Method, device and equipment for encrypting and securely transmitting sensitive data

Abstract

The present application provides a method, device and equipment for secure transmission of sensitive data through encryption. The method includes: a server obtains a second key and an encryption rule. The terminal generates a first key and an initial salt value according to a key length condition and a salt value initial condition in the encryption rule. The terminal encrypts the first key and the initial salt value using a public key to obtain a first ciphertext. The terminal inputs the initial salt value into a salt value generation algorithm to calculate the salt value. The terminal encrypts the sensitive data using the salt value and the first key to obtain a target ciphertext. The server decrypts the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain the sensitive data. The method of the present application implements one-time one-key and improves the security of encryption.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to a method, device and equipment for encrypting and securely transmitting sensitive data. Background Art

[0002] With the development of the Internet, more and more information can be exchanged through the Internet. In the process of information exchange, most of the data is public data, and it is only necessary to ensure the stability of data transmission. In the process of information exchange, some sensitive data is usually included, such as personal privacy data, financial information data, medical information data, etc.

[0003] For these sensitive data, on the basis of ensuring stable data transmission, it is usually necessary to ensure its security. At present, the security of sensitive data is usually ensured by encrypted transmission. In the prior art, the encrypted transmission of sensitive data may include presetting keys and encryption algorithms on the server side, installing encryption controls on the server side, presetting keys and encryption algorithms on the terminal side, installing encryption controls on the terminal side, etc.

[0004] However, in the above sensitive data encryption method, the key and / or encryption algorithm are usually stored in the code fragment, which is a pre-set key and / or encryption. Therefore, the prior art has the problem of low encryption security. Summary of the invention

[0005] The present application provides a method, device and equipment for encrypting and securely transmitting sensitive data, so as to solve the problem of low encryption security in the prior art.

[0006] In a first aspect, the present application provides a method for encrypting and securely transmitting sensitive data, which is applied to a terminal and includes:

[0007] Obtaining encryption rules, wherein the encryption rules are obtained from a data encryption rule pool through a server, wherein the data encryption rule pool includes multiple encryption rules, and the encryption rules include a salt value generation algorithm, a key length condition, and a salt value initial condition;

[0008] Generate a first key and an initial salt value according to the key length condition and the salt value initial condition, wherein the first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition;

[0009] Generate a salt value according to the salt value initial value and the salt value generation algorithm, wherein the salt value is a value obtained by calculating the salt value initial value through the salt value generation algorithm;

[0010] The sensitive data is encrypted using the salt value and the first key to obtain a target ciphertext.

[0011] Optionally, the method further includes:

[0012] Obtaining a public key, where the public key is a public key in a second key obtained by the server from a key pair pool, where the key pair pool includes multiple keys, and the second key is an asymmetric key;

[0013] The first key and the initial value of the salt are encrypted according to the public key to obtain a first ciphertext.

[0014] In a second aspect, the present application provides a method for encrypting and securely transmitting sensitive data, which is applied to a server and includes:

[0015] Obtaining a second key and an encryption rule, wherein the second key is obtained from a key pair pool, wherein the key pair pool includes a plurality of keys, and the encryption rule is obtained from an encryption rule pool, wherein the data encryption rule pool includes a plurality of encryption rules;

[0016] Obtaining a first ciphertext and a target ciphertext, wherein the first ciphertext and the target ciphertext are obtained from a terminal;

[0017] The target ciphertext is decrypted according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data.

[0018] Optionally, decrypting the target ciphertext according to the first ciphertext, a private key in the second key, and the encryption rule to obtain sensitive data includes:

[0019] Decrypting the first ciphertext and the private key to obtain a first key and an initial salt value;

[0020] Generate a salt value according to the salt value generation algorithm in the encryption rule and the salt value initial value;

[0021] The sensitive data is decrypted according to the target ciphertext, the salt value and the first key.

[0022] Optionally, the method further includes:

[0023] Pre-generating multiple key pairs and multiple encryption rules, wherein the key pairs are asymmetric key pairs;

[0024] Storing the key pair in the key pair pool;

[0025] The encryption rule is stored in the encryption rule pool.

[0026] Optionally, the key pair pool includes a primary key pair pool and a backup key pair pool, and the method includes:

[0027] When the master key pair pool triggers an update, the server uses the backup key pair pool to obtain a key pair, and the triggering update condition includes that the usage time of the master key pair pool exceeds a preset time and / or the number of times the master key pair pool is used exceeds a preset number of times.

[0028] In a third aspect, the present application provides a device for encrypting and securely transmitting sensitive data, which is applied to a terminal and includes:

[0029] An acquisition module, used to acquire encryption rules, wherein the encryption rules are acquired from a data encryption rule pool through a server, wherein the data encryption rule pool includes multiple encryption rules, wherein the encryption rules include a salt value generation algorithm, a key length condition, and a salt value initial condition;

[0030] A first generating module is used to generate a first key and an initial salt value according to the key length condition and the salt value initial condition, wherein the first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition;

[0031] A second generating module is used to generate a salt value according to the initial salt value and the salt value generating algorithm, wherein the salt value is a value obtained by calculating the initial salt value through the salt value generating algorithm;

[0032] The encryption module is used to encrypt the sensitive data using the salt value and the first key to obtain a target ciphertext.

[0033] Optionally, the device further comprises:

[0034] The acquisition module is further used to acquire a public key, where the public key is a public key in a second key acquired by the server from a key pair pool, where the key pair pool includes multiple keys, and the second key is an asymmetric key;

[0035] The encryption module is further used to encrypt the first key and the initial value of the salt according to the public key to obtain a first ciphertext.

[0036] In a fourth aspect, the present application provides a sensitive data encryption and secure transmission device, which is applied to a server and includes:

[0037] A first acquisition module, used to acquire a second key and an encryption rule, wherein the second key is acquired from a key pair pool, wherein the key pair pool includes a plurality of keys, and the encryption rule is acquired from an encryption rule pool, wherein the data encryption rule pool includes a plurality of encryption rules;

[0038] A second acquisition module is used to acquire a first ciphertext and a target ciphertext, wherein the first ciphertext and the target ciphertext are acquired from a terminal;

[0039] A decryption module is used to decrypt the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data.

[0040] Optionally, the decryption module specifically includes decrypting to obtain a first key and an initial salt value according to the first ciphertext and the private key; generating a salt value according to a salt value generation algorithm in the encryption rule and the initial salt value; and decrypting to obtain sensitive data according to the target ciphertext, the salt value and the first key.

[0041] Optionally, the device further comprises:

[0042] A pre-generation module, used to pre-generate multiple key pairs and multiple encryption rules, wherein the key pairs are asymmetric key pairs;

[0043] A storage module, used for storing the key pair in the key pair pool;

[0044] The storage module is also used to store the encryption rules in the encryption rule pool.

[0045] Optionally, the key pair pool includes a master key pair pool and a backup key pair pool, and the device includes:

[0046] When the master key pair pool triggers an update, the server uses the backup key pair pool to obtain a key pair, and the triggering update condition includes that the usage time of the master key pair pool exceeds a preset time and / or the number of times the master key pair pool is used exceeds a preset number of times.

[0047] In a fifth aspect, the present application provides a system for encrypting and securely transmitting sensitive data, including: a terminal and a server;

[0048] The terminal is used to implement the sensitive data encryption and secure transmission method in the first aspect and any possible design of the first aspect.

[0049] The server is used to implement the method for securely transmitting encrypted sensitive data as in the second aspect and any possible design of the second aspect.

[0050] In a sixth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the sensitive data encryption and secure transmission method in the first aspect and any possible design of the first aspect and the sensitive data encryption and secure transmission method in the second aspect and any possible design of the second aspect.

[0051] In the seventh aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the first aspect and the method for securely transmitting encrypted sensitive data in any possible design of the first aspect and the second aspect and the method for securely transmitting encrypted sensitive data in any possible design of the second aspect.

[0052] The method, device and equipment for secure transmission of sensitive data encryption provided by the present application, the server obtains the second key from the key pair pool and the encryption rule from the encryption rule pool; sends the public key and encryption rule in the second key to the terminal; decrypts the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain the means of sensitive data, realizes the random acquisition of the second key and the encryption rule, realizes one-time one-key, and improves the security of encryption. The terminal randomly generates the first key according to the key length condition in the encryption rule, and the first key is a symmetric key; generates the initial value of the salt value according to the initial condition of the salt value in the encryption rule; encrypts the first key and the initial value of the salt value using the received public key to obtain the first ciphertext; sends the first ciphertext encrypted using the public key to the server; inputs the initial value of the salt value into the salt value generation algorithm to calculate the salt value; uses the salt value and the first key to encrypt the sensitive data to obtain the target ciphertext; uploads the target ciphertext to the server, realizes the encryption of the sensitive data using the second key and the encryption rule, realizes one-time one-key, and improves the security of encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 A schematic diagram of a scenario for encrypted and secure transmission of sensitive data provided by an embodiment of the present application;

[0055] Figure 2 A signaling interaction diagram of a sensitive data encryption and secure transmission method provided in an embodiment of the present application;

[0056] Figure 3 A signaling interaction diagram of another method for securely transmitting encrypted sensitive data provided by an embodiment of the present application;

[0057] Figure 4 A schematic diagram of the structure of a device for securely transmitting encrypted sensitive data provided by an embodiment of the present application;

[0058] Figure 5A schematic diagram of the structure of another device for encrypting and securely transmitting sensitive data provided in one embodiment of the present application;

[0059] Figure 6 A schematic diagram of the structure of a system for encrypting and securely transmitting sensitive data provided in one embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in this article, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this article, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination". Furthermore, as used in this article, the singular forms "one", "one" and "the" are intended to also include plural forms, unless there is an opposite indication in the context. It should be further understood that the terms "comprising", "including" indicate the existence of features, steps, operations, elements, components, projects, kinds, and / or groups, but do not exclude the existence, occurrence or addition of one or more other features, steps, operations, elements, components, projects, kinds, and / or groups. The terms "or" and "and / or" used herein are interpreted as inclusive, or mean any one or any combination. Thus, “A, B, or C” or “A, B and / or C” means “any of the following: A; B; C; A and B; A and C; B and C; A, B, and C.” An exception to this definition will occur only when a combination of elements, functions, steps, or operations are inherently mutually exclusive in some manner.

[0062] It should be understood that, although the various steps in the flowcharts in the above-described embodiments are sequentially displayed according to the indications of the arrows, these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and they can be executed in other orders. Moreover, at least a portion of the steps in the figure may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily to be carried out sequentially, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0063] With the development of the Internet, more and more information can be exchanged through the Internet. For example, users can upload data through the terminal, view data on the terminal, download data through the terminal, etc. In the process of information exchange, most of the data is public data. For example, users can directly retrieve the obtained data on the terminal. For this data, it is usually only necessary to ensure the stability of data transmission. In addition to these data, the information interaction process may also include some sensitive data, such as personal privacy data, financial information data, medical information data, etc. For these sensitive data, on the basis of ensuring the stability of data transmission, it is usually necessary to ensure its security. For example, the personal privacy data filled in on the terminal needs to be uploaded to the server after encryption. Or, the financial information data read from the server needs to be sent to the terminal after encryption, so as to realize the display of the financial information data.

[0064] At present, the security of sensitive data is usually guaranteed by encrypted transmission. In the prior art, the encrypted transmission of sensitive data can include the following:

[0065] 1) The server may be pre-set with a key and an encryption algorithm. The key may be stored in a non-executable file. Before the terminal submits a message with sensitive information, the server may encrypt the sensitive information using the pre-set key and encryption algorithm. When the key and / or encryption algorithm needs to be updated, the server re-publishes the program to update the key and / or encryption algorithm.

[0066] 2) The terminal can be installed with an encryption control. When the terminal needs to submit a message with sensitive information, the terminal can encrypt the sensitive information through the encryption control. When the encryption algorithm needs to be updated, the encryption control usually needs to be downloaded again.

[0067] 3) When the terminal is a terminal in an APP, the terminal can also use the encryption computing capability of the APP to achieve communication between the terminal and the APP through bridge technology, thereby completing the encryption of sensitive data. When the encryption computing capability of the APP needs to be updated, the terminal needs to obtain and install a new APP program to update the key and / or encryption algorithm.

[0068] However, in the above-mentioned sensitive data encryption method, the key and / or encryption algorithm usually need to be preset in advance. For example, when the key and encryption algorithm are stored in a server, the key and encryption algorithm can be preset in the server in advance. When the terminal implements encryption with the help of an APP or an encryption control, the key and / or encryption algorithm are usually stored in the code of the APP or the encryption control. The preset code has the problem of fixed keys and / or encryption algorithms, and the probability of cracking is high, and there is a problem of low security. In addition, if the key and / or encryption algorithm needs to be updated, it is usually necessary to reinstall the program or reinstall the APP, which is very inconvenient and has the problem of low flexibility.

[0069] In view of the above problems, the present application proposes a method, device and equipment for secure transmission of sensitive data encryption. The present application configures an encryption rule pool and a key pair pool on the server side, so that the server can implement a one-time one-key when obtaining the key and encryption rule, thereby improving the security of encryption. In the present application, the terminal obtains the sensitive data entered by the user in the browser. When the user submits the sensitive data at the terminal, the terminal encrypts the sensitive data. The terminal requests the server to obtain the second key from the key pair pool and the encryption rule from the encryption rule pool. The terminal obtains the encryption rule and the public key in the second key fed back by the server. The terminal generates a first key and an initial value of the salt value according to the encryption rule. The terminal encrypts the first key and the initial value of the salt value using the public key and uploads them to the server. The server decrypts the first key and the initial value of the salt value using the private key in the second key to obtain the first key and the initial value of the salt value. When the user submits the sensitive data at the terminal, the terminal generates a corresponding message according to the sensitive data. The terminal encrypts the message using the first key and the salt value to obtain the target ciphertext. The terminal reports the target ciphertext to the server. The server decrypts the target ciphertext using the first key and the salt value to obtain the sensitive data.

[0070] The technical solution of the present application is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0071] Figure 1A schematic diagram of a scenario for encrypted and secure transmission of sensitive data provided by an embodiment of the present application is shown. It includes a terminal and a server. Among them, the terminal includes a computer, a tablet, a mobile phone, etc. The scenario in which the terminal submits sensitive data may include: a user opens a web page through an application or APP on the terminal, and the user enters sensitive data on the web page. The user submits the sensitive data on the web page. Alternatively, the user enters sensitive data on the interactive interface of the application or APP on the terminal. The user submits the sensitive data on the interactive interface. Alternatively, the method for encrypted and secure transmission of sensitive data used in the present application can also be applied to sensitive downloading of data from a server to a terminal. The application or APP on the terminal displays the sensitive data on a web page or an interactive interface.

[0072] In this application, the terminal and the server are used as the execution entities to execute the sensitive data encryption and secure transmission method of the following embodiment.

[0073] Figure 2 The following is a signaling interaction diagram of a sensitive data encryption and secure transmission method provided by an embodiment of the present application. Figure 1 Based on the embodiment shown, Figure 2 As shown, the method of this embodiment may include the following steps:

[0074] S101. The server obtains a second key and an encryption rule. The second key is obtained from a key pair pool. The key pair pool includes multiple keys. The encryption rule is obtained from an encryption rule pool. The data encryption rule pool includes multiple encryption rules.

[0075] In this embodiment, after the server receives the encryption request sent by the terminal, the server obtains the second key from the key pair pool and obtains the encryption rule from the encryption rule pool.

[0076] The key pair pool includes multiple key pairs. The server randomly obtains a key pair from the multiple key pairs as the second key. After the server obtains the second key from the key pair pool, the key pair pool deletes the second key from the key pair pool, thereby preventing the second key from being repeatedly selected. The second key is an asymmetric key, which includes a public key and a private key.

[0077] The encryption rule pool includes multiple encryption rules. The server randomly obtains an encryption rule from the multiple encryption rules as the encryption rule for sensitive data. After the server obtains the encryption rule from the encryption rule pool, the encryption rule will be deleted from the encryption rule pool to avoid repeated selection of the encryption rule. The encryption rule may include a salt value generation algorithm, a key length condition, and a salt value initial condition.

[0078] S102: The server sends the public key encryption rule of the second key to the terminal, where the encryption rule includes a salt value generation algorithm, a key length condition, and a salt value initial condition.

[0079] In this embodiment, the server sends the public key and encryption rule in the second key to the terminal.

[0080] S103. The terminal generates a first key and an initial salt value according to the key length condition and the salt value initial condition. The first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition.

[0081] In this embodiment, after receiving the encryption rule sent by the server, the terminal obtains the key length condition and the salt value initial condition in the encryption rule.

[0082] The terminal randomly generates a first key according to a key length condition. The length of the first key meets the key length condition. The first key is a symmetric key.

[0083] The terminal generates the initial salt value according to the initial salt value condition. For example, when the initial salt value condition includes the initial salt value, the terminal can directly obtain the initial salt value. When the initial salt value condition does not include the initial salt value, the terminal can randomly generate the initial salt value according to the initial salt value condition.

[0084] S104. The terminal encrypts the first key and the initial value of the salt according to the public key to obtain a first ciphertext.

[0085] In this embodiment, the terminal can use the received public key to encrypt the first key and the initial value of the salt. The encryption method can be an existing encryption method or an improved encryption method, which is not limited in this application. The terminal obtains the first ciphertext after encryption.

[0086] S105. The terminal sends the first ciphertext to the server.

[0087] In this embodiment, the terminal sends the first ciphertext obtained by encrypting with the public key to the server.

[0088] S106. The terminal generates a salt value according to the initial salt value and a salt value generation algorithm. The salt value is a value obtained by calculating the initial salt value through the salt value generation algorithm.

[0089] In this embodiment, after calculating and obtaining the initial value of the salt value, the terminal inputs the initial value of the salt value into the salt value generation algorithm to calculate and obtain the salt value.

[0090] S107. The terminal uses the salt value and the first key to encrypt the sensitive data to obtain a target ciphertext.

[0091] In this embodiment, when the user clicks the submit or upload button on the webpage or interactive interface, the terminal generates a message according to the content on the webpage or interactive interface. The message includes sensitive data. The terminal encrypts the sensitive data using the salt value and the first key. The encryption method may be an existing encryption method or an improved encryption method, which is not limited in this application. The terminal obtains the target ciphertext after encryption.

[0092] S108. The terminal sends the target ciphertext to the server.

[0093] In this embodiment, the terminal uploads the target ciphertext to the server.

[0094] S109. The server decrypts the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data.

[0095] In this embodiment, after receiving the first ciphertext, the server can decrypt the first ciphertext according to the private key in the second key. The server decrypts the first ciphertext to obtain the first key and the initial value of the salt value. The server uses the salt value generation algorithm in the encryption rule to calculate the initial value of the salt value to obtain the salt value. The server uses the first key and salt value obtained by decryption to decrypt the target ciphertext to obtain a message containing sensitive data. The server parses the message to obtain the sensitive data.

[0096] The server stores the sensitive data in a corresponding storage device.

[0097] The sensitive data encryption and secure transmission method provided by the present application is that the server obtains the second key from the key pair pool and obtains the encryption rule from the encryption rule pool. The server sends the public key and encryption rule in the second key to the terminal. The terminal randomly generates the first key according to the key length condition in the encryption rule. The first key is a symmetric key. The terminal generates the initial value of the salt value according to the initial condition of the salt value in the encryption rule. The terminal encrypts the first key and the initial value of the salt value using the received public key to obtain the first ciphertext. The terminal sends the first ciphertext encrypted using the public key to the server. The terminal inputs the initial value of the salt value into the salt value generation algorithm to calculate the salt value. The terminal encrypts the sensitive data using the salt value and the first key to obtain the target ciphertext. The terminal uploads the target ciphertext to the server. The server decrypts the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain the sensitive data. In the present application, by randomly obtaining the second key and the encryption rule, one-time one-key is achieved to improve the security of encryption.

[0098] Figure 3 The following is a signaling interaction diagram of another sensitive data encryption and secure transmission method provided by an embodiment of the present application. Figure 2Based on the embodiment, this embodiment also includes a key pair pool and an encryption rule pool. Figure 3 As shown, the method of this embodiment may include the following steps:

[0099] S201. The server pregenerates multiple key pairs and multiple encryption rules, where the key pairs are asymmetric key pairs.

[0100] In this embodiment, the server pregenerates multiple key pairs and encryption rules. The server can pregenerate the key pairs and encryption rules regularly according to a preset update cycle. Or the server can also pregenerate multiple key pairs and encryption rule pools when the key pair pool or encryption rule pool needs to be updated.

[0101] S202: The server stores the key pair in a key pair pool.

[0102] In this embodiment, after pre-generating multiple key pairs, the server adds the key pair to the key pair pool.

[0103] In one example, the server may include a master key pair pool and a backup key pair pool. When the master key pair pool triggers an update, the server uses the backup key pair pool to obtain a key pair. After the server switches to obtaining a key pair from the backup key pair pool, the server adds multiple pre-generated key pairs to the master key pair pool to update the master key pair pool. When the master key pair pool completes the update, the server switches back to the master key pair pool to obtain a key pair. The server updates the key pairs in the backup key pair pool based on the usage of the backup key pair pool during the update to maintain the stability of the backup key pair pool.

[0104] The condition for triggering the update of the master key pair pool may include that the usage time of the master key pair pool exceeds a preset time and / or the number of times the master key pair pool is used exceeds a preset number.

[0105] S203: The server stores the encryption rules in an encryption rule pool.

[0106] In this embodiment, after pre-generating a plurality of encryption rules, the server adds the encryption rules to the encryption rule pool.

[0107] In one example, the server may include a main encryption rule pool and a backup encryption rule pool. When the main encryption rule pool triggers an update, the server uses the backup encryption rule pool to obtain encryption rules. When the server switches to the backup encryption rule pool, the server adds the pre-generated multiple encryption rules to the main encryption rule pool to implement the update of the main encryption rule pool. When the update is completed, the server switches back to the main encryption rule pool. In addition, the server updates the encryption rules in the backup encryption rule pool based on the usage of the backup encryption rule pool during the update to maintain the stability of the backup key pair pool.

[0108] S204: The terminal obtains terminal sensitive information.

[0109] In this embodiment, when the webpage or interactive interface of the terminal includes sensitive information, the terminal initiates an encryption request to the server. When the user clicks upload or submit on the webpage or interactive interface, the terminal obtains the sensitive information therein. The terminal generates a corresponding message according to the webpage or interactive interface. The message includes sensitive information.

[0110] S205. The server obtains a second key and an encryption rule. The second key is obtained from a key pair pool, which includes multiple keys. The encryption rule is obtained from an encryption rule pool, which includes multiple encryption rules.

[0111] S206. The server sends the public key encryption rule of the second key to the terminal, where the encryption rule includes a salt value generation algorithm, a key length condition, and a salt value initial condition.

[0112] S207. The terminal generates a first key and an initial salt value according to the key length condition and the salt value initial condition. The first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition.

[0113] S208. The terminal encrypts the first key and the initial value of the salt according to the public key to obtain a first ciphertext.

[0114] S209: The terminal sends the first ciphertext to the server.

[0115] S210. The terminal generates a salt value according to an initial salt value and a salt value generation algorithm. The salt value is a value obtained by calculating the initial salt value through the salt value generation algorithm.

[0116] S211. The terminal uses the salt value and the first key to encrypt the sensitive data to obtain a target ciphertext.

[0117] S212. The terminal sends the target ciphertext to the server.

[0118] Among them, steps S205 to S212 are Figure 2 The implementation of steps S101 to S108 in the embodiment is similar and will not be described in detail in this embodiment.

[0119] S213. The server decrypts the first ciphertext and the private key to obtain the first key and the initial value of the salt value.

[0120] In this embodiment, this step can be performed after S209. When the server receives the first ciphertext sent by the terminal, the server can use the private key in the second key to decrypt the first ciphertext. The server uses the private key to decrypt the first ciphertext to obtain the first key and the initial value of the salt value.

[0121] S214. The server generates a salt value according to the salt value generation algorithm and the initial salt value in the encryption rule.

[0122] In this embodiment, after the server decrypts the first ciphertext to obtain the initial salt value, the server can generate the salt value according to the salt value generation algorithm and the initial salt value in the encryption rule. Specifically, the server inputs the initial salt value into the salt value generation algorithm to calculate the salt value.

[0123] S215. The server decrypts the target ciphertext, the salt value and the first key to obtain the sensitive data.

[0124] In this embodiment, this step can be performed after S212. After the server obtains the target ciphertext from the terminal, the server can use S213 to decrypt the first ciphertext and the salt value calculated by S214 to decrypt the target ciphertext. The server can decrypt to obtain a message containing sensitive data. The server parses the message to obtain sensitive data. The server stores the sensitive data in a corresponding storage device.

[0125] The method for secure transmission of sensitive data encryption provided by the present application is that the server pregenerates multiple key pairs and encryption rules. The server stores the key pair in a key pair pool. The server stores the encryption rules in an encryption rule pool. The server obtains a second key from the key pair pool and obtains the encryption rules from the encryption rule pool. The server sends the public key and encryption rules in the second key to the terminal. The terminal randomly generates a first key according to the key length condition in the encryption rule. The first key is a symmetric key. The terminal generates an initial salt value according to the initial salt value condition in the encryption rule. The terminal encrypts the first key and the initial salt value using the received public key to obtain a first ciphertext. The terminal sends the first ciphertext encrypted using the public key to the server. The terminal inputs the initial salt value into the salt value generation algorithm to calculate the salt value. The terminal encrypts the sensitive data using the salt value and the first key to obtain the target ciphertext. The terminal uploads the target ciphertext to the server. The server decrypts the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain the sensitive data. In the present application, by randomly obtaining the second key and the encryption rule, one-time one-key is achieved to improve the security of encryption. At the same time, the present application can also enable the server to update the key pair pool while ensuring the efficiency of key pair acquisition by switching between the main key pair pool and the backup key pair pool, thereby improving the flexibility of key update.

[0126] Figure 4 A schematic diagram of the structure of a sensitive data encryption and secure transmission device provided by an embodiment of the present application is shown. Figure 4As shown, the sensitive data encryption and secure transmission device 10 of this embodiment is used to implement the operation corresponding to the terminal in any of the above method embodiments. The sensitive data encryption and secure transmission device 10 of this embodiment includes:

[0127] An acquisition module 11 is used to acquire encryption rules. The encryption rules are acquired from a data encryption rule pool through a server. The data encryption rule pool includes multiple encryption rules. The encryption rules include a salt value generation algorithm, a key length condition, and a salt value initial condition.

[0128] A first generating module 12 is used to generate a first key and an initial salt value according to a key length condition and a salt value initial condition, wherein the first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition;

[0129] A second generating module 13 is used to generate a salt value according to the initial salt value and a salt value generating algorithm, wherein the salt value is a value obtained by calculating the initial salt value through the salt value generating algorithm;

[0130] The encryption module 14 is used to encrypt the sensitive data using the salt value and the first key to obtain a target ciphertext.

[0131] In one example, the acquisition module 11 is further used to acquire a public key, where the public key is a public key in a second key acquired by the server from a key pair pool, where the key pair pool includes multiple keys, and the second key is an asymmetric key;

[0132] The encryption module 14 is further used to encrypt the first key and the initial value of the salt according to the public key to obtain a first ciphertext.

[0133] The sensitive data encryption and secure transmission device 10 provided in the embodiment of the present application can execute the above method embodiment. Its specific implementation principle and technical effects can be found in the above method embodiment, and this embodiment will not be repeated here.

[0134] Figure 5 A schematic diagram of the structure of another sensitive data encryption and secure transmission device provided by an embodiment of the present application is shown. Figure 4 Based on the embodiment shown, Figure 5 As shown, the sensitive data encryption and secure transmission device 20 of this embodiment is used to implement the operation corresponding to the server in any of the above method embodiments. The sensitive data encryption and secure transmission device 20 of this embodiment includes:

[0135] A first acquisition module 21, used to acquire a second key and an encryption rule, the second key is acquired from a key pair pool, the key pair pool includes multiple keys, and the encryption rule is acquired from an encryption rule pool, the data encryption rule pool includes multiple encryption rules;

[0136] A second acquisition module 22, used to acquire a first ciphertext and a target ciphertext, where the first ciphertext and the target ciphertext are acquired from a terminal;

[0137] The decryption module 23 is used to decrypt the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data.

[0138] In one example, the decryption module 23 is specifically used to decrypt the first key and the initial salt value according to the first ciphertext and the private key; generate the salt value according to the salt value generation algorithm and the initial salt value in the encryption rule; and decrypt the sensitive data according to the target ciphertext, the salt value and the first key.

[0139] In one example, the sensitive data encryption and secure transmission device 20 further includes:

[0140] A pre-generation module 24, used to pre-generate multiple key pairs and multiple encryption rules, the key pairs are asymmetric key pairs;

[0141] The storage module 25 is used to store the key pair in the key pair pool;

[0142] The storage module 25 is also used to store the encryption rules in the encryption rule pool.

[0143] In one example, the key pair pool includes a main key pair pool and a backup key pair pool. When the main key pair pool triggers an update, the server uses the backup key pair pool to obtain a key pair. The conditions for triggering the update include that the usage time of the main key pair pool exceeds a preset time and / or the number of times the main key pair pool is used exceeds a preset number of times.

[0144] Figure 6 FIG. 1 is a schematic diagram showing a structure of a sensitive data encryption and secure transmission system provided by an embodiment of the present application. Figure 6 As shown, the sensitive data encryption and secure transmission system 30 may include: a terminal 31 and a server 32;

[0145] The terminal 31 includes a web page for interacting with the user. The web page can be a web page opened directly by the terminal, a web page opened by the terminal through an APP, etc. The terminal is used to implement the sensitive data encryption and secure transmission method in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0146] The server is used to implement the method for implementing the sensitive data encryption and secure transmission method in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0147] The electronic device provided in this embodiment can be used to execute the above-mentioned method for securely transmitting encrypted sensitive data. Its implementation method and technical effects are similar and will not be described in detail in this embodiment.

[0148] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the methods provided in the various embodiments described above.

[0149] The present application also provides a program product, which includes an execution instruction, which is stored in a computer-readable storage medium. At least one processor of the device can read the execution instruction from the computer-readable storage medium, and at least one processor executes the execution instruction so that the device implements the methods provided in the various embodiments described above.

[0150] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0151] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0152] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0153] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0154] Those skilled in the art will appreciate that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the above embodiments can still be modified, or some or all of the technical features can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for encrypting and securely transmitting sensitive data, characterized in that: Applied to a terminal, the method comprises: Obtaining encryption rules and public keys, wherein the encryption rules are obtained from an encryption rule pool through a server, wherein the encryption rule pool includes multiple encryption rules, wherein the encryption rules include a salt value generation algorithm, a key length condition, and a salt value initial condition. After the server obtains the encryption rules from the encryption rule pool, the encryption rules will be deleted from the encryption rule pool. The public key is a public key in a second key obtained by the server from a key pair pool, wherein the key pair pool includes multiple key pairs, each key pair including a public key and a private key. After the server obtains the second key from the key pair pool, the key pair pool deletes the second key from the key pair pool. Generate a first key and an initial salt value according to the key length condition and the salt value initial condition, wherein the first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition; Encrypting the first key and the initial value of the salt according to the public key to obtain a first ciphertext, and sending the first ciphertext to the server; Generate a salt value according to the salt value initial value and the salt value generation algorithm, wherein the salt value is a value obtained by calculating the salt value initial value through the salt value generation algorithm; The sensitive data is encrypted using the salt value and the first key to obtain a target ciphertext, and the target ciphertext is sent to the server. The server is used to decrypt the first key and the initial salt value according to the first ciphertext and the private key in the second key, and generate a salt value according to the salt value generation algorithm in the encryption rule and the initial salt value, so as to decrypt the sensitive data according to the target ciphertext, the salt value and the first key.

2. A method for encrypting and securely transmitting sensitive data, characterized in that: Applied to a server, the method comprises: Obtaining a second key and an encryption rule, wherein the second key is obtained from a key pair pool, wherein the key pair pool includes multiple key pairs, each key pair includes a public key and a private key, and after the server obtains the second key from the key pair pool, the key pair pool deletes the second key from the key pair pool; the encryption rule is obtained from an encryption rule pool, wherein the encryption rule pool includes multiple encryption rules, wherein the encryption rule includes a salt value generation algorithm, a key length condition, and a salt value initial condition, and after the server obtains the encryption rule from the encryption rule pool, the encryption rule will be deleted from the encryption rule pool; Obtaining a first ciphertext and a target ciphertext, wherein the first ciphertext and the target ciphertext are obtained from a terminal; Decrypt the target ciphertext according to the first ciphertext, the private key in the second key, and the encryption rule to obtain sensitive data; The decrypting the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data includes: Decrypting, according to the first ciphertext and the private key, to obtain a first key and an initial salt value, wherein the first key is a symmetric key randomly generated by the terminal according to the key length condition, and the initial salt value is a value randomly generated by the terminal according to the initial salt value condition; Generate a salt value according to the salt value generation algorithm in the encryption rule and the salt value initial value; The sensitive data is decrypted according to the target ciphertext, the salt value and the first key.

3. The method according to claim 2, characterized in that The method further comprises: Pre-generating multiple key pairs and multiple encryption rules, wherein the key pairs are asymmetric key pairs; Storing the key pair in the key pair pool; The encryption rule is stored in the encryption rule pool.

4. The method according to claim 3, characterized in that The key pair pool includes a primary key pair pool and a backup key pair pool, and the method includes: When the master key pair pool triggers an update, the server uses the backup key pair pool to obtain a key pair, and the conditions for triggering the update include that the usage time of the master key pair pool exceeds a preset time and / or the number of times the master key pair pool is used exceeds a preset number of times.

5. A device for encrypting and securely transmitting sensitive data, characterized in that: Applied to a terminal, the device comprises: An acquisition module is used to acquire encryption rules and public keys. The encryption rules are acquired from a data encryption rule pool by a server. The data encryption rule pool includes multiple encryption rules. The encryption rules include a salt value generation algorithm, a key length condition, and a salt value initial condition. After the server acquires the encryption rules from the encryption rule pool, the encryption rules will be deleted from the encryption rule pool. The public key is a public key in a second key acquired by the server from a key pair pool. The key pair pool includes multiple key pairs, each key pair includes a public key and a private key. After the server acquires the second key from the key pair pool, the key pair pool deletes the second key from the key pair pool. A first generating module, configured to generate a first key and an initial salt value according to the key length condition and the salt value initial condition, wherein the first key is a symmetric key randomly generated according to the key length condition, and the initial salt value is a value randomly generated according to the salt value initial condition; An encryption module, used to encrypt the first key and the initial value of the salt value according to the public key to obtain a first ciphertext, and send the first ciphertext to the server; A second generating module is used to generate a salt value according to the initial salt value and the salt value generating algorithm, wherein the salt value is a value obtained by calculating the initial salt value through the salt value generating algorithm; The encryption module is further used to encrypt the sensitive data using the salt value and the first key to obtain a target ciphertext, and send the target ciphertext to the server. The server is used to decrypt the first key and the initial salt value according to the first ciphertext and the private key in the second key, and generate a salt value according to the salt value generation algorithm in the encryption rule and the initial salt value, so as to decrypt the sensitive data according to the target ciphertext, the salt value and the first key.

6. A device for encrypting and securely transmitting sensitive data, characterized in that: Applied to a server, the device comprises: A first acquisition module is used to acquire a second key and an encryption rule, wherein the second key is acquired from a key pair pool, wherein the key pair pool includes multiple key pairs, each key pair includes a public key and a private key, and the encryption rule is acquired from an encryption rule pool, wherein the data encryption rule pool includes multiple encryption rules, and the encryption rule includes a salt value generation algorithm, a key length condition, and a salt value initial condition; A second acquisition module is used to acquire a first ciphertext and a target ciphertext, wherein the first ciphertext and the target ciphertext are acquired from a terminal; A decryption module, configured to decrypt the target ciphertext according to the first ciphertext, the private key in the second key and the encryption rule to obtain sensitive data; Wherein, the decryption module is specifically used for: Decrypting, according to the first ciphertext and the private key, to obtain a first key and an initial salt value, wherein the first key is a symmetric key randomly generated by the terminal according to the key length condition, and the initial salt value is a value randomly generated by the terminal according to the initial salt value condition; Generate a salt value according to the salt value generation algorithm in the encryption rule and the salt value initial value; The sensitive data is decrypted according to the target ciphertext, the salt value and the first key.

7. A sensitive data encryption and secure transmission system, characterized in that: The system comprises: a terminal and a server; The terminal is used to implement the sensitive data encryption and secure transmission method as claimed in claim 1; The server is used to implement the sensitive data encryption and secure transmission method as described in any one of claims 2-4.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, is used to implement the sensitive data encryption and secure transmission method as described in any one of claims 1 to 4.

9. A computer program product, characterized in that The computer program product comprises a computer program, characterized in that when the computer program is executed by a processor, the method for encrypting and securely transmitting sensitive data as described in any one of claims 1 to 4 is implemented.

Images