Method and system for reinforcing and encrypting important data in front-end and back-end communications

Abstract

This application provides a method and system for strengthening and encrypting important data in front-end and back-end communication. The method includes: performing multi-layer encryption and decryption during transmission between the client and the server to avoid increasing the risk of being cracked due to the transmission of fixed information, strengthening the confidentiality of the transmission process, and destroying the records stored on the client and the server each time during transmission, thereby enhancing the confidentiality of important data during transmission and preventing key leakage after data packets are intercepted, which could lead to data cracking, tampering, or other situations.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a method and system for reinforcing and encrypting important data in front-end and back-end communications. Background Art

[0002] Whether developing native APP, webapp or PC software, any development model that separates the front-end and back-end often calls the interface provided by the back-end to perform business interactions. Data security is very important, especially user-related information, which is transmitted between the front-end and back-end in plain text, and the interface security is extremely low.

[0003] Based on the above situation, the existing technology uses https protocol communication requests and simply applies a certain encryption algorithm to the request parameters to create a signature to complete Internet data transmission encryption and achieve Internet transmission security protection. However, the security scope of these two methods is limited, and information can still be attacked, obtained, forged and tampered with. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a method and system for strengthening and encrypting important data in front-end and back-end communications, so as to solve or partially solve the above-mentioned technical problems.

[0005] Based on the above purpose, the first aspect of the present application provides a method for strengthening and encrypting important data in front-end and back-end communications, including:

[0006] The client receives the data sending instruction to form first access information, and sends the first access information to the server;

[0007] The server receives the first access information, performs a first encryption on it to generate first encrypted information, and sends the first encrypted information to the client;

[0008] The client uses the first decryption information to perform a first decryption on the first encrypted information to obtain first decrypted data, and destroys the first decryption information;

[0009] The client uses the first decrypted data to perform a second encryption on the important data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server;

[0010] The server uses the second decryption information to perform a second decryption on the second encrypted information, obtains second decrypted data, destroys the second decryption information, and executes a business function according to important data in the obtained second decrypted data.

[0011] A second aspect of the present application provides a system for reinforcing and encrypting important data in front-end and back-end communications, comprising: a client and a server connected to each other for communication;

[0012] The client includes: an access information generation module, a client decryption module, a client destruction module and a decrypted data encryption module;

[0013] The server includes: access information encryption module, server decryption module, server destruction module and business function execution module;

[0014] An access information generating module, configured to generate first access information after receiving a data sending instruction;

[0015] An access information encryption module is configured to receive the first access information and encrypt it to generate first encrypted information;

[0016] A client decryption module is configured to use the first decryption information to perform a first decryption on the received first encrypted information to obtain first decrypted data;

[0017] A client destruction module is configured to destroy the first decrypted information after decrypting the first decrypted information;

[0018] The decrypted data encryption module is configured to use the first decrypted data to perform a second encryption on the important data to generate second encrypted information;

[0019] The server-side decryption module is configured to use the second decryption information to perform a second decryption on the received second encrypted information to obtain second decrypted data;

[0020] A server-side destruction module is configured to destroy the second decrypted information after decrypting the second decrypted information;

[0021] The business function execution module is configured to perform logical processing and execution functions according to the acquired important data.

[0022] From the above, it can be seen that the method and system for strengthening encryption of important data in front-end and back-end communications provided by the present application undergo multiple layers of encryption and decryption during the transmission process between the client and the server, thereby avoiding the increased risk of cracking caused by the transmission of fixed information, strengthening the confidentiality of the transmission process, and destroying the records stored in the client and the server each time during the transmission process, thereby strengthening the confidentiality of important data during the transmission process, avoiding the leakage of keys after the data packet is intercepted, resulting in data cracking, tampering, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flow chart of a method for strengthening and encrypting important data in front-end and back-end communications according to an embodiment of the present application;

[0025] Figure 2 This is a flow chart of a method for reinforcing and encrypting important data in front-end and back-end communications in another embodiment of the present application;

[0026] Figure 3 This is a structural block diagram of the important data reinforcement encryption system in the front-end and back-end communications of the embodiment of the present application;

[0027] Figure 4 This is a structural block diagram of a system for reinforcing and encrypting important data in front-end and back-end communications in another embodiment of the present application;

[0028] Figure 5 A structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0030] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0031] In related technologies, the https protocol is generally used in communication requests, and data confidentiality, data integrity and identity verification security are mainly protected through digital certificates, encryption algorithms, asymmetric keys and other technologies. However, the security of the https protocol is limited and cannot protect against hacker attacks, denial of service attacks and server hijacking. Some third-party packet capture tools can capture https plaintext through certain means, so some sensitive data still needs to be encrypted.

[0032] In addition, the related technology also prevents data from being tampered with by simply applying a certain encryption algorithm to create a signature. However, as long as the cracker understands or obtains the encryption method through exhaustive means, the data can basically be tampered with or forged.

[0033] The embodiments of the present application provide a method for strengthening encryption of important data in front-end and back-end communications, strengthening the key transmission process, and thus enhancing the confidentiality of important data during transmission.

[0034] like Figure 1 As shown, the method of this embodiment includes:

[0035] Step 101: The client receives a data sending instruction, forms first access information, and sends the first access information to the server.

[0036] In this step, the data sending instruction is triggered by the interaction between the person and the client to form a first access information access service end on the client, and a communication connection is established between the client and the service end.

[0037] The client may be a web browser, an email client for sending and receiving emails, and an instant messaging client software, etc. The client is not specifically limited here.

[0038] The data sending instruction may be information data entered by a person in a web browser search on a client, identity information data and password data in an instant messaging client software, etc. The data sending instruction is not specifically limited here, and the data sending instruction is triggered by direct human operation on the client.

[0039] Step 102: The server receives the first access information, performs a first encryption on it to generate first encrypted information, and sends the first encrypted information to the client.

[0040] In this step, the server receives the first access information and generates a third RSA key pair, the third RSA key pair includes a third public key and a third private key, records the second timestamp corresponding to the third RSA key pair, uses the second timestamp as a flag, stores the third private key in the server session information, encrypts the third private key and the second timestamp through the first access information to form a first encrypted information, and sends it to the client.

[0041] A key pair is randomly generated through the RSA algorithm. The encryption and decryption process is performed by a pair of keys. Decryption is completed without directly transferring the key, thereby ensuring the security of the information and avoiding the risk of being cracked by directly transferring the key.

[0042] Through time domain and other technologies, the server responds to the runtime and creates an exclusive time domain object in the server to store the properties and configuration information required for a specific session. Here, the third private key is stored in the server session information to retain the third private key, transmit the third public key, and protect information security.

[0043] Step 103: The client uses the first decryption information to perform a first decryption on the first encrypted information to obtain first decrypted data, and destroys the first decryption information.

[0044] In this step, the client decrypts the received first encrypted information by using the first decryption information stored locally, obtains the first decrypted data, and destroys the first decryption information stored locally.

[0045] The first decryption information is stored on the client side through local storage, and the stored data parameters will not be actively passed to the server side, solving the problem of useless parameter transmission. The locally stored data is stored on the hard disk and destroyed after reaching the validity period, preventing the data stored on the client from being obtained by attacks.

[0046] Step 104: the client uses the first decrypted data to perform a second encryption on the important data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server.

[0047] In this step, the client encrypts the important data by using the third public key in the obtained first decrypted data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server.

[0048] The second encrypted information is signed by a second timestamp, replacing the signing method using a digital signature. The timestamp signing method is not subject to time limits and revocation issues at any time, further strengthening the security of the transmission content that needs to be protected.

[0049] Step 105, the server uses the second decryption information to perform a second decryption on the second access information, obtains the second decrypted data, destroys the second decryption information, and executes a business function according to the important data in the obtained second decrypted data.

[0050] In this step, the server retrieves the third private key of the third RSA key pair stored in the session information according to the second timestamp in the received second access information, decrypts the second encrypted information with the third private key, obtains important data, destroys the third private key stored in the session information, and executes business functions according to the important data in the obtained second decrypted data.

[0051] The important data obtained by the server is the logical processing data of the login page. In response to the important data, matching content is found in the database, and then the browser acts as the client to display the login page content. No specific restrictions are made on the important data here.

[0052] Through the above scheme, keys are randomly generated, encrypted and transmitted multiple times, and the key storage records of the client and server are destroyed during the data transmission process. This strengthens the key transmission process, thereby enhancing the confidentiality of important data transmission, avoiding the risk of fixed keys being cracked, and avoiding key information storage on the client to cause key leakage and interception of server-side request to return the key to crack or forge request data.

[0053] In some embodiments, Figure 2 As shown, before steps 102, 103, 104 and 105, the method includes: the client receives the data sending instruction to form first access information, and sends the first access information to the server. The method also includes:

[0054] Step 201: The client receives a data sending instruction to form encrypted access data, and sends the encrypted access data to the server.

[0055] In this step, the client receives a data sending instruction to generate a first RSA key pair, the first RSA key pair includes a first public key and a first private key, stores the first private key locally, encodes the first public key with base64, and accesses the server with the first public key encoded with base64 as a parameter.

[0056] The first public key is encoded in base64. The bsae64 encoding method encodes a longer identifier into a string, encodes binary data, makes data unreadable, and protects the confidentiality of data transmission.

[0057] Step 202: The server receives the encrypted access data, encrypts it to generate ciphertext information, and sends the ciphertext information to the client.

[0058] In this step, the server receives the first public key encoded in base64 to generate a second RSA key pair, the second RSA key pair includes a second public key and a second private key, records the first timestamp corresponding to the second RSA key pair, uses the first timestamp as a flag, stores the second public key in the server session information, encrypts the second private key and the first timestamp with the first public key to form ciphertext information and sends it to the client.

[0059] The second RSA key pair is generated on the server side and then encrypted for transmission, making it difficult to attack the server side and strengthening the confidentiality of transmission.

[0060] Step 203: The client uses the decrypted access information to decrypt the ciphertext information to generate first access information, destroys the decrypted access information, and sends the first access information to the server.

[0061] In this step, the client decrypts the received ciphertext information using the locally stored first private key, obtains the second private key and the first timestamp in the ciphertext information, forms the first access information, destroys the locally stored first private key, stores the decrypted second private key locally, and sends the first access information to the server.

[0062] Using timestamp as a variant of digital signature and as a unique time identifier for key pair generation further protects the security of front-end and back-end communications and prevents data from being forged and tampered with during transmission.

[0063] In some embodiments, the client receives a data sending instruction to form first access information and sends the first access information to the server. The method can also repeat the above steps 201, 202, and 203, and multiple layers of encryption can be performed. The number of encryption layers is set according to the performance of the client and the server. The number of encryption layers is not specifically limited here.

[0064] Through the above scheme, the number of encryption layers is increased, making the encryption rules more secure and reducing the risk of being cracked. In addition, the second key is generated and stored on the server, and then the third key is transmitted. Because the server is more difficult to attack than the client and has stronger confidentiality, the key transmission process is further strengthened, thereby achieving the effect of strengthening the confidentiality of important data during transmission.

[0065] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0066] It should be noted that the above describes some embodiments of the present application. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0067] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an important data reinforcement encryption system in front-end and back-end communications.

[0068] refer to Figure 3 , the important data reinforcement encryption system in the front-end and back-end communication includes: a client and a server connected to each other for communication;

[0069] The client includes: an access information generation module 301, a client decryption module 303, a client destruction module 304 and a decrypted data encryption module 305;

[0070] The server includes: an access information encryption module 302, a server decryption module 306, a server destruction module 307 and a business function execution module 308;

[0071] The access information generating module 301 is configured to generate first access information after receiving a data sending instruction;

[0072] The access information encryption module 302 is configured to receive the first access information and encrypt it to generate the first encrypted information;

[0073] The client decryption module 303 is configured to use the first decryption information to perform a first decryption on the received first encrypted information to obtain first decrypted data;

[0074] The client destruction module 304 is configured to destroy the first decrypted information after decrypting the first decrypted information;

[0075] The decrypted data encryption module 305 is configured to use the first decrypted data to perform a second encryption on the important data to generate second encrypted information;

[0076] The server-side decryption module 306 is configured to use the second decryption information to perform a second decryption on the received second encrypted information to obtain second decrypted data;

[0077] The server-side destruction module 307 is configured to destroy the second decrypted information after decrypting it using the second decrypted information;

[0078] The business function execution module 308 is configured to perform logic processing and execution functions according to the acquired important data.

[0079] In some embodiments, Figure 4As shown, the important data reinforcement encryption system in the front-end and back-end communication also includes:

[0080] The client includes: an encrypted access data generation module 401, a decrypted access information decryption module 403 and a decrypted access information destruction module 404;

[0081] The server includes: an encrypted access data encryption module 402;

[0082] The encrypted access data generating module 401 is configured to receive a data sending instruction to form encrypted access data;

[0083] The encrypted access data encryption module 402 is configured to encrypt the encrypted access data to generate ciphertext information;

[0084] The decryption access information decryption module 403 is configured to decrypt the received ciphertext information using the decryption access information to generate the first access information;

[0085] The decryption access information destruction module 404 is configured to destroy the decryption access information after decrypting the information using the decryption access information.

[0086] In some embodiments, the encrypted access data generation module 401 is configured to receive a data sending instruction from the client to generate a first RSA key pair, the first RSA key pair including a first public key and a first private key, store the first private key locally, encode the first public key with base64, and access the server with the base64-encoded first public key as a parameter.

[0087] In some embodiments, the encrypted access data encryption module 402 is configured to generate a second RSA key pair when the server receives a first public key encoded in base64, the second RSA key pair includes a second public key and a second private key, record the first timestamp corresponding to the second RSA key pair, use the first timestamp as a flag, store the second public key in the server session information, encrypt the second private key and the first timestamp with the first public key to form ciphertext information and send it to the client.

[0088] In some embodiments, the decryption access information decryption module 403 is configured so that the client decrypts the received ciphertext information through the first private key stored locally, obtains the second private key and the first timestamp in the ciphertext information, and forms the first access information.

[0089] The decrypted access information destruction module 404 is configured to destroy the first private key in the local storage, store the decrypted second private key locally, and send the first access information to the server.

[0090] In some embodiments, the access information encryption module 302 is configured to generate a third RSA key pair when the server receives the first access information, the third RSA key pair includes a third public key and a third private key, record the second timestamp corresponding to the third RSA key pair, use the second timestamp as a flag, store the third private key in the server session information, encrypt the third private key and the second timestamp through the first access information to form a first encrypted information and send it to the client.

[0091] In some embodiments, the client decryption module 303 is configured so that the client decrypts the received first encrypted information through the first decryption information stored locally to obtain the first decrypted data;

[0092] The client destroying module 304 is configured to destroy the first decrypted information stored locally on the client.

[0093] In some embodiments, the decrypted data encryption module 305 is configured such that the client encrypts important data using the third public key in the first decrypted data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server.

[0094] In some embodiments, the server-side decryption module 306 is configured to retrieve and call the third private key in the third RSA key pair stored in the session information according to the second timestamp in the received second access information, and decrypt the second encrypted information with the third private key to obtain the important data;

[0095] The server-side destruction module 307 is configured to destroy the third private key stored in the session information by the server;

[0096] The service function execution module 308 is configured to execute the service function at the server according to the important data in the acquired second decrypted data.

[0097] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0098] The device of the above embodiment is used to implement the corresponding important data reinforcement encryption method in the front-end and back-end communication in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0099] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the important data reinforcement encryption method in the front-end and back-end communications described in any of the above embodiments is implemented.

[0100] Figure 5 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 501, a memory 502, an input / output interface 503, a communication interface 504, and a bus 505. The processor 501, the memory 502, the input / output interface 503, and the communication interface 504 are connected to each other in communication within the device through the bus 505.

[0101] The processor 501 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0102] The memory 502 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 502 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 502 and are called and executed by the processor 501.

[0103] The input / output interface 503 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0104] The communication interface 504 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0105] The bus 505 includes a path to transmit information between various components of the device (eg, the processor 501 , the memory 502 , the input / output interface 503 , and the communication interface 504 ).

[0106] It should be noted that, although the above device only shows a processor 501, a memory 502, an input / output interface 503, a communication interface 504, and a bus 505, in a specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0107] The electronic device of the above embodiment is used to implement the corresponding important data reinforcement encryption method in the front-end and back-end communication in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0108] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the important data reinforcement encryption method in the front-end and back-end communications as described in any of the above embodiments.

[0109] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0110] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the important data reinforcement encryption method in the front-end and back-end communication as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0111] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0112] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device may be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0113] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0114] The embodiments of the present application are intended to cover all such substitutions, modifications and variations falling within the broad scope. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the protection scope of the present application.

Claims

1. A method for strengthening and encrypting important data in front-end and back-end communications, characterized in that: include: The client receives the data sending instruction to form first access information, and sends the first access information to the server; The server receives the first access information, performs a first encryption on it to generate first encrypted information, and sends the first encrypted information to the client; The client uses the first decryption information to perform a first decryption on the first encrypted information to obtain first decrypted data, and destroys the first decryption information; The client uses the first decrypted data to perform a second encryption on the important data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server; The server uses the second decryption information to perform a second decryption on the second encrypted information, obtains second decrypted data, destroys the second decryption information, and performs a service function according to important data in the obtained second decrypted data; The client receives the data sending instruction to form first access information, and sends the first access information to the server, further comprising: The client receives the data sending instruction to form encrypted access data, and sends the encrypted access data to the server; The client receives the data sending instruction to form encrypted access data, and sends the encrypted access data to the server, specifically including: The client receives a data sending instruction to generate a first RSA key pair, the first RSA key pair including a first public key and a first private key, stores the first private key locally, encodes the first public key using base64, and accesses the server using the first public key encoded with base64 as a parameter; The server receives the encrypted access data, encrypts it to generate ciphertext information, and sends the ciphertext information to the client; The client uses the decrypted access information to decrypt the ciphertext information to generate first access information, destroys the decrypted access information, and sends the first access information to the server; The server receives the encrypted access data, encrypts it to generate ciphertext information, and sends the ciphertext information to the client, specifically including: The server receives the first public key encoded in base64 to generate a second RSA key pair, where the second RSA key pair includes a second public key and a second private key. The server records the first timestamp corresponding to the second RSA key pair, uses the first timestamp as a flag, stores the second public key in the server session information, encrypts the second private key and the first timestamp with the first public key to form ciphertext information, and sends it to the client.

2. The method according to claim 1, characterized in that The client uses the decrypted access information to decrypt the ciphertext information to generate first access information, destroys the decrypted access information, and sends the first access information to the server, specifically including: The client decrypts the received ciphertext information using the first private key stored locally, obtains the second private key and the first timestamp in the ciphertext information, forms the first access information, destroys the first private key stored locally, stores the decrypted second private key locally, and sends the first access information to the server.

3. The method according to claim 1, characterized in that The server receives the first access information, performs a first encryption to generate first encrypted information, and sends the first encrypted information to the client, specifically including: The server receives the first access information and generates a third RSA key pair, wherein the third RSA key pair includes a third public key and a third private key. The server records the second timestamp corresponding to the third RSA key pair, uses the second timestamp as a flag, stores the third private key in the server session information, encrypts the third private key and the second timestamp through the first access information to form a first encrypted information, and sends it to the client.

4. The method according to claim 1, characterized in that: The client uses the first decryption information to perform a first decryption on the first encrypted information to obtain first decrypted data, and destroys the first decryption information, specifically including: The client decrypts the received first encrypted information by using the first decryption information stored locally, obtains the first decrypted data, and destroys the first decryption information stored locally.

5. The method according to claim 3, characterized in that: The client uses the first decrypted data to encrypt the important data for a second time to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server, specifically including: The client encrypts the important data by using the third public key in the obtained first decrypted data to generate second encrypted information, forms second access information based on the second encrypted information, and sends the second access information to the server.

6. The method according to claim 3, characterized in that: The server uses the second decryption information to perform a second decryption on the second encrypted information, obtains second decrypted data, and destroys the second decryption information. The server performs a service function according to important data in the obtained second decrypted data, specifically including: The server retrieves and calls the third private key in the third RSA key pair stored in the session information according to the second timestamp in the received second access information, decrypts the second encrypted information with the third private key, obtains the important data, destroys the third private key stored in the session information, and executes business functions according to the important data in the obtained second decrypted data.

7. A system for reinforcing and encrypting important data in front-end and back-end communications, characterized in that: include: The client and server communicate with each other; The client includes: an access information generation module, a client decryption module, a client destruction module and a decrypted data encryption module; The server includes: access information encryption module, server decryption module, server destruction module and business function execution module; The access information generation module is configured to generate the first access information after receiving the data sending instruction. The client receives the data sending instruction to form the first access information, and sends the first access information to the server, so that the client receives the data sending instruction to form encrypted access data, and sends the encrypted access data to the server; the server receives the encrypted access data, encrypts it to generate ciphertext information, and sends the ciphertext information to the client; the client uses the decrypted access information to decrypt the ciphertext information to generate the first access information, destroys the decrypted access information, and sends the first access information to the server; the client receives the data sending instruction to form the encrypted access data, and sends the encrypted access data to the server, so that the client receives the data sending instruction to generate the first RSA key pair , the first RSA key pair includes a first public key and a first private key, the first private key is stored locally, the first public key is encoded with base64, and the server is accessed with the first public key encoded with base64 as a parameter; the server receives the encrypted access data, encrypts it to generate ciphertext information, and sends the ciphertext information to the client, for the server to receive the first public key encoded with base64 to generate a second RSA key pair, the second RSA key pair includes a second public key and a second private key, record the first timestamp corresponding to the second RSA key pair, use the first timestamp as a flag, store the second public key in the server session information, encrypt the second private key and the first timestamp with the first public key to form ciphertext information and send it to the client; An access information encryption module is configured to receive the first access information and encrypt it to generate first encrypted information; A client decryption module is configured to use the first decryption information to perform a first decryption on the received first encrypted information to obtain first decrypted data; A client destruction module is configured to destroy the first decrypted information after decrypting the first decrypted information; The decrypted data encryption module is configured to use the first decrypted data to perform a second encryption on the important data to generate second encrypted information; The server-side decryption module is configured to use the second decryption information to perform a second decryption on the received second encrypted information to obtain second decrypted data; A server-side destruction module is configured to destroy the second decrypted information after decrypting the second decrypted information; The business function execution module is configured to perform logical processing and execution functions according to the acquired important data.

Images