This can protect the signature encryption public key and prevent the real signature encryption public key from being illegally obtained or maliciously authorized. Furthermore, if a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained, and the second application compiled data is restored to the first application compiled data. Thus, based on the real signature encryption public key in the first application compiled data, the data to be processed can be encrypted and signed to obtain encrypted signature data. This allows the server to recognize and parse the encrypted signature data and respond to the corresponding data processing request. This achieves the goal of restoring the second application compiled data to the first application compiled data only when a data encryption request is received. This reduces the risk of leakage of the signature encryption public key in the first application compiled data, avoids the illegal acquisition of the real signature encryption public key and malicious authorization, reduces information leakage and resource loss to the platform and users, and improves the efficiency of information security protection.

[0012] Sixthly, this application provides a risky data processing method, comprising: receiving a data processing request and obtaining encrypted signature data corresponding to the data processing request; parsing the encrypted signature data and determining the data signature type to which the encrypted signature data belongs; if the data signature type is determined to be a simulated signature, calling a simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain first decryption information corresponding to the encrypted signature data; parsing the first decryption information to obtain an object identifier corresponding to the data processing request, and performing risky data processing based on the object identifier.

[0013] Seventhly, this application also provides a risk data processing apparatus, comprising: an encrypted signature data acquisition module, configured to receive a data processing request and acquire encrypted signature data corresponding to the data processing request; a data signature type determination module, configured to parse the encrypted signature data and determine the data signature type to which the encrypted signature data belongs; a decryption processing module, configured to, if the data signature type is determined to be a simulated signature, invoke a simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain first decryption information corresponding to the encrypted signature data; and a risk processing module, configured to parse the first decryption information, obtain an object identifier corresponding to the data processing request, and perform risk data processing based on the object identifier.

[0014] Eighthly, this application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: receiving a data processing request and obtaining encrypted signature data corresponding to the data processing request; parsing the encrypted signature data and determining the data signature type to which the encrypted signature data belongs; if the data signature type is determined to be a simulated signature, calling a simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain first decryption information corresponding to the encrypted signature data; parsing the first decryption information to obtain an object identifier corresponding to the data processing request, and performing risk data processing on the object identifier.

[0015] Ninthly, this application also provides a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, performs the following steps: receiving a data processing request and obtaining encrypted signature data corresponding to the data processing request; parsing the encrypted signature data and determining the data signature type to which the encrypted signature data belongs; if the data signature type is determined to be a simulated signature, calling a simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain first decryption information corresponding to the encrypted signature data; parsing the first decryption information to obtain an object identifier corresponding to the data processing request, and performing risky data processing based on the object identifier.

[0016] Tenthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps: receiving a data processing request and obtaining encrypted signature data corresponding to the data processing request; parsing the encrypted signature data and determining the data signature type to which the encrypted signature data belongs; if the data signature type is determined to be a simulated signature, calling a simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain first decryption information corresponding to the encrypted signature data; parsing the first decryption information to obtain an object identifier corresponding to the data processing request, and performing risky data processing based on the object identifier.

[0017] In the aforementioned risk data processing methods, apparatus, computer equipment, computer-readable storage media, and computer program products, upon receiving a data processing request, the encrypted signature data corresponding to the data processing request is obtained and parsed to determine the data signature type to which the encrypted signature data belongs. If the data signature type is determined to be a simulated signature, the simulated public key associated with the simulated signature is invoked to decrypt the encrypted signature data, obtaining first decryption information corresponding to the encrypted signature data. The first decryption information is further parsed to obtain an object identifier corresponding to the data processing request. Thus, risk data processing can be performed based on the object identifier, thereby reducing illegal calls to the server, reducing the consumption of server bandwidth, computing resources, and other resources, and further improving the efficiency of information security protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is an application environment diagram of a data encryption method and a risky data processing method in one embodiment;

[0020] Figure 2 This is a flowchart illustrating a data encryption method in one embodiment;

[0021] Figure 3 This is a schematic diagram illustrating the process of obtaining the public key processing code file in one embodiment;

[0022] Figure 4 This is a schematic diagram illustrating the encryption and signing process of data to be processed based on a signature encryption public key in one embodiment.

[0023] Figure 5This is a schematic diagram of the process for obtaining the compilation data of the second application in one embodiment;

[0024] Figure 6 This is a schematic diagram illustrating the replacement of the signature encryption public key with a simulated public key in one embodiment;

[0025] Figure 7 This is a schematic diagram of the process for obtaining the compilation data of the first application in one embodiment;

[0026] Figure 8 This is a schematic diagram illustrating the process of restoring a simulated public key to a signed encryption public key in one embodiment.

[0027] Figure 9 This is a schematic diagram illustrating the process of restoring a signature encryption public key to a simulated public key in one embodiment.

[0028] Figure 10 This is a flowchart illustrating the data encryption method in another embodiment;

[0029] Figure 11 This is a flowchart illustrating a risk data processing method in one embodiment;

[0030] Figure 12 This is a schematic diagram illustrating the traditional illegal data processing request process in one embodiment;

[0031] Figure 13 This is a schematic diagram illustrating the process of handling illegal data processing requests in a risk data processing method in one embodiment;

[0032] Figure 14 This is a schematic diagram illustrating the processing procedure of a normal data processing request in a risk data processing method in one embodiment;

[0033] Figure 15 This is a schematic diagram illustrating the process of compiling application source code data to obtain a release artifact in one embodiment.

[0034] Figure 16 This is a schematic diagram of the risk data processing method in another embodiment;

[0035] Figure 17 This is a structural block diagram of a data encryption device in one embodiment;

[0036] Figure 18 This is a structural block diagram of a risk data processing device in one embodiment;

[0037] Figure 19 This is an internal structural diagram of a computer device in one embodiment;

[0038] Figure 20 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0040] The data encryption method and risk data processing method provided in this application can be applied to, for example... Figure 1 The application environment shown includes a client 102, a server 104, and a data storage system. The client 102 communicates with the server 104 via a network. The data storage system stores the data that the server 104 needs to process. The data storage system can be integrated into the server 104 or located in the cloud or on other network servers. The client 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, portable wearable devices, and aircraft. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 can be a standalone physical server, a server cluster consisting of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The client 102 and the server 104 can be connected directly or indirectly via wired or wireless communication; this embodiment does not impose any restrictions on this.

[0041] In this embodiment, both client 102 and server 104 can be used independently to execute the data encryption method and the risk data processing method provided in this application. Client 102 and server 104 can also collaboratively execute the data encryption method and the risk data processing method provided in this application. For example, taking the collaborative execution of the data encryption method provided in this application by client 102 and server 104 as an example, client 102 obtains application source code data, compiles the application source code data to obtain first application compilation data, and replaces the signature encryption public key in the first application compilation data with a simulated public key to obtain second application compilation data. Furthermore, if client 102 receives a data encryption request triggered by an object, it obtains the data to be processed corresponding to the data encryption request, and restores the second application compilation data to the first application compilation data. Based on the signature encryption public key in the first application compilation data, it performs encryption and signature processing on the data to be processed to obtain encrypted signature data. When it is necessary to send a data processing request to server 104, it sends both the data processing request and the encrypted signature data back to server 104. Server 104 can then decrypt and verify the encrypted signature data. When the verification is successful, it responds to the data processing request sent by client 102 and performs the corresponding data processing operation.

[0042] Similarly, taking the risk data processing method provided in this application embodiment, which is executed collaboratively by client 102 and server 104, as an example, server 104 receives the data processing request from client 102, obtains the encrypted signature data corresponding to the data processing request, and parses the encrypted signature data to determine the data signature type to which the encrypted signature data belongs. Further, if server 104 determines that the data signature type is a simulated signature, it calls the simulated public key associated with the simulated signature to decrypt the encrypted signature data to obtain the first decryption information corresponding to the encrypted signature data. By parsing the first decryption information, the object identifier corresponding to the data processing request can be obtained, thereby allowing server 104 to perform risk data processing based on the object identifier.

[0043] In one exemplary embodiment, such as Figure 2 As shown, a data encryption method is provided, which can be applied to... Figure 1 Taking client 102 as an example, the explanation includes the following steps S202 to S206. Wherein:

[0044] Step S202: Obtain application source code data, compile application source code data, and obtain first application compilation data.

[0045] Before initiating a data processing request to the server, the client needs to call an encryption algorithm or encryption function to encrypt and sign its login information, environment information, and other data to be processed, obtaining the corresponding encrypted signature data. When initiating the data processing request, the client sends both the encrypted signature data and the data processing request back to the server. Upon receiving the data processing request and the encrypted signature data, the server decrypts and verifies the encrypted signature data. Only when the verification is successful does the server respond to the data processing request and execute the data processing task corresponding to the data processing request.

[0046] Specifically, the client obtains the application source code data used for encryption. This application source code data includes the signature encryption public key, encryption functions, or encryption algorithms used for encryption. To protect the signature encryption public key and encryption algorithms, the client uses a web-oriented encoding format (i.e., Web Assembly, which can be understood as a web-oriented binary encoding format) to compile the application source code data, thereby obtaining the first application compiled data. This increases the difficulty of data cracking and ensures data security.

[0047] The first application compilation data is compiled using a web-oriented encoding format. It can be understood as an executable binary file in a web environment. Specifically, it is compiled from application source code data into the first application compilation data, so that the application source code data originally intended for the server can be run in the browser after being compiled into application compilation data.

[0048] For example, the first application compilation data can be divided into multiple regions (i.e., segments) according to its function or purpose, including a code segment (used to store the program's executable code), a data segment (used to store initialized global and static variables in the program, specifically including the signature encryption public key used for encryption, as well as encryption functions or encryption algorithms), and a function segment (used to store function parameter names, parameter lists, return values, and function bodies, etc.). When the browser creates a corresponding application compilation instance based on the first application compilation data to run the application compilation data, it needs to create a linear memory instance using `new WebAssembly.Memory()` (i.e., the memory instance creation component). This linear memory instance is passed as a parameter when creating the application compilation instance. That is, during the creation of the application compilation instance, the constant data (including the signature encryption public key used for encryption, as well as encryption functions or encryption algorithms) in the data segment (i.e., the data segment) of the first application compilation data is automatically written by the browser into the created linear memory.

[0049] Step S204: Replace the signature encryption public key in the first application compilation data with a simulated public key to obtain the second application compilation data.

[0050] For information security protection, the client needs to implement honeypot protection for key strings (such as the signature encryption public key) in the first application compilation data. This involves replacing the actual key strings in the data segments (Data Segments) of the first application compilation data with simulated strings. For example, the actual signature encryption public key used for signature encryption is replaced with a simulated public key. When an attacker views the second application compilation data using a binary editor (such as Chrome Developer Tools), the strings they see are simulated. Honeypot protection refers to using additional hosts, network services, or information to attract attention and lure attackers to attack them, thereby protecting the actual hosts, services, and information providing or processing the service. By capturing and analyzing attack behavior, the tools and methods used by the attackers are identified, and risk labeling and interception of attackers are implemented.

[0051] When an attacker makes a black-box call by saving the compilation data of a second application, the key strings such as the signature encryption public key are in an obfuscated state protected by a honeypot. Therefore, the public key used to sign and encrypt the data to be processed is a simulated public key, not the actual signature encryption public key. The encrypted signature data after being encrypted and signed with a simulated public key cannot be verified by the server. This can effectively prevent attackers from forging illegal requests to access and process data resources, thus ensuring the security of information resources.

[0052] Specifically, the client obtains a simulated public key set for the honeypot protection mechanism, such as a simulated public key string, and determines the location of the signature encryption public key from the first application compilation data. The client then replaces the signature encryption public key at that location with the simulated public key to obtain the compiled second application compilation data.

[0053] In practical applications, the second application compilation data is a specific file that can be intercepted and obtained by attackers. That is, the first application compilation data obtained by compiling the application source code data is intermediate data in the compilation process. It is not stored in the application compilation instance. In other words, through the honeypot protection mechanism, the key strings stored in the application compilation instance and the linear memory instance are all simulated public keys that have been replaced, rather than the actual signature encryption public keys.

[0054] Step S206: If a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained, and the second application compilation data is restored to the first application compilation data. The data to be processed is encrypted and signed according to the signature encryption public key in the first application compilation data to obtain encrypted signature data.

[0055] Specifically, before initiating a data processing request to the server, the client needs to call an encryption algorithm or encryption function to encrypt and sign its own login information and environment information pending processing data. Specifically, when receiving a data encryption request triggered by the login information and environment information pending processing data, the client obtains the data to be processed corresponding to the data encryption request, which specifically includes the login information and environment information corresponding to the user.

[0056] The login information may include account information and password information corresponding to the user, while the environment information is used to determine the environment in which the data encryption request is initiated. Specifically, it is either a browser environment (i.e., a runtime environment designed for front-end development, handling client-side tasks such as user interface rendering, client-side script execution, and interaction with web pages) or a NodeJS environment (i.e., a runtime environment designed for server-side and back-end development, handling server-side tasks such as file system operations, network communication, and running operating system commands).

[0057] For example, in practical applications, attackers can intercept and download second application compilation data, and then impersonate a browser environment in a NodeJS environment to run the second application compilation data. However, the environment information of the NodeJS environment and the browser environment are different, specifically including different global objects and different application interfaces provided. Therefore, by parsing and verifying the environment information, it can be determined whether the currently triggered data processing request is a request forged by the attacker based on the NodeJS environment, so as to promptly mark and intercept the forged request and ensure data security.

[0058] Furthermore, when the client restores the second application compilation data to the first application compilation data, it specifically obtains the public key processing code file corresponding to the application source code data, executes the public key processing code file, and restores the simulated public key in the second application compilation data to the signature encryption public key, thereby restoring the first application compilation data.

[0059] Specifically, the client obtains the public key processing code file corresponding to the application source code data, which is the public key code data file used for public key replacement processing. By executing the public key processing code file, the client performs public key replacement processing on the second application compilation data based on the signature encryption public key included in the public key processing code file and the linear memory offset corresponding to the signature encryption public key. This restores the simulated public key in the second application compilation data to the signature encryption public key, thus obtaining the first application compilation data.

[0060] In one exemplary embodiment, the method of obtaining the public key processing code file corresponding to the application source code data includes:

[0061] Obtain the compilation metadata associated with the first application compilation data, parse the compilation metadata, and obtain the linear memory offset corresponding to the signature encryption public key; inject the signature encryption public key and the linear memory offset corresponding to the signature encryption public key into the code processing file corresponding to the application source code data to obtain the public key processing code file.

[0062] Specifically, the client needs to determine the compilation metadata associated with the first application compilation data. This metadata is used to structurally describe the first application compilation data obtained from compiling the application source code data. Specifically, this includes each region (i.e., segment) in the application compilation instance, and the offset and size of each region (i.e., segment) in the binary output (i.e., the linear memory of the first application compilation data). For example, the Function Segment describes the parameter names, parameter list, return value, and function body of a function, as well as the offset and size of the parameter names in the first application compilation data. The Data Segment primarily describes the string content (such as the signature encryption public key), and the length and offset of the string (i.e., the signature encryption public key) in the linear memory of the first application compilation data.

[0063] Specifically, the client can parse the compilation metadata associated with the application source code data to obtain, for example, the Data Segment in the compilation metadata. Based on the data segment, the client can determine the signature encryption public key used for encryption, as well as the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data.

[0064] Furthermore, the client also needs to obtain the code processing file corresponding to the application source code data, that is, the JS code file protected by JSVMP (i.e., JavaScript Virtual Machine Protection, which can be understood as a code hardening and obfuscation method implemented by the JS virtual machine). Then, the client injects the signing encryption public key and the linear memory offset corresponding to the signing encryption public key into the code processing file corresponding to the application source code data, so as to obtain the public key processing code file carrying the signing encryption public key and the linear memory offset corresponding to the signing encryption public key.

[0065] In one exemplary embodiment, such as Figure 3 As shown, a process for obtaining a public key processing code file is provided, referring to... Figure 3 As can be seen, firstly, the client compiles the application source code data (including the signing encryption public key and encryption functions) used for encryption to obtain the first application compilation data and the compilation metadata associated with it. Secondly, the client parses the compilation metadata to obtain the signing encryption public key and its corresponding linear memory offset. Further, the client obtains the code processing file corresponding to the application source code data and injects the signing encryption public key and its corresponding linear memory offset into the code processing file to obtain the public key processing code file.

[0066] In an exemplary embodiment, after the client restores the second application compilation data to the first application compilation data, it can perform encryption and signature processing on the data to be processed based on the signature encryption public key in the first application compilation data to obtain encrypted signature data.

[0067] Specifically, when the client receives a data encryption request and obtains the data to be processed corresponding to the data encryption request, it obtains the public key processing code file corresponding to the application source code data in real time, executes the public key processing code file, restores the simulated public key in the second application compilation data to the signature encryption public key, and obtains the first application compilation data. Thus, based on the signature encryption public key in the first application compilation data, the data to be processed (specifically including login information and environment information, etc.) can be encrypted and signed to obtain encrypted signature data.

[0068] When a client needs to send a data processing request to the server, it sends both the data processing request and the encrypted signature data back to the server. The server can then decrypt and verify the encrypted signature data. If the verification passes, the server will respond to the data processing request from the client, perform the corresponding data processing operation, and obtain the corresponding data processing result.

[0069] In one exemplary embodiment, such as Figure 4 As shown, a process is provided for encrypting and signing data to be processed based on a signature encryption public key, referring to... Figure 4 It can be seen that the client reads the signature encryption public key (i.e., ...) from the linear memory containing the compiled data of the first application by calling its own deployed application encoding encryption component. Figure 4 The system uses the "PUKEY" in the first application compilation data to execute the encryption algorithm or encryption function in the first application compilation data, and uses the signature encryption public key to perform encryption signature processing on the data to be processed to obtain encrypted signature data.

[0070] In the above data encryption method, by obtaining application source code data, compiling the application source code data, and obtaining the first application compiled data, the signature encryption public key in the first application compiled data is replaced with a simulated public key to obtain the second application compiled data. That is, when an unauthorized external object intercepts or saves data, what it obtains is the simulated public key in the second application compiled data, rather than the real signature encryption public key. This can protect the signature encryption public key and prevent the real signature encryption public key from being illegally obtained or maliciously authorized. Furthermore, if a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained, and the second application compiled data is restored to the first application compiled data. Thus, based on the real signature encryption public key in the first application compiled data, the data to be processed can be encrypted and signed to obtain encrypted signature data. This allows the server to recognize and parse the encrypted signature data and respond to the corresponding data processing request. This achieves the restoration of the second application compiled data to the first application compiled data only when a data encryption request is received. This reduces the risk of leakage of the signature encryption public key in the first application compiled data, avoids the illegal acquisition of the real signature encryption public key and malicious authorization, reduces information leakage and resource loss to the platform and users, and improves the efficiency of information security protection.

[0071] In one exemplary embodiment, such as Figure 5 As shown, the steps to obtain the second application compilation data, namely replacing the signature encryption public key in the first application compilation data with a simulated public key, specifically include the following steps S502 to S506. Wherein:

[0072] Step S502: Extract public key compilation data, which is used to represent the signature encryption public key, from the first application compilation data.

[0073] Specifically, the client parses the first application compilation data and extracts the public key compilation data that represents the signature encryption public key from the first application compilation data, such as obtaining the Data Segment. Based on the data segment, the client can determine the signature encryption public key used for encryption and the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data.

[0074] Step S504: Parse the public key compilation data to determine the location of the signature encryption public key in the first application compilation data.

[0075] Specifically, the client parses the public key compilation data used to represent the signature encryption public key, and obtains the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data from the public key compilation data. Thus, the position of the signature encryption public key in the first application compilation data can be determined based on the linear memory offset.

[0076] Step S506: For the first application compilation data, replace the signature encryption public key located in the public key position with a simulated public key to obtain the second application compilation data.

[0077] Specifically, the client obtains a simulated public key for honeypot protection and uses it to perform public key replacement processing on the first application compilation data. That is, the signature encryption public key located in the public key position in the first application compilation data is replaced with the simulated public key to obtain the second application compilation data.

[0078] In one exemplary embodiment, such as Figure 6 As shown, a process is provided to replace the signature encryption public key with a simulated public key, referring to... Figure 6 It is understood that the client, by calling the application encoding encryption component, creates a corresponding application compilation instance based on the first application compilation data. Simultaneously, it creates a linear memory instance corresponding to the first application compilation data to write the signature encryption public key used for encryption, as well as constant data such as encryption functions or algorithms. Specifically, the client needs to perform honeypot protection on key strings (such as the signature encryption public key) in the obtained first application compilation data. That is, during the compilation of the application source code data, the key strings (such as the signature encryption public key "PUKEY") in the data segment of the first application compilation data are replaced with simulated strings (such as simulated public keys "ABCDE"). Therefore, the linear memory stores the simulated string "ABCDE," not the actual signature encryption public key "PUKEY."

[0079] In this embodiment, by extracting public key compilation data representing the signature encryption public key from the first application compilation data and parsing the public key compilation data, the position of the signature encryption public key in the first application compilation data can be determined. This allows the signature encryption public key located at the public key position in the first application compilation data to be replaced with a simulated public key, resulting in the second application compilation data. This achieves obfuscation protection of the signature encryption public key in the first application compilation data during the compilation of the application source code data, preventing the leakage of the signature encryption public key. This effectively prevents attackers from forging illegal requests to access and process data resources, ensuring information resource security.

[0080] In one exemplary embodiment, such as Figure 7 As shown, the steps to obtain the first application compilation data, namely, executing the public key processing code file to restore the simulated public key in the second application compilation data to the signature encryption public key, and thus obtaining the first application compilation data, specifically include the following steps S702 to S704. Wherein:

[0081] Step S702: Execute the public key processing code file and determine the location of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature encryption public key in the public key processing code file.

[0082] When the client receives a data encryption request and obtains the data to be processed corresponding to the data encryption request, that is, when the data to be processed needs to be encrypted and signed, it obtains the public key processing code file corresponding to the application source code data in real time, executes the public key processing code file, restores the simulated public key in the second application compilation data to the signature encryption public key, and obtains the first application compilation data. Thus, based on the signature encryption public key in the first application compilation data, the data to be processed (specifically including login information and environment information, etc.) can be encrypted and signed to obtain encrypted and signed data.

[0083] Specifically, the client executes the public key processing code file to determine the location of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature encryption public key in the public key processing code file, that is, based on the linear memory offset of the signature encryption public key in the linear memory of the application compilation data.

[0084] Step S704: Using the public key processing code file's signature encryption public key, the simulated public key located in the public key position in the second application compilation data is restored to the signature encryption public key, thus obtaining the first application compilation data.

[0085] Specifically, the client executes a public key processing code file, and after determining the location of the simulated public key in the public key position of the second application compilation data, it uses the signature encryption public key in the public key processing code file to restore the simulated public key located at the public key position in the second application compilation data to the signature encryption public key, thus obtaining the first application compilation data. Therefore, the client can perform encryption and signature processing on the data to be processed (specifically including login information and environment information, etc.) based on the signature encryption public key in the first application compilation data to obtain encrypted signature data.

[0086] In one exemplary embodiment, such as Figure 8 As shown, a process for restoring a simulated public key to a signed encryption public key is provided, referring to... Figure 8 It can be seen that the client executes the public key processing code file (i.e. Figure 8 The JS file in the second application's compilation data is used to perform a honeypot removal operation, which restores the simulated public key (i.e., the simulated string "ABCDE") in the linear memory of the second application's compilation data to the signature encryption public key (i.e., the real signature encryption public key "PUKEY"), thus obtaining the first application's compilation data.

[0087] In an exemplary embodiment, after obtaining the encrypted signature data, the method further includes: executing a public key processing code file, obtaining a simulated public key, restoring the signature encryption public key in the first application compilation data to the simulated public key, and obtaining the second application compilation data.

[0088] Specifically, the client performs encryption and signature processing on the data to be processed based on the signature encryption public key in the first application compilation data. After obtaining the encrypted signature data, the client executes the public key processing code file to obtain a simulated public key, so as to restore the signature encryption public key in the first application compilation data back to the simulated public key. Thus, the real signature encryption public key only appears briefly in linear memory during the encryption algorithm and is only used for signature encryption processing. After the signature encryption processing is completed, it is restored to the simulated public key. That is, in the non-decryption case, the simulated honeypot public key is always stored in the linear memory and the second application compilation data, rather than the real signature encryption public key.

[0089] Furthermore, such as Figure 9 As shown, a process for restoring a signed encryption public key to a simulated public key is provided, referring to... Figure 9 It can be seen that after obtaining the encrypted signature data, the client executes the public key processing code file (i.e., Figure 9 (In the JS file), obtain the simulated public key, and restore the signature encryption public key (i.e. the real signature encryption public key "PUKEY") in the linear memory of the first application compilation data to the simulated public key (i.e. the simulated string "ABCDE").

[0090] In this embodiment, by executing the public key processing code file, the position of the simulated public key in the second application compilation data is determined according to the linear memory offset corresponding to the signature encryption public key in the public key processing code file. Then, using the signature encryption public key in the public key processing code file, the simulated public key located at the public key position in the second application compilation data is restored to the signature encryption public key, thus obtaining the first application compilation data. Therefore, when signature encryption processing is required, the simulated public key in the second application compilation data can be restored in real time by executing the public key processing code file to obtain the signature encryption public key that can be used for signature encryption processing. This avoids the real signature encryption public key being exposed for a long time, and instead uses honeypot obfuscation to protect it, preventing the leakage of the signature encryption public key. This can effectively prevent attackers from forging illegal requests to access and process data resources, ensuring the security of information resources.

[0091] In one exemplary embodiment, such as Figure 10 As shown, a data encryption method is provided, which can be applied to... Figure 1 Taking client 102 as an example, the explanation includes the following steps S1001 to S1011. Wherein:

[0092] Step S1001: Obtain application source code data, compile application source code data, and obtain first application compilation data.

[0093] Specifically, the client obtains the application source code data used for encryption. This application source code data includes the public key for encryption, as well as encryption functions or algorithms. The client then compiles the application source code data using a web-oriented encoding format to obtain the first application compiled data. This first application compiled data can be understood as an executable binary file in a web environment.

[0094] Step S1002: Extract public key compilation data, which is used to represent the signature encryption public key, from the first application compilation data.

[0095] Specifically, the client parses the first application compilation data and extracts the public key compilation data that represents the signature encryption public key from the first application compilation data, such as obtaining the Data Segment. Based on the data segment, the client can determine the signature encryption public key used for encryption and the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data.

[0096] Step S1003: Parse the public key compilation data to determine the position of the signature encryption public key in the first application compilation data.

[0097] Specifically, the client parses the public key compilation data used to represent the signature encryption public key, and obtains the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data from the public key compilation data. Thus, the position of the signature encryption public key in the first application compilation data can be determined based on the linear memory offset.

[0098] Step S1004: Obtain the simulated public key. For the first application compilation data, replace the signature encryption public key located in the public key position with the simulated public key to obtain the second application compilation data.

[0099] Specifically, the client obtains a simulated public key for honeypot protection and uses it to perform public key replacement processing on the first application compilation data. That is, the signature encryption public key located in the public key position in the first application compilation data is replaced with the simulated public key to obtain the second application compilation data.

[0100] Step S1005: If a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained.

[0101] Specifically, before initiating a data processing request to the server, the client needs to call an encryption algorithm or encryption function to encrypt and sign its own login information and environment information pending processing data. Specifically, when receiving a data encryption request triggered by the login information and environment information pending processing data, the client obtains the data to be processed corresponding to the data encryption request, which specifically includes the login information and environment information corresponding to the user.

[0102] Step S1006: Obtain the compilation metadata associated with the compilation data of the first application, parse the compilation metadata, and obtain the linear memory offset corresponding to the signature encryption public key.

[0103] Specifically, the client obtains the compilation metadata associated with the first application compilation data, that is, the metadata used to structurally describe the first application compilation data obtained from compiling the application source code data, and parses the compilation metadata to obtain, for example, the Data Segment in the compilation metadata. Based on the data segment, the client can determine the signature encryption public key used for encryption, as well as the linear memory offset of the signature encryption public key in the linear memory of the first application compilation data.

[0104] Step S1007: Inject the signature encryption public key and the linear memory offset corresponding to the signature encryption public key into the code processing file corresponding to the application source code data to obtain the public key processing code file.

[0105] Specifically, the client obtains the code processing file corresponding to the application source code data, and injects the signature encryption public key and the linear memory offset corresponding to the signature encryption public key into the code processing file corresponding to the application source code data, thereby obtaining a public key processing code file carrying the signature encryption public key and the linear memory offset corresponding to the signature encryption public key.

[0106] Step S1008: Execute the public key processing code file and determine the location of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature encryption public key in the public key processing code file.

[0107] Specifically, the client executes the public key processing code file to determine the location of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature encryption public key in the public key processing code file, that is, based on the linear memory offset of the signature encryption public key in the linear memory of the application compilation data.

[0108] Step S1009: By using the public key processing code file to process the signature encryption public key, the simulated public key located in the public key position in the second application compilation data is restored to the signature encryption public key, and the first application compilation data is obtained.

[0109] Specifically, the client executes a public key processing code file, and after determining the location of the simulated public key in the public key position of the second application compilation data, it uses the signature encryption public key in the public key processing code file to restore the simulated public key located at the public key position in the second application compilation data to the signature encryption public key, thus obtaining the first application compilation data. Therefore, the client can perform encryption and signature processing on the data to be processed (specifically including login information and environment information, etc.) based on the signature encryption public key in the first application compilation data to obtain encrypted signature data.

[0110] Step S1010: Based on the signature encryption public key in the first application compilation data, perform encryption signature processing on the data to be processed to obtain encrypted signature data.

[0111] Specifically, when the client receives a data encryption request and obtains the data to be processed corresponding to the data encryption request, it obtains the public key processing code file corresponding to the application source code data in real time, executes the public key processing code file, restores the simulated public key in the second application compilation data to the signature encryption public key, and obtains the first application compilation data. Thus, based on the signature encryption public key in the first application compilation data, the data to be processed (specifically including login information and environment information, etc.) can be encrypted and signed to obtain encrypted signature data.

[0112] Step S1011: Execute the public key processing code file, obtain the simulated public key, restore the signature encryption public key in the first application compilation data to the simulated public key, and obtain the second application compilation data.

[0113] Specifically, after obtaining the encrypted signature data, a simulated public key is obtained by executing the public key processing code file. This simulated public key is then used to restore the signature encryption public key in the first application compilation data to the simulated public key. Thus, the real signature encryption public key only appears briefly in linear memory during the encryption algorithm and is only used for signature encryption processing. After the signature encryption processing is completed, it is restored to the simulated public key. In other words, in the non-decryption case, the simulated honeypot public key is always stored in the linear memory and the second application compilation data, rather than the real signature encryption public key.

[0114] In the above data encryption method, by obtaining application source code data, compiling the application source code data, and obtaining the first application compiled data, the signature encryption public key in the first application compiled data is replaced with a simulated public key to obtain the second application compiled data. That is, when an unauthorized external object intercepts or saves data, what it obtains is the simulated public key in the second application compiled data, rather than the real signature encryption public key. This can protect the signature encryption public key and prevent the real signature encryption public key from being illegally obtained or maliciously authorized. Furthermore, if a data encryption request is received, the system obtains the data to be processed corresponding to the data encryption request, as well as the public key processing code file corresponding to the application source code data. By executing the public key processing code file, the simulated public key in the second application compilation data is restored to the signature encryption public key, thus restoring the first application compilation data. Based on the real signature encryption public key in the first application compilation data, the data to be processed can be encrypted and signed to obtain encrypted signature data. This allows the server to recognize and parse the encrypted signature data and respond to the corresponding data processing request. This achieves the goal of restoring the simulated public key in the second application compilation data to the signature encryption public key only when a data encryption request is received. This reduces the risk of leakage of the signature encryption public key, prevents the real signature encryption public key from being illegally obtained and maliciously authorized, reduces information leakage and resource loss to the platform and users, and improves the efficiency of information security protection.

[0115] In one exemplary embodiment, such as Figure 11 As shown, a risk data processing method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps S1102 to S1108. Wherein:

[0116] Step S1102: Receive a data processing request and obtain the encrypted signature data corresponding to the data processing request.

[0117] Specifically, before initiating a data processing request to the server, the client needs to call an encryption algorithm or encryption function to encrypt and sign its own login information, environment information, and other data to be processed, and obtain the corresponding encrypted signature data. When initiating the data processing request, the client sends both the encrypted signature data and the data processing request back to the server. When the server receives the data processing request sent by the client, it needs to obtain the encrypted signature data corresponding to the data processing request and decrypt and verify the encrypted signature data.

[0118] Step S1104: Parse the encrypted signature data and determine the data signature type to which the encrypted signature data belongs.

[0119] Specifically, the server determines the data signature type of the encrypted signature data by parsing the encrypted signature data. The data signature type specifically includes simulated signatures and object signatures.

[0120] Furthermore, the client uses a honeypot to protect the public key for signing the encryption algorithm in the first application's compiled data. The file saved by the attacker will be the honeypot-protected second application's compiled data. The signature data generated by encrypting the second application's compiled data using a simulated public key is simulated honeypot signature data. The server can then obtain the simulated honeypot signature data corresponding to the data processing request and decrypt it to determine that the signature data belongs to the simulated signature type. Thus, the server can mark the risk based on the object identifier and login information for subsequent monitoring and interception.

[0121] Step S1106: If the data signature type is determined to be a simulated signature, the simulated public key associated with the simulated signature is called to decrypt the encrypted signature data and obtain the first decryption information corresponding to the encrypted signature data.

[0122] Specifically, if the server determines that the data signature type is a simulated signature, it obtains the simulated public key associated with the simulated signature and decrypts the encrypted signature data using the simulated public key to obtain the first decryption information corresponding to the encrypted signature data. The first decryption information specifically includes: the object identifier, login information, and environment information of the user object that triggered the data processing request.

[0123] Step S1108: Parse the first decryption information to obtain the object identifier corresponding to the data processing request, and perform risk data processing based on the object identifier.

[0124] Specifically, risk data processing based on object identifiers may include risk data labeling, monitoring, and interception. Specifically, the server parses the first decryption information to obtain the object identifier corresponding to the triggering data processing request, and then labels the object identifier with a risk marker, indicating that the data processing request triggered by this object identifier is an illegal request and poses a risk of data and resource leakage.

[0125] Furthermore, after the object identifier is marked with a risk, resource requests based on the object identifier can be monitored and intercepted in real time during subsequent actual business processing. If a resource request initiated by an object identifier marked with a risk is detected, it will be intercepted in a timely manner to avoid illegal requests and unauthorized authorizations, thereby ensuring data security and saving server-side service resources.

[0126] In one exemplary embodiment, such as Figure 12 As shown, a traditional process for handling illegal data processing requests is provided, referring to... Figure 12 It is known that, traditionally, when encrypting login information and environment information, data awaiting processing, a web-oriented encoding format (i.e., Web Assembly, which can be understood as a web-oriented binary encoding format) is usually used. The signature encryption public key used for encryption, as well as encryption functions or encryption algorithms, are compiled to obtain application compilation data. However, in the application compilation data obtained using the web-oriented encoding format, the strings are stored in plaintext, which is easy to discover and extract. For example, the signature encryption public key string used for encryption is stored in the Data Segment of the application compilation data, and the public key plaintext can be obtained by opening the application compilation data with a binary editor.

[0127] Specifically, attackers can save the application's compiled data and perform black-box calls to obtain the correct signature information. This causes the server to mistakenly believe the request originated from a trusted client and respond accordingly. Furthermore, because the signature information is correct, server-side developers have difficulty detecting and investigating such request forgery, posing a security risk to the platform and its users, and increasing the possibility of unauthorized calls or malicious authorization.

[0128] Furthermore, such as Figure 13 As shown, a process for handling illegal data processing requests in a risk data processing method is provided, referring to... Figure 13It is known that the client uses a honeypot to protect the encryption algorithm and signature encryption public key in the first application compilation data. The file saved by the attacker will be the honeypot-protected second application compilation data. The signature data generated by using the simulated public key in the second application compilation data for signature encryption is simulated honeypot signature data. However, the format and text length of the simulated honeypot signature data are the same as the correct encrypted signature data, making it difficult for the attacker to detect that the honeypot has been hit. The attacker then sends the simulated honeypot signature data to the server for data processing requests.

[0129] Simultaneously, the server obtains and decrypts the simulated honeypot signature data corresponding to the data processing request. This confirms that the signature data belongs to a simulated signature type, meaning the signature data has hit the honeypot. The server can then mark the risk based on the object identifier and login information for subsequent monitoring and interception. The server will also return a normal response for the simulated honeypot signature data, making it even harder for attackers to detect the honeypot hit. When the number of marked risky objects reaches a certain scale or after a certain period, the server can monitor and intercept abnormal users in batches.

[0130] In an exemplary embodiment, after parsing the encrypted signature data and determining the data signature type to which the encrypted signature data belongs, the method further includes:

[0131] If the data signature type is determined to be an object signature, the signature encryption public key corresponding to the object signature is called to decrypt the encrypted signature data and obtain the second decryption information corresponding to the encrypted signature data. Based on the second decryption information, a security verification is performed. If the security verification is successful, in response to the data processing request, the data processing task corresponding to the data processing request is executed to obtain the data processing result.

[0132] Specifically, when the server receives a data processing request from the client, it needs to obtain the encrypted signature data corresponding to the data processing request and parse the encrypted signature data to determine the data signature type to which the encrypted signature data belongs.

[0133] If the data signature type is determined to be an object signature, the signature encryption public key corresponding to the object signature is obtained, and the encrypted signature data is decrypted using the signature encryption public key to obtain the second decryption information corresponding to the encrypted signature data. The second decryption information specifically includes: the object identifier, login information, and environment information of the user object corresponding to the data processing request.

[0134] Furthermore, the server performs security checks on the second decrypted information, such as the object identifier, login information, and environment information of the user, to determine whether there are any abnormalities in the login information or environment information. If the security check is passed, that is, the login information and environment information of the user are not abnormal, the server responds to the data processing request, executes the data processing task corresponding to the data processing request, and obtains the data processing result.

[0135] In one exemplary embodiment, such as Figure 14 As shown, a process for processing normal data processing requests in a risk data processing method is provided, referring to... Figure 14 It is known that before the client calls encryption algorithms or encryption functions to encrypt and sign its own login information and environment information, it executes a public key processing code file. Based on the signature encryption public key included in the public key processing code file and the linear memory offset corresponding to the signature encryption public key, it performs public key replacement processing to restore the simulated public key in the second application compilation data to the signature encryption public key. Thus, based on the signature encryption public key, it can perform encryption and signature processing on the data to be processed to obtain encrypted signature data.

[0136] Simultaneously, after obtaining the encrypted signature data, the client immediately executes the public key processing code file, restoring the signature encryption public key in the first application compilation data to a simulated public key. Thus, the real signature encryption public key only appears briefly in linear memory during the encryption algorithm, used solely for signature encryption processing. After the signature encryption processing is complete, it is restored to a simulated public key. That is, in non-decryption situations, the simulated honeypot public key is always stored in linear memory and the second application compilation data, rather than the real signature encryption public key. This makes it difficult for attackers to directly obtain the signature encryption public key. The client ensures that the server can normally decrypt the signature data and return the correct response, while also protecting against attackers forging requests and triggering the honeypot policy. This ensures that the server can promptly monitor and intercept illegal requests and malicious authorizations.

[0137] In one exemplary embodiment, such as Figure 15 As shown, a process is provided for compiling application source code data to obtain release artifacts, referring to... Figure 15As can be seen, firstly, the client obtains the application source code data used for encryption. This application source code data specifically includes the signature encryption public key used for encryption, as well as encryption functions or encryption algorithms, etc., and compiles the application source code data using a web-oriented encoding format (i.e., Web Assembly, which can be understood as a web-oriented binary encoding format) to obtain the first application compiled data. At the same time, the client determines the compilation metadata associated with the first application compiled data, that is, determines the metadata used to structurally describe the first application compiled data obtained by compiling the application source code data.

[0138] Secondly, the client parses the compilation metadata associated with the application source code data to obtain, for example, the Data Segment within the compilation metadata. Based on this data segment, it can determine the signature encryption public key used for encryption, and the linear memory offset of the signature encryption public key within the linear memory of the first application's compilation data. It then obtains the code processing file corresponding to the application source code data, i.e., the JS code file protected by JSVMP. Furthermore, it injects the signature encryption public key and its corresponding linear memory offset into the code processing file corresponding to the application source code data, resulting in a public key processing code file carrying the signature encryption public key and its corresponding linear memory offset (i.e.,...). Figure 15 (JS product in the middle).

[0139] Furthermore, the client implements honeypot protection for the obtained first application compilation data. During the compilation of the application source code data, key strings in the data segments of the first application compilation data are replaced with simulated strings. For example, the actual signature encryption public key used for signature encryption is replaced with a simulated public key, thus obtaining the second application compilation data (i.e., Figure 15 The honeypot product is released together with the public key processing code file (i.e., the JS product) and the honeypot product (i.e., the honeypot product).

[0140] The client replaces the signature encryption public key of the first application compilation data with a simulated public key and outputs the second application compilation data (i.e., honeypot output) for distribution. The constant data in the linear memory of the first application compilation data (including the signature encryption public key used for encryption, and the encryption function or algorithm) is automatically written into the created linear memory by the browser during the application compilation instance creation process. Specifically, the offset value A indicating the data segment to be written into the linear memory is stored there. The compilation metadata includes the offset value B of the signature encryption public key in the Data Segment and the length L of the signature encryption public key. Therefore, the region [A+B, A+B+L] in the linear memory is used as the storage area for the signature encryption public key.

[0141] In one exemplary embodiment, such as Figure 16 As shown, a risk data processing method is provided, referring to... Figure 16 It is known that the client can use Web Assembly (i.e., web-oriented binary encoding) to implement a sandbox, which contains the cryptographic signature algorithm, the cryptographic signature public key, and the simulated honeypot public key.

[0142] Specifically, before running the cryptographic signature algorithm and performing signature encryption based on the public key, the runtime environment is checked. If the environment check fails, it is assumed that the current environment is a simulated environment created by an attacker. In this case, the cryptographic signature algorithm uses a simulated honeypot key to calculate and obtain simulated signature data. When the simulated signature data is sent to the server, the server identifies the honeypot and performs risk labeling and interception. The runtime environment specifically includes the simulated environment forged by the attacker (i.e., the NodeJS environment) and the browser environment corresponding to a normal data processing request. Therefore, if the current environment is determined to be a simulated environment (i.e., the NodeJS environment), the environment check fails. If the current environment is determined to be a browser environment, the environment check passes.

[0143] Conversely, if the environment detection is successful, the encryption signature algorithm uses the real encryption signature public key to encrypt the data, thus obtaining the encryption signature data. When the encryption signature data is sent to the server, the server decrypts and verifies the encryption signature data. If the verification is successful, the server executes the data processing task corresponding to the data processing request to obtain the data processing result.

[0144] In the aforementioned risk data processing method, upon receiving a data processing request, the method obtains and parses the encrypted signature data corresponding to the data processing request to determine the data signature type to which the encrypted signature data belongs. If the data signature type is determined to be a simulated signature, the method calls the simulated public key associated with the simulated signature to decrypt the encrypted signature data, obtains the first decryption information corresponding to the encrypted signature data, and further parses the first decryption information to obtain the object identifier corresponding to the data processing request. Thus, risk data processing can be performed based on the object identifier to reduce illegal calls to the server, thereby reducing the consumption of server bandwidth, computing and other resources, and further improving the efficiency of information security protection.

[0145] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0146] Based on the same inventive concept, this application also provides a data encryption device and a risk data processing device for implementing the data encryption method and risk data processing method described above. The solution provided by this device is similar to the implementation scheme described in the above methods. Therefore, the specific limitations of one or more data encryption devices and risk data processing devices provided below can be found in the limitations of the data encryption method and risk data processing method described above, and will not be repeated here.

[0147] In one exemplary embodiment, such as Figure 17 As shown, a data encryption device is provided, including: an application source code data compilation module 1702, a public key replacement module 1704, and an encryption signature processing module 1706, wherein:

[0148] The application source code data compilation module 1702 is used to obtain application source code data, compile the application source code data, and obtain the first application compilation data; the first public key replacement module 1704 is used to replace the signature encryption public key in the first application compilation data with a simulated public key to obtain the second application compilation data; the encryption signature processing module 1706 is used to, if a data encryption request is received, obtain the data to be processed corresponding to the data encryption request, restore the second application compilation data to the first application compilation data, and perform encryption signature processing on the data to be processed according to the signature encryption public key in the first application compilation data to obtain encrypted signature data.

[0149] In the aforementioned data encryption device, by acquiring application source code data and compiling the application source code data, a first application compiled data is obtained. The signature encryption public key in the first application compiled data is replaced with a simulated public key to obtain a second application compiled data. That is, when an unauthorized external object intercepts or saves data, what it obtains is the simulated public key in the second application compiled data, rather than the real signature encryption public key. This can protect the signature encryption public key and prevent the real signature encryption public key from being illegally obtained or maliciously authorized. Furthermore, if a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained, and the second application compiled data is restored to the first application compiled data. Thus, based on the real signature encryption public key in the first application compiled data, the data to be processed can be encrypted and signed to obtain encrypted signature data. This allows the server to recognize and parse the encrypted signature data and respond to the corresponding data processing request. This achieves the restoration of the second application compiled data to the first application compiled data only when a data encryption request is received. This reduces the risk of leakage of the signature encryption public key in the first application compiled data, avoids the illegal acquisition of the real signature encryption public key and malicious authorization, reduces information leakage and resource loss to the platform and users, and improves the efficiency of information security protection.

[0150] In an exemplary embodiment, the public key replacement module is further configured to: extract public key compilation data representing the signature encryption public key from the first application compilation data; parse the public key compilation data to determine the public key position of the signature encryption public key in the first application compilation data; and replace the signature encryption public key located at the public key position with a simulated public key for the first application compilation data to obtain the second application compilation data.

[0151] In an exemplary embodiment, the encryption signature processing module is further configured to: obtain a public key processing code file corresponding to the application source code data; execute the public key processing code file to restore the simulated public key in the second application compilation data to a signature encryption public key, thereby obtaining the first application compilation data.

[0152] In an exemplary embodiment, the cryptographic signature processing module is further configured to: execute a public key processing code file; determine the position of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature cryptographic public key in the public key processing code file; and restore the simulated public key located at the public key position in the second application compilation data to the signature cryptographic public key using the signature cryptographic public key in the public key processing code file, thereby obtaining the first application compilation data.

[0153] In an exemplary embodiment, the public key replacement module is further configured to: execute a public key processing code file, obtain a simulated public key, restore the signature encryption public key in the first application compilation data to the simulated public key, and obtain the second application compilation data.

[0154] In one exemplary embodiment, a data encryption device is provided, further comprising a public key processing code file acquisition module, configured to: acquire compilation metadata associated with first application compilation data, parse the compilation metadata, obtain a linear memory offset corresponding to the signature encryption public key; and inject the signature encryption public key and the linear memory offset corresponding to the signature encryption public key into a code processing file corresponding to the application source code data to obtain a public key processing code file.

[0155] In one exemplary embodiment, such as Figure 18 As shown, a risk data processing device is provided, including: an encrypted signature data acquisition module 1802, a data signature type determination module 1804, a decryption processing module 1806, and a risk processing module 1808, wherein:

[0156] The encrypted signature data acquisition module 1802 is used to receive data processing requests and acquire encrypted signature data corresponding to the data processing requests; the data signature type determination module 1804 is used to parse the encrypted signature data and determine the data signature type to which the encrypted signature data belongs; the decryption processing module 1806 is used to, if the data signature type is determined to be a simulated signature, call the simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain the first decryption information corresponding to the encrypted signature data; the risk processing module 1808 is used to parse the first decryption information, obtain the object identifier corresponding to the data processing request, and perform risk data processing based on the object identifier.

[0157] In the aforementioned risk data processing device, upon receiving a data processing request, the device acquires and parses the encrypted signature data corresponding to the data processing request to determine the data signature type to which the encrypted signature data belongs. If the data signature type is determined to be a simulated signature, the device invokes the simulated public key associated with the simulated signature to decrypt the encrypted signature data, obtaining the first decryption information corresponding to the encrypted signature data. The device further parses the first decryption information to obtain the object identifier corresponding to the data processing request. Thus, risk data processing can be performed based on the object identifier to reduce illegal calls to the server, thereby reducing the consumption of server bandwidth, computing resources, and other resources, and further improving the efficiency of information security protection.

[0158] In an exemplary embodiment, the decryption processing module is further configured to: if the data signature type is determined to be an object signature, call the signature encryption public key corresponding to the object signature to decrypt the encrypted signature data and obtain the second decryption information corresponding to the encrypted signature data.

[0159] In one exemplary embodiment, a risk data processing apparatus is provided, which further includes a data processing task execution module for: performing a security verification based on second decryption information; if the security verification is found to be successful, executing a data processing task corresponding to the data processing request in response to a data processing request, and obtaining a data processing result.

[0160] The modules in the aforementioned data encryption device and risk data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0161] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 19As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a data encryption method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0162] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 20 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores encrypted signature data, data signature types, simulated signatures, simulated public keys, first decryption information, and object identifiers. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a risky data processing method.

[0163] Those skilled in the art will understand that Figure 19 and Figure 20The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0164] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0165] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0166] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0168] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0169] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this application. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data encryption method characterized by, The method includes: Obtain application source code data, compile the application source code data, and obtain the first application compilation data; Replace the signature encryption public key in the first application compilation data with a simulated public key to obtain the second application compilation data; If a data encryption request is received, the data to be processed corresponding to the data encryption request is obtained, and the second application compilation data is restored to the first application compilation data. The data to be processed is then encrypted and signed according to the signature encryption public key in the first application compilation data to obtain encrypted signature data.

2. The method of claim 1, wherein, The step of replacing the signature encryption public key in the first application compilation data with the simulated public key to obtain the second application compilation data includes: Extract the public key compilation data, which represents the signature encryption public key, from the first application compilation data; Parse the public key compilation data to determine the position of the signature encryption public key in the first application compilation data; For the first application compilation data, the signature encryption public key located at the public key position is replaced with the simulated public key to obtain the second application compilation data.

3. The method of claim 1, wherein, The step of restoring the second application compilation data to the first application compilation data includes: Obtain the public key processing code file corresponding to the application source code data; Execute the public key processing code file to restore the simulated public key in the second application compilation data to the signature encryption public key, and obtain the first application compilation data.

4. The method of claim 3, wherein, The execution of the public key processing code file restores the simulated public key in the second application compilation data to the signature encryption public key, thereby obtaining the first application compilation data, including: Execute the public key processing code file, and determine the position of the simulated public key in the second application compilation data based on the linear memory offset corresponding to the signature encryption public key in the public key processing code file; By using the public key processing code file to process the signature encryption public key, the simulated public key located at the public key position in the second application compilation data is restored to the signature encryption public key, thus obtaining the first application compilation data.

5. The method according to any one of claims 1 to 4, characterized in that, After obtaining the cryptographic signature data, it also includes: Execute the public key processing code file to obtain the simulated public key, restore the signature encryption public key in the first application compilation data to the simulated public key, and obtain the second application compilation data.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Obtain the compilation metadata associated with the compilation data of the first application, parse the compilation metadata, and obtain the linear memory offset corresponding to the signature encryption public key; The signature encryption public key and the linear memory offset corresponding to the signature encryption public key are injected into the code processing file corresponding to the application source code data to obtain the public key processing code file.

7. A risk data processing method, characterized in that, The method includes: Receive a data processing request and obtain the encrypted signature data corresponding to the data processing request; Parse the encrypted signature data to determine the data signature type to which the encrypted signature data belongs; If the data signature type is determined to be a simulated signature, the simulated public key associated with the simulated signature is invoked to decrypt the encrypted signature data and obtain the first decryption information corresponding to the encrypted signature data. Parse the first decryption information to obtain the object identifier corresponding to the data processing request, and perform risk data processing based on the object identifier.

8. The method according to claim 7, characterized in that, The method further includes: If the data signature type is determined to be an object signature, the signature encryption public key corresponding to the object signature is called to decrypt the encrypted signature data and obtain the second decryption information corresponding to the encrypted signature data. Based on the second decryption information, a security verification is performed. If the security verification is successful, in response to the data processing request, the data processing task corresponding to the data processing request is executed to obtain the data processing result.

9. A data encryption device, characterized in that, The device includes: The application source code data compilation module is used to obtain application source code data, compile the application source code data, and obtain the first application compilation data. The public key replacement module is used to replace the signature encryption public key in the first application compilation data with a simulated public key to obtain the second application compilation data. The encryption signature processing module is used to, upon receiving a data encryption request, obtain the data to be processed corresponding to the data encryption request, restore the second application compilation data to the first application compilation data, and perform encryption signature processing on the data to be processed according to the signature encryption public key in the first application compilation data to obtain encrypted signature data.

10. A risk data processing apparatus, characterized by, The device includes: The encrypted signature data acquisition module is used to receive a data processing request and acquire the encrypted signature data corresponding to the data processing request. The data signature type determination module is used to parse the encrypted signature data and determine the data signature type to which the encrypted signature data belongs; The decryption processing module is used to, if it is determined that the data signature type is a simulated signature, call the simulated public key associated with the simulated signature to decrypt the encrypted signature data and obtain the first decryption information corresponding to the encrypted signature data; The risk processing module is used to parse the first decryption information, obtain the object identifier corresponding to the data processing request, and perform risk data processing based on the object identifier. 11.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-10. When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images