Data transfer method, device, storage medium and electronic device

Abstract

The embodiment of the present application discloses a data transfer method, device, storage medium and electronic device, wherein the method comprises: receiving a first public key sent by a data transfer terminal, decrypting a first encrypted string stored in the user terminal based on the first public key to obtain a first identity string, sending a first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on the first identity token, and performs data transfer after determining that the server has authenticated the user terminal. The embodiment of the present application can improve the security of data transfer.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data transfer method, device, storage medium and electronic device. Background Art

[0002] With the development of communication technology, data transfer using user terminals such as smart phones, tablet computers, PDAs, and mobile Internet devices (MID) has become a convenient and popular data service method, and the application of data transfer has facilitated people's lives. In the data transfer scenario, the user can bind the user terminal (such as a mobile phone, tablet, etc.) to a designated account (such as binding by mobile phone number, instant messaging number binding, etc.), so that the user can realize data transfer between the designated account and other accounts through the user terminal. Summary of the invention

[0003] The embodiments of the present application provide a data transfer method, device, storage medium and electronic device. The technical solution of the embodiments of the present application is as follows:

[0004] In a first aspect, an embodiment of the present application provides a data transfer method, which is applied to a user terminal, and the method includes:

[0005] Receive a first public key sent by the data transfer terminal, and decrypt the first encrypted string stored in the user terminal based on the first public key to obtain a first identity string; wherein the first public key is obtained by the data transfer terminal from the server, the first encrypted string is generated by encrypting the first reference identity string of the original identity token based on the first private key stored in the user terminal, and the first private key corresponds to the first public key one by one;

[0006] Sending the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on a first identity token, wherein the first identity token is composed of the first identity string and a second identity string, the second identity string is obtained by decrypting a second encrypted string stored in the server based on the first private key, and the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0007] Determine that the identity authentication is passed, and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0008] In a second aspect, an embodiment of the present application provides a data transfer method, which is applied to a data transfer terminal, and the method includes:

[0009] Obtaining a first public key from the server, and sending the first public key to the user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string, where the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on a first private key;

[0010] receiving the first identity string and the first private key sent by the user terminal, so that the server authenticates the user terminal based on a first identity token, wherein the first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key;

[0011] Determine that the server has authenticated the identity of the user terminal, receive a data transfer request from the user terminal, and send the data transfer request to the server so that the server performs data transfer.

[0012] In a third aspect, an embodiment of the present application provides a data transfer method, which is applied to a server, and the method includes:

[0013] Sending a first public key to a data transfer terminal, so that the data transfer terminal sends the first public key to a user terminal, the user terminal stores a first encrypted string and a first private key, the first public key is used to decrypt the first encrypted string to generate a first identity string, the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on the first private key;

[0014] Obtain a first identity token, and authenticate the user terminal based on the first identity token, wherein the first identity token is generated based on the first identity string and a second identity string, wherein the second identity string is generated by decrypting the first private key and a stored second encrypted string, and wherein the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0015] Determine that the identity authentication of the user terminal is passed, receive a data transfer request sent by a data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

[0016] In a fourth aspect, an embodiment of the present application provides a data transfer device, the device comprising:

[0017] a public key acquisition module, configured to receive a first public key sent by a data transfer terminal, and decrypt a first encrypted string stored in the user terminal based on the first public key to obtain a first identity string; wherein the first public key is obtained by the data transfer terminal from a server, the first encrypted string is generated by encrypting a first reference identity string of an original identity token based on a first private key stored in the user terminal, and the first private key corresponds to the first public key in a one-to-one manner;

[0018] a data sending module, configured to send the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on a first identity token, wherein the first identity token is composed of the first identity string and a second identity string, the second identity string is obtained by decrypting a second encrypted string stored in the server based on the first private key, and the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0019] The data transfer module is used to determine whether the identity authentication is passed and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0020] In a fifth aspect, an embodiment of the present application provides a data transfer device, the device comprising:

[0021] a public key acquisition module, configured to acquire a first public key from the server, and send the first public key to a user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string, wherein the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on a first private key;

[0022] an information receiving module, configured to receive the first identity string and the first private key sent by the user terminal, so that the server authenticates the user terminal based on a first identity token, the first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key;

[0023] The data transfer module is used to determine that the server has passed the identity authentication of the user terminal, receive a data transfer request from the user terminal, and send the data transfer request to the server so that the server performs data transfer.

[0024] In a fifth aspect, an embodiment of the present application provides a data transfer device, the device comprising:

[0025] a public key sending module, configured to send a first public key to the data transfer terminal, so that the data transfer terminal sends the first public key to a user terminal, wherein the user terminal stores a first encrypted string and a first private key, wherein the first public key is used to decrypt the first encrypted string to generate a first identity string, wherein the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on the first private key;

[0026] an identity authentication module, configured to obtain a first identity token, and authenticate the user terminal based on the first identity token, wherein the first identity token is generated based on the first identity string and a second identity string, wherein the second identity string is generated by decrypting the first private key and a stored second encrypted string, and wherein the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0027] The data transfer module is used to determine whether the identity authentication of the user terminal is passed, receive a data transfer request sent by the data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

[0028] In a sixth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0029] In a seventh aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0030] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0031] In one or more embodiments of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string synthesized into the first identity token is invisible to the outside and can only be decrypted on the local side based on the public key on the server. The data transfer process has high security, and during the entire data transfer process, the electronic devices involved can be carried out independently of the identity token, which greatly improves the security of the data transfer; and, in the data transfer, the data transfer code is generated independently of the user terminal, which reduces the cost of data transfer, and the electronic devices involved in the data transfer can finally complete the entire data transfer process based on the flow of corresponding data, which improves the universality of data transfer. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 It is a flowchart of a data transfer method provided in an embodiment of the present application;

[0034] Figure 2 It is a schematic diagram of a scenario of identity token splitting involved in the data transfer method provided in an embodiment of the present application;

[0035] Figure 3 It is a schematic diagram of a scenario of identity string encryption and decryption involved in the data transfer method provided in an embodiment of the present application;

[0036] Figure 4 is a flowchart of another data transfer method provided in an embodiment of the present application;

[0037] Figure 5 is a flowchart of another data transfer method provided in an embodiment of the present application;

[0038] Figure 6 is a flowchart of another data transfer method provided in an embodiment of the present application;

[0039] Figure 7It is a schematic diagram of data information interaction provided by an embodiment of the present application;

[0040] Figure 8 is a schematic diagram of another data information interaction provided by an embodiment of the present application;

[0041] Fig. 9 is a flowchart of another data transfer method provided in an embodiment of the present application;

[0042] Fig.10 is a flowchart of another data transfer method provided in an embodiment of the present application;

[0043] Fig.11 This is a schematic diagram of a data transfer scenario architecture provided by an embodiment of the present application;

[0044] Fig.11a An interactive schematic diagram of a data transfer system provided in an embodiment of the present application;

[0045] Fig.11b Another interactive diagram of a data transfer system provided in an embodiment of the present application

[0046] Fig.12 is a structural schematic diagram of a data transfer device provided in an embodiment of the present application;

[0047] Fig.13 It is a structural diagram of a public key acquisition module provided in an embodiment of the present application;

[0048] Fig.14 is a structural schematic diagram of another data transfer device provided in an embodiment of the present application;

[0049] Fig.15 is a structural schematic diagram of another data transfer device provided in an embodiment of the present application;

[0050] Fig.16 is a structural schematic diagram of another data transfer device provided in an embodiment of the present application;

[0051] Fig.17 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0052] Fig.18 It is a schematic diagram of the structure of the operating system and user space provided in the embodiment of the present application;

[0053] Fig.19 yes Fig.17 The architecture diagram of the Android operating system;

[0054] Fig. 20 yes Fig.17 The architecture diagram of the IOS operating system;

[0055] Fig.21 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0056] Fig. 22 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] In the description of this application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this application, it should be noted that, unless otherwise expressly specified and limited, "including", "having" and any of their variations are intended to cover non-exclusive inclusions. For example

[0059] A process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to the specific circumstances. In addition, in the description of this application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0060] In the related art, data transfer has become more and more common, but considering the complexity of the actual application environment, the security and universality of data transfer are particularly important; for example, in common data transfer scenarios, it is often necessary for the user terminal used by the user to be able to access the mobile data network normally to ensure the normal data transfer based on the mobile data network. For example, it is necessary for the network between the user terminal and the server used for data transfer to be normal so that the server can transfer data to the user terminal. If the user terminal cannot access the mobile data network normally, the data transfer cannot be performed normally; for example, electronic devices involved in data transfer scenarios, each electronic device The data transfer link of the sub-device is usually carried out in a less secure manner (such as non-http protocol), the security of the link itself is unreliable, and data security cannot be guaranteed; for example, in the related technology, identity tokens are often used directly for data transfer, and there is a risk of identity token leakage; for example, in order to improve the convenience of data transfer (such as normal payment in an offline state), the related technology often uses data transfer codes generated by user terminals (such as data transfer QR codes, barcodes, etc.). In this scenario, additional hardware devices with scanning capabilities (such as barcode scanners) are required, the universality of data transfer is low, and the cost of data transfer is also high.

[0061] The present application is described in detail below with reference to specific embodiments.

[0062] In one embodiment, Figure 1 As shown, a data transfer method is proposed, which is applied to a user terminal. The method can be implemented by a computer program and can be run on a data transfer device based on a von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0063] Specifically, the data transfer method includes:

[0064] Step S101: receiving a first public key sent by a data transfer terminal, and decrypting a first encrypted string stored in the user terminal based on the first public key to obtain a first identity string.

[0065] The first public key is obtained by the data transfer terminal from the server, the first encrypted string is generated by encrypting the first reference identity string of the original identity token based on the first private key stored in the user terminal, and the first private key corresponds to the first public key one by one;

[0066] With the rapid development of communication technology, users can use user terminals (such as mobile phones, tablets, etc.) to transfer data. Data transfer involves all aspects of users' daily lives, such as purchasing goods. Data transfer has become a convenient and popular Internet data service method. In actual applications, when users use user terminals to transfer data, users can open the corresponding application interface on the user terminal to complete the triggering of data transfer operations. For example, when users purchase goods in offline stores, they can usually open an application interface that supports the data transfer function on the user terminal, and then turn on the data transfer function to trigger the data transfer operation. Among them, the application interface that supports the data transfer function can be an online payment application belonging to Genting on the user terminal, or it can be an instant messaging application running on the user terminal, such as a payment interface in an instant messaging application, or a transfer interface on an instant messaging application, etc.

[0067] Specifically, in an embodiment of the present application, after the user triggers a data transfer operation by operating the user terminal, the user terminal responds to the machine executable instructions corresponding to the data transfer operation, and first obtains the first public key saved by the server from the data transfer terminal. In actual applications, the user terminal can receive the first public key sent by the data transfer terminal. In this process, the data transfer terminal usually obtains the first public key from the server and then sends it to the user terminal.

[0068] Specifically, in the present application, the data transfer method involves a user terminal, a data transfer terminal and a server; the data transfer process of the user terminal is implemented based on a first public key, a first private key, a first encryption string, a second encryption string and an identity summary.

[0069] Specifically, before data transfer occurs, if the user terminal can communicate normally with the server, the user terminal may negotiate the original identity token with the server in advance, and then generate a first reference identity string and a second reference identity string based on the original identity token, and then negotiate to determine the first public key and the first private key, and calculate the identity digest based on the original identity token using the corresponding digest algorithm.

[0070] The original identity token is used as a credential for identity authentication between the front-end user terminal and the back-end server. For example, in data transfer scenarios, in order to ensure the security and universality of data transfer, the successful data transfer between the front-end user terminal and the back-end server often depends on whether the identity authentication process based on the identity token is passed;

[0071] In the present application, the original identity token is a credential that uniquely represents the identity of the user terminal and is determined during the first identity negotiation between the front-end user terminal and the back-end server, that is, a unique identity identification code. Based on the original identity token, the user terminal or the server can correspondingly determine the first public key, the first private key, the first encryption string and the second encryption string, as well as the identity summary calculated using the corresponding summary algorithm based on the original identity token.

[0072] The original identity token may be an identity identifier that is predetermined before the user terminal leaves the factory and is used to uniquely characterize the user terminal. For example, the identity identifier may be an international mobile equipment identity (IMEI), a processor ID, etc., or the identity identifier may be an identity identifier that uniquely characterizes the user terminal and is generated using an irreversible random number generation algorithm (such as a random number generator). In this application, the method for determining the original identity token may be determined based on the actual application environment and is not specifically limited here. In a feasible implementation, the original identity token may be an identity credential that uniquely characterizes the user terminal and is assigned by the server to the user terminal, such as an identity credential generated using a random number generator, etc.

[0073] During the first identity negotiation between the front-end user terminal and the back-end server, after the original identity token is determined, the original identity token can be split into characters using a preset splitting rule to obtain a first reference identity string and a second reference identity string, wherein the original identity token can be composed of the first reference identity string and the second reference identity string. After splitting, it is necessary to satisfy the requirement that the original identity token can be restored based on the first reference identity string and the second reference identity string, so as to facilitate the identity authentication of the user terminal based on the restored identity token (such as the first identity token) during the data transfer process, and the splitting and synthesis are a reversible process. In addition, in the present application, in order to avoid the leakage of identity tokens during the previous data verification processes, the user terminal usually does not store the identity token (such as the original identity token) after the negotiation is completed, and the user terminal will not directly initiate subsequent data transfer operations based on the identity token during the data verification process, thereby avoiding information leakage in data transfer under the premise of low confidence in the communication link between devices.

[0074] In this application, if Figure 2 As shown, Figure 2 The present invention is a schematic diagram of a scenario in which the identity token splitting is involved in the present application, wherein (such as a user terminal or a server) splits the original identity token to obtain a first reference identity string (SEG1) and a second reference identity string (SEG2), and then determines a key pair for encrypting and decrypting the "first reference identity string and the second reference identity string", wherein the key pair includes a first public key and a first private key.

[0075] Among them, the public key and private key are a key pair (i.e., a public key and a private key) obtained through a key generation algorithm. The public key is open to the server, and the private key is used to store on the user terminal and is not visible to the outside in non-data transfer scenarios.

[0076] In the present application, the first public key usually corresponds to the first private key, and the method of encrypting and decrypting the transmission data using the first public key and the first private key is generally called an asymmetric encryption method. The first public key and the first private key can be allocated based on an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes but is not limited to RSA encryption algorithm, Elgamal encryption algorithm, backpack algorithm, Rabin encryption algorithm, ECC (elliptic curve encryption algorithm), etc.

[0077] Further, after determining the first reference identity string and the second reference identity string, the first public key and the first private key, the following operations are performed:

[0078] 1. If Figure 3 As shown, Figure 3 is a schematic diagram of a scenario for encryption and decryption of an identity string involved in the present application. The first private key can be used to encrypt the first reference identity string (SEG1) to generate a first encrypted string (ESEG1). The encryption process can be based on any of the asymmetric encryption algorithms mentioned above. It should be noted that in the present application, the decryption of the first encrypted string needs to be based on the first public key, that is, the first public key can be used to decrypt the first encrypted string (ESEG1) to decrypt it into a first identity string (in some embodiments, in order to distinguish, the identity string generated by decrypting the first encrypted string using the first public key is referred to as the first identity string. Under normal circumstances, the first identity string is the same as the first reference identity string);

[0079] 2. Use the first public key to encrypt the second reference identity string (SEG2) to generate a second encrypted string (ESEG2). The encryption process can be based on any of the asymmetric encryption algorithms mentioned above. It should be noted that in the present application, the decryption of the second encrypted string (ESEG2) needs to be based on the first private key, that is, the first private key can be used to decrypt the second encrypted string (ESEG2) to decrypt it into a second identity string (in some embodiments, in order to distinguish, the identity string generated by decrypting the second encrypted string using the first private key is called the second identity string. Under normal circumstances, the second identity string is the same as the second reference identity string);

[0080] 3. If Figure 2As shown, the identity digest (tokenD) can be calculated based on the original identity token (token) using a corresponding digest algorithm, wherein the digest algorithm includes but is not limited to an MD message digest algorithm, a hash algorithm, an SM3 hash algorithm, etc. The digest generally refers to converting input data of any length (such as the original identity token) into output data of a fixed length through a digest algorithm, for example, converting 256-bit data into 64-bit data.

[0081] Specifically, after determining the first encrypted string and the second encrypted string, the first public key, the first private key and the identity summary based on the above process, the user terminal side then saves the first encrypted string and the first private key, and in some embodiments the user terminal can save the identity summary; the server side saves the second encrypted string and the first public key, and in some embodiments the server side can save the identity summary; further, the first reference identity string and the second reference identity string may not be stored by the user terminal and the server side, and the user terminal does not store the original identity token.

[0082] In actual applications, the above data transfer process can be considered as the transfer of data on the user terminal to the "data transfer terminal"; for example, when a user purchases goods based on data, the data on the user terminal is transferred to the data account corresponding to the data transfer terminal (such as a merchant).

[0083] After data transfer is triggered on the user terminal, the data transfer process is usually completed after the server has authenticated the user terminal. During the identity authentication process: the user terminal obtains the first public key stored in the server from the data transfer terminal. If the user terminal initiates a request to obtain the first public key to the data transfer terminal, the data transfer terminal receives the request and obtains the first public key from the server, and then sends the obtained first public key to the user terminal.

[0084] Specifically, after obtaining the first public key, the user terminal can use the first public key to decrypt the first encrypted string stored on this end, thereby generating a first identity string (wherein, when the above encryption and decryption are normal, the above-mentioned first reference identity string is the same as the first identity string, and the difference between the two identity strings is that the timing of the identity string generation is different, so they are distinguished in this application).

[0085] Specifically, after obtaining the first public key, the user terminal obtains the first encrypted string stored on the local end, and then uses an asymmetric decryption algorithm to decrypt the first encrypted string using the first public key to generate a first identity string, wherein the asymmetric decryption algorithm corresponds to the above-mentioned asymmetric encryption algorithm.

[0086] Step S102: sending the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on the first identity token.

[0087] Specifically, after the user terminal decrypts the first encrypted string stored locally based on the first public key to generate a first identity string, in order to complete the identity authentication process before data transfer, the user terminal then sends the first identity string and the first private key to the data transfer terminal through the communication connection with the data transfer terminal.

[0088] Among them, the first private key is used to decrypt the second encrypted string stored on the server to generate a second identity string. In addition, in this application, the restoration process of the second identity string can be performed on the data transfer terminal or on the server. The detailed step explanation can refer to other embodiments of this application. After the second identity string is generated, the identity token can be synthesized based on the first identity string and the second identity string to generate a first identity token, so that the server side can complete the identity authentication of the user terminal based on the first identity token, so that after the identity authentication is completed and it is determined that the identity authentication is passed, data transfer is performed, such as transferring the data in the user account on the user terminal to the merchant account associated with the data transfer terminal.

[0089] Step S103: Determine that the server has passed the identity authentication of the user terminal, and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0090] Specifically, a verification pass judgment condition is pre-determined, and the verification pass judgment condition may be that the user terminal determines that it has passed after receiving a verification pass message fed back by the server; the verification pass judgment condition may be that the user terminal determines that it has passed after not receiving a verification failure message fed back by the server within a preset verification time period; the verification pass judgment condition may be that the user terminal does not receive any message sent by the server within a preset verification time period, at which time the user terminal may generally consider that the verification has passed, etc. After the server authenticates the user terminal based on the first identity token, the user terminal may determine that the authentication process is completed, and usually after the authentication process is completed, data transfer can be performed.

[0091] In a specific implementation scenario, after the server passes the identity authentication of the user terminal based on the first identity token, it can return a verification message to the data transfer device, and then the data transfer device sends the verification message to the user terminal; the user terminal can receive the verification message forwarded by the server via the data transfer terminal, at which time, the identity authentication process before data transfer is completed, that is, data transfer can be performed after the verification is passed; further, the user terminal can send a data transfer request to the data transfer terminal; after receiving the data transfer request, the data transfer terminal sends the data transfer request to the server, and the server can respond to the data transfer request to transfer data. Furthermore, the data transfer request usually contains data transfer information (such as data transfer account information, data transfer amount, etc.), and the server can transfer data based on the data transfer information, such as transferring a specified amount of data in the user account on the user terminal to the merchant account associated with the data transfer terminal.

[0092] Optionally, the data transfer result sent by the server (e.g., via the data transfer terminal) may be received; and prompt information corresponding to the data transfer result may be displayed according to the data transfer result. Further, if the data transfer result is that the data transfer is successful, a success message may be displayed; if the data transfer result is that the data transfer fails, the user terminal may prompt the user to resubmit the above operation process.

[0093] In an illustrative manner, a user can log in to a shopping platform through a shopping portal provided by a social client, and further, the user can select a product with price information on the shopping platform. Accordingly, the user terminal can detect the product with price information selected by the user on the shopping platform, and calculate the data transfer amount according to the price information of the selected product (i.e., data transfer amount = the sum of the price information of the selected product), and generate a data transfer request including the data transfer amount and the receiver identifier according to the data transfer amount and the receiver identifier corresponding to the selected product. The receiver identifier corresponding to the product refers to the identity identifier of the merchant or seller who publishes the selected product on the shopping platform, that is, the identity identifier of the payee.

[0094] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string synthesized into the first identity token is invisible to the outside and can only be decrypted on the local side based on the public key on the server. The data transfer process has high security, and during the entire data transfer process, the various electronic devices involved can be carried out independently of the identity token, which greatly improves the security of the data transfer; and, in the data transfer, the data transfer code is generated independently of the user terminal, which reduces the cost of data transfer. The various electronic devices involved in the data transfer only need to complete the entire data transfer process based on the flow of corresponding data, which improves the universality of data transfer.

[0095] See also Figure 4 , Figure 4 This is a flow chart of another embodiment of a data transfer method proposed in this application. Specifically:

[0096] Step S201: When connecting to the server for the first time, the user terminal and the server determine the original identity token of the user terminal.

[0097] Specifically, when a user terminal and a server establish a communication connection for the first time, the user terminal and the server determine an original identity token of the user terminal.

[0098] In a specific implementation scenario, when a user logs in to a server for the first time on a user terminal, an identity registration process of a data account is involved. During the first identity registration process, the user terminal can negotiate with the server for an original identity token for the user terminal. For example, when a user logs in to a server providing shopping for the first time on a user terminal, such as when a user logs in to a shopping webpage in a social application for the first time, the shopping webpage is associated with the server;

[0099] According to some embodiments, the original identity token (token) serves as a credential for identity authentication between the front-end-user terminal and the back-end-server. In order to ensure the security and universality of data transfer, the successful transfer of data between the front-end-user terminal and the back-end-server often depends on whether the identity authentication process based on the identity token (token) is passed; when the first connection is made to the server, such as when the user terminal first accesses the server based on a network connection, the original identity token is negotiated.

[0100] According to some embodiments, during the negotiation between the user terminal and the server, the user terminal may use an identity identifier that is predetermined before leaving the factory and is used to uniquely characterize the user terminal as the original identity token and synchronize it to the server, such as the identity identifier may be an International Mobile Equipment Identity (IMEI), a processor ID, etc.;

[0101] Optionally, the user terminal or server may use an irreversible random number generation algorithm (such as a random number generator) to generate an identity identifier that uniquely represents the user terminal, use the identity identifier as the original identity token, and synchronize it with the other end, such as the user terminal generates the identity identifier and informs the server, or the server generates the identity identifier based on a random number generation algorithm, uses the identity identifier as the original identity token, and synchronizes it with the user terminal. In this application, the method for determining the original identity token can be determined based on the actual application environment and is not specifically limited here. In a feasible implementation, the original identity token can be an identity credential that uniquely represents the user terminal and is assigned by the server to the user terminal, such as an identity credential generated by a random number generator, etc.

[0102] Step S202: Determine the first encrypted string, the second encrypted string, the identity summary, the first public key and the first private key based on the original identity token, and save the first encrypted string, the first private key and the identity summary.

[0103] In a feasible implementation, the user terminal can determine the original identity token at the local end, such as using the IMEI code as the original identity token, and then send the original identity token to the server. After receiving the original identity token, the server determines the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key of the original identity token, and generates a first encrypted string that encrypts the first reference identity string using the first private key and generates a second encrypted string that encrypts the second reference identity string using the first public-private key.

[0104] In actual applications, after receiving the original identity token, the server splits the original identity token to obtain a first reference identity string and a second reference identity string, and then determines a key pair for encrypting and decrypting the "first reference identity string and the second reference identity string", the key pair including a first public key and a first private key, encrypts the first reference identity string using the first private key to generate a first encrypted string, encrypts the second reference identity string using the first public key to generate a second encrypted string, and calculates an identity digest based on the original identity token using a corresponding digest algorithm;

[0105] The user terminal can obtain the first reference identity string, the first private key and the identity summary from the server, and save the first encrypted string, the first private key and the identity summary; for example, after generating the first reference identity string, the first private key and the identity summary, the server can send them to the user terminal, and the user terminal will receive the first reference identity string, the first private key and the identity summary.

[0106] In a feasible implementation, after determining the original identity token, the user terminal can split the original identity token on the local end to determine the first reference identity string, the second reference identity string, the identity summary, the first public key and the first private key, encrypt the first reference identity string using the first private key to generate a first encrypted string and encrypt the second reference identity string using the first public key to generate a second encrypted string, then save the first encrypted string, the first private key and the identity summary, and send the second encrypted string, the first public key and the identity summary to the server.

[0107] Among them, the original identity token can be character-splitting using a preset splitting rule to obtain a first reference identity string and a second reference identity string. After splitting, it is necessary to satisfy the requirement that the original identity token can be restored based on the first reference identity string and the second reference identity string, so as to facilitate the authentication of the user terminal based on the restored identity token (such as the first identity token) during the data transfer process, and the splitting and synthesis are reversible processes. The specific splitting rules can be determined based on the actual application environment and are not specifically limited here.

[0108] In a specific implementation scenario, the data transfer method involved in the present application can be applied to a scenario where the user terminal and the server cannot directly establish a network connection, which can be understood as a state of no network or a network failure. For example, in actual applications, the user terminal cannot use the mobile communication network (such as 4G / 5G communication, WIFI, etc.). At this time, when it comes to the data transfer scenario, that is, when the user terminal is in a network failure state (the user terminal and the server cannot directly establish a network communication), the user terminal can establish a communication connection with the data transfer terminal, and the communication connection can be a communication connection corresponding to a near-field communication method, a communication connection corresponding to a Bluetooth communication method, and so on.

[0109] The server side can correspond to multiple user terminals. For each user terminal, the server can uniquely identify the user terminal based on the identity summary, and establish a mapping relationship between the first public key and the second encryption string associated with the user terminal, that is, establish a mapping relationship between the identity summary of each user terminal and the first public key and the second encryption string associated with the user terminal. The mapping relationship includes but is not limited to data lists, data combinations, and data arrays to represent it, so that the server can uniquely obtain the first public key and the second encryption string corresponding to the user terminal after receiving the identity summary.

[0110] Based on this, in a specific implementation scenario, the user terminal can send the stored identity summary to the data transfer terminal; the data transfer terminal receives the identity summary and can send the identity summary to the server, thereby obtaining the stored first public key from the server. After receiving the identity summary, the server can obtain the first public key and second encryption string corresponding to the identity summary.

[0111] Furthermore, the user terminal may send an identity authentication request including an identity digest to the data transfer terminal based on the communication connection, and after receiving the identity authentication request, the data transfer terminal may obtain the first public key on the server based on the carried identity digest.

[0112] Step S203: sending the stored identity summary to the server via the data transfer terminal, so that the server can determine the second encrypted string and the first public key corresponding to the identity summary.

[0113] In actual applications, after receiving the identity summary of the user terminal, the server can send the second encrypted string and the first public key to the data transfer terminal, so as to decrypt the second encrypted string on the data transfer terminal to generate a second identity string and then merge it with the first identity string to generate a first identity token.

[0114] In actual applications, after receiving the identity summary of the user terminal, the server can send the first public key to the data transfer terminal, so that the first identity string and the first private key can be sent to the server on the data transfer terminal, thereby facilitating the subsequent data transfer terminal to decrypt the second encrypted string based on the first private key to generate a second identity string, thereby merging the second identity string with the first identity string to generate a first identity token.

[0115] Step S204: After the data transfer terminal receives the second encrypted string and the first public key sent by the server, the first public key sent by the data transfer terminal is received.

[0116] According to some embodiments, the user terminal sends the stored identity summary to the server via the data transfer terminal, such as the user terminal can generate an identity authentication request including the identity summary, and send the identity authentication request to the server via the data transfer terminal; thus, after the server receives it, it can obtain the identity summary stored on the user terminal, and then search for the second encrypted string and the first public key stored for the user terminal based on the identity summary, and then send the second encrypted string and the first public key to the data transfer terminal. That is, the synthesis of the first identity token is completed on the user terminal later.

[0117] Specifically, after the data transfer terminal receives the second encrypted string and the first public key sent by the server, the first public key can be sent to the user terminal; at this time, the user terminal can receive the first public key sent by the data transfer terminal.

[0118] Step S205: After the data transfer terminal receives the first public key sent by the server, the first public key sent by the data transfer terminal is received.

[0119] According to some embodiments, the user terminal sends the stored identity summary to the server via the data transfer terminal, such as the user terminal can generate an identity authentication request including the identity summary, and send the identity authentication request to the server via the data transfer terminal; thus, after receiving the identity summary, the server can obtain the identity summary stored on the user terminal, and then search for the second encrypted string and the first public key stored for the user terminal based on the identity summary, and then only send the first public key to the data transfer terminal. That is, it is completed on the server when the first identity token is synthesized later.

[0120] Specifically, after receiving the first public key sent by the server, the data transfer terminal may send the first public key to the user terminal; at this time, the user terminal may receive the first public key sent by the data transfer terminal.

[0121] Step S206: decrypt the first encrypted string stored in the user terminal based on the first public key to obtain a first identity string.

[0122] Please refer to step S101 for details, which will not be described again here.

[0123] Step S207: Send the stored first private key and the first identity string to the data transfer terminal, so that the data transfer terminal uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates a first identity token based on the second identity string and the first identity string, and then sends the first identity token to the server to authenticate the identity of the user terminal.

[0124] According to some embodiments, after receiving the identity summary of the user terminal, the server can send the second encrypted string and the first public key to the data transfer terminal, and then after the user terminal decrypts and generates the first identity string based on the first public key, the server can send the stored first private key and the first identity string to the data transfer terminal; after receiving the data transfer terminal, the server can then use the first private key to decrypt the second encrypted string to generate the second identity string, thereby synthesizing the first identity string and the second identity string to generate a first identity token, and send the identity token to the server for identity authentication.

[0125] Step S208: Forward the stored first private key and the first identity string to the server via the data transfer terminal, so that the server uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates the first identity token based on the first identity string and the second identity string, and authenticates the user terminal.

[0126] The first public key sent is then decrypted by the user terminal based on the first public key to generate a first identity string, and then the stored first private key and the first identity string are sent to the data transfer terminal; the data transfer terminal receives and forwards it to the server; after receiving it, the server can use the first private key to decrypt the second encrypted string to generate a second identity string, thereby synthesizing the first identity string and the second identity string to generate a first identity token, and then authenticate the user terminal based on the first identity token.

[0127] Step S209: Determine that the server has passed the identity authentication of the user terminal, and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0128] For details, please refer to step S101, which will not be repeated here.

[0129] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string that synthesizes the first identity token is not visible to the outside and can only be decrypted on the local end based on the public key on the server. The data transfer process has high security, and the electronic devices involved in the entire data transfer process can be It is independent of identity tokens, which greatly improves the security of data transfer; and, in data transfer, it does not rely on the corresponding generation of data transfer codes by user terminals, which reduces the cost of data transfer. Each electronic device involved in data transfer can finally complete the entire data transfer process based on the flow of corresponding data, thereby improving the universality of data transfer; and in the scenario of user terminal network failure (user terminal and server have no network service), the entire data transfer process can be successfully completed through communication connection with the data transfer terminal, thereby improving the disaster recovery of the data transfer process, realizing network-free data transfer, and expanding the data transfer scenario; and, even if the communication link between the electronic devices is unreliable, the encryption and decryption means involved in the data transfer method of the present application can also ensure the security of data transfer.

[0130] In one embodiment, Figure 5 As shown, a data transfer method is proposed, which is applied to a data transfer terminal. The method can be implemented by a computer program and can be run on a data transfer device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. Specifically, the data transfer method includes:

[0131] Step S301: Obtain a first public key from the server, and send the first public key to a user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string.

[0132] According to some embodiments, after the user triggers a data transfer operation by operating a user terminal, the user terminal responds to the machine executable instructions corresponding to the data transfer operation, and first obtains the first public key stored in the server from the data transfer terminal; further, the user terminal can generate an identity authentication request including an identity summary, and send the identity authentication request to the data transfer terminal; at this time, the data transfer terminal can respond (such as responding to the identity authentication request of the user terminal), thereby sending the identity authentication request to the server, that is, obtaining the first public key from the server based on the identity authentication request; after receiving the identity authentication request, the server uses the identity summary carried in the identity authentication request to search for the second encrypted string and the first public key stored for the user terminal based on the identity summary; further, the server can send the first public key to the data transfer terminal; it can also send the first public key and the second encrypted string to the data transfer terminal, at which time the data transfer terminal can usually perform a first identity token synthesis later.

[0133] According to some embodiments, after receiving the first public key sent by the data transfer terminal, the user terminal can decrypt the first encrypted string stored locally based on the first public key to generate a first identity string, and then send the first identity string and the first private key to the data transfer terminal.

[0134] Step S302: receiving the first identity string and the first private key sent by the user terminal, so that the server performs identity authentication on the user terminal based on the first identity token.

[0135] The first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key.

[0136] According to some embodiments, after the user terminal generates a first identity string based on the first public key decryption, the stored first private key and the first identity string are then sent to the data transfer terminal; after receiving the data transfer terminal, the first private key is then used to decrypt the second encrypted string to generate a second identity string, thereby synthesizing the first identity string and the second identity string to generate a first identity token, and the identity token is sent to the server for identity authentication.

[0137] According to some embodiments, the user terminal sends the stored first private key and the first identity string to the data transfer terminal; the data transfer terminal receives and forwards it to the server; after receiving it, the server can use the first private key to decrypt the second encrypted string to generate a second identity string, thereby synthesizing the first identity string and the second identity string to generate a first identity token, and then authenticate the user terminal based on the first identity token.

[0138] Step S303: Determine that the server has passed the identity authentication of the user terminal, receive a data transfer request from the user terminal, and send the data transfer request to the server so that the server performs data transfer.

[0139] According to some embodiments, after the server passes the identity authentication of the user terminal based on the first identity token, it can return a verification pass message to the data transfer device, and the data transfer device can determine that the user terminal identity authentication is passed based on the verification pass message. Usually, after the identity authentication is passed, the identity authentication process before data transfer is completed, that is, data transfer can be performed after the verification is passed;

[0140] Furthermore, the data transfer process may be: the user terminal may send a data transfer request to the data transfer terminal; after receiving the data transfer request, the data transfer terminal sends the data transfer request to the server, and the server may respond to the data transfer request to transfer the data. Furthermore, the data transfer request usually includes data transfer information (such as data transfer account information, data transfer amount, etc.), and the server may transfer data based on the data transfer information, such as transferring a specified amount of data in the user account on the user terminal to the merchant account associated with the data transfer terminal.

[0141] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string synthesized into the first identity token is invisible to the outside and can only be decrypted on the local side based on the public key on the server. The data transfer process has high security, and in the entire data transfer process, the electronic devices involved can be independent of the identity token, which greatly improves the security of data transfer; and, in the data transfer, it does not rely on the corresponding generation of data transfer codes (such as data transfer QR codes, bar codes, etc.) by the user terminal, the data transfer is more convenient, and the cost of the hardware device that displays the data transfer code is reduced. The electronic devices involved in the data transfer can finally complete the entire data transfer process based on the flow of corresponding data, which improves the universality of data transfer.

[0142] See also Figure 6 , Figure 6This is a flow chart of another embodiment of a data transfer method proposed in this application. Specifically:

[0143] Step S401: receiving an identity summary sent by the user terminal.

[0144] According to some embodiments, the identity summary server or user terminal calculates an identity summary based on the original identity token of the user terminal using a corresponding summary algorithm, wherein the summary algorithm includes but is not limited to an MD message digest algorithm, a hash algorithm, an SM3 hash algorithm, etc. The summary generally refers to converting input data of any length (such as the original identity token) into output data of a fixed length through a summary algorithm, for example, converting 256-bit data into 64-bit data.

[0145] According to some embodiments, during the data transfer process, the user terminal sends an identity summary to the data transfer terminal, and the data transfer terminal sends the identity summary to the server, which can facilitate the server to quickly find the second encryption string and the first public key for the user terminal based on the identity summary.

[0146] Step S402: obtaining a first public key from the server based on the identity summary, and sending the first public key to the user terminal, so that the user terminal generates a first identity string based on the first public key and the stored first encrypted string.

[0147] According to some embodiments, the data transfer terminal sends the identity summary to the server. After receiving the identity summary of the user terminal, the server searches for the second encrypted string and the first public key stored for the user terminal based on the identity summary. One way is that the server can send the second encrypted string and the first public key to the data transfer terminal. At this time, when the data transfer terminal receives the second encrypted string and the first public key, it completes the step of obtaining the first public key from the server based on the identity summary. Usually, receiving the second encrypted string and the first public key can facilitate the decryption of the second encrypted string on the data transfer terminal to generate the second identity string, which is then combined with the first identity string to generate the first identity token. One way is that the server only sends the first public key to the data transfer terminal, and then the data transfer terminal sends the first public key to the user terminal, and the user terminal can generate the first identity string based on the first public key and the stored first encrypted string.

[0148] In a specific implementation scenario, the data transfer method involved in the present application can be applied to a scenario where the user terminal and the server cannot directly establish a network connection, which can be understood as a situation where there is no network or a network failure state. For example, in actual applications, the user terminal cannot use a mobile communication network (such as 4G / 5G communication, WIFI, etc.). At this time, when it comes to the data transfer scenario, that is, when the user terminal is in a network failure state (the user terminal and the server cannot directly communicate over the network). At this time, the user of the data transfer terminal can establish a communication connection with the terminal, and the communication connection can be a communication connection corresponding to a near-field communication method, a communication connection corresponding to a Bluetooth communication method, a communication connection corresponding to an infrared communication method, and so on.

[0149] That is, when the user terminal is in a network failure state, when data needs to be transferred to the user terminal, the data transfer terminal establishes a communication connection with the user terminal.

[0150] According to some embodiments, the user terminal can send an identity authentication request including an identity summary to the data transfer terminal based on the communication connection; at this time, the data transfer terminal can receive the identity authentication request sent by the user terminal, and the identity authentication request usually carries the identity summary. The user terminal can obtain the first public key from the server based on the identity summary and send the first public key to the user terminal; in a specific implementation, the data transfer terminal can forward the identity authentication request to the server, and the server can obtain the identity summary after receiving the identity authentication request.

[0151] Step S403: Receive the first identity string and the first private key sent by the user terminal, and send the first identity string and the first private key to the server, so that the server generates the first identity token after receiving the first identity string and the first private key, and authenticates the user terminal based on the first identity token.

[0152] According to some embodiments, Figure 7 As shown, Figure 7 This is a schematic diagram of a data information interaction involved in this application. After receiving the identity summary of the user terminal, the server Figure 7 As shown, the server can now send the first public key to the data transfer terminal, and then after the user terminal decrypts the first public key to generate a first identity string, the stored first private key and the first identity string are sent to the data transfer terminal; the data transfer terminal receives and forwards it to the server; after receiving it, the server can use the first private key to decrypt the second encrypted string to generate a second identity string, thereby synthesizing the first identity string and the second identity string to generate a first identity token, and then authenticate the user terminal based on the first identity token.

[0153] Step S404: Obtain the first public key and the second encrypted string from the server, and send the first public key to the user terminal.

[0154] According to some embodiments, the user terminal sends the stored identity summary to the data transfer terminal, such as the user terminal can generate an identity authentication request including the identity summary, and send the identity authentication request to the data transfer terminal; after the data transfer terminal receives it, it sends the identity authentication request to the server, so that after the server receives it, it can obtain the identity summary stored on the user terminal, and then search for the second encrypted string and the first public key stored for the user terminal based on the identity summary, and then send the second encrypted string and the first public key to the data transfer terminal. That is, it is completed on the user terminal when the first identity token is synthesized later.

[0155] Specifically, after the data transfer terminal receives the second encrypted string and the first public key sent by the server, the first public key can be sent to the user terminal; at this time, the user terminal can receive the first public key sent by the data transfer terminal.

[0156] Step S405: receiving the first identity string and the first private key sent by the user terminal, generating a first identity token, and sending the first identity token to the server, so that the server authenticates the user terminal based on the first identity token.

[0157] According to some embodiments, Figure 8 As shown, Figure 8 is a schematic diagram of another data information interaction involved in the present application. After the user terminal decrypts and generates a first identity string based on the first public key, the stored first private key and the first identity string are sent to the data transfer terminal; Figure 8 After receiving the data transfer terminal, the first private key is used to decrypt the second encrypted string to generate a second identity string, thereby synthesizing the first identity string and the second identity string, that is, generating the first identity token based on the first identity string and the second identity string, and sending the identity token to the server, so that the server can authenticate the user terminal.

[0158] Among them, the process of "generating the first identity token based on the first identity string and the second identity string" is the inverse process of splitting the original identity token to generate identity strings (such as the first reference identity string and the second reference identity string). The specific generation process is determined based on the actual application environment. For example, it can be concatenating the first identity string and the second identity string, or performing logical operations on the first identity string and the second identity string, etc., which are not specifically limited here.

[0159] Step S406: receiving a verification pass message from the server, and determining that the identity authentication of the user terminal is passed, wherein the verification pass message is generated after the server passes the identity authentication of the user terminal;

[0160] According to some embodiments, after the server successfully authenticates the user terminal based on the first identity token, the server can return a verification success message to the data transfer device. The data transfer device can then receive the verification success message sent by the server and determine that the server has successfully authenticated the user terminal.

[0161] Furthermore, the verification result message (i.e., verification pass message and verification fail message) sent by the server (e.g., via the data transfer terminal) can be received; and prompt information corresponding to the verification pass message can be displayed according to the verification pass message. Furthermore, if the verification result is verification success, a success message is displayed; if the verification result is verification failure, the data transfer terminal performs verification troubleshooting and prompts the user terminal to resubmit the above operation process.

[0162] Step S407: Send the verification pass message to the user terminal so that the user terminal determines that the identity authentication is passed based on the verification pass message, receives the data transfer request from the user terminal, and sends the data transfer request to the server so that the server performs data transfer.

[0163] Specifically, the data transfer device sends the verification pass message to the user terminal; the user terminal can receive the verification pass message forwarded by the server via the data transfer terminal.

[0164] According to some embodiments, at this time, the identity authentication process before data transfer is completed, that is, data transfer can be performed after verification; further, the user terminal can send a data transfer request to the data transfer terminal; after receiving the data transfer request, the data transfer terminal sends the data transfer request to the server, and the server can respond to the data transfer request to transfer data. Further, the data transfer request usually contains data transfer information (such as data transfer account information, data transfer amount, etc.), and the server can perform data transfer based on the data transfer information, such as transferring a specified amount of data in the user account on the user terminal to the merchant account associated with the data transfer terminal.

[0165] Optionally, after receiving the data transfer request sent by the user terminal, the data transfer terminal may send the data transfer request and the first identity token to the server if a first identity token is synthesized on the data transfer terminal in the aforementioned operation process. After the server receives the data transfer request and the first identity token, for the sake of data transfer security, the server may respond to the data transfer request and perform a secondary identity authentication on the current user terminal based on the first identity token, and after this identity authentication is passed, perform data transfer based on some request information in the data transfer request (such as data transfer account information, data transfer amount, etc.), such as transferring a specified amount of data in the user account on the user terminal to a merchant account associated with the data transfer terminal.

[0166] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string that synthesizes the first identity token is not visible to the outside and can only be decrypted on the local end based on the public key on the server. The data transfer process has high security, and the electronic devices involved in the entire data transfer process can be It is independent of identity tokens, which greatly improves the security of data transfer; and, in data transfer, it does not rely on the corresponding generation of data transfer codes by user terminals, which reduces the cost of data transfer. Each electronic device involved in data transfer can finally complete the entire data transfer process based on the flow of corresponding data, thereby improving the universality of data transfer; and in the scenario of user terminal network failure (user terminal and server have no network service), the entire data transfer process can be successfully completed through communication connection with the data transfer terminal, thereby improving the disaster recovery of the data transfer process, realizing network-free data transfer, and expanding the data transfer scenario; and, even if the communication link between the electronic devices is unreliable, the encryption and decryption means involved in the data transfer method of the present application can also ensure the security of data transfer.

[0167] In one embodiment, Fig. 9 As shown, a data transfer method is proposed, which is applied to a server. The method can be implemented by a computer program and can be run on a data transfer device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0168] Specifically, the data transfer method includes:

[0169] Step S501: Sending a first public key to the data transfer terminal, so that the data transfer terminal sends the first public key to the user terminal.

[0170] The user terminal stores a first encrypted string and a first private key, the first public key is used to decrypt the first encrypted string to generate a first identity string, and the first encrypted string is generated by the first reference identity string of the original identity token of the user terminal based on the first private key.

[0171] In addition, the specific interpretations of the first encrypted string, the second encrypted string, the first reference identity string, the second reference identity string, the first key, the first public key and the original identity token can be referred to the aforementioned embodiments and will not be explained in detail here.

[0172] According to some embodiments, in a scenario where a data transfer operation is triggered between a user terminal and a data transfer terminal, for example, after a user triggers the data transfer operation by operating the user terminal, the user terminal responds to a machine executable instruction corresponding to the data transfer operation, and first obtains a first public key stored by a server from the data transfer terminal; in the scenario shown, in order to implement data transfer for the user terminal, the server will send the first public key to the data transfer terminal; after receiving the first public key sent by the server, the data transfer terminal can send the first public key to the user terminal.

[0173] Further, the server "sending the first public key to the data transfer terminal" may be a machine executable operation triggered in response to an identity authentication request generated on the user terminal, schematically:

[0174] According to some embodiments, the user terminal can generate an identity authentication request including an identity summary, and send the identity authentication request to the data transfer terminal; at this time, the data transfer terminal can respond (such as responding to the identity authentication request of the user terminal), thereby sending the identity authentication request to the server; the server can then receive the identity authentication request generated on the user terminal, and the server responds to the identity authentication request to obtain the first public key (or, the first public key and the second encrypted string) stored for the user terminal; further, the identity authentication request can carry the first identity summary (that is, the identity summary stored on the user terminal), and based on the first identity summary, the second encrypted string and the first public key stored for the user terminal are searched; further, the server can send only the first public key to the data transfer terminal; it can also send the first public key and the second encrypted string to the data transfer terminal, at which time the data transfer terminal can usually perform the first identity token synthesis later. After the data transfer terminal receives the first public key, the first public key can be sent to the user terminal.

[0175] Step S502: Acquire a first identity token, and perform identity authentication on the user terminal based on the first identity token.

[0176] The first identity token is generated based on the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the stored second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key.

[0177] According to some embodiments, the first identity token may be synthesized on the data transfer terminal, and then the server may obtain the first identity token from the server, thereby authenticating the user terminal based on the first identity token. Further, the server may send a second encrypted string to the data transfer terminal, and after the data transfer terminal subsequently obtains the first identity string and the first private key sent by the user terminal, it may use the first private key to decrypt the second encrypted string to generate a second identity string, and then generate the first identity token based on the first identity string and the second identity string, so that the data transfer terminal can send the first identity token to the server, and the server can then obtain the first identity token, and then authenticate the first identity token;

[0178] According to some embodiments, the first identity token may be generated on the server; further, after the user terminal generates the first identity string based on the first public key, the first identity string and the first private key (used to decrypt the second encrypted string to generate the second identity string) may be sent to the server via the data transfer terminal. After receiving the first identity string, the server may use the first private key to decrypt the second encrypted string to generate the second identity string, and then generate the first identity token based on the first identity string and the second identity string. At this point, the server can obtain the first identity token.

[0179] The following explains the authentication process:

[0180] The server may pre-store an original identity token that uniquely identifies the identity of the user terminal. After obtaining the first identity token, the server may match the first identity token with the original identity token to determine whether the identity of the user terminal has been verified. In schematic form, when the first identity token and the original identity token are consistent, the server determines that the identity authentication of the user terminal has been passed. In schematic form, the similarity between the first identity token and the original identity token may be calculated. When the similarity meets a threshold, the server determines that the identity authentication of the user terminal has been passed.

[0181] Step S503: Determine that the identity authentication of the user terminal is passed, receive a data transfer request sent by a data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

[0182] In a specific implementation scenario, after the server passes the identity authentication of the user terminal based on the first identity token, it can return a verification pass message to the data transfer device, and then the data transfer device sends the verification pass message to the user terminal; the user terminal can receive the verification pass message forwarded by the server via the data transfer terminal, and at this time, the identity authentication process before data transfer is completed, that is, the server can transfer data to the user terminal after the verification is passed;

[0183] Further, after the identity authentication is passed, the user terminal may send a data transfer request to the server via the data transfer terminal; or, the data transfer terminal sends a data transfer request to the server;

[0184] After receiving the data transfer request, the server may respond to the data transfer request and transfer the data. Furthermore, the data transfer request usually includes data transfer information (such as data transfer account information, data transfer amount, etc.), and the server may transfer the data based on the data transfer information, such as transferring a specified amount of data in the user account on the user terminal to the merchant account associated with the data transfer terminal.

[0185] Optionally, the data transfer result sent by the server (e.g., via the data transfer terminal) may be received; and prompt information corresponding to the data transfer result may be displayed according to the data transfer result. Further, if the data transfer result is that the data transfer is successful, a success message may be displayed; if the data transfer result is that the data transfer fails, the user terminal may prompt the user to resubmit the above operation process.

[0186] Optionally, a data transfer request and the first identity token sent by the data transfer terminal may be received, and the server responds to the data transfer request, performs identity authentication based on the first identity token, and performs data transfer after the identity authentication is passed.

[0187] In an illustrative manner, a user can log in to a shopping platform through a shopping portal provided by a social client, and further, the user can select a product with price information on the shopping platform. Accordingly, the user terminal can detect the product with price information selected by the user on the shopping platform, and calculate the data transfer amount according to the price information of the selected product (i.e., data transfer amount = the sum of the price information of the selected product), and generate a data transfer request including the data transfer amount and the receiver identifier according to the data transfer amount and the receiver identifier corresponding to the selected product. The receiver identifier corresponding to the product refers to the identity identifier of the merchant or seller who publishes the selected product on the shopping platform, that is, the identity identifier of the payee.

[0188] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string synthesized into the first identity token is invisible to the outside and can only be decrypted on the local side based on the public key on the server. The data transfer process has high security, and during the entire data transfer process, the various electronic devices involved can be carried out independently of the identity token, which greatly improves the security of the data transfer; and, in the data transfer, the data transfer code is generated independently of the user terminal, which reduces the cost of data transfer. The various electronic devices involved in the data transfer only need to complete the entire data transfer process based on the flow of corresponding data, which improves the universality of data transfer.

[0189] See also Fig.10 , Fig.10 This is a flow chart of another embodiment of a data transfer method proposed in this application. Specifically:

[0190] Step S601: When establishing the first connection with the user terminal, determine the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key based on the original identity token of the user terminal, and generate a first encrypted string that encrypts the first reference identity string using the first private key and generate a second encrypted string that encrypts the second reference identity string using the first public-private key.

[0191] Step S602: Save the second encrypted string, the first public key and the identity summary.

[0192] In a feasible implementation manner: when the user terminal determines the first encrypted string, the second encrypted string, the identity summary, the first public key and the first private key based on the original identity token, the server may receive the second encrypted string, the first public key and the identity summary sent by the user terminal, the identity token information consisting of the first identity string and the second identity string; the server then saves the second encrypted string, the first public key and the identity summary;

[0193] In a feasible implementation manner: the server can receive the original identity token sent by the user terminal, split and encrypt the original identity token, and then determine the first data, the second encrypted string, the identity summary, the first public key and the first private key; finally, save the second encrypted string, the first public key and the identity summary; the server sends the first data, the first private key and the identity summary to the user terminal.

[0194] In addition, the definitions of the relevant terms and the corresponding generation process involved in this embodiment can be referred to the other embodiments mentioned above and will not be described again here.

[0195] Step S603: receiving a first identity summary sent by the data transfer terminal, where the first identity summary is an identity summary stored on the user terminal.

[0196] Please refer to step S501 for details, which will not be repeated here.

[0197] Step S604: Determine a first public key and a second encryption string based on the first identity summary, and send the first public key to the data transfer terminal, so that the data transfer terminal sends the first public key to the user terminal.

[0198] The server side can correspond to multiple user terminals. For each user terminal, the server can uniquely identify the user terminal based on the identity summary, and establish a mapping relationship between the first public key and the second encryption string associated with the user terminal, that is, establish a mapping relationship between the identity summary of each user terminal and the first public key and the second encryption string associated with the user terminal. The mapping relationship includes but is not limited to data lists and data groups. Furthermore, after receiving the first identity summary sent by the data transfer terminal, the server can uniquely obtain the first public key and the second encryption string corresponding to the user terminal based on the first identity summary, and then can only send the first public key to the user terminal.

[0199] In a specific implementation scenario, the data transfer method involved in the present application can be applied to a scenario where the user terminal and the server cannot directly connect to the network, which can be understood as no network state or network failure state, that is, when the user terminal is in a network failure state, such as the user terminal cannot use the mobile communication network (such as 4G / 5G communication, WIFI, etc.), at this time, if it involves a data transfer scenario, that is, when the user terminal is in a network failure state (the user terminal and the server cannot directly communicate with each other), the user terminal can establish a communication connection with the data transfer terminal, and the communication connection can be a communication connection corresponding to a near field communication method, a communication connection corresponding to a Bluetooth communication method, etc. Then the user terminal can send the first identity summary to the data transfer terminal based on the stored first identity summary (in this embodiment, the identity summary stored by the user terminal is called the first identity summary, and the identity summary stored on the server is called the reference identity summary) to obtain the first public key on the server; at this time, the server can receive the first identity summary sent by the data transfer terminal.

[0200] Step S605: receiving the first identity string and the first private key sent by the data transfer terminal, and decrypting the second encrypted string based on the first private key to generate a second identity string.

[0201] Step S606: Generate a first identity token based on the first identity string and the second identity string.

[0202] According to some embodiments, the first identity token may be generated on the server; further, after the user terminal generates the first identity string based on the first public key, the first identity string and the first private key (used to decrypt the second encrypted string to generate the second identity string) may be sent to the server via the data transfer terminal. After receiving the first identity string, the server may use the first private key to decrypt the second encrypted string to generate the second identity string, and then generate the first identity token based on the first identity string and the second identity string. At this point, the server can obtain the first identity token.

[0203] Among them, the detailed explanations of "using the first private key to decrypt the second encrypted string to generate a second identity string" and "generating a first identity token" can be referred to other embodiments and will not be repeated here.

[0204] Step S607: Determine a first public key and a second encrypted string based on the first identity summary, and send the first public key and the second encrypted string to the data transfer terminal, so that the data transfer terminal decrypts the second encrypted string based on the first private key to generate a second identity string.

[0205] Step S608: receiving a first identity token sent by the data transfer terminal, wherein the identity token information is generated by the data transfer terminal based on the first identity string and the second identity string.

[0206] According to some embodiments, the first identity token may be synthesized on the data transfer terminal, and the server may obtain the first identity token from the server, thereby authenticating the user terminal based on the first identity token. Further, the server may send the second encrypted string to the data transfer terminal, and after the data transfer terminal subsequently obtains the first identity string and the first private key sent by the user terminal, it may use the first private key to decrypt the second encrypted string to generate the second identity string, and then generate the first identity token based on the first identity string and the second identity string, so that the data transfer terminal can send the first identity token to the server, and the server can then obtain the first identity token, and then authenticate the first identity token;

[0207] Step S609: Authenticate the identity of the user terminal based on the first identity token.

[0208] In a feasible implementation, both the user terminal and the server may not store the original identity token, and the identity authentication process may be performed based on the identity summary, as follows: 1. The server may calculate a reference identity summary corresponding to the first identity token; in actual applications, the identity summary may be calculated based on the first identity token using a corresponding summary algorithm, wherein the summary algorithm includes but is not limited to an MD message digest algorithm, a hash algorithm, an SM3 hash algorithm, etc. The summary generally refers to converting input data of any length (such as the original identity token) into output data of a fixed length through a summary algorithm, such as converting 256-bit data into 64-bit data.

[0209] 2. The server can determine whether the identity authentication of the user terminal is successful based on the reference identity summary and the identity summary. That is, the reference identity summary can be matched with the identity summary to determine whether the identity of the user terminal is verified. Schematically, when the reference identity summary is consistent with the identity summary, the server determines that the identity authentication of the user terminal is successful. Schematically, the similarity between the reference identity summary and the identity summary can be calculated. When the similarity meets a threshold, the server determines that the identity authentication of the user terminal is successful.

[0210] Step S610: Determine that the user terminal identity authentication is passed, receive a data transfer request sent by a data transfer terminal, and perform data transfer based on the data transfer request, the data transfer request is sent by the user terminal to the data transfer terminal. For details, please refer to step S503, which will not be repeated here.

[0211] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string that synthesizes the first identity token is not visible to the outside and can only be decrypted on the local end based on the public key on the server. The data transfer process has high security, and the electronic devices involved in the entire data transfer process can be It is independent of identity tokens, which greatly improves the security of data transfer; and, in data transfer, it does not rely on the corresponding generation of data transfer codes by user terminals, which reduces the cost of data transfer. Each electronic device involved in data transfer can finally complete the entire data transfer process based on the flow of corresponding data, thereby improving the universality of data transfer; and in the scenario of user terminal network failure (user terminal and server have no network service), the entire data transfer process can be successfully completed through communication connection with the data transfer terminal, thereby improving the disaster recovery of the data transfer process, realizing network-free data transfer, and expanding the data transfer scenario; and, even if the communication link between the electronic devices is unreliable, the encryption and decryption means involved in the data transfer method of the present application can also ensure the security of data transfer.

[0212] See also Fig.11 , is a schematic diagram of the architecture of a data transfer system provided in an embodiment of the present application. Figure 3 As shown, the data transfer system 10 may include a user terminal 100, a data transfer terminal 110 and a server 120;

[0213] The server 120 has a data transfer function and can be a separate server device, such as a rack-mounted, blade, tower, or cabinet-mounted server device, or a workstation, mainframe computer, or other hardware device with strong computing power; it can also be a server cluster composed of multiple servers, and the servers in the service cluster can be composed in a symmetrical manner, wherein each server has equivalent functions and status in the business link, and each server can provide services to the outside independently, and the independent service can be understood as not requiring the assistance of other servers.

[0214] The user terminal 100 may be an electronic device, including but not limited to: a wearable device, a handheld device, a personal computer, a tablet computer, a vehicle-mounted device, a smart phone, a computing device or other processing device connected to a wireless modem, etc. Electronic devices may be called different names in different networks, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), terminal equipment in 5G network or future evolution network, etc.

[0215] The data transfer terminal 110 may also be an electronic device, including but not limited to: a personal computer, a tablet computer, a smart phone, a computing device or other processing device connected to a wireless modem.

[0216] According to some embodiments, the user terminal 100 and the data transfer terminal 110 can establish a communication connection and complete the data interaction during the data transfer process based on the communication connection, wherein the communication connection includes but is not limited to Bluetooth connection, infrared connection, near field communication connection, etc.

[0217] The data transfer terminal 110 and the server 120 interact and communicate via a network, which may be a wireless network or a wired network. Wireless networks include but are not limited to cellular networks, wireless local area networks, infrared networks or Bluetooth networks, and wired networks include but are not limited to Ethernet, universal serial bus (USB) or controller area network.

[0218] See also Fig.11a , Fig.11a An interactive schematic diagram of a data transfer system provided in an embodiment of the present application.

[0219] Step S701: the user terminal 100 establishes a communication connection with the data transfer terminal 110 in a network failure state.

[0220] Step S702: the user terminal 100 sends an identity authentication request including an identity digest to the data transfer terminal 110 based on the communication connection.

[0221] Step S703 : the data transfer terminal 100 receives the identity summary sent by the user terminal, and sends the identity summary to the server 120 .

[0222] The identity summary is generated based on the original identity token.

[0223] Step S704 : the server 120 determines a first public key and a second encryption string for the user terminal 100 based on the identity digest, and sends the first public key to the data transfer terminal 110 .

[0224] Step S705 : the data transfer terminal 110 sends the first public key to the user terminal 100 .

[0225] Step S706: The user terminal 100 decrypts the stored first encrypted string based on the first public key to obtain a first identity string;

[0226] Step S707 : the user terminal 100 sends the stored first private key and first identity string to the data transfer terminal 110 .

[0227] Step S708 : the data transfer terminal 110 sends the first identity string and the first private key to the server 120 .

[0228] Step S709: The server 120 decrypts the second encrypted string based on the first private key to generate a second identity string, and generates a first identity token based on the first identity string and the second identity string.

[0229] Step S710: The server 120 authenticates the user terminal 100 based on the first identity token, and determines that the identity authentication of the user terminal 100 is successful.

[0230] Step S711: the server 120 sends a verification success message to the data transfer terminal 110 .

[0231] Step S712 : the data transfer terminal 110 sends the verification pass message to the user terminal 100 .

[0232] Step S713: The user terminal 100 receives the verification success message and determines that the server 120 has passed the identity authentication of the user terminal 100.

[0233] Step S714 : the user terminal 100 sends a data transfer request to the data transfer terminal 110 .

[0234] Step S715: The data transfer terminal 110 sends the data transfer request to the server 120. Step S716: The server 120 performs data transfer.

[0235] See also Fig.11b , Fig.11b An interactive schematic diagram of another data transfer system provided in an embodiment of the present application.

[0236] Step S801: the user terminal 100 sends an identity authentication request including an identity digest to the data transfer terminal 110.

[0237] Step S802 : the data transfer terminal 100 receives the identity summary sent by the user terminal, and sends the identity summary to the server 120 .

[0238] The identity summary is generated based on the original identity token.

[0239] Step S803 : the server 120 determines a first public key and a second encrypted string for the user terminal 100 based on the identity digest, and sends the first public key and the second encrypted string to the data transfer terminal 110 .

[0240] Step S804 : the data transfer terminal 110 sends the first public key to the user terminal 100 .

[0241] Step S805: The user terminal 100 decrypts the stored first encrypted string based on the first public key to obtain a first identity string;

[0242] Step S806 : the user terminal 100 sends the stored first private key and first identity string to the data transfer terminal 110 .

[0243] Step S807: the data transfer terminal 110 uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates a first identity token based on the first identity string and the second identity string.

[0244] Step S808 : the data transfer terminal 110 sends the first identity token to the server 120 .

[0245] Step S809: the server 120 performs identity authentication on the user terminal 100 based on the first identity token, and determines that the identity authentication of the user terminal 100 is successful.

[0246] Step S810: The user terminal 100 determines that the server identity authentication is passed.

[0247] Step S811: Sending a data transfer request to the data transfer terminal 110.

[0248] Step S812: the data transfer terminal 110 sends the data transfer request to the server 120.

[0249] Step S813: The server 120 performs data transfer.

[0250] In addition, the remote diagnosis system embodiment provided in the above embodiment and the remote diagnosis method in some embodiments belong to the same concept, and its embodiment and implementation process are detailed in the method embodiment, which will not be repeated here.

[0251] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0252] See also Fig.12 , which shows a schematic diagram of the structure of a data transfer device provided by an exemplary embodiment of the present application. The data transfer device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a public key acquisition module 11, a data sending module 12 and a data transfer module 13.

[0253] The public key acquisition module 11 receives a first public key sent by the data transfer terminal, and decrypts a first encrypted string stored in the user terminal based on the first public key to obtain a first identity string; wherein the first public key is obtained by the data transfer terminal from the server, the first encrypted string is generated by encrypting a first reference identity string of the original identity token based on a first private key stored in the user terminal, and the first private key corresponds to the first public key one by one;

[0254] A data sending module 12 is used to send the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on a first identity token, wherein the first identity token is composed of the first identity string and a second identity string, the second identity string is obtained by decrypting a second encrypted string stored in the server based on the first private key, and the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0255] The data transfer module 13 is used to determine whether the identity authentication is passed and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0256] Optionally, the public key acquisition module 11 is specifically used to:

[0257] The stored identity summary is sent to the data transfer terminal, and a first public key sent by the data transfer terminal is received, wherein the identity summary is generated based on the original identity token.

[0258] Optional, such as Fig.14 As shown, the device 1 further includes:

[0259] A token determination module 14, configured to determine the original identity token of the user terminal with the server when the user terminal is connected to the server for the first time;

[0260] The information determination module 15 is used to determine the first encrypted string, the second encrypted string, the identity summary, the first public key and the first private key based on the original identity token, and save the first encrypted string, the first private key and the identity summary.

[0261] Optionally, the information determination module 15 is specifically used to:

[0262] Send the original identity token to the server so that the server determines the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key of the original identity token, and generates a first encrypted string encrypted by the first private key for the first reference identity string and generates a second encrypted string encrypted by the first public-private key for the second reference identity string; obtain the first reference identity string, the first private key and the identity summary from the server, and save the first encrypted string, the first private key and the identity summary; or,

[0263] The original identity token is split to determine the first reference identity string, the second reference identity string, the identity summary, the first public key and the first private key, the first reference identity string is encrypted using the first private key to generate a first encrypted string and the second reference identity string is encrypted using the first public key to generate a second encrypted string, the first encrypted string, the first private key and the identity summary are saved, and the second encrypted string, the first public key and the identity summary are sent to the server.

[0264] Optional, such as Fig.13 As shown, the public key acquisition module 11 includes:

[0265] A summary sending unit 111, configured to send the stored identity summary to the server via the data transfer terminal, so that the server determines the second encrypted string and the first public key corresponding to the identity summary;

[0266] The public key obtaining unit 112 is configured to receive the first public key sent by the data transfer terminal.

[0267] Optionally, the public key acquisition unit 112 is specifically used to:

[0268] After the data transfer terminal receives the second encrypted string and the first public key sent by the server, receiving the first public key sent by the data transfer terminal; or,

[0269] After the data transfer terminal receives the first public key sent by the server, the first public key sent by the data transfer terminal is received.

[0270] Optionally, the data sending module 12 is specifically used for:

[0271] Sending the stored first private key and the first identity string to the data transfer terminal, so that the data transfer terminal uses the first private key to decrypt the second encrypted string to generate a second identity string, and after generating a first identity token based on the second identity string and the first identity string, sends the first identity token to the server to authenticate the user terminal; or,

[0272] The stored first private key and the first identity string are forwarded to the server via the data transfer terminal, so that the server uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates the first identity token based on the first identity string and the second identity string, and authenticates the user terminal.

[0273] Optionally, the public key acquisition module 11 is specifically used to:

[0274] In a network failure state, establishing a communication connection with the data transfer terminal;

[0275] Sending an identity authentication request including an identity digest to the data transfer terminal based on the communication connection, so that the data transfer terminal obtains a first public key on the server based on the identity digest;

[0276] Receive the first public key sent by the data transfer terminal.

[0277] It should be noted that, when the data transfer device provided in the above embodiment executes the data transfer method, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data transfer device provided in the above embodiment and the data transfer method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0278] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0279] See also Fig.15, which shows a schematic diagram of the structure of a data transfer device provided by an exemplary embodiment of the present application. The data transfer device can be implemented as all or part of the device through software, hardware or a combination of both. The device 2 includes a public key acquisition module 21, an information receiving module 22 and a data transfer module 23.

[0280] A public key acquisition module 21, configured to acquire a first public key from the server, and send the first public key to a user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string, where the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on a first private key;

[0281] An information receiving module 22 is used to receive the first identity string and the first private key sent by the user terminal, so that the server authenticates the user terminal based on a first identity token, the first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key;

[0282] The data transfer module 23 is used to determine that the server has passed the identity authentication of the user terminal, receive a data transfer request from the user terminal, and send the data transfer request to the server so that the server performs data transfer.

[0283] Optionally, the public key acquisition module 21 is specifically used to:

[0284] An identity summary sent by the user terminal is received, and a first public key is obtained from the server based on the identity summary, where the identity summary is generated based on the original identity token.

[0285] Optionally, the public key acquisition module 21 is specifically used to:

[0286] When the user terminal is in a network failure state, establishing a communication connection with the user terminal;

[0287] An identity authentication request sent by the user terminal is received based on the communication connection, where the identity authentication request carries an identity digest.

[0288] Optionally, the information receiving module 22 is specifically used for:

[0289] receiving the first identity string and the first private key sent by the user terminal, generating a first identity token, and sending the first identity token to the server, so that the server authenticates the user terminal based on the first identity token; or,

[0290] Receive the first identity string and the first private key sent by the user terminal, and send the first identity string and the first private key to the server, so that the server generates the first identity token after receiving the first identity string and the first private key, and authenticates the user terminal based on the first identity token.

[0291] Optionally, the public key acquisition module 21 is specifically used to:

[0292] Obtaining a first public key and a second encrypted string from the server;

[0293] The receiving the first identity string and the first private key sent by the user terminal to generate a first identity token includes:

[0294] receiving the first identity string and the first private key sent by the user terminal, and using the first private key to decrypt the second encrypted string to generate a second identity string;

[0295] A first identity token is generated based on the first identity string and the second identity string.

[0296] Optionally, the data transfer module 23 is specifically used for:

[0297] Receiving a verification success message from the server, and determining that the server has passed the identity authentication of the user terminal;

[0298] The verification pass message is sent to the user terminal, and a data transfer request from the user terminal is received.

[0299] Optionally, the data transfer module 23 is specifically used for:

[0300] Sending the verification success message to the user terminal;

[0301] A data transfer request sent by the user terminal is received, and the data transfer request is sent to the server, so that the server performs data transfer.

[0302] Optionally, the data transfer module 23 is specifically used for:

[0303] The data transfer request and the first identity token are sent to the server, so that the server responds to the data transfer request and performs data transfer based on the first identity token.

[0304] It should be noted that, when the data transfer device provided in the above embodiment executes the data transfer method, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data transfer device provided in the above embodiment and the data transfer method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0305] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0306] See also Fig.16 , which shows a schematic diagram of the structure of a remote diagnosis device provided by an exemplary embodiment of the present application. The remote diagnosis device can be implemented as all or part of the device through software, hardware or a combination of both. The device 3 includes a public key sending module 31, an identity authentication module 32 and a data transfer module 33.

[0307] A public key sending module 31 is used to send a first public key to the data transfer terminal, so that the data transfer terminal sends the first public key to the user terminal, the user terminal stores a first encrypted string and a first private key, the first public key is used to decrypt the first encrypted string to generate a first identity string, the first encrypted string is generated by the first reference identity string of the original identity token of the user terminal based on the first private key;

[0308] an identity authentication module 32, configured to obtain a first identity token, and authenticate the user terminal based on the first identity token, wherein the first identity token is generated based on the first identity string and a second identity string, wherein the second identity string is generated by decrypting the first private key and a stored second encrypted string, and wherein the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0309] The data transfer module 33 is used to determine whether the identity authentication of the user terminal is passed, receive a data transfer request sent by the data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

[0310] Optionally, the public key sending module 31 is specifically used for:

[0311] receiving a first identity summary sent by the data transfer terminal, where the first identity summary is an identity summary stored on the user terminal;

[0312] A first public key and a second encrypted string are determined based on the first identity digest, and the first public key is sent to the data transfer terminal.

[0313] Optionally, the public key sending module 31 is specifically used for:

[0314] When the user terminal is in a network failure state, receiving a first identity digest sent by the data transfer terminal.

[0315] Optionally, the public key sending module 31 is specifically used to: send a first public key and a second encrypted string to the data transfer terminal, so that the data transfer terminal decrypts the second encrypted string based on the first private key to generate a second identity string;

[0316] The obtaining of the first identity token is specifically used for:

[0317] A first identity token sent by the data transfer terminal is received, where the identity token information is generated by the data transfer terminal based on the first identity string and the second identity string.

[0318] The identity verification module 32 is specifically used for:

[0319] receiving the first identity string and the first private key sent by the data transfer terminal, and decrypting the second encrypted string based on the first private key to generate a second identity string;

[0320] A first identity token is generated based on the first identity string and the second identity string.

[0321] Optionally, the device 3 is specifically used for:

[0322] When connecting to the user terminal for the first time, determine the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key based on the original identity token of the user terminal, and generate a first encrypted string encrypted by using the first private key to encrypt the first reference identity string and generate a second encrypted string encrypted by using the first public-private key to encrypt the second reference identity string;

[0323] The second encrypted string, the first public key, and the identity summary are saved.

[0324] Optionally, the device 3 is specifically used to: when the user terminal determines the first encrypted string, the second encrypted string, the identity summary, the first public key and the first private key based on the original identity token, receive the second encrypted string, the first public key and the identity summary sent by the user terminal, and the identity token information consists of the first identity string and the second identity string; save the second encrypted string, the first public key and the identity summary; or,

[0325] Receive the original identity token sent by the user terminal, split and encrypt the original identity token, determine the first data, the second encrypted string, the identity summary, the first public key and the first private key; save the second encrypted string, the first public key and the identity summary; and send the first data, the first private key and the identity summary to the user terminal.

[0326] Optionally, the identity authentication module 32 is specifically used for:

[0327] Calculating a reference identity digest corresponding to the first identity token;

[0328] Based on the reference identity digest and the identity digest, it is determined that the identity authentication of the user terminal is passed.

[0329] Optionally, the device 3 is specifically used for:

[0330] A verification pass message is sent to the data transfer terminal, so that the data transfer terminal sends the verification pass message to the user terminal.

[0331] Optionally, the device 3 is specifically used for:

[0332] receiving a data transfer request sent by the data transfer terminal, and performing data transfer in response to the data transfer request, wherein the data transfer request is generated when the user terminal receives the verification pass message; or,

[0333] Receive the data transfer request and the first identity token sent by the data transfer terminal, respond to the data transfer request, perform identity authentication based on the first identity token, and perform data transfer after the identity authentication is passed.

[0334] It should be noted that, when the data transfer device provided in the above embodiment executes the data transfer method, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data transfer device provided in the above embodiment and the data transfer method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0335] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0336] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1-11bThe data transfer method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 11 The specific description of the illustrated embodiment will not be repeated here.

[0337] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-11b The data transfer method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 11 The specific description of the illustrated embodiment will not be repeated here.

[0338] Please refer to Fig.17 , which shows a block diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. The electronic device in the present application may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0339] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the electronic device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0340] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems. The data storage area may also store data created by the electronic device during use, such as a phone book, audio and video data, chat record data, etc.

[0341] See also Fig.18 As shown, the memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, different application scenarios in the same third-party application also have different requirements for system resources. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0342] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0343] Taking the Android operating system as an example, the programs and data stored in the memory 120 are as follows: Fig.19As shown, the memory 120 may store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360 and an application layer 380, wherein the Linux kernel layer 320, the system runtime library layer 340 and the application framework layer 360 belong to the operating system space, and the application layer 380 belongs to the user space. The Linux kernel layer 320 provides underlying drivers for various hardware of electronic devices, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, etc. The system runtime library layer 340 provides the main feature support for the Android system through some C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D drawing support, and the Webkit library provides browser kernel support, etc. The Android runtime library (Android runtime) is also provided in the system runtime library layer 340, which mainly provides some core libraries that allow developers to use the Java language to write Android applications. The application framework layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application runs in the application layer 380. These applications can be native applications that come with the operating system, such as contact applications, text messaging applications, clock applications, camera applications, etc.; they can also be third-party applications developed by third-party developers, such as game applications, instant messaging applications, photo beautification applications, data transfer applications, etc.

[0344] Taking the operating system as an IOS system as an example, the programs and data stored in the memory 120 are as follows: Fig. 20As shown, the IOS system includes: a core operating system layer 420 (Core OS layer), a core service layer 440 (Core Services layer), a media layer 460 (Media layer), and a touchable layer 480 (Cocoa Touch Layer). The core operating system layer 420 includes the operating system kernel, drivers, and underlying program frameworks, which provide functions closer to the hardware for use by the program framework located in the core service layer 440. The core service layer 440 provides system services and / or program frameworks required by the application, such as the foundation framework, account framework, advertising framework, data storage framework, network connection framework, geographic location framework, motion framework, etc. The media layer 460 provides audio-visual interfaces for the application, such as graphics and image related interfaces, audio technology related interfaces, video technology related interfaces, and wireless playback (AirPlay) interfaces for audio and video transmission technologies. The touchable layer 480 provides various commonly used interface-related frameworks for application development, and the touchable layer 480 is responsible for the user's touch interaction operations on the electronic device. For example, local notification service, remote push service, advertising framework, game tool framework, message user interface (UI) framework, user interface UIKit framework, map framework, etc.

[0345] exist Fig. 20 Among the frameworks shown, the frameworks related to most applications include but are not limited to: the basic framework in the core service layer 440 and the UIKit framework in the touchable layer 480. The basic framework provides many basic object classes and data types, provides the most basic system services for all applications, and has nothing to do with UI. The classes provided by the UIKit framework are basic UI class libraries for creating touch-based user interfaces. iOS applications can provide UIs based on the UIKit framework, so it provides the basic architecture of applications for building user interfaces, drawing, processing and user interaction events, responding to gestures, etc.

[0346] Among them, the method and principle of implementing data communication between third-party applications and the operating system in the IOS system can be referred to the Android system, and this application will not go into details here.

[0347] Among them, the input device 130 is used to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone or a touch device. The output device 140 is used to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays, which are used to receive touch operations on or near the user using any suitable object such as a finger or a touch pen, and to display the user interface of each application. The touch screen display is usually set on the front panel of the electronic device. The touch screen display can be designed as a full screen, a curved screen or a special-shaped screen. The touch screen display can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of the present application.

[0348] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0349] In the embodiment of the present application, the execution subject of each step may be the electronic device described above. Optionally, the execution subject of each step is the operating system of the electronic device. The operating system may be an Android system, an IOS system, or other operating systems, which is not limited in the embodiment of the present application.

[0350] The electronic device of the embodiment of the present application may also be equipped with a display device, which may be any device capable of realizing a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), etc. The user may use the display device on the electronic device 101 to view displayed text, images, videos and other information. The electronic device may be a smart phone, a tablet computer, a gaming device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook, a desktop computing device, a wearable device such as an electronic watch, an electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, electronic clothing and other devices.

[0351] exist Fig.17 In the electronic device shown, which may be a user terminal, the processor 110 may be used to call the data transfer application stored in the memory 120 and specifically perform the following operations:

[0352] Receive a first public key sent by the data transfer terminal, and decrypt the first encrypted string stored in the user terminal based on the first public key to obtain a first identity string; wherein the first public key is obtained by the data transfer terminal from the server, the first encrypted string is generated by encrypting the first reference identity string of the original identity token based on the first private key stored in the user terminal, and the first private key corresponds to the first public key one by one;

[0353] Sending the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on a first identity token, wherein the first identity token is composed of the first identity string and a second identity string, the second identity string is obtained by decrypting a second encrypted string stored in the server based on the first private key, and the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0354] Determine that the identity authentication is passed, and send a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer.

[0355] In one embodiment, when executing the receiving of the first public key sent by the data transfer terminal, the processor 110 specifically performs the following steps:

[0356] The stored identity summary is sent to the data transfer terminal, and a first public key sent by the data transfer terminal is received, wherein the identity summary is generated based on the original identity token.

[0357] In one embodiment, the processor 110, after executing the sending of the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal, further executes the following steps:

[0358] When connecting to a server for the first time, the user terminal and the server determine the original identity token of the user terminal;

[0359] The first encrypted string, the second encrypted string, the identity summary, the first public key, and the first private key are determined based on the original identity token, and the first encrypted string, the first private key, and the identity summary are saved.

[0360] In one embodiment, when executing the sending of the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal, the processor 110 specifically performs the following steps:

[0361] Sending the stored identity summary to the server via the data transfer terminal so that the server determines the second encrypted string and the first public key corresponding to the identity summary; after the data transfer terminal receives the second encrypted string and the first public key sent by the server, the user terminal receives the first public key sent by the data transfer terminal; or,

[0362] The stored identity summary is sent to the server via the data transfer terminal so that the server determines the second encrypted string and the first public key corresponding to the identity summary; after the data transfer terminal receives the first public key sent by the server, the user terminal receives the first public key sent by the data transfer terminal.

[0363] In one embodiment, when the processor 110 executes the sending of the first private key and the first identity string to the data transfer terminal so that the data transfer terminal instructs the server to authenticate the user terminal based on the first identity token, the processor 110 specifically performs the following steps:

[0364] Sending the stored first private key and the first identity string to the data transfer terminal, so that the data transfer terminal uses the first private key to decrypt the second encrypted string to generate a second identity string, and after generating a first identity token based on the second identity string and the first identity string, sends the first identity token to the server to authenticate the user terminal; or,

[0365] The stored first private key and the first identity string are forwarded to the server via the data transfer terminal, so that the server uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates the first identity token based on the first identity string and the second identity string, and authenticates the user terminal.

[0366] In one embodiment, when executing the sending of the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal, the processor 110 further performs the following steps:

[0367] In a network failure state, establishing a communication connection with the data transfer terminal;

[0368] Sending an identity authentication request including an identity digest to the data transfer terminal based on the communication connection, so that the data transfer terminal obtains a first public key on the server based on the identity digest;

[0369] Receive the first public key sent by the data transfer terminal.

[0370] See also Fig.21 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.21As shown, the electronic device 1000 may include: at least one processor 1001, at least one network interface 1004, a user interface 1003, a memory 1005, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. Among them, the user interface 1003 may include a display screen (Display), a camera (Camera), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Among them, the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). Among them, the processor 1001 may include one or more processing cores. The processor 1001 uses various interfaces and lines to connect the various parts of the entire server 1000, and executes various functions and processes data of the server 1000 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1005, and calling data stored in the memory 1005. Optionally, the processor 1001 can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 1001 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 1001, but may be implemented separately through a chip.

[0371] Among them, the memory 1005 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1005 may optionally be at least one storage device located away from the aforementioned processor 1001. As Fig.21 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a data transfer application.

[0372] exist Fig.21 In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 1001 can be used to call the data transfer application stored in the memory 1005 and specifically perform the following operations:

[0373] Obtaining a first public key from the server, and sending the first public key to the user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string, where the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on a first private key;

[0374] receiving the first identity string and the first private key sent by the user terminal, so that the server authenticates the user terminal based on a first identity token, wherein the first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key;

[0375] Determine that the server has authenticated the identity of the user terminal, receive a data transfer request from the user terminal, and send the data transfer request to the server so that the server performs data transfer.

[0376] In one embodiment, when the processor 1001 executes the step of obtaining the first public key from the server, the processor 1001 specifically performs the following steps:

[0377] An identity summary sent by the user terminal is received, and a first public key is obtained from the server based on the identity summary, where the identity summary is generated based on the original identity token.

[0378] In one embodiment, when the processor 1001 executes the receiving of the identity summary sent by the user terminal, the processor 1001 specifically performs the following steps:

[0379] When the user terminal is in a network failure state, establishing a communication connection with the user terminal;

[0380] An identity authentication request sent by the user terminal is received, where the identity authentication request carries an identity digest.

[0381] In one embodiment, when the processor 1001 executes the receiving of the identity summary sent by the user terminal, the processor 1001 specifically performs the following steps:

[0382] When the user terminal is in a network failure state, establishing a communication connection with the user terminal;

[0383] An identity authentication request sent by the user terminal is received based on the communication connection, where the identity authentication request carries an identity digest.

[0384] In one embodiment, when the processor 1001 executes the receiving of the first identity string and the first private key sent by the user terminal so that the server authenticates the user terminal based on the first identity token, the processor 1001 specifically performs the following steps:

[0385] receiving the first identity string and the first private key sent by the user terminal, generating a first identity token, and sending the first identity token to the server, so that the server authenticates the user terminal based on the first identity token; or,

[0386] Receive the first identity string and the first private key sent by the user terminal, and send the first identity string and the first private key to the server, so that the server generates the first identity token after receiving the first identity string and the first private key, and authenticates the user terminal based on the first identity token.

[0387] In one embodiment, when the processor 1001 executes the step of obtaining the first public key from the server, the processor 1001 specifically performs the following steps:

[0388] Obtaining a first public key and a second encrypted string from the server;

[0389] The receiving the first identity string and the first private key sent by the user terminal to generate a first identity token includes:

[0390] receiving the first identity string and the first private key sent by the user terminal, and using the first private key to decrypt the second encrypted string to generate a second identity string;

[0391] A first identity token is generated based on the first identity string and the second identity string.

[0392] In one embodiment, when the processor 1001 performs the steps of determining that the server passes the identity authentication of the user terminal and receiving the data transfer request of the user terminal, the processor 1001 specifically performs the following steps:

[0393] Receiving a verification success message from the server, and determining that the server has passed the identity authentication of the user terminal;

[0394] The verification pass message is sent to the user terminal, and a data transfer request from the user terminal is received.

[0395] In one embodiment, when the processor 1001 executes the step of sending the data transfer request to the server so that the server performs data transfer, the processor 1001 specifically performs the following steps: sending the data transfer request and the first identity token to the server so that the server responds to the data transfer request and performs data transfer based on the first identity token.

[0396] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string that synthesizes the first identity token is not visible to the outside and can only be decrypted on the local end based on the public key on the server. The data transfer process has high security, and the electronic devices involved in the entire data transfer process can be It is independent of identity tokens, which greatly improves the security of data transfer; and, in data transfer, it does not rely on the corresponding generation of data transfer codes by user terminals, which reduces the cost of data transfer. Each electronic device involved in data transfer can finally complete the entire data transfer process based on the flow of corresponding data, thereby improving the universality of data transfer; and in the scenario of user terminal network failure (user terminal and server have no network service), the entire data transfer process can be successfully completed through communication connection with the data transfer terminal, thereby improving the disaster recovery of the data transfer process, realizing network-free data transfer, and expanding the data transfer scenario; and, even if the communication link between the electronic devices is unreliable, the encryption and decryption means involved in the data transfer method of the present application can also ensure the security of data transfer.

[0397] See also Fig. 22 , provides a structural diagram of another electronic device for the embodiment of the present application. Fig. 22As shown, the electronic device 2000 may include: at least one processor 2001, at least one network interface 2004, a user interface 2003, a memory 2005, and at least one communication bus 2002. Wherein, the communication bus 2002 is used to realize the connection and communication between these components. Wherein, the user interface 2003 may include a display screen (Display), and the optional user interface 2003 may also include a standard wired interface and a wireless interface. Wherein, the network interface 2004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). Wherein, the processor 2001 may include one or more processing cores. The processor 2001 uses various interfaces and lines to connect various parts within the entire server 2000, and executes various functions and processes data of the server 2000 by running or executing instructions, programs, code sets or instruction sets stored in the memory 2005, and calling data stored in the memory 2005. Optionally, the processor 2001 can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 2001 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 2001, but may be implemented separately through a chip.

[0398] Among them, the memory 2005 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 2005 includes a non-transitory computer-readable storage medium. The memory 2005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 2005 may optionally be at least one storage device located away from the aforementioned processor 2001. As Fig. 22 As shown, the memory 2005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a data transfer application.

[0399] exist Fig. 22 In the electronic device 2000 shown, the user interface 2003 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 2001 can be used to call the data transfer application stored in the memory 2005 and specifically perform the following operations:

[0400] Sending a first public key to a data transfer terminal, so that the data transfer terminal sends the first public key to a user terminal, the user terminal stores a first encrypted string and a first private key, the first public key is used to decrypt the first encrypted string to generate a first identity string, the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on the first private key;

[0401] Obtain a first identity token, and authenticate the user terminal based on the first identity token, wherein the first identity token is generated based on the first identity string and a second identity string, wherein the second identity string is generated by decrypting the first private key and a stored second encrypted string, and wherein the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key;

[0402] Determine that the identity authentication of the user terminal is passed, receive a data transfer request sent by a data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

[0403] In one embodiment, when executing the sending of the first public key to the data transfer terminal, the processor 2001 specifically performs the following operations: receiving a first identity digest sent by the data transfer terminal, where the first identity digest is an identity digest stored on the user terminal;

[0404] A first public key and a second encrypted string are determined based on the first identity digest, and the first public key is sent to the data transfer terminal.

[0405] In one embodiment, when the processor 2001 executes the receiving of the first identity digest sent by the data transfer terminal, the processor 2001 specifically performs the following operations:

[0406] When the user terminal is in a network failure state, receiving a first identity digest sent by the data transfer terminal.

[0407] In one embodiment, when executing the sending of the first public key to the data transfer terminal, the processor 2001 specifically performs the following operations:

[0408] Sending the first public key and the second encrypted string to the data transfer terminal, so that the data transfer terminal decrypts the second encrypted string based on the first private key to generate a second identity string;

[0409] The obtaining of the first identity token comprises:

[0410] A first identity token sent by the data transfer terminal is received, where the identity token information is generated by the data transfer terminal based on the first identity string and the second identity string.

[0411] In one embodiment, the processor 2001, when executing the step of obtaining the first identity token, includes:

[0412] receiving the first identity string and the first private key sent by the data transfer terminal, and decrypting the second encrypted string based on the first private key to generate a second identity string;

[0413] A first identity token is generated based on the first identity string and the second identity string.

[0414] In one embodiment, before executing the sending of the first public key to the data transfer terminal, the processor 2001 further includes:

[0415] When connecting to the user terminal for the first time, determine the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key based on the original identity token of the user terminal, and generate a first encrypted string encrypted by using the first private key to encrypt the first reference identity string and generate a second encrypted string encrypted by using the first public-private key to encrypt the second reference identity string;

[0416] The second encrypted string, the first public key, and the identity summary are saved.

[0417] In one embodiment, the processor 2001 determines the first reference identity string and the second reference identity string, the identity summary, the first public key and the first private key based on the original identity token of the user terminal, generates a first encrypted string encrypted by the first private key for the first reference identity string and generates a second encrypted string encrypted by the first public-private key for the second reference identity string; and saves the second encrypted string, the first public key and the identity summary, including:

[0418] When the user terminal determines the first encrypted string, the second encrypted string, the identity summary, the first public key, and the first private key based on the original identity token, receiving the second encrypted string, the first public key, and the identity summary sent by the user terminal, the identity token information consisting of the first identity string and the second identity string; saving the second encrypted string, the first public key, and the identity summary;

[0419] Receive the original identity token sent by the user terminal, split and encrypt the original identity token, determine the first data, the second encrypted string, the identity summary, the first public key and the first private key; save the second encrypted string, the first public key and the identity summary; and send the first data, the first private key and the identity summary to the user terminal.

[0420] In one embodiment, when the processor 2001 executes the authentication of the user terminal based on the first identity token, the processor 2001 specifically performs the following operations: calculating the reference identity digest corresponding to the first identity token; determining that the identity authentication of the user terminal is successful based on the reference identity digest and the identity digest; or matching the first identity token with the stored original identity token to determine that the identity authentication of the user terminal is successful.

[0421] In one embodiment, after executing the determination that the identity authentication of the user terminal is passed, the processor 2001 further includes:

[0422] A verification pass message is sent to the data transfer terminal, so that the data transfer terminal sends the verification pass message to the user terminal.

[0423] In one embodiment, the processor 2001, when performing the data transfer after the verification is passed, further includes:

[0424] receiving a data transfer request sent by the data transfer terminal, and performing data transfer in response to the data transfer request, wherein the data transfer request is generated when the user terminal receives the verification pass message; or,

[0425] Receive the data transfer request and the first identity token sent by the data transfer terminal, respond to the data transfer request, perform identity authentication based on the first identity token, and perform data transfer after the identity authentication is passed.

[0426] In an embodiment of the present application, the original identity token corresponding to the user terminal is pre-split and encrypted and stored in the user terminal and the server. When transferring data, the first identity token requires a matching encryption string and key (such as the first encryption string requires the first public key on the server to decrypt to generate the first identity string, and the second encryption string requires the first private key on the user terminal to generate the second identity string) to finally generate the first identity token, and the server can complete the identity verification of the user terminal based on the first identity token; the entire data transfer process has high security, and the first encryption string that synthesizes the first identity token is not visible to the outside and can only be decrypted on the local end based on the public key on the server. The data transfer process has high security, and the electronic devices involved in the entire data transfer process can be It is independent of identity tokens, which greatly improves the security of data transfer; and, in data transfer, it does not rely on the corresponding generation of data transfer codes by user terminals, which reduces the cost of data transfer. Each electronic device involved in data transfer can finally complete the entire data transfer process based on the flow of corresponding data, thereby improving the universality of data transfer; and in the scenario of user terminal network failure (user terminal and server have no network service), the entire data transfer process can be successfully completed through communication connection with the data transfer terminal, thereby improving the disaster recovery of the data transfer process, realizing network-free data transfer, and expanding the data transfer scenario; and, even if the communication link between the electronic devices is unreliable, the encryption and decryption means involved in the data transfer method of the present application can also ensure the security of data transfer.

[0427] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A data transfer method, characterized in that: Applied to a user terminal, the method comprises: Receive a first public key sent by the data transfer terminal, and decrypt the first encrypted string stored in the user terminal based on the first public key to obtain a first identity string; wherein the first public key is obtained by the data transfer terminal from the server, the first encrypted string is generated by encrypting the first reference identity string of the original identity token based on the first private key stored in the user terminal, and the first private key corresponds to the first public key one by one; Sending the first private key and the first identity string to the data transfer terminal, so that the data transfer terminal instructs the server to authenticate the user terminal based on a first identity token, wherein the first identity token is composed of the first identity string and a second identity string, the second identity string is obtained by decrypting a second encrypted string stored in the server based on the first private key, and the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key; Determining that the identity authentication is passed, sending a data transfer request to the data transfer terminal, so that the data transfer terminal sends the data transfer request to the server for data transfer; The receiving the first public key sent by the data transfer terminal includes: The stored identity summary is sent to the data transfer terminal, and a first public key sent by the data transfer terminal is received, wherein the identity summary is generated based on the original identity token.

2. The method according to claim 1, characterized in that The method further includes sending the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal: When connecting to a server for the first time, the user terminal and the server determine the original identity token of the user terminal; The first encrypted string, the second encrypted string, the identity summary, the first public key, and the first private key are determined based on the original identity token, and the first encrypted string, the first private key, and the identity summary are saved.

3. The method according to claim 1, characterized in that The step of sending the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal includes: Sending the stored identity summary to the server via the data transfer terminal so that the server determines the second encrypted string and the first public key corresponding to the identity summary; after the data transfer terminal receives the second encrypted string and the first public key sent by the server, the user terminal receives the first public key sent by the data transfer terminal; or, The stored identity summary is sent to the server via the data transfer terminal so that the server determines the second encrypted string and the first public key corresponding to the identity summary; after the data transfer terminal receives the first public key sent by the server, the user terminal receives the first public key sent by the data transfer terminal.

4. The method according to claim 1, characterized in that The sending the first private key and the first identity string to the data transfer terminal so that the data transfer terminal instructs the server to authenticate the user terminal based on the first identity token includes: Sending the stored first private key and the first identity string to the data transfer terminal, so that the data transfer terminal uses the first private key to decrypt the second encrypted string to generate a second identity string, and after generating a first identity token based on the second identity string and the first identity string, sends the first identity token to the server to authenticate the user terminal; or, The stored first private key and the first identity string are forwarded to the server via the data transfer terminal, so that the server uses the first private key to decrypt the second encrypted string to generate a second identity string, and generates the first identity token based on the first identity string and the second identity string, and authenticates the user terminal.

5. The method according to claim 1, characterized in that The step of sending the stored identity summary to the data transfer terminal and receiving the first public key sent by the data transfer terminal comprises: In a network failure state, establishing a communication connection with the data transfer terminal; Sending an identity authentication request including an identity digest to the data transfer terminal based on the communication connection, so that the data transfer terminal obtains a first public key on the server based on the identity digest; Receive the first public key sent by the data transfer terminal.

6. A data transfer method, characterized in that: Applied to a data transfer terminal, the method comprises: Obtain a first public key from a server, and send the first public key to a user terminal, so that the user terminal decrypts and generates a first identity string based on the first public key and a stored first encrypted string, where the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on a first private key; receiving the first identity string and the first private key sent by the user terminal, so that the server authenticates the user terminal based on a first identity token, wherein the first identity token is generated by the first identity string and the second identity string, the second identity string is generated by decrypting the first private key and the second encrypted string, and the second encrypted string is generated by the second reference identity string of the original identity token based on the first public key; Determining that the server has authenticated the identity of the user terminal, receiving a data transfer request from the user terminal, and sending the data transfer request to the server so that the server performs data transfer; The obtaining the first public key from the server includes: An identity summary sent by a user terminal is received, and a first public key is obtained from a server based on the identity summary, where the identity summary is generated based on the original identity token.

7. The method according to claim 6, characterized in that The receiving the identity summary sent by the user terminal includes: When the user terminal is in a network failure state, establishing a communication connection with the user terminal; An identity authentication request sent by the user terminal is received based on the communication connection, where the identity authentication request carries an identity digest.

8. The method according to claim 6, characterized in that The receiving the first identity string and the first private key sent by the user terminal so that the server authenticates the user terminal based on the first identity token includes: receiving the first identity string and the first private key sent by the user terminal, generating a first identity token, and sending the first identity token to the server, so that the server authenticates the user terminal based on the first identity token; or, Receive the first identity string and the first private key sent by the user terminal, and send the first identity string and the first private key to the server, so that the server generates the first identity token after receiving the first identity string and the first private key, and authenticates the user terminal based on the first identity token.

9. The method according to claim 8, characterized in that The obtaining the first public key from the server includes: Obtaining the first public key and the second encrypted string from the server; The receiving the first identity string and the first private key sent by the user terminal to generate a first identity token includes: receiving the first identity string and the first private key sent by the user terminal, and using the first private key to decrypt the second encrypted string to generate a second identity string; A first identity token is generated based on the first identity string and the second identity string.

10. The method according to claim 6, characterized in that The step of determining that the server has passed the identity authentication of the user terminal and receiving the data transfer request of the user terminal includes: Receiving a verification success message from the server, and determining that the server has passed the identity authentication of the user terminal; The verification pass message is sent to the user terminal, and a data transfer request from the user terminal is received.

11. The method according to claim 6, characterized in that The step of sending the data transfer request to the server so that the server performs data transfer includes: The data transfer request and the first identity token are sent to the server, so that the server responds to the data transfer request and performs data transfer based on the first identity token.

12. A data transfer method, characterized in that: Applied to a server, the method comprises: receiving an identity summary sent by a data transfer terminal, wherein the identity summary is sent by a user terminal to the data transfer terminal and is used to obtain a first public key from the server; Sending a first public key corresponding to the identity summary to a data transfer terminal, so that the data transfer terminal sends the first public key to a user terminal, the user terminal stores a first encrypted string and a first private key, the first public key is used to decrypt the first encrypted string to generate a first identity string, the first encrypted string is generated by a first reference identity string of an original identity token of the user terminal based on the first private key; Obtain a first identity token, and authenticate the user terminal based on the first identity token, wherein the first identity token is generated based on the first identity string and a second identity string, wherein the second identity string is generated by decrypting the first private key and a stored second encrypted string, and wherein the second encrypted string is generated by a second reference identity string of the original identity token based on the first public key; Determine that the identity authentication of the user terminal is passed, receive a data transfer request sent by a data transfer terminal, and perform data transfer based on the data transfer request, wherein the data transfer request is sent by the user terminal to the data transfer terminal.

13. The method according to claim 12, characterized in that The authenticating the user terminal based on the first identity token includes: Calculating a reference identity digest corresponding to the first identity token; determining that the identity authentication of the user terminal is passed based on the reference identity digest and the identity digest; or, The first identity token is matched with the stored original identity token to determine whether the identity authentication of the user terminal is passed.

14. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps as claimed in any one of claims 1 to 5 or 6 to 11 or 12 to 13.

15. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 5 or 6 to 11 or 12 to 13.

Images