A data protection method and device

Abstract

The present invention provides a data protection method and device, relating to the field of network security technology. The method includes: determining the time period to which the current time belongs; calling a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encrypted file; wherein, the preset encrypted file includes multiple sets of encryption algorithms that are effective in different time periods; obtaining verification parameters based on the target encryption algorithms and request parameters; sending the request carrying the verification parameters to the server, so that after receiving the request, the server verifies the request based on the verification parameters. The solution of the present invention uses verification data to verify the request in real time, realizes active defense, can timely detect abnormal situations, effectively avoid loss of interests, and the multiple sets of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a data protection method and device. Background Art

[0002] A web crawler is a program or script that automatically grabs information on the World Wide Web according to certain rules. Some other less commonly used names include ants, automatic indexing, simulators, or worms, etc. In the early days of the development of the Internet, web crawlers could enable websites to be included in search engines or navigation websites, which not only helped website promotion but also helped users find the information they wanted faster, being very beneficial to both websites and users. However, with the continuous development of network technology, there are constantly black production users who use crawler technology for illegal theft. All parties involved in black production will use crawler technology to steal precious data of website owners, such as real estate data of real estate sales websites, etc., seriously damaging the legitimate rights and interests of websites.

[0003] For a long time, the means adopted in anti-crawler technology has been passive defense, treating the problem only after a crawler is discovered. For example, after discovering an abnormal IP, it is added to the blacklist for anti-crawling. This passive defense method has hysteresis, will cause certain losses of interests, and has a poor anti-crawling effect. Summary of the Invention

[0004] Embodiments of the present invention provide a data protection method and device to solve the technical problems that the existing anti-crawling methods have hysteresis and poor anti-crawling effects.

[0005] To solve the above technical problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a data protection method applied to a terminal. The method includes:

[0007] Determine the time period to which the current time belongs;

[0008] Call a set of target encryption algorithms that are effective for the time period to which the current time belongs from a preset encryption file; wherein, the preset encryption file includes multiple sets of encryption algorithms that are effective in different time periods;

[0009] Obtain a verification parameter based on the target encryption algorithm and the request parameter;

[0010] Send the request carrying the verification parameter to the server, so that after receiving the request, the server verifies the request based on the verification parameter.

[0011] Optionally, each set of encryption algorithms includes multiple encryption algorithms;

[0012] The steps of obtaining verification parameters based on the target encryption algorithm and request parameters include:

[0013] Based on multiple encryption algorithms included in the target encryption algorithm and the request parameters, generate multiple first encryption parameters as the verification parameters.

[0014] Optionally, the steps of generating multiple first encryption parameters as the verification parameters based on multiple encryption algorithms included in the target encryption algorithm and the request parameters include:

[0015] Based on multiple encryption algorithms in the target encryption algorithm, current time information, and the request parameters, and one or more of the terminal system identifier and the terminal user identifier, generate a first encryption input parameter and a first signature as the verification parameters.

[0016] Optionally, the steps of generating a first encryption input parameter and a first signature based on multiple encryption algorithms in the target encryption algorithm, current time information, and the request parameters, and one or more of the terminal system identifier and the terminal user identifier include:

[0017] Based on the first encryption algorithm in the target encryption algorithm and the current time information, generate a first secret key;

[0018] Based on the second encryption algorithm in the target encryption algorithm, the first secret key, and the request parameters, and one or more of the current time information, the terminal system identifier, and the terminal user identifier, generate a first encryption input parameter;

[0019] Based on the third encryption algorithm in the target encryption algorithm, the first secret key, and the first encryption input parameter, generate a first signature.

[0020] Optionally, the steps of obtaining verification parameters based on the target encryption algorithm and request parameters further include:

[0021] Use the terminal system identifier as the verification parameter, where the terminal system identifier is valid when it is used for the first time in the request and invalid when it is used non-first time.

[0022] Optionally, before sending the request carrying the verification parameter to the server, the method further includes:

[0023] Encrypt one or more parameters in the request parameters using a preset private key and set the valid time for the encrypted request parameters.

[0024] Optionally, before calling a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encrypted file, the method further includes:

[0025] Send an inquiry request to the server asking whether there is an update to the encryption algorithm in the preset encrypted file;

[0026] When receiving the message from the server that there is an update to the encryption algorithm in the preset encryption algorithm, perform an update process on the encryption algorithm in the preset encrypted file stored locally.

[0027] Optionally, before determining the current time period, the method further includes:

[0028] Send a time synchronization request to the server;

[0029] Receive the system time returned by the server;

[0030] Based on the system time returned by the server, perform a synchronization process on the system time of the terminal.

[0031] Optionally, the preset encrypted file is a binary file.

[0032] In a second aspect, an embodiment of the present invention further provides a data protection device, which is applied to a terminal. The device includes:

[0033] A first determination module, configured to determine the time period to which the current time belongs;

[0034] A first call module, configured to call a set of target encryption algorithms that are in effect during the time period to which the current time belongs from a preset encrypted file; wherein, the preset encrypted file includes multiple sets of encryption algorithms that are in effect during different time periods;

[0035] A first acquisition module, configured to acquire verification parameters based on the target encryption algorithm and request parameters;

[0036] A first sending module, configured to send a request carrying the verification parameters to the server, so that after receiving the request, the server verifies the request based on the verification parameters.

[0037] In a third aspect, an embodiment of the present invention further provides a data protection method, which is applied to a server. The method includes:

[0038] Obtain a request carrying verification parameters sent by a terminal; the verification parameters are verification parameters obtained by the terminal after determining the time period to which the current time belongs and calling a set of target encryption algorithms that are in effect during the time period to which the current time belongs from a preset encrypted file; wherein the preset encrypted file includes multiple sets of encryption algorithms that are in effect during different time periods;

[0039] Call the target encryption algorithm from the preset encrypted file;

[0040] Verify the request based on the target encryption algorithm and the verification parameters.

[0041] Optionally, the verification parameters include multiple first encryption parameters, and each set of encryption algorithms includes multiple encryption algorithms.

[0042] The steps of verifying the request based on the target encryption algorithm and the verification parameters include:

[0043] Generate multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters.

[0044] Compare the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively.

[0045] When any second encryption parameter is different from the corresponding first encryption parameter, determine that the request verification fails.

[0046] Optionally, the multiple first encryption parameters include a first encryption input parameter and a first signature.

[0047] The steps of generating multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters include:

[0048] Generate a second encryption input parameter and a second signature based on the multiple encryption algorithms in the target encryption algorithm, the current time information, the request parameters, and one or more of the terminal system identifier and the terminal user identifier.

[0049] The steps of comparing the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively include:

[0050] Compare the second encryption input parameter with the first encryption input parameter, and compare the second signature with the first signature.

[0051] When the second encryption input parameter is different from the first encryption input parameter, or the second signature is different from the first signature, determine that the request verification fails.

[0052] Optionally, the verification parameters further include a terminal system identifier.

[0053] The steps of verifying the request based on the target encryption algorithm and the verification parameters include:

[0054] Verify whether the terminal system identifier is used for the first time based on the terminal system identifier.

[0055] When the terminal system identifier is not used for the first time, determine that the request verification fails.

[0056] Optionally, the request further carries request parameters encrypted by a preset private key;

[0057] After verifying the request based on the target encryption algorithm and the verification parameter, the method further includes:

[0058] Decrypt the encrypted request parameters with the public key corresponding to the preset private key;

[0059] Verify whether the encrypted request parameters are valid at the current time based on the valid time corresponding to the encrypted request parameters.

[0060] Optionally, the method further includes:

[0061] Monitor whether the encryption algorithm in the preset encryption file is cracked. When the encryption algorithm in the preset encryption file is cracked, update the encryption algorithm in the preset encryption file; or

[0062] Regularly update the encryption algorithm in the preset encryption file at preset time intervals; or

[0063] Update the encryption algorithm in the preset encryption file irregularly.

[0064] Optionally, when the encryption algorithm in the preset encryption file is cracked, the step of updating the encryption algorithm in the preset encryption file includes:

[0065] When any encryption algorithm in the preset encryption file is cracked, update the cracked encryption algorithm; or

[0066] When all encryption algorithms in the preset encryption file are cracked, update all encryption algorithms in the preset encryption file.

[0067] Optionally, when the encryption algorithm in the preset encryption file is cracked, the method further includes:

[0068] Before updating the cracked encryption algorithm, modify the effective time of the uncracked encryption algorithm to the original effective time period of the uncracked encryption algorithm plus the original effective time period of the cracked encryption algorithm.

[0069] Optionally, before obtaining the request carrying the verification parameter sent by the terminal, the method further includes:

[0070] Receive the time synchronization request sent by the terminal;

[0071] Send the system time of the server to the terminal, so that the terminal synchronizes the system time of the terminal based on the system time of the server.

[0072] Fourthly, an embodiment of the present invention further provides a data protection device, which is applied to a server. The device includes:

[0073] A second acquisition module, configured to acquire a request carrying a verification parameter sent by a terminal; the verification parameter is a verification parameter acquired by the terminal based on a set of target encryption algorithms that are effective in the time period to which the current time belongs after determining the time period to which the current time belongs and calling a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encryption file; wherein the preset encryption file includes multiple sets of encryption algorithms that are effective in different time periods;

[0074] A second call module, configured to call the target encryption algorithm from the preset encryption file;

[0075] A first verification module, configured to verify the request based on the target encryption algorithm and the verification parameter.

[0076] In the embodiment of the present invention, before the terminal sends a request, it first determines the time period to which the current time belongs, and then calls a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encryption file. The preset encryption file includes multiple sets of encryption algorithms that are effective in different time periods, so as to increase the difficulty of cracking through the automatic switching of multiple sets of encryption algorithms; then, based on the target encryption algorithm and the request parameters, a verification parameter is acquired; and then the request carrying the verification parameter is sent to the server. After receiving the request, the server verifies the request in real time based on the verification parameter. In this way, the request is verified in real time by using the verification data, active defense is realized, abnormal situations can be detected in time, loss of interests can be effectively avoided, and multiple sets of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0077] The above description is only an overview of the technical solution of the present invention. In order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description. And in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable, the following specifically describes the embodiments of the present invention. Description of the Drawings

[0078] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0079] Figure 1 It is a flowchart of the steps of a data protection method on the terminal side in an embodiment of the present invention;

[0080] Figure 2 It is a specific flowchart of the steps of a data protection method on the terminal side in an embodiment of the present invention;

[0081] Figure 3 It is another specific flowchart of the steps of a data protection method on the terminal side in an embodiment of the present invention;

[0082] Figure 4 It is yet another specific flowchart of the steps of a data protection method on the terminal side in an embodiment of the present invention;

[0083] Figure 5 It is yet another specific flowchart of the steps of a data protection method on the terminal side in an embodiment of the present invention;

[0084] Figure 6 It is a schematic structural diagram of a data protection device on the terminal side in an embodiment of the present invention;

[0085] Figure 7 It is a schematic hardware structure diagram of a terminal device in an embodiment of the present invention;

[0086] Figure 8 It is a flowchart of the steps of a data protection method on the server side in an embodiment of the present invention;

[0087] Figure 9 It is a schematic structural diagram of a data protection device on the server side in an embodiment of the present invention;

[0088] Figure 10 It is a schematic hardware structure diagram of a server in an embodiment of the present invention. Detailed implementation manners

[0089] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0090] Embodiment 1

[0091] A data protection method applied to the terminal side provided by the embodiment of the present invention is introduced in detail.

[0092] Refer to Figure 1 , which shows a flowchart of the steps of a data protection method in an embodiment of the present invention. This method is applied to the terminal and includes:

[0093] Step 11: Determine the time period to which the current time belongs.

[0094] In the embodiment of the present invention, multiple groups of encryption algorithms that take effect in different time periods are pre-stored in the encrypted file. Before sending a request, the terminal first determines the time period to which the current time belongs to determine the encryption algorithm that takes effect.

[0095] Step 12: Call a group of target encryption algorithms that take effect in the time period to which the current time belongs from the preset encrypted file; wherein, the preset encrypted file includes multiple groups of encryption algorithms that take effect in different time periods.

[0096] Here, after determining the time period to which the current time belongs, a group of target encryption algorithms that take effect in the time period to which the current time belongs are called from the preset encrypted file to use the target encryption algorithm to determine the verification parameter for verifying the request and prevent crawlers.

[0097] Among them, since the preset encrypted file includes multiple groups of encryption algorithms, each group of encryption algorithms is completely different, and each group of encryption algorithms will be used in different time periods according to established rules, realizing automatic switching of multiple groups of encryption algorithms. Only by completely cracking the preset encrypted file can it be truly considered cracked, greatly increasing the difficulty of cracking, thereby improving the anti-crawling effect.

[0098] Among them, the embodiment of the present invention does not limit in which time period each of the multiple groups of encryption algorithms in the preset encrypted file takes effect and how the time periods are divided. In actual application, it can be flexibly adjusted according to requirements. For example, assuming that the preset encrypted file includes two groups of encryption algorithms, one day can be used as a time period, and the effective time of the two groups of encryption algorithms is exchanged once a day. Of course, this division of time periods is only for illustrative purposes and is not limited thereto.

[0099] Among them, the embodiment of the present invention does not limit the number of groups of encryption algorithms set in the preset encrypted file either. In actual application, it can be flexibly adjusted according to requirements. For example, two groups of encryption algorithms or three groups of encryption algorithms, or more groups of encryption algorithms can be set in the preset encrypted file.

[0100] Step 13: Obtain the verification parameter based on the target encryption algorithm and the request parameter.

[0101] Here, based on the currently effective target encryption algorithm and the request parameter, the verification parameter for verifying the request is obtained to perform real-time verification on the request.

[0102] Step 14: Send the request carrying the verification parameter to the server so that after receiving the request, the server verifies the request based on the verification parameter.

[0103] Here, a request carrying verification parameters is sent to the server. After receiving the request, the server verifies the request in real time based on the verification parameters. Thus, the request is verified in real time using the verification data, realizing active defense, being able to detect abnormal situations in a timely manner, and effectively avoiding losses.

[0104] Among them, the verification parameters can be carried in the Header of the request message and passed to the server, but it is not limited to this.

[0105] In the data protection method of the embodiment of the present invention, when the terminal sends a request, the verification parameters are obtained by using the currently effective target encryption algorithm, so that the server verifies the request in real time based on the verification parameters, realizing active defense, being able to detect abnormal situations in a timely manner, and effectively avoiding losses. Moreover, multiple groups of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0106] In the embodiment of the present invention, in order to further increase the difficulty of cracking and improve the anti-crawling effect, optionally, each group of encryption algorithms respectively includes multiple encryption algorithms.

[0107] The above step 13 includes:

[0108] Step 131: Based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters, generate multiple first encryption parameters to be used as the verification parameters.

[0109] At this time, multiple different encryption algorithms are set in each group of encryption algorithms. The terminal can use multiple different encryption algorithms and request parameters to generate multiple first encryption parameters to be used as verification parameters. After the terminal sends a request carrying multiple first encryption parameters to the server, the server needs to verify these multiple first encryption parameters respectively. Only after these multiple first encryption parameters pass the verification will it enter the next process of request processing, thereby further improving the security and the anti-crawling effect. And multiple encryption algorithms in each group need to be cracked, further increasing the difficulty of cracking.

[0110] Specifically, the process of the server verifying multiple first encryption parameters respectively can be: The server first calls the target encryption algorithm that is effective in the time period to which the current time belongs from the preset encryption file, and then generates multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters; compares the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively; when any second encryption parameter is different from the corresponding first encryption parameter, it is determined that the request verification fails and no service data will be returned; when the multiple second encryption parameters are all the same as the corresponding multiple first encryption parameters, it is determined that the verification is successful and the next process of request processing is entered. Thus, multiple verifications are realized by using multiple first encryption parameters, improving the security guarantee and the anti-crawling effect.

[0111] As an alternative implementation, the encrypted input parameter WUA and the signature SIGN can be used as two verification parameters. The above step 131 includes:

[0112] Step 1311: Based on multiple encryption algorithms in the target encryption algorithm, the current time information, and the request parameters, and one or more of the terminal system identifier and the terminal user identifier, generate a first encrypted input parameter and a first signature as the verification parameters.

[0113] At this time, using multiple encryption algorithms in the target encryption algorithm, the current time information, and the request parameters, and combining one or more of the terminal system identifier (English abbreviation: SID, English full name: System IDentifier) and the terminal user identifier (English abbreviation: UID, English full name: User IDentify), generate a first encrypted input parameter WUA1 and a first signature SIGN1 as verification parameters, so that the server verification needs to verify the first encrypted input parameter WUA1 and the first signature SIGN1 respectively. Only when both verifications pass can it enter the next process of request processing, thereby further improving security and improving the anti-crawling effect.

[0114] Specifically, the process of the server verifying the first encrypted input parameter WUA1 and the first signature SIGN1 can be as follows: The server first calls the target encryption algorithm that takes effect in the time period to which the current time belongs from the preset encryption file, and then based on multiple encryption algorithms included in the target encryption algorithm, the current time information, and the request parameters, and one or more of the terminal system identifier and the terminal user identifier, generate a second encrypted input parameter WUA2 and a second signature SIGN2; then compare the second encrypted input parameter WUA2 with the first encrypted input parameter WUA1, and compare the second signature SIGN2 with the first signature SIGN1; when the second encrypted input parameter WUA2 is different from the first encrypted input parameter WUA1, or the second signature SIGN2 is different from the first signature SIGN1, it is determined that the request verification fails and no service data will be returned; when the second encrypted input parameter WUA2 is the same as the first encrypted input parameter WUA1, and the second signature SIGN2 is the same as the first signature SIGN1, it is determined that the verification is successful and the next process of request processing is entered. Thus, multiple verifications are realized by using the encrypted input parameter WUA and the signature SIGN, improving the security guarantee and improving the anti-crawling effect.

[0115] In the embodiment of the present invention, the generation process of the encrypted input parameter WUA and the signature SIGN can be split into three encryption operations, which are introduced below.

[0116] Optionally, the above step 1311 includes:

[0117] Step 13111: Generate a first secret key based on the first encryption algorithm in the target encryption algorithm and the current time information.

[0118] Here, the terminal may first generate a first secret key APPKEY1 based on the first encryption algorithm for generating a secret key in the target encryption algorithm and the current time information, so as to further generate a first encryption input parameter WUA1 by using the first secret key APPKEY1.

[0119] Among them, the specific calculation rules of the first encryption algorithm in the embodiments of the present invention are not limited, and any method in the prior art that can realize generating a secret key by using the current time information can be applied to the embodiments of the present invention. For example, a secret key can be obtained through a series of rules such as taking the remainder of the timestamp, but not limited thereto.

[0120] Among them, the current time information may include the current timestamp.

[0121] Step 13112: Generate a first encryption input parameter based on the second encryption algorithm in the target encryption algorithm, the first secret key, the request parameters, and one or more of the current time information, the terminal system identifier, and the terminal user identifier.

[0122] Here, after obtaining the first secret key APPKEY1, the terminal can generate a first encryption input parameter WUA1 through the second encryption algorithm, the first secret key APPKEY1, and the request parameters in the target encryption algorithm, and in combination with one or more of the current time information, the terminal system identifier SID, and the terminal user identifier UID, for verifying the legality of the request parameters.

[0123] Among them, the specific calculation rules of the second encryption algorithm in the embodiments of the present invention are not limited, and any method in the prior art that can realize generating an encryption input parameter by using information such as a secret key, request parameters, current time information, SID, UID, etc. can be applied to the embodiments of the present invention.

[0124] Among them, the request parameters may include but are not limited to request input parameters, and the request input parameters may include but are not limited to query parameters, path parameters, request body parameters, etc.

[0125] Among them, the generated first encryption input parameter WUA1 can be placed in the header Header of this request, but not limited thereto.

[0126] Step 13113: Generate a first signature based on the third encryption algorithm in the target encryption algorithm, the first secret key, and the first encryption input parameter.

[0127] Here, after obtaining the first encrypted input parameter WUA1, the terminal can generate the first signature SIGN1 through the third encryption algorithm, the first secret key APPKEY1, and the first encrypted input parameter WUA1 in the target encryption algorithm, which is used to verify the legitimacy of WUA1.

[0128] Among them, the specific calculation rules of the third encryption algorithm in the embodiments of the present invention are not limited. Any method in the prior art that can generate a signature using a secret key and an encrypted input parameter can be applied to the embodiments of the present invention.

[0129] Among them, the generated first signature SIGN1 can be placed in the header Header of this request, but it is not limited to this.

[0130] At this time, the calculated first encrypted input parameter WUA1 and the first signature SIGN1 can be used to implement multiple verifications of the request, improving the security guarantee and the anti-crawling effect.

[0131] In the embodiments of the present invention, after the server receives the first encrypted input parameter WUA1 and the first signature SIGN1, it can generate the second encrypted input parameter WUA2 and the second signature SIGN2 according to the same three-step encryption operation to verify the first encrypted input parameter WUA1 and the first signature SIGN1. The specific process is as follows;

[0132] The server first generates the second secret key APPKEY2 based on the first encryption algorithm in the target encryption algorithm and the current time information; then generates the second encrypted input parameter WUA2 based on the second encryption algorithm, the second secret key APPKEY2, and the request parameters, and one or more of the current time information, the terminal system identifier SID, and the terminal user identifier UID; and then generates the second signature SIGN2 based on the third encryption algorithm, the second secret key APPKEY2, and the second encrypted input parameter WUA2.

[0133] Since the process of the server generating the second encrypted input parameter WUA2 and the second signature SIGN2 is similar to the process of the terminal generating the first encrypted input parameter WUA1 and the first signature SIGN1, it will not be elaborated here.

[0134] Among them, when the terminal sends a request to the server, it can send SID and UID to the server together for the server to verify and use.

[0135] In the embodiments of the present invention, when generating multiple encrypted parameters according to the above three-step encryption operation, in theory, each group of encryption algorithms should include three encryption algorithms, which are respectively used to calculate the secret key, the encrypted input parameter, and the signature. Of course, each group of encryption algorithms is not limited to these three encryption algorithms.

[0136] Among them, as described above, the embodiments of the present invention do not limit the specific calculation rules for each encryption algorithm, and any encryption algorithm in the prior art that can calculate the secret key, encrypt the input parameter, and sign can be applied to the embodiments of the present invention.

[0137] In the embodiments of the present invention, since the server side and the terminal side determine multiple encryption parameters according to the same process and both need to use the current time information, in order to ensure that there is no deviation in the understanding of the current time information between the server and the terminal, optionally, before the above step 11, the method further includes:

[0138] Step 1001: Send a time synchronization request to the server;

[0139] Step 1002: Receive the system time returned by the server;

[0140] Step 1003: Based on the system time returned by the server, perform synchronization processing on the system time of the terminal.

[0141] At this time, before sending a request, the terminal will perform system time synchronization processing with the server to ensure that the time difference is within the allowable error range (such as 10 seconds), so as to ensure that there is no deviation in the understanding of the current time information between the server and the terminal, and further ensure the accuracy of verification.

[0142] Among them, it can be set that each time the terminal starts an application program that accesses the anti-crawling verification service, the above steps 1001-1003 are executed for time synchronization.

[0143] In the embodiments of the present invention, after the terminal sends a request to the server, if the request fails, the terminal can perform a time synchronization so as to maintain consistency with the server system time during the next request, and at the same time re-perform a data request to meet the business requirements.

[0144] See Figure 2 As shown, it is a flowchart of a terminal using the first encrypted input parameter WUA1 and the first signature SIGN1 for request verification provided by the embodiments of the present invention. The terminal includes a service layer and an encryption layer, and the process includes:

[0145] Step 201: Start.

[0146] Step 202: Service request data.

[0147] Step 203: Initiate a request.

[0148] Step 204: Generate a terminal system identifier SID through the device unique identifier CID (English full name: Consecutive identical digits; Chinese full name: Consecutive identical code / digit), the current timestamp, and a randomly generated serial number.

[0149] Step 205: Encrypt request parameters.

[0150] Step 206: Determine the time period to which the current time belongs.

[0151] Step 207: Invoke a set of target encryption algorithms that are effective for the time period to which the current time belongs from a preset encryption file.

[0152] [[ID=...]]... Step 208: Generate the first secret key APPKEY1 through the first encryption algorithm in the target encryption algorithm and the current timestamp.

[0153] Step 209: Generate the first encrypted input parameter WUA1 through the second encryption algorithm in the target encryption algorithm, the first secret key APPKEY1, the request input parameter, the terminal system identifier SID, and the terminal user identifier UID.

[0154] Step 2010: Return the encrypted string WUA1.

[0155] Step 2011: Generate the first signature SIGN1 through the third encryption algorithm in the target encryption algorithm, the first secret key APPKEY1, and the first encrypted input parameter WUA1.

[0156] Step 2012: Return the first signature SIGN1.

[0157] Step 2013: Initiate a request.

[0158] Step 2014: Determine whether the request is successfully sent, that is, whether the network communication is interrupted. If so, jump to Step 2015; if not, jump to Step 2017.

[0159] Step 2015: Determine whether the request verification fails. If so, jump to Step 2016; if not, jump to Step 2017. [[ID=...]]...

[0160] Step 2016: Time synchronization.

[0161] Step 2017: End.

[0162] In the embodiment of the present invention, multiple verifications are realized by using the first encrypted input parameter WUA1 and the first signature SIGN1, improving the security guarantee and the anti-crawling effect.

[0163] See Figure 3As shown in the figure, it is a flowchart of a terminal encrypting data using multiple encryption algorithms of a preset encrypted file provided by an embodiment of the present invention. A KEY pool and an encryption module are provided in the terminal. The KEY pool includes a system terminal identifier SID and N input parameters. The encryption module includes an algorithm pool and an APPKEY module. The algorithm pool includes M encryption algorithms. The APPKEY module is used to generate an APPKEY. When the terminal performs encryption processing, it obtains the required parameters from the KEY pool, obtains the required algorithms from the algorithm pool, and obtains the APPKEY generated by the encryption module, calculates the verification parameters, and then sends the verification data to the server.

[0164] In an embodiment of the present invention, in addition to verifying using the first encryption input parameter WUA1 and the first signature SIGN1 as described above, the system terminal identifier SID of the terminal can also be used for verification. Optionally, step 13 further includes:

[0165] Step 132: Use the system terminal identifier of the terminal as the verification parameter, where the system terminal identifier of the terminal is valid when it is used for the first time in the request and invalid when it is not used for the first time.

[0166] At this time, in a normal request, the system terminal identifier SID of the terminal will only be used once in each request. The terminal can send the system terminal identifier SID of the terminal to the server as a verification parameter. In addition to verifying the first encryption input parameter WUA1 and the first signature SIGN1, the server can also verify whether the system terminal identifier SID is used for the first time. When the system terminal identifier SID is not used for the first time, even if the first encryption input parameter WUA1 and the first signature SIGN1 pass the verification, it is determined that the request verification fails and no service data will be returned. Thus, an additional layer of protection is added using the system terminal identifier SID, improving the anti-crawling effect.

[0167] In an embodiment of the present invention, in order to further ensure the security of communication between the terminal and the server, some sensitive data during the communication process between the terminal and the server can be encrypted and a validity period can be set. Optionally, before step 14, the method further includes:

[0168] Encrypt one or more parameters in the request parameters using a preset private key and set the valid time corresponding to the encrypted request parameters.

[0169] At this time, when the terminal sends a request to the server, some sensitive parameters in the request parameters can be encrypted using a preset private key and their valid time can be set. In this way, illegal interception can be avoided during the communication process, ensuring the security of data communication. After receiving the request, even if the above verification data passes the verification, the server still needs to perform data timeliness verification through a symmetric encryption algorithm. Thus, the security is further ensured and the anti-crawling performance is improved.

[0170] The execution process of the server for data timeliness verification can be as follows: First, the server decrypts the encrypted request parameters using the public key corresponding to the preset private key; then, based on the valid time corresponding to the encrypted request parameters, it verifies whether the encrypted request parameters are valid at the current time; when the encrypted request parameters are valid at the current time, it further obtains business data using the decrypted parameters; when the encrypted request parameters are invalid at the current time, it does not obtain business data, thereby further ensuring security and improving the anti-crawling performance.

[0171] See Figure 4 As shown, it is a process for a terminal to perform data timeliness and SID uniqueness verification while using the first encrypted input parameter WUA1 and the first signature SIGN1 for request verification provided by an embodiment of the present invention. Among them, the terminal includes a terminal service module and a terminal encryption module, and the server includes a server encryption module, a crawler service module, a verification module, and a server service module. The process includes:

[0172] The data protection method of the embodiment of the present invention includes:

[0173] Step 401: Generate a terminal system identifier SID.

[0174] Step 402: Generate the first encrypted input parameter WUA1.

[0175] Step 403: Generate the first signature SIGN1.

[0176] Step 404: Send a request carrying SID, WUA1, SIGN1, and input parameters.

[0177] Step 405: Verify WUA1. If it passes, jump to Step 406; if it fails, jump to Step 4011.

[0178] Step 406: Verify SIGN1. If it passes, jump to Step 407; if it fails, jump to Step 4011.

[0179] Step 407: Crawler SID verification. If it passes, jump to Step 408; if it fails, jump to Step 4011.

[0180] Step 408: Decrypt and perform timeliness verification on the encrypted request parameters. If it passes, jump to Step 409; if it fails, jump to Step 4011.

[0181] Step 409: Obtain business data.

[0182] Step 4010: Determine whether the business data is valid. If it is valid, jump to Step 4014; if it is invalid, jump to Step 4012.

[0183] Step 4011: Determine that the verification fails, and then jump to step 4013.

[0184] Step 4012: Determine that the data is invalid, and then jump to step 4013.

[0185] Step 4013: Exception handling.

[0186] Step 4014: Determine a successful return.

[0187] In the data protection method of the embodiment of the present invention, a WUA and a SIGN parameter can be generated through parameters such as input parameters for verification. If the verification passes, it indicates that the current request is legal. Next, data timeliness and SID uniqueness verification are performed. Only when both the data timeliness and SID uniqueness verifications pass, will business data be obtained. Through multiple verifications, the security of data requests is guaranteed, the protection performance is improved, and the anti-crawling effect is improved.

[0188] In the embodiment of the present invention, all encryption algorithms are stored in a preset encryption file, and the preset encryption file can be a binary file. Since it is extremely difficult to crack a binary file and it is very difficult for code leakage to occur, the anti-crawling effect is further improved.

[0189] For example, the preset encryption file can be a file in the SO (English full name: shared object, Chinese full name: shared object) library. At this time, the terminal can directly call the encryption algorithm in the SO library through the SDK (English full name: Software Development Kit, Chinese full name: Software Development Toolkit); the server can call the encryption algorithm in the SO library through a PHP (English full name: Pre Hypertext Preprocessor, Chinese full name: Hypertext Preprocessor) extension.

[0190] Among them, an SO library that can be directly called by both the terminal and the server can be generated in advance through a programming language, such as the C language. At this time, the terminal and the server use the same set of encryption file codes, greatly reducing the development effort, and the joint debugging time can be ignored. Providing complete deployment script support can greatly shorten the test and online time.

[0191] In the embodiment of the present invention, the server can also update the preset encryption file according to set rules, thereby actively performing defensive work, increasing the cracking difficulty, and improving the anti-crawling effect. The following is an introduction.

[0192] The server can update the preset encryption file in the following three ways.

[0193] Method 1:

[0194] The server can monitor whether the encryption algorithm in the preset encrypted file is cracked. When the encryption algorithm in the preset encrypted file is cracked, an update process is performed on the encryption algorithm in the preset encrypted file.

[0195] At this time, the server can monitor whether the encryption algorithm in the preset encrypted file (such as the SO library file) is cracked. When it is detected that the algorithm is cracked, an update process is performed on the encryption algorithm in the preset encrypted file to prevent black production users from using crawlers.

[0196] Among them, the server can monitor whether the encryption algorithm is cracked according to traffic patterns and anomaly detection. When the encryption algorithm is cracked, in addition to updating the preset encrypted file, defenses can also be implemented through operations such as rate limiting of interfaces.

[0197] Optionally, when the encryption algorithm in the preset encrypted file is cracked, the steps for the server to perform an update process on the encryption algorithm in the preset encrypted file may include: when any encryption algorithm in the preset encrypted file is cracked, an update process is performed on the cracked encryption algorithm; or when all encryption algorithms in the preset encrypted file are cracked, an update process is performed on all encryption algorithms in the preset encrypted file.

[0198] At this time, when the server discovers that the encryption algorithm in the preset encrypted file is cracked, it can execute an update operation and perform an update process on the cracked encryption algorithm in the case where any one encryption algorithm is cracked for real-time dynamic adjustment; the server can also perform an update process on the entire preset encrypted file when all encryption algorithms are cracked and the algorithms are exhausted to ensure security.

[0199] Optionally, when the encryption algorithm in the preset encrypted file is cracked, the server can also modify the effective time of the uncracked encryption algorithm to the original effective time period of the uncracked encryption algorithm plus the original effective time period of the cracked encryption algorithm before updating the cracked encryption algorithm.

[0200] At this time, if the server discovers that the encryption algorithm is cracked, it can first adjust the use of other uncracked encryption algorithms before updating the preset encrypted file to ensure the normal operation of the application program.

[0201] Method 2:

[0202] At regular time intervals, the encryption algorithm in the preset encrypted file is periodically updated.

[0203] At this time, the server can periodically update the encryption algorithm in the preset encrypted file to update the preset encrypted file before it is cracked, making the work of black production in vain and improving security.

[0204] Method 3:

[0205] The encryption algorithm in the preset encryption file is updated irregularly.

[0206] At this time, the server can also update the encryption algorithm in the preset encrypted file from time to time, which can also achieve the goal of updating the preset encrypted file before it is cracked, making the work of the black industry go to waste and improving security.

[0207] Since the server updates the preset encryption file, in order to ensure that the encryption algorithm in the preset encryption file is the latest, safe and effective, the method may optionally further include, before step 12:

[0208] Step 1004: Sending a query request to the server to inquire whether there is an update to the encryption algorithm in the preset encryption file;

[0209] Step 1005: When receiving a message from the server indicating that an encryption algorithm in the preset encryption algorithm has been updated, the encryption algorithm in the locally stored preset encryption file is updated.

[0210] At this time, before calling the encryption algorithm, the terminal will send a query request to the server whether there is an update to the preset encryption file, and if there is an update, the encryption algorithm in the locally stored preset encryption file will be updated to ensure that the encryption algorithm in the preset encryption file is the latest, safe and effective, thereby ensuring the accuracy of the verification.

[0211] Among them, when the preset encryption file is an SO library file, the execution process of the terminal updating the encryption algorithm in the locally stored preset encryption file can be that the terminal obtains the SDK package containing the latest SO library file from the server side, replaces the previous SDK package and reinstalls the application.

[0212] Among them, it can be set that each time the terminal starts an application connected to the anti-crawling verification service, when executing the above steps 1001-1003 for time synchronization, the above step 1004 is executed to inquire whether there is any update to the encryption algorithm in the preset encryption file.

[0213] The following is an example of an update process of a preset encrypted file according to an embodiment of the present invention.

[0214] like Figure 5 As shown, the update process steps include:

[0215] Step 501: The server monitors whether the encryption algorithm in the preset encryption file is cracked. If so, jump to step 502; if not, return to step 501.

[0216] Step 502: The server determines whether all the encryption algorithms in the preset encrypted file have been cracked, that is, whether the algorithms have been exhausted. If so, it jumps to Step 504; if not, it returns to Step 501.

[0217] Step 503: The terminal sends an inquiry request to the server asking whether there is an update to the encryption algorithm in the preset encrypted file.

[0218] Step 504: The server determines the latest preset encrypted file.

[0219] Step 505: Based on the inquiry request, the server determines whether there is an update to the preset encrypted file. If so, it jumps to Step 506; if not, it jumps to Step 507.

[0220] Step 506: The server sends the updated preset encrypted file to the terminal.

[0221] Step 507: The server returns a message indicating no update to the terminal.

[0222] At this time, when the server discovers that the encryption algorithm in the preset encrypted file has been cracked, it can perform an update process on the entire preset encrypted file when all the encryption algorithms have been cracked and exhausted, to ensure security.

[0223] In the data protection method of the embodiments of the present invention, the source file of the encryption algorithm can be kept by a dedicated person, and only core personnel can view it. General developers can only obtain the compiled binary preset encrypted file (such as an SO library file), and the difficulty of decompilation is extremely high. Moreover, the automatic switching of algorithms is realized. Each preset encrypted file includes multiple groups of encryption algorithms, and each group of algorithms is completely different, and different encryption algorithms will be used at different times according to established rules. Only when the preset encrypted file is 100% cracked can it be truly considered cracked, greatly increasing the cracking difficulty. At the same time, the server will quickly discover that the preset encrypted file (such as an SO library file) may be being cracked based on the monitoring of traffic patterns and anomaly detection, and can actively perform defensive operations such as replacing the preset encrypted file and throttling. In addition, even if the preset encrypted file is cracked, there is a backup plan. The algorithms in the preset encrypted files used by the client and the server can be dynamically adjusted and will be updated irregularly, so as to update the preset encrypted file before it is cracked, making the work of the black production in vain. For example, the latest preset encrypted file can be updated each time the client raft is updated, and at the same time, the server will perform compatibility processing of the old and new preset encrypted files for a certain period of time.

[0224] The data protection method according to the embodiment of the present invention can, in theory, completely keep black production out as long as the code of the preset encrypted file (such as the SO library file) is not cracked, achieving 100% interception of crawler requests. Moreover, the code used online can be a binary file, which is extremely difficult to crack. At the same time, the sensitive code can be kept by a dedicated person, and it is very difficult for code leakage incidents to occur.

[0225] The data protection method according to the embodiment of the present invention is easy to access. Any business line only needs to add a small amount of code after applying for the service to smoothly access the service, greatly reducing the personnel development cost. Moreover, the client and the server use the same set of code, greatly reducing the development volume. The joint debugging time can be directly ignored, and a complete deployment script is provided to support, greatly shortening the test online time.

[0226] Embodiment 2

[0227] A data protection device applied to a terminal provided by the embodiment of the present invention is introduced in detail.

[0228] Referring to Figure 6 , a schematic structural diagram of a data protection device in the embodiment of the present invention is shown.

[0229] The data protection device 600 according to the embodiment of the present invention includes: a first determination module 601, a first call module 602, a first acquisition module 603, and a first sending module 604.

[0230] The functions of each module and the interaction relationship between each module are introduced in detail below.

[0231] The first determination module 601 is used to determine the time period to which the current time belongs;

[0232] The first call module 602 is used to call a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encrypted file; wherein, multiple sets of encryption algorithms that are effective in different time periods are included in the preset encrypted file;

[0233] The first acquisition module 603 is used to obtain verification parameters based on the target encryption algorithm and request parameters;

[0234] The first sending module 604 is used to send a request carrying the verification parameters to the server, so that after receiving the request, the server verifies the request based on the verification parameters.

[0235] In the data protection device according to the embodiment of the present invention, when the terminal sends a request, the target encryption algorithm that is currently in effect is used to obtain the verification parameters, so that the server can verify the request in real time based on the verification parameters, realizing active defense, being able to detect abnormal situations in time, effectively avoiding losses, and the multiple groups of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0236] Optionally, each group of encryption algorithms respectively includes multiple encryption algorithms;

[0237] The first acquisition module 603 includes:

[0238] A first generation sub-module, configured to generate multiple first encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters, and use the multiple first encryption parameters as the verification parameters.

[0239] Optionally, the first generation sub-module includes:

[0240] A first generation unit, configured to generate a first encryption input parameter and a first signature based on the multiple encryption algorithms in the target encryption algorithm, the current time information, and one or more of the terminal system identifier and the terminal user identifier, and use the first encryption input parameter and the first signature as the verification parameters.

[0241] Optionally, the first generation unit includes:

[0242] A first generation subunit, configured to generate a first secret key based on the first encryption algorithm in the target encryption algorithm and the current time information;

[0243] A second generation subunit, configured to generate a first encryption input parameter based on the second encryption algorithm in the target encryption algorithm, the first secret key, the request parameters, and one or more of the current time information, the terminal system identifier, and the terminal user identifier;

[0244] A third generation subunit, configured to generate a first signature based on the third encryption algorithm in the target encryption algorithm, the first secret key, and the first encryption input parameter.

[0245] Optionally, the first acquisition module 603 further includes:

[0246] A first determination sub-module, configured to use the terminal system identifier as the verification parameter, where the terminal system identifier is valid when it is first used in the request and invalid when it is not used for the first time.

[0247] Optionally, the device further includes:

[0248] A setting module, configured to encrypt one or more parameters in the request parameters with a preset private key and set the valid time corresponding to the encrypted request parameters.

[0249] Optionally, the device further includes:

[0250] A second sending module is used to send a query request to the server whether the encryption algorithm in the preset encryption file has been updated;

[0251] The first updating module is configured to update the encryption algorithm in the locally stored preset encryption file upon receiving a message from the server indicating that an encryption algorithm in the preset encryption algorithm has been updated.

[0252] Optionally, the device further includes:

[0253] A third sending module is used to send a time synchronization request to the server;

[0254] A first receiving module, configured to receive the system time returned by the server;

[0255] The first synchronization module is configured to synchronize the system time of the terminal based on the system time returned by the server.

[0256] Optionally, the preset encrypted file is a binary file.

[0257] The data protection device of the embodiment of the present invention uses the currently effective target encryption algorithm to obtain verification parameters when the terminal sends a request, so that the server verifies the request in real time based on the verification parameters, thereby realizing active defense, being able to detect abnormal situations in time, and effectively avoiding loss of interests. In addition, the multiple sets of encryption algorithms used for verification are automatically switched, which greatly increases the difficulty of cracking and improves the anti-crawling effect.

[0258] Example 3

[0259] Figure 7 A schematic diagram of the hardware structure of a terminal device for implementing various embodiments of the present invention.

[0260] The terminal device 700 includes but is not limited to: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, a processor 710, and a power supply 711. It will be understood by those skilled in the art that Figure 7 The terminal device structure shown in the figure does not constitute a limitation on the terminal device. The terminal device may include more or fewer components than shown, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the terminal device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle terminal, a wearable device, and a pedometer.

[0261] It should be understood that in the embodiments of the present invention, the radio frequency unit 701 can be used for receiving and sending signals during information reception and transmission or call processes. Specifically, after receiving the downlink data from the base station, it is given to the processor 710 for processing; in addition, the uplink data is sent to the base station. Generally, the radio frequency unit 701 includes, but is not limited to, antennas, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. In addition, the radio frequency unit 701 can also communicate with the network and other devices through a wireless communication system.

[0262] The terminal device provides users with wireless broadband Internet access through the network module 702, such as helping users to send and receive e-mails, browse web pages, and access streaming media, etc.

[0263] The audio output unit 703 can convert the audio data received by the radio frequency unit 701 or the network module 702 or stored in the memory 709 into an audio signal and output it as sound. Moreover, the audio output unit 703 can also provide an audio output related to the specific functions executed by the terminal device 700 (for example, call signal reception sound, message reception sound, etc.). The audio output unit 703 includes a speaker, a buzzer, a receiver, etc.

[0264] The input unit 704 is used for receiving audio or video signals. The input unit 704 can include a graphics processing unit (GPU) 7041 and a microphone 7042. The graphics processing unit 7041 processes the image data of the static pictures or videos obtained by an image capture device (such as a camera) in the video capture mode or the image capture mode. The processed image frames can be displayed on the display unit 706. The processed image frames can be stored in the memory 709 (or other storage media) or sent via the radio frequency unit 701 or the network module 702. The microphone 7042 can receive sounds and can process such sounds into audio data. The processed audio data can be converted into a format that can be output via the radio frequency unit 701 to the mobile communication base station in the case of a phone call mode.

[0265] The terminal device 700 further includes at least one sensor 705, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. Among them, the ambient light sensor can adjust the brightness of the display panel 7061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 7061 and / or the backlight when the terminal device 700 is moved to the ear. As a kind of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary, and can be used to identify the posture of the terminal device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 705 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be elaborated here.

[0266] The display unit 706 is used to display the information input by the user or the information provided to the user. The display unit 706 may include a display panel 7061, and the display panel 7061 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.

[0267] The user input unit 707 can be used to receive input digital or character information, and generate key signal inputs related to the user settings and function controls of the terminal device. Specifically, the user input unit 707 includes a touch panel 7071 and other input devices 7072. The touch panel 7071, also known as a touch screen, can collect touch operations of the user on or near it (such as operations of the user using a finger, a stylus, or any suitable object or accessory on or near the touch panel 7071). The touch panel 7071 can include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the touch position of the user, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 710, and receives and executes the command sent by the processor 710. In addition, the touch panel 7071 can be implemented in a variety of types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 7071, the user input unit 707 can also include other input devices 7072. Specifically, the other input devices 7072 can include but are not limited to a physical keyboard, function keys (such as volume control buttons, power on / off buttons, etc.), a trackball, a mouse, a joystick, which will not be elaborated here.

[0268] Further, the touch panel 7071 can cover the display panel 7061. After the touch panel 7071 detects a touch operation on or near it, it transmits the operation to the processor 710 to determine the type of touch event. Subsequently, the processor 710 provides a corresponding visual output on the display panel 7061 according to the type of touch event. Although in Figure 6 , the touch panel 7071 and the display panel 7061 are implemented as two independent components to achieve the input and output functions of the terminal device, in some embodiments, the touch panel 7071 and the display panel 7061 can be integrated to achieve the input and output functions of the terminal device, and specific details are not limited here.

[0269] The interface unit 708 is an interface for connecting an external device to the terminal device 700. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headset port, and so on. The interface unit 708 can be used to receive inputs from the external device (such as data information, power, etc.) and transmit the received inputs to one or more components within the terminal device 700 or can be used to transfer data between the terminal device 700 and the external device.

[0270] The memory 709 can be used to store software programs and various data. The memory 709 mainly includes a program storage area and a data storage area. Among them, the program storage area can store an operating system, applications required for at least one function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory 709 can include a high-speed random access memory and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0271] The processor 710 is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines. By running or executing software programs and / or modules stored in the memory 709, and calling data stored in the memory 709, it performs various functions of the terminal device and processes data, thereby monitoring the terminal device as a whole. The processor 710 can include one or more processing units; preferably, the processor 710 can integrate an application processor and a modem processor. Among them, the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above modem processor may not be integrated into the processor 710.

[0272] The terminal device 700 may further include a power supply 711 (such as a battery) for powering each component. Preferably, the power supply 711 may be logically connected to the processor 710 through a power management system, so as to implement functions such as management of charging, discharging, and power consumption management through the power management system.

[0273] In addition, the terminal device 700 includes some functional modules not shown, which will not be elaborated here.

[0274] Preferably, an embodiment of the present invention further provides a terminal device, including: a processor 710, a memory 709, and a computer program stored on the memory 709 and executable on the processor 710. When the computer program is executed by the processor 710, it implements each process of the above-mentioned data protection method embodiment and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0275] An embodiment of the present invention further provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, it implements each process of the above-mentioned data protection method embodiment and can achieve the same technical effect. To avoid repetition, it will not be elaborated here. Among them, the computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc, etc.

[0276] Embodiment 4

[0277] A data protection method applied to the server side provided by the embodiment of the present invention will be introduced in detail.

[0278] Refer to Figure 8 , which shows a flowchart of the steps of a data protection method in an embodiment of the present invention. The method is applied to a server and includes:

[0279] Step 81: Obtain a request carrying verification parameters sent by the terminal; the verification parameters are obtained by the terminal determining the time period to which the current time belongs, calling a set of target encryption algorithms that are effective in the time period to which the current time belongs from a preset encryption file, and then based on the target encryption algorithms and request parameters; where the preset encryption file includes multiple sets of encryption algorithms that are effective in different time periods.

[0280] In the embodiments of the present invention, multiple groups of encryption algorithms that become effective at different time periods are pre-stored in an encrypted file. Before sending a request, the terminal first determines the time period to which the current time belongs, and then calls a group of target encryption algorithms that become effective during the time period to which the current time belongs from a preset encrypted file, where the preset encrypted file includes multiple groups of encryption algorithms that become effective at different time periods, thereby automatically switching between multiple groups of encryption algorithms, increasing the difficulty of cracking; then, based on the target encryption algorithm and the request parameters, a verification parameter is obtained; and then the request carrying the verification parameter is sent to the server. After receiving the request, the server can verify the request in real time based on the verification parameter.

[0281] Among them, since the preset encrypted file includes multiple groups of encryption algorithms, each group of encryption algorithms is completely different, and each group of encryption algorithms will be used at different time periods according to established rules, realizing the automatic switching of multiple groups of encryption algorithms. Only by cracking the preset encrypted file completely can it be truly considered cracked, greatly increasing the difficulty of cracking, thereby improving the anti-crawling effect.

[0282] Among them, the embodiments of the present invention do not limit which time periods the multiple groups of encryption algorithms in the preset encrypted file become effective in, nor how the time periods are divided. In actual applications, it can be flexibly adjusted according to needs. For example, assuming that the preset encrypted file includes two groups of encryption algorithms, one day can be used as a time period, and the effective times of the two groups of encryption algorithms are exchanged once a day. Of course, this division of time periods is only for illustrative purposes and is not limited thereto.

[0283] Among them, the embodiments of the present invention do not limit the number of groups of encryption algorithms set in the preset encrypted file either. In actual applications, it can be flexibly adjusted according to needs. For example, two groups of encryption algorithms or three groups of encryption algorithms, or more groups of encryption algorithms can be set in the preset encrypted file.

[0284] Step 82: Call the target encryption algorithm from the preset encrypted file.

[0285] Here, after receiving the request, the server calls the target encryption algorithm that is currently effective from the preset encrypted file to perform verification based on the target encryption algorithm.

[0286] Among them, the server can also first determine the time period to which the current time belongs, and then call the target encryption algorithm that becomes effective during the time period to which the current time belongs from the preset encrypted file.

[0287] Step 83: Verify the request based on the target encryption algorithm and the verification parameter.

[0288] Here, after receiving the request, the server uses the target encryption algorithm and the verification data to verify the request in real time, realizing active defense, being able to detect abnormal situations in a timely manner, and effectively avoiding losses of interests.

[0289] In the data protection method according to the embodiment of the present invention, the server uses the currently effective target encryption algorithm and the verification parameters sent by the terminal to verify the request in real time, realizing active defense, being able to detect abnormal situations in a timely manner, effectively avoiding losses, and the multiple groups of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0290] In the embodiment of the present invention, in order to further increase the difficulty of cracking and improve the anti-crawling effect, optionally, the verification parameters include multiple first encryption parameters, and each group of encryption algorithms respectively includes multiple encryption algorithms.

[0291] The above step 83 includes:

[0292] Step 831: Generate multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameters.

[0293] Here, multiple different encryption algorithms are set in each group of encryption algorithms. The terminal can use multiple different encryption algorithms and request parameters to generate multiple first encryption parameters as verification parameters. After the terminal sends a request carrying multiple first encryption parameters to the server, the server first follows the same process, uses multiple different encryption algorithms and request parameters to generate multiple second encryption parameters, and uses the multiple second encryption parameters to verify the multiple first encryption parameters. Only after these multiple first encryption parameters pass the verification will the server enter the next process of request processing, thereby further improving security and the anti-crawling effect. And multiple encryption algorithms in each group need to be cracked, further increasing the difficulty of cracking.

[0294] Step 832: Compare the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively.

[0295] Here, if the first encryption parameter is legal, then the second encryption parameter calculated by the server should be the same as the first encryption parameter calculated by the terminal. The server compares the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively to verify the legality of each first encryption parameter.

[0296] Step 833: When any second encryption parameter is different from the corresponding first encryption parameter, determine that the request verification fails.

[0297] Here, when any second encryption parameter is different from the corresponding first encryption parameter, it is determined that the request verification fails and no service data will be returned; when multiple second encryption parameters are the same as the corresponding multiple first encryption parameters, it is determined that the verification is successful and the next process of request processing will be entered. Thus, multiple verifications are realized using multiple first encryption parameters, improving the security guarantee and the anti-crawling effect.

[0298] Optionally, the multiple first encryption parameters include a first encryption input parameter WUA1 and a first signature SIGN1.

[0299] At this time, the terminal uses multiple encryption algorithms in the target encryption algorithm, the current time information, and the request parameters, and combines one or more of the terminal system identifier SID and the terminal user identifier UID to generate the first encryption input parameter WUA1 and the first signature SIGN1 as verification parameters, so that the server needs to verify the first encryption input parameter WUA1 and the first signature SIGN1 separately. Only when both verifications pass can the next process of request processing be entered, thereby further improving security and enhancing the anti-crawling effect.

[0300] The above step 831 includes:

[0301] Step 8311: Based on multiple encryption algorithms in the target encryption algorithm, the current time information, the request parameters, and one or more of the terminal system identifier and the terminal user identifier, generate a second encryption input parameter and a second signature.

[0302] Here, the server can follow the same process as the terminal, use multiple encryption algorithms in the target encryption algorithm, the current time information, and the request parameters, and combine one or more of the terminal system identifier SID and the terminal user identifier UID to generate the second encryption input parameter WUA2 and the second signature SIGN2, so as to use the second encryption input parameter WUA2 and the second signature SIGN2 to verify the legality of the first encryption input parameter WUA1 and the first signature SIGN1.

[0303] The above step 832 includes:

[0304] Step 8321: Compare the second encryption input parameter with the first encryption input parameter, and compare the second signature with the first signature.

[0305] Here, if the first encryption input parameter WUA1 and the first signature SIGN1 are legal, then the second encryption input parameter WUA2 and the second signature SIGN2 calculated by the server should be the same as the first encryption input parameter WUA1 and the first signature SIGN1 calculated by the terminal. The server compares the second encryption input parameter WUA2 with the first encryption input parameter WUA1, and compares the second signature SIGN2 with the first signature SIGN1 to verify the legality of the first encryption input parameter WUA1 and the first signature SIGN1.

[0306] Step 8322: When the second encryption input parameter is different from the first encryption input parameter, or the second signature is different from the first signature, determine that the request verification fails.

[0307] Here, when the second encrypted input parameter WUA2 is different from the first encrypted input parameter WUA1, or the second signature SIGN2 is different from the first signature SIGN1, it is determined that the request verification fails and no service data will be returned; when the second encrypted input parameter WUA2 is the same as the first encrypted input parameter WUA1 and the second signature SIGN2 is the same as the first signature SIGN1, it is determined that the verification is successful and the next step in the request processing flow is entered. Thus, multiple verifications are implemented using the encrypted input parameter WUA and the signature SIGN, improving the security guarantee and the anti-crawling effect.

[0308] In the embodiments of the present invention, the generation process of the encrypted input parameter WUA and the signature SIGN can be split into three encryption operations, which will be introduced below.

[0309] The terminal can first generate the first secret key APPKEY1 based on the first encryption algorithm in the target encryption algorithm and the current time information; then generate the first encrypted input parameter WUA1 through the second encryption algorithm in the target encryption algorithm, the first secret key APPKEY1, and the request parameters, in combination with one or more of the current time information, the terminal system identifier SID, and the terminal user identifier UID, for verifying the legality of the request parameters; and then generate the first signature SIGN1 through the third encryption algorithm in the target encryption algorithm, the first secret key APPKEY1, and the first encrypted input parameter WUA1, for verifying the legality of WUA1.

[0310] The server side can generate the second encrypted input parameter WUA2 and the second signature SIGN2 according to the same three-step encryption operation.

[0311] Optionally, the above step 8311 includes:

[0312] Step 83111: Generate a second secret key based on the first encryption algorithm in the target encryption algorithm and the current time information.

[0313] Here, the server can first generate the second secret key APPKEY2 based on the first encryption algorithm for generating the secret key in the target encryption algorithm and the current time information, in order to further generate the second encrypted input parameter WUA2 using the second secret key APPKEY2.

[0314] Among them, the specific calculation rules of the first encryption algorithm in the embodiments of the present invention are not limited, and any method in the prior art that can implement generating a secret key using the current time information can be applied to the embodiments of the present invention. For example, the secret key can be obtained through a series of rules such as taking the remainder of the timestamp, but not limited to this.

[0315] Among them, the current time information may include the current timestamp.

[0316] Step 83112: Generate a second encryption input parameter based on the second encryption algorithm, the second secret key, and the request parameters in the target encryption algorithm, and one or more of the current time information, the terminal system identifier, and the terminal user identifier.

[0317] Here, after obtaining the second secret key APPKEY2, the terminal can generate a second encryption input parameter WUA2 through the second encryption algorithm, the second secret key APPKEY2, and the request parameters in the target encryption algorithm, in combination with one or more of the current time information, the terminal system identifier SID, and the terminal user identifier UID, for the legitimacy of WUA1.

[0318] Among them, the specific calculation rules of the second encryption algorithm in the embodiments of the present invention are not limited, and any method in the prior art that can generate an encryption input parameter using information such as a secret key, request parameters, current time information, SID, and UID can be applied to the embodiments of the present invention.

[0319] Among them, the request parameters may include, but are not limited to, request input parameters, and the request input parameters may include, but are not limited to, query parameters, path parameters, request body parameters, etc.

[0320] Step 83113: Generate a second signature based on the third encryption algorithm, the second secret key, and the second encryption input parameter in the target encryption algorithm.

[0321] Here, after obtaining the second encryption input parameter WUA2, the terminal can generate a second signature SIGN2 through the third encryption algorithm, the second secret key APPKEY2, and the second encryption input parameter WUA2 in the target encryption algorithm, for verifying the legitimacy of SIGN1.

[0322] At this time, the calculated second encryption input parameter WUA2 and the second signature SIGN2 can be used to implement multiple verifications of the request, improving security and enhancing the anti-crawling effect.

[0323] In the embodiments of the present invention, when generating multiple encryption parameters according to the above three-step encryption operation, theoretically, each set of encryption algorithms should include three encryption algorithms, which are respectively used to calculate the secret key, the encryption input parameter, and the signature. Of course, each set of encryption algorithms is not limited to these three encryption algorithms.

[0324] Among them, as mentioned above, the specific calculation rules of each encryption algorithm in the embodiments of the present invention are not limited, and any encryption algorithm in the prior art that can calculate the secret key, the encryption input parameter, and the signature can be applied to the embodiments of the present invention.

[0325] In the embodiments of the present invention, since the server side and the terminal side determine multiple encryption parameters according to the same process and both need to use the current time information, in order to ensure that there is no deviation in the understanding of the current time information between the server and the terminal, optionally, before the above step 81, the method further includes:

[0326] Step 8001: Receive the time synchronization request sent by the terminal;

[0327] Step 8002: Send the system time of the server to the terminal, so that the terminal synchronizes the system time of the terminal based on the system time of the server.

[0328] At this time, before sending the request, the terminal will perform system time synchronization with the server to ensure that the time difference is within the allowable error range (such as 10 seconds), so as to ensure that there is no deviation in the understanding of the current time information between the server and the terminal, and further ensure the accuracy of the verification.

[0329] Among them, it can be set that each time the terminal starts an application program that accesses the anti-crawling verification service, a time synchronization request is sent for time synchronization.

[0330] In the embodiments of the present invention, after the terminal sends a request to the server, if the request fails, the terminal can perform a time synchronization so as to maintain consistency with the server system time during the next request, and at the same time re-perform a data request to meet the business requirements.

[0331] In the embodiments of the present invention, in addition to the above verification using encrypted input parameters and signatures, the terminal system identifier SID can also be used for verification. Optionally, the verification parameter further includes the terminal system identifier;

[0332] The above step 83 includes:

[0333] Step 834: Verify whether the terminal system identifier is used for the first time based on the terminal system identifier;

[0334] Step 835: When the terminal system identifier part is not used for the first time, determine that the request verification fails.

[0335] At this time, in a normal request, the terminal system identifier SID is only used once in each request. The terminal can send the terminal system identifier SID to the server as a verification parameter. In addition to verifying the first encrypted input parameter WUA1 and the first signature SIGN1, the server can also verify whether the terminal system identifier SID is used for the first time. When the terminal system identifier SID is not used for the first time, even if the verification of the first encrypted input parameter WUA1 and the first signature SIGN1 passes, it is determined that the request verification fails and no service data is returned, thus adding an extra layer of protection using the terminal system identifier SID and improving the anti-crawling effect.

[0336] In an embodiment of the present invention, in order to further ensure the security of communication between the terminal and the server, some sensitive data during the communication process between the terminal and the server can be encrypted and an expiration period can be set. Optionally, the request also carries request parameters encrypted by a preset private key;

[0337] After the above step 83, the method further includes:

[0338] Step 84: Decrypt the encrypted request parameters using the public key corresponding to the preset private key.

[0339] Here, when the terminal sends a request to the server, some sensitive parameters in the request parameters can be encrypted by a preset private key and their valid time can be set. After receiving the request, even if the above verification data passes the verification, the server still needs to use the symmetric encryption algorithm, that is, use the public key corresponding to the preset private key, to decrypt the encrypted request parameters to obtain the request parameters, so as to avoid illegal interception during the communication process and ensure the security of data communication.

[0340] Step 85: Based on the expiration time of the encrypted request parameters, verify whether the encrypted request parameters are valid at the current time.

[0341] Here, after decrypting to obtain the request parameters, it is also necessary to perform a timeliness verification on the encrypted request parameters. When the encrypted request parameters are valid at the current time, the decrypted parameters are used to obtain service data; when the encrypted request parameters are invalid at the current time, no service data is obtained, thus further ensuring security and improving the anti-crawling performance.

[0342] In an embodiment of the present invention, all encryption algorithms are stored in a preset encryption file, and the preset encryption file can be a binary file. Since it is extremely difficult to crack a binary file and it is very difficult for code leakage to occur, the anti-crawling effect is further improved.

[0343] For example, the preset encrypted file can be a file in the SO library. At this time, the terminal can directly call the encryption algorithm in the SO library through the SDK; the server can call the encryption algorithm in the SO library through the PHP extension.

[0344] Among them, the SO library that can be directly called by both the terminal and the server can be generated in advance through a programming language, such as C language. At this time, the terminal and the server use the same set of encrypted file codes, greatly reducing the development effort, and the joint debugging time can be ignored. Providing complete deployment script support can greatly shorten the test and go-live time.

[0345] In the embodiment of the present invention, the server can also update the preset encrypted file according to the set rules, so as to actively perform defensive work, increase the cracking difficulty, and improve the anti-crawling effect, which will be introduced below.

[0346] Optionally, the method further includes:

[0347] Step 8003: Monitor whether the encryption algorithm in the preset encrypted file is cracked. When the encryption algorithm in the preset encrypted file is cracked, perform an update process on the encryption algorithm in the preset encrypted file.

[0348] At this time, the server can monitor whether the encryption algorithm in the preset encrypted file (such as the SO library file) is cracked. When it is detected that it is cracked, perform an update process on the encryption algorithm in the preset encrypted file to prevent black production users from crawling.

[0349] Among them, the server can monitor whether the encryption algorithm is cracked according to traffic rules and anomaly detection. When the encryption algorithm is cracked, in addition to updating the preset encrypted file, defenses can also be implemented through operations such as rate limiting of interfaces.

[0350] Optionally, in the above step 8003, when the encryption algorithm in the preset encrypted file is cracked, the step of performing an update process on the encryption algorithm in the preset encrypted file includes:

[0351] Step 80031: When any encryption algorithm in the preset encrypted file is cracked, perform an update process on the cracked encryption algorithm; or

[0352] Step 80032: When all the encryption algorithms in the preset encrypted file are cracked, perform an update process on all the encryption algorithms in the preset encrypted file.

[0353] At this time, when the server finds that the encryption algorithm in the preset encryption file has been cracked, it can perform an update operation when any encryption algorithm is cracked, and update the cracked encryption algorithm to make real-time dynamic adjustments; the server can also update the entire preset encryption file when all encryption algorithms are cracked and the algorithms are exhausted to ensure security.

[0354] Optionally, in step 8003, when the encryption algorithm in the preset encrypted file is cracked, the method further includes:

[0355] Step 80033: Before the cracked encryption algorithm is updated, the effective time of the uncracked encryption algorithm is modified to the original effective time period of the uncracked encryption algorithm plus the original effective time period of the cracked encryption algorithm.

[0356] At this time, if the server finds that the encryption algorithm has been cracked, it can adjust to use other encryption algorithms that have not been cracked before updating the preset encryption file to ensure the normal operation of the application.

[0357] Alternatively, optionally, the method further comprises:

[0358] Step 8004: regularly updating the encryption algorithm in the preset encryption file at preset time intervals.

[0359] At this time, the server can regularly update the encryption algorithm in the preset encrypted file to update the preset encrypted file before it is cracked, making the work of the black industry go to waste and improving security.

[0360] Alternatively, optionally, the method further comprises:

[0361] Step 8005: Update the encryption algorithm in the preset encryption file from time to time.

[0362] At this time, the server can also update the encryption algorithm in the preset encrypted file from time to time, which can also achieve the goal of updating the preset encrypted file before it is cracked, making the work of the black industry go to waste and improving security.

[0363] Among them, before calling the encryption algorithm, the terminal can send a query request to the server whether there is an update to the preset encryption file, and if there is an update, update the encryption algorithm in the locally stored preset encryption file, thereby ensuring that the encryption algorithm in the preset encryption file is the latest, safe and effective, and thus ensuring the accuracy of the verification.

[0364] The terminal can be set to inquire whether there is any update to the encryption algorithm in the preset encryption file when performing time synchronization each time the terminal starts an application connected to the anti-crawling verification service.

[0365] In the data protection method according to the embodiment of the present invention, the source file of the encryption algorithm can be kept by a dedicated person, and only core personnel can view it. General developers can only obtain the preset encrypted file (such as an SO library file) in binary form generated after compilation, and the difficulty of decompilation is extremely high. Moreover, automatic switching of algorithms is realized. Each preset encrypted file includes multiple groups of encryption algorithms, and each group of algorithms is completely different. Different encryption algorithms will be used at different times according to established rules. Only by cracking the preset encrypted file 100% can it be truly considered cracked, greatly increasing the cracking difficulty. At the same time, the server will quickly detect that the preset encrypted file (such as an SO library file) may be being cracked based on traffic patterns and anomaly detection monitoring, and can actively perform defensive operations, such as replacing the preset encrypted file, limiting traffic, etc. In addition, even if the preset encrypted file is cracked, there is a backup plan. The algorithms in the preset encrypted files used by the client and the server can be dynamically adjusted and will be updated irregularly to update the preset encrypted file before it is cracked, making the work of the black industry in vain. For example, the latest preset encrypted file can be updated each time the client raft is updated, and the server will have a compatibility process for the old and new preset encrypted files for a period of time.

[0366] In the data protection method according to the embodiment of the present invention, theoretically, as long as the code of the preset encrypted file (such as an SO library file) is not cracked, black production can be completely kept out, achieving 100% interception of crawler requests. Moreover, the code used online can be a binary file, and the cracking difficulty is extremely high. At the same time, the sensitive code can be kept by a dedicated person, and it is very difficult for code leakage events to occur.

[0367] In the data protection method according to the embodiment of the present invention, the access is simple. Any business line only needs to add a small amount of code after applying for the service to smoothly access the service, greatly reducing the personnel development cost. Moreover, the client and the server use the same set of code, greatly reducing the development volume, and the joint debugging time can be directly ignored. Complete deployment script support is provided, greatly shortening the test and online time.

[0368] Embodiment 5

[0369] A data protection device applied to a server provided by the embodiment of the present invention will be introduced in detail.

[0370] Referring to Figure 9 shows a schematic structural diagram of a data protection device in an embodiment of the present invention.

[0371] The data protection device 900 according to the embodiment of the present invention includes: a second acquisition module 901, a second call module 902, and a first verification module 903.

[0372] The functions of each module and the interaction relationship between each module will be introduced in detail below.

[0373] A second acquisition module 901, configured to acquire a request carrying a verification parameter sent by a terminal; the verification parameter is a verification parameter acquired by the terminal based on a set of target encryption algorithms effective in the current time period after determining the time period to which the current time belongs and invoking the target encryption algorithms effective in the current time period from a preset encryption file; wherein the preset encryption file includes multiple sets of encryption algorithms effective in different time periods.

[0374] A second invocation module 902, configured to invoke the target encryption algorithm from the preset encryption file.

[0375] A first verification module 903, configured to verify the request based on the target encryption algorithm and the verification parameter.

[0376] The data protection device according to the embodiment of the present invention uses the currently effective target encryption algorithm and the verification parameter sent by the terminal to verify the request in real time, realizes active defense, can detect abnormal situations in time, effectively avoids losses, and the multiple sets of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0377] Optionally, the verification parameter includes multiple first encryption parameters, and each set of encryption algorithms respectively includes multiple encryption algorithms.

[0378] The first verification module 903 includes:

[0379] A second generation sub-module, configured to generate multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithm and the request parameter.

[0380] A first comparison sub-module, configured to compare the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively.

[0381] A second determination sub-module, configured to determine that the request verification fails when any second encryption parameter is different from the corresponding first encryption parameter.

[0382] Optionally, the multiple first encryption parameters include a first encryption input parameter and a first signature.

[0383] The second generation sub-module includes:

[0384] A second generation unit, configured to generate a second encryption input parameter and a second signature based on the multiple encryption algorithms in the target encryption algorithm, current time information, and the request parameter, and one or more of a terminal system identifier and a terminal user identifier.

[0385] The first comparison sub-module includes:

[0386] A first comparison unit, configured to compare the second encryption input parameter with the first encryption input parameter, and compare the second signature with the first signature;

[0387] A first determination unit, configured to determine that the request verification fails when the second encryption input parameter is different from the first encryption input parameter, or the second signature is different from the first signature.

[0388] Optionally, the verification parameter further includes a terminal system identifier;

[0389] The first verification module 903 includes:

[0390] A first verification sub-module, configured to verify whether the terminal system identifier is used for the first time based on the terminal system identifier;

[0391] A third determination sub-module, configured to determine that the request verification fails when the terminal system identifier part is not used for the first time.

[0392] Optionally, the request further carries request parameters encrypted by a preset private key;

[0393] The device further includes:

[0394] A decryption module, configured to decrypt the encrypted request parameters by using the public key corresponding to the preset private key;

[0395] A second verification module, configured to verify whether the encrypted request parameters are valid at the current time based on the valid time corresponding to the encrypted request parameters.

[0396] Optionally, the device further includes:

[0397] A second update module, configured to monitor whether the encryption algorithm in the preset encrypted file is cracked, and when the encryption algorithm in the preset encrypted file is cracked, perform an update process on the encryption algorithm in the preset encrypted file; or

[0398] A third update module, configured to perform an update process on the encryption algorithm in the preset encrypted file at regular time intervals; or

[0399] A fourth update module, configured to perform an update process on the encryption algorithm in the preset encrypted file irregularly.

[0400] Optionally, the second update module includes:

[0401] A first update sub-module, configured to perform an update process on the cracked encryption algorithm when any encryption algorithm in the preset encrypted file is cracked; or

[0402] A second update sub-module, configured to update all the encryption algorithms in the preset encrypted file when all the encryption algorithms in the preset encrypted file are cracked.

[0403] Optionally, the device further includes:

[0404] A modification module, configured to, before updating the cracked encryption algorithm, modify the effective time of the uncracked encryption algorithm to the original effective time period of the uncracked encryption algorithm plus the original effective time period of the cracked encryption algorithm.

[0405] Optionally, the device further includes:

[0406] A second receiving module, configured to receive a time synchronization request sent by the terminal;

[0407] A fourth sending module, configured to send the system time of the server to the terminal, so that the terminal synchronizes the system time of the terminal based on the system time of the server.

[0408] The data protection device according to the embodiment of the present invention uses the currently effective target encryption algorithm and the verification parameters sent by the terminal to verify the request in real time, realizes active defense, can detect abnormal situations in time, effectively avoids losses, and the multiple groups of encryption algorithms used for verification are automatically switched, greatly increasing the difficulty of cracking and improving the anti-crawling effect.

[0409] Embodiment 6

[0410] Figure 10 A schematic hardware structure diagram of a server 100 for implementing various embodiments of the present invention.

[0411] The server 100 includes, but is not limited to, a processor 101, a communication interface 102, a memory 103, and a communication bus 104. Among them, the processor 101, the communication interface 102, and the memory 103 communicate with each other through the communication bus 104.

[0412] The memory 103 is used to store a computer program.

[0413] When the processor 101 is used to execute the program stored in the memory 103, the steps executed by the server in the data protection method as described above are implemented.

[0414] The communication bus mentioned in the above server can be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience in representation, only a thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0415] The communication interface is used for communication between the above server and other devices.

[0416] The memory can include a Random Access Memory (RAM), and can also include a non-volatile memory, such as at least one disk memory. Optionally, the memory can also be at least one storage device located far from the aforementioned processor.

[0417] The above-mentioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0418] The embodiment of the present invention also provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, it realizes each process of the above-mentioned embodiment of the data protection method applied to the terminal, and can achieve the same technical effect. To avoid repetition, it will not be elaborated here. Among them, the computer-readable storage medium is, for example, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disc, etc.

[0419] It should be noted that in this article, the terms "including", "comprising" or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or device comprising that element.

[0420] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-described embodiment methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in various embodiments of the present invention.

[0421] The embodiments of the present invention have been described above in conjunction with the accompanying drawings. However, the present invention is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present invention, those of ordinary skill in the art can also make many forms without departing from the spirit and scope protected by the claims of the present invention, and all of them belong to the protection scope of the present invention.

[0422] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0423] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described systems, devices and units can refer to the corresponding processes in the foregoing method embodiments and will not be repeated here.

[0424] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical or other forms.

[0425] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0426] In addition, in each embodiment of the present invention, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0427] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or part of this technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical discs that can store program codes.

[0428] As described above, only the specific implementation manners of the present invention are provided, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of changes or substitutions, which should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A data protection method, applied to a terminal, characterized in that The method includes: Determine the time period to which the current time belongs; Call a set of target encryption algorithms that are effective during the time period to which the current time belongs from a preset encryption file; wherein, the preset encryption file includes multiple sets of encryption algorithms that are effective during different time periods, and each set of encryption algorithms includes multiple encryption algorithms; Based on the target encryption algorithms and request parameters, obtain verification parameters, where the verification parameters include multiple first encryption input parameters, and the first encryption input parameters are generated based on the first encryption algorithm, second encryption algorithm in the target encryption algorithms, the request parameters, and one or more of the current time information, terminal system identifier, and terminal user identifier; Send the request carrying the verification parameters to the server, so that after receiving the request, the server verifies the request based on the verification parameters.

2. The data protection method according to claim 1, wherein The step of obtaining verification parameters based on the target encryption algorithms and request parameters includes: Generate multiple first encryption parameters based on the multiple encryption algorithms included in the target encryption algorithms and the request parameters, and use them as the verification parameters.

3. The data protection method according to claim 2, wherein The step of generating multiple first encryption parameters based on the multiple encryption algorithms included in the target encryption algorithms and the request parameters, and using them as the verification parameters includes: Generate a first encryption input parameter and a first signature based on the multiple encryption algorithms in the target encryption algorithms, the current time information, the request parameters, and one or more of the terminal system identifier and terminal user identifier, and use them as the verification parameters.

4. The data protection method according to claim 3, characterized in that, The step of generating a first encryption input parameter and a first signature based on the multiple encryption algorithms in the target encryption algorithms, the current time information, the request parameters, and one or more of the terminal system identifier and terminal user identifier includes: Generate a first secret key based on the first encryption algorithm in the target encryption algorithms and the current time information; Generate a first encryption input parameter based on the second encryption algorithm in the target encryption algorithms, the first secret key, the request parameters, and one or more of the current time information, terminal system identifier, and terminal user identifier; Generate a first signature based on the third encryption algorithm in the target encryption algorithms, the first secret key, and the first encryption input parameter.

5. The data protection method according to any one of claims 1 to 4, characterized in that, The step of obtaining verification parameters based on the target encryption algorithms and request parameters further includes: Use the terminal system identifier as the verification parameter, where the terminal system identifier is valid when it is first used in the request and invalid when it is not used for the first time.

6. The data protection method according to any one of claims 1 to 4, characterized in that, Before sending the request carrying the verification parameters to the server, the method further includes: Encrypt one or more parameters in the request parameters with a preset private key and set the valid time corresponding to the encrypted request parameters.

7. The data protection method according to any one of claims 1 to 4, characterized in that, Before calling a set of target encryption algorithms that are effective during the time period to which the current time belongs from a preset encryption file, the method further includes: Send an inquiry request to the server asking whether the encryption algorithms in the preset encryption file have been updated; When receiving the message that the encryption algorithms in the preset encryption algorithms returned by the server have been updated, perform an update process on the encryption algorithms in the locally stored preset encryption file.

8. The data protection method according to any one of claims 1 to 4, characterized in that, Before determining the time period to which the current time belongs, the method further includes: Sending a time synchronization request to the server; Receiving the system time returned by the server; Based on the system time returned by the server, synchronizing the system time of the terminal.

9. The data protection method according to any one of claims 1 to 4, characterized in that, The preset encrypted file is a binary file.

10. A data protection device, applied to a terminal, characterized in that The device includes: A first determination module, configured to determine the time period to which the current time belongs; A first invocation module, configured to invoke a set of target encryption algorithms that are effective for the time period to which the current time belongs from a preset encrypted file; wherein, the preset encrypted file includes multiple sets of encryption algorithms that are effective in different time periods, and each set of encryption algorithms includes multiple encryption algorithms; A first acquisition module, configured to obtain verification parameters based on the target encryption algorithms and request parameters, where the verification parameters include multiple first encryption input parameters, and the first encryption input parameters are generated based on a first encryption algorithm, a second encryption algorithm in the target encryption algorithms, and one or more of current time information, terminal system identifier, and terminal user identifier; A first sending module, configured to send a request carrying the verification parameters to the server, so that after receiving the request, the server verifies the request based on the verification parameters.

11. A data protection method, applied to a server, characterized in that, The method includes: Obtaining a request carrying verification parameters sent by a terminal; the verification parameters are the verification parameters obtained by the terminal after determining the time period to which the current time belongs and invoking a set of target encryption algorithms that are effective for the time period to which the current time belongs from a preset encrypted file; wherein the preset encrypted file includes multiple sets of encryption algorithms that are effective in different time periods, and the verification parameters include multiple first encryption input parameters, and the first encryption input parameters are generated based on a first encryption algorithm, a second encryption algorithm in the target encryption algorithms, and one or more of current time information, terminal system identifier, and terminal user identifier; Invoking the target encryption algorithms from the preset encrypted file, and each set of encryption algorithms includes multiple encryption algorithms; Based on the target encryption algorithms and the verification parameters, verifying the request.

12. The data protection method according to claim 11, wherein The verification parameters include multiple first encryption parameters; The step of verifying the request based on the target encryption algorithms and the verification parameters includes: Generating multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithms and the request parameters; Comparing the multiple second encryption parameters with the corresponding multiple first encryption parameters respectively; When any one of the second encryption parameters is different from the corresponding first encryption parameter, determining that the request verification fails.

13. The data protection method according to claim 12, wherein The multiple first encryption parameters include first encryption input parameters and a first signature; The step of generating multiple second encryption parameters based on the multiple encryption algorithms included in the target encryption algorithms and the request parameters includes: Generating second encryption input parameters and a second signature based on the multiple encryption algorithms in the target encryption algorithms, current time information, and the request parameters, and one or more of terminal system identifier and terminal user identifier; The steps of comparing multiple second encryption parameters with corresponding multiple first encryption parameters respectively include: Comparing the second encrypted input parameter with the first encrypted input parameter, and comparing the second signature with the first signature; When the second encrypted input parameter is different from the first encrypted input parameter, or the second signature is different from the first signature, it is determined that the request verification fails.

14. The data protection method according to any one of claims 11 to 13, characterized in that, The verification parameter further includes a terminal system identifier; Based on the target encryption algorithm and the verification parameter, the steps of verifying the request include: Based on the terminal system identifier, verifying whether the terminal system identifier is used for the first time; When the terminal system identifier part is not used for the first time, it is determined that the request verification fails.

15. The data protection method according to any one of claims 11 to 13, characterized in that, The request also carries request parameters encrypted by a preset private key; After verifying the request based on the target encryption algorithm and the verification parameter, the method further includes: Decrypting the encrypted request parameters with the public key corresponding to the preset private key; Based on the valid time corresponding to the encrypted request parameters, verifying whether the encrypted request parameters are valid at the current time.

16. The data protection method according to any one of claims 11 to 13, characterized in that, The method further includes: Monitoring whether the encryption algorithm in the preset encryption file is cracked, and when the encryption algorithm in the preset encryption file is cracked, performing an update process on the encryption algorithm in the preset encryption file; or At preset time intervals, regularly performing an update process on the encryption algorithm in the preset encryption file; or Performing an update process on the encryption algorithm in the preset encryption file irregularly.

17. The data protection method according to claim 16, wherein When the encryption algorithm in the preset encryption file is cracked, the steps of performing an update process on the encryption algorithm in the preset encryption file include: When any encryption algorithm in the preset encryption file is cracked, performing an update process on the cracked encryption algorithm; or When all encryption algorithms in the preset encryption file are cracked, performing an update process on all encryption algorithms in the preset encryption file.

18. The data protection method according to claim 16, wherein When the encryption algorithm in the preset encryption file is cracked, the method further includes: Before updating the cracked encryption algorithm, modifying the effective time of the uncracked encryption algorithm to the original effective time period of the uncracked encryption algorithm plus the original effective time period of the cracked encryption algorithm.

19. The data protection method according to any one of claims 11 to 13, characterized in that, Before obtaining the request carrying the verification parameter sent by the terminal, the method further includes: Receiving the time synchronization request sent by the terminal; Sending the system time of the server to the terminal, so that the terminal synchronizes the system time of the terminal based on the system time of the server.

20. A data protection device, applied to a server, characterized in that, The device includes: A second acquisition module, configured to acquire a request carrying a verification parameter sent by a terminal; the verification parameter is obtained by the terminal determining the time period to which the current time belongs, and invoking a set of target encryption algorithms effective for the time period to which the current time belongs from a preset encryption file, and then based on the target encryption algorithms and request parameters; wherein the preset encryption file includes multiple sets of encryption algorithms effective in different time periods, the verification parameter includes multiple first encryption input parameters, and the first encryption input parameters are generated based on the first encryption algorithm, the second encryption algorithm in the target encryption algorithms, and one or more of the current time information, the terminal system identifier, and the terminal user identifier; A second invocation module, configured to invoke the target encryption algorithms from the preset encryption file, and each set of encryption algorithms includes multiple encryption algorithms; A first verification module, configured to verify the request based on the target encryption algorithms and the verification parameter.

Images