Mini-program data processing method, device, equipment, and storage medium

Abstract

The present disclosure provides a data processing method, device, equipment and storage medium for a mini-program, and relates to the field of computer technology, and in particular to the field of mini-program technology. The specific implementation scheme is: encrypt the handshake data of the mini-program client to obtain first encrypted data, and the handshake data of the mini-program client includes the first information of the host program; send a handshake request including the first encrypted data to the mini-program server; receive the handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, and the handshake response includes the handshake data of the mini-program server; generate a shared key based on the handshake data of the mini-program server, and the shared key is used to encrypt and decrypt business data. The method of the embodiment of the present disclosure can ensure the security of the business data of the mini-program.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of applet technology. Background Art

[0002] Smart Mini Programs can run on multiple open source alliance host programs (or host applications). Some unsigned host programs forge the information of online signed hosts to run smart mini programs, which may make it difficult to ensure the security of mini programs on host programs. Summary of the invention

[0003] The present invention provides a data processing method, device, equipment and storage medium for a small program.

[0004] According to one aspect of the present disclosure, a data processing method of an applet is provided, comprising:

[0005] Encrypting the handshake data of the mini-program client to obtain first encrypted data, wherein the handshake data of the mini-program client includes first information of the host program;

[0006] Sending a handshake request including the first encrypted data to the mini program server;

[0007] Receiving a handshake response returned by the applet server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, the handshake response including the handshake data of the applet server;

[0008] A shared key is generated based on the handshake data of the applet server, and the shared key is used to encrypt and decrypt business data.

[0009] According to another aspect of the present disclosure, there is provided a data processing method for an applet, comprising:

[0010] Receive a handshake request including first encrypted data sent by the mini-program client, where the first encrypted data includes data obtained by the mini-program client encrypting handshake data of the mini-program client, where the handshake data of the mini-program client includes first information of the host program;

[0011] Verifying first information of the host program obtained by decrypting the first encrypted data;

[0012] If the verification is successful, a handshake response is returned to the mini-program client, and the handshake response includes the handshake data of the mini-program server;

[0013] A shared key is generated based on the handshake data of the applet client, and the shared key is used to encrypt and decrypt business data.

[0014] According to another aspect of the present disclosure, there is provided a data processing device for an applet, comprising:

[0015] A first encryption module, used to encrypt the handshake data of the mini-program client to obtain first encrypted data, wherein the handshake data of the mini-program client includes first information of the host program;

[0016] A first sending module, used to send a handshake request including the first encrypted data to the mini program server;

[0017] A first receiving module is used to receive a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, wherein the handshake response includes the handshake data of the mini-program server;

[0018] The first processing module is used to generate a shared key according to the handshake data of the mini-program server, and the shared key is used to encrypt and decrypt business data.

[0019] According to another aspect of the present disclosure, there is provided a data processing device for an applet, comprising:

[0020] A third receiving module is used to receive a handshake request including first encrypted data sent by the mini-program client, where the first encrypted data includes data obtained by the mini-program client encrypting the handshake data of the mini-program client, where the handshake data of the mini-program client includes first information of the host program;

[0021] A first verification module, used for verifying first information of the host program obtained by decrypting the first encrypted data;

[0022] A first return module, used to return a handshake response to the mini-program client when the verification is successful, wherein the handshake response includes handshake data of the mini-program server;

[0023] The second processing module is used to generate a shared key according to the handshake data of the mini-program client, and the shared key is used to encrypt and decrypt the business data.

[0024] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any embodiment of the present disclosure.

[0028] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method according to any embodiment of the present disclosure.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method according to any one of the embodiments of the present disclosure is implemented.

[0030] According to the present disclosure, the first information of the host program can be verified during the handshake process, and if the verification is successful, the shared key used to encrypt and decrypt the business data can be obtained through the handshake process, thereby preventing the information of the host program from being impersonated and ensuring the security of the business data of the mini program.

[0031] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0033] Figure 1 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure;

[0034] Figure 2 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure;

[0035] Figure 3 is a flow chart of key exchange using DH algorithm according to an embodiment of the present disclosure;

[0036] Figure 4 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure;

[0037] Figure 5 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure;

[0038] Figure 6 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure;

[0039] Figure 7 It is a flowchart of pulling a small program package in the related technology;

[0040] Figure 8 is a schematic diagram of a process of pulling a small program package according to an embodiment of the present disclosure;

[0041] Fig. 9 is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure;

[0042] Fig.10 is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure;

[0043] Fig.11 is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure;

[0044] Fig.12 is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure;

[0045] Fig.13 It is a block diagram of an electronic device used to implement the data processing method of the applet of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0047] Figure 1 1 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure. The data processing method of the mini-program may include:

[0048] S101. Encrypt handshake data of a mini-program client to obtain first encrypted data. The handshake data of the mini-program client includes first information of a host program.

[0049] S102: Send a handshake request including the first encrypted data to the mini program server.

[0050] S103, receiving a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, wherein the handshake response includes the handshake data of the mini-program server.

[0051] S104. Generate a shared key according to the handshake data of the applet server, where the shared key is used to encrypt and decrypt business data.

[0052] In the disclosed embodiments, a mini program may be an application that can be used without downloading and installing. The host program may include a program that provides an application environment for the mini program. The mini program client may be called a mini program SDK (Software Development Kit), a mini program framework, etc., and may include the ability to support the operation of various mini programs. The mini program client may be integrated in the host program. The host program may be registered in a host platform (or host server), and a successfully registered host program may be called a legitimate host program. The mini program client integrated in a legitimate host program may support subsequent processing of business data of various mini programs.

[0053] In order to prevent illegal host programs from impersonating legitimate host program information, verification can be performed based on the first information of the host program. The first information of the host program may include information built into the host program to represent the unique identity of the host. After the mini program SDK obtains the first information of the host program, the first information of the host program can be encrypted as part of the handshake data of the mini program client. For example, the handshake data of the mini program client may include a ClientHello protocol package. Encrypting the ClientHello protocol package can obtain protocol buffer extension package data (referred to as data package). The extension package may include the first information of the host program, etc.

[0054] There may be multiple algorithms for encrypting the handshake data of the mini-program client, such as asymmetric encryption algorithms and symmetric encryption algorithms. For example, the RSA (Rivest, Shamir, Adleman) encryption algorithm is used to generate a public key and a private key. The handshake data of the mini-program client is encrypted using the public key on the mini-program client, and the encrypted first encrypted data is sent to the mini-program server through a handshake request. The mini-program server decrypts the first encrypted data using the private key to obtain the handshake data of the mini-program client, and verifies the first information of the host program therein to determine whether the host program is legal. If the verification is successful, it means that the host program is legal, and if the verification fails, it means that the host program is illegal. Information for verification may be pre-stored in the mini-program server. For example, the first information of the host program includes using the MD5 (information digest) algorithm to calculate the package name of the host program to obtain an MD5 string, and the MD5 string pre-stored in the mini-program server may be compared to see if there is a string matching the MD5 string represented by the first information of the host program. If there is, it means that the first information of the host program has been successfully verified. After successful verification, the handshake process can continue, and the mini program server returns the handshake data of the mini program server to the mini program client. Through the handshake process, the mini program client can obtain the shared key for encrypting and decrypting subsequent business data based on the handshake data of the mini program server. The mini program server can also obtain the shared key for encrypting and decrypting subsequent business data based on the handshake data of the mini program client. The shared keys at both ends can be the same.

[0055] In an embodiment of the present application, the first information of the host program can be verified during the handshake process, and if the verification is successful, the shared key used to encrypt and decrypt the business data can be obtained through the handshake process, thereby preventing the information of the host program from being impersonated and ensuring the security of the business data of the mini program.

[0056] In a possible implementation, Figure 2 As shown, the method further includes: S201, obtaining second information of the host program from the host program, wherein the second information of the host program includes key material for generating a public key obtained by the host program from a host server.

[0057] In a possible implementation, in S101, encrypting the handshake data of the mini-program client includes: S202, encrypting the handshake data of the mini-program client using the public key.

[0058] In the disclosed embodiment, the host server may store information of a variety of host programs (which may be referred to as host information, host registration information, etc.), and the host program and / or the mini-program server may obtain the required host program information from the host server. For example, host program A obtains the registration information of host program A from the host server, and host program B obtains the registration information of host program B from the host server. A variety of host programs may include different types of host programs such as video, map, social, etc., and may also include host programs of the same type and different versions. The host program may obtain information of the host program, i.e., the second information of the host program, from the host server. The information of the host program obtained from the host server may include key materials for generating a public key. The key materials may include information such as the host's identification. The key materials may be calculated using the RAS algorithm to obtain a public key and a private key. Among them, the public key is stored in the mini-program client, and the private key is stored in the mini-program server. Encrypting the handshake data of the mini-program client using the public key generated by the second information of the host program is conducive to ensuring the security of the handshake process.

[0059] In one possible implementation, the first information of the host program includes first verification information obtained based on information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; and the handshake data of the mini program client includes the first verification information and the second verification information.

[0060] In an embodiment of the present disclosure, the host program may obtain second information of the host program from the host server, which may include second verification information related to the identity of the host program, such as identification information (identity, ID) assigned by the host server to the host program. The identification information may be used to verify whether the host program is legal. Since the identification information may be intercepted by an unregistered host program, in order to prevent an unregistered host program from impersonating a registered host program, a multi-level verification may be performed in combination with the first verification information and the second verification information. The verification order of the first verification information and the second verification information may not be restricted.

[0061] For example, first verify whether the first verification information is legal. If the first verification information is legal, then verify whether the second verification information is legal. If the second verification information is also legal, it means that the overall verification of the host program is successful. If the first verification information is not legal, no subsequent verification is performed. If the first verification information is legal but the second verification information is not legal, it also means that the overall verification of the host program is unsuccessful.

[0062] For another example, first verify whether the second verification information is legal. If the second verification information is legal, then verify whether the first verification information is legal. If the first verification information is also legal, it means that the overall verification of the host program is successful. If the second verification information is not legal, no subsequent verification is performed. If the second verification information is legal but the first verification information is not legal, it also means that the overall verification of the host program is unsuccessful.

[0063] Since the first verification information includes information related to the identity of the host program obtained directly from the host program, such as the package name of the host APP (Application), the package name is usually not easily intercepted or tampered with, and the verification result is more accurate. Therefore, by performing multi-level verification on the first verification information and the second verification information, it is helpful to improve the accuracy of the host program verification and improve the data security of the mini program.

[0064] In a possible implementation, using the public key to encrypt the handshake data of the mini-program client includes: using the public key to encrypt the first verification information and the second verification information.

[0065] In the disclosed embodiment, the mini program client can use the public key to encrypt the first verification information, such as the package name of the host APP, and the second verification information, such as the ID registered by the host APP, to obtain the first encrypted data. Then send a handshake request including the first encrypted data to the mini program server. The mini program server uses the private key to decrypt the first encrypted data to obtain the first verification information and the second verification information, and then refer to the above-mentioned verification steps to verify whether the first verification information and the second verification information are legal using the legal information stored locally on the mini program server. If legal, the mini program server further returns a handshake response to the mini program client. If illegal, the mini program server may not return a handshake response, or return a response of handshake failure.

[0066] In one possible implementation, receiving a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data includes: receiving a handshake response returned by the mini-program server when the first verification information and the second verification information are successfully verified.

[0067] In the disclosed embodiment, after the mini program client receives the handshake response indicating a successful handshake, it can obtain the mini program server handshake data in the handshake response, such as the ServerHello protocol packet. The mini program server handshake data in the handshake response can be encrypted, such as encrypted using the RAS algorithm, or can be unencrypted. If it is encrypted, it can be decrypted using the RAS algorithm.

[0068] In the disclosed embodiment, a handshake response is returned when the first verification information and the second verification information are successfully verified, which is beneficial to improving the accuracy of host program verification during the handshake phase and improving the security of mini program data.

[0069] In a possible implementation, the information related to the host program identity stored locally by the host program includes the package name of the host program. In the disclosed embodiment, the package name of the host program can be associated with the operating system that the host program needs to be applicable to. The package name of host program A in one operating system is A1, and the package name in another operating system is A2.

[0070] In a possible implementation, the method further includes: using an information digest algorithm to encrypt the package name of the host program to obtain the first verification information. For example, the information digest algorithm may be an MD5 algorithm, and the MD5 algorithm may be used to calculate the package name of the host program, and the obtained first verification information includes the encrypted package name. The encrypted package name and the ID registered by the host APP are then encrypted together using the public key to obtain the first encrypted data. Since the package name of the host program can usually uniquely determine the identity of the host program, and the package name built into the host program is not easily counterfeited, after the mini program client encrypts the package name of the host program, it can be encrypted again together with other identity information for handshake, which can better improve the security of the handshake stage.

[0071] In a possible implementation, the handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client.

[0072] In the disclosed embodiment, the mini-program client and the mini-program server may exchange keys during the handshake phase through a key exchange algorithm such as the DH (Diffie–Hellman) algorithm. Random numbers may be generated in the mini-program client and the mini-program server, respectively. For example, the mini-program client includes a first random number, and the mini-program server includes a second random number. The mini-program client may perform a modulus operation on the first random number to obtain a first public number, and the mini-program server may perform a modulus operation on the second to obtain a second public number. Then, the mini-program client and the mini-program server may exchange the first public number and the second public number with each other. For example, the mini-program client may use the first public number as part of the handshake data of the mini-program client, encrypt it together with other information such as the first verification information and / or the second verification information using a public key, and then send it to the mini-program server through a handshake request. For another example, the mini-program server may send the second public number to the mini-program client through a handshake response.

[0073] In a possible implementation, in S104, a shared key is generated based on the handshake data of the mini-program server, including: performing a modulus operation based on the second public number to obtain the shared key of the mini-program client. For example, the mini-program client can generate a shared key based on the second public number. The mini-program server can also generate a shared key based on the first public number. The shared key generated by the mini-program client can be equal to the shared key generated by the mini-program server. In this way, in subsequent specific business processes, the shared key can be used to encrypt and decrypt business data exchanged between the mini-program client and the mini-program server, thereby improving the security of the business data.

[0074] like Figure 3 FIG. 1 is a flowchart of an exemplary key exchange using the DH algorithm. The process of generating a shared key may include the following steps:

[0075] The mini program client generates a first random number A, and the mini program server generates a second random number B. The random number is modulo-operated using parameters G and P. For example, the mini program client uses G A mod P performs a modulo operation on A to obtain the first public number α. The applet server uses G B mod P performs a modulus operation on B to obtain the second public number β. Then, the mini program client and the mini program server exchange the first public number and the second public number through a handshake process. A×B mod P(β A mod P) performs a modulus operation on β to obtain the shared key K A In the mini program service, you can use G A×B mod P(α A mod P) performs a modulus operation on α to obtain the shared key K B Among them, K A =K B .

[0076] In a possible implementation, Figure 4 As shown, the method also includes:

[0077] S401. Send a service request to the mini-program server, where the service request includes uplink service data encrypted by using the shared key.

[0078] S402. Receive a service response returned by the mini-program server, wherein the service response includes downlink service data encrypted by using the shared key after the mini-program server decrypts and processes the encrypted uplink service data by using the shared key.

[0079] In the disclosed embodiment, the mini program client and the mini program server can obtain the same shared key after a successful handshake. The shared key can be used to implement symmetric encryption of the mini program client and the mini program server. For example, the AES (Advanced Encryption Standard) algorithm can be used to encrypt and decrypt business data. Using a shared key to encrypt and decrypt business data between the mini program client and the mini program server can improve the security of business data and prevent business data leakage.

[0080] In a possible implementation manner, the service request also includes first verification information and / or second verification information of the host program.

[0081] In a possible implementation, receiving a service response returned by the mini-program server includes: receiving a service response returned by the mini-program server when the first verification information and / or the second verification information are successfully verified.

[0082] In an embodiment of the present disclosure, if the business request includes the first verification information of the above-mentioned host program, such as the encrypted package name of the host program and / or the second verification information such as the registered ID of the host program, the host program can be verified again at the business request stage, and business requests of illegal host programs can be intercepted. The illegal host programs can be managed and controlled by mini-program packages, thereby limiting the flow of pulling mini-program package entrances and restricting mini-program authorization services.

[0083] Figure 5 1 is a flowchart of a data processing method of a mini-program according to an embodiment of the present disclosure. The data processing method of the mini-program may include:

[0084] S501, receiving a handshake request including first encrypted data sent by a mini-program client, where the first encrypted data includes data obtained by the mini-program client encrypting handshake data of the mini-program client, where the handshake data of the mini-program client includes first information of the host program;

[0085] S502, verifying the first information of the host program obtained by decrypting the first encrypted data;

[0086] S503: If the verification is successful, a handshake response is returned to the mini-program client, and the handshake response includes the handshake data of the mini-program server.

[0087] S504: Generate a shared key according to the handshake data of the applet client, where the shared key is used to encrypt and decrypt business data.

[0088] In a possible implementation, verifying the first information of the host program obtained by decrypting the first encrypted data includes:

[0089] Decrypting the first encrypted data using a private key corresponding to the public key of the mini-program client to obtain first information of the host program;

[0090] Verifying the first information of the host program;

[0091] The public key of the mini-program client is generated based on the second information of the host program obtained from the host program; the second information of the host program includes the key material for generating the public key obtained by the host program from the host server.

[0092] In a possible implementation, the first information of the host program includes first verification information obtained by encrypting information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information;

[0093] Verifying the first information of the host program includes: verifying the first verification information and the second verification information.

[0094] In a possible implementation, the information related to the host program identity stored locally by the host program includes a package name of the host program;

[0095] The first information of the host program is verified, including: verifying whether there is information matching the first verification information in the mini-program server.

[0096] For example, the first verification information includes an MD5 string obtained by calculating the package name of the host program using the MD5 algorithm. The mini-program server can pre-acquire the package name of the registered legal host program, and use the same MD5 algorithm to calculate the MD5 string corresponding to the package name of the legal host program. After the mini-program server receives the first verification information to be verified, it can search the locally calculated MD5 string to see whether there is an MD5 string that is the same as the first verification information. If so, it means the match is successful, that is, the verification is successful.

[0097] In a possible implementation, the handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client.

[0098] In a possible implementation, generating a shared key according to the handshake data of the mini-program server includes: performing a modulo operation on the first public number to obtain the shared key of the mini-program server.

[0099] In a possible implementation, Figure 6 As shown, the method also includes:

[0100] S601, receiving a service request sent by the mini-program client, where the service request includes uplink service data encrypted by using the shared key;

[0101] S602: Decrypt and process the encrypted uplink service data using the shared key to obtain downlink service data;

[0102] S603, using the shared key to encrypt the downlink service data;

[0103] S604: Return a service response to the mini-program client, including the encrypted downlink service data.

[0104] In a possible implementation manner, the service request further includes the first verification information and / or the second verification information of the host program;

[0105] In a possible implementation, the method further includes: verifying the first verification information and / or the second verification information. This step may be performed before S604 and S603, or after S602 decrypts the uplink service data to obtain the first verification information and the second verification information.

[0106] In S601, returning a service response to the mini-program client includes: if the verification is successful, returning the service response to the mini-program client.

[0107] Above Figure 5 and Figure 6 For specific examples and explanations in the method embodiments, please refer to Figures 1 to 4 The relevant description of the method embodiment will not be repeated here.

[0108] In the related art, some unsigned host APPs (which may be referred to as hosts, host applications, host programs, etc.) may forge the registration information of online signed host APPs (which may be referred to as host information) to run smart mini-programs. At this time, the security of the mini-programs on the host APP cannot be guaranteed. Moreover, as the output party of the smart mini-program technical service, it is impossible to control the malicious pulling of mini-program packages by unsigned host APPs, resulting in the malicious theft of online mini-program packages. To this end, the method provided in the embodiments of the present disclosure can identify legitimate hosts; limit the flow of pulling mini-program package entrances; and limit mini-program authorization services.

[0109] like Figure 7 As shown, in the related art, the process of pulling the mini-program package may include:

[0110] S701. The host APP client (referred to as host, host APP, host program, etc.) is initialized and configured in the mini program SDK.

[0111] S702. The mini program SDK initiates a request for a mini program package to the smart mini program server (server) through a C / S (Client / Server) protocol such as HTTPS (HyperText Transfer Protocol over Secure Socket Layer) carrying the hostname parameter of the host.

[0112] S703, the server verifies the hostname, identifies the signed host APP client through the hostname, and then executes S704.

[0113] S704: Allow the host APP client to download the mini program package.

[0114] In S701, if an unsigned host forges host configuration information (or host information), the mini program server may also recognize that the hostname is legitimate, and the mini program SDK can be downloaded to the mini program package based on the forged host configuration information.

[0115] The related technology has the risk of host information being replaced. The small program package requests plain text data transmission and plain text return, and the request will be captured. The small program server cannot perceive the host with a legal contract. The disclosed embodiment can add a unique identification identity verification to the host information and encrypt the package request.

[0116] In the disclosed embodiment, an identity is added to the host information, and the host information can be encrypted using the public key corresponding to the host information. In one example, a package request may include two stages: a handshake request stage to obtain a key such as a shared key; a service request stage to encrypt the parameter information of the package request (such as host information, APP package name information) using the key obtained in the handshake stage. The server returns data in ciphertext, and the plaintext is parsed using the key. If the host forges the host information, and carries the encrypted host's identity and APP package name (obtained from the APP and cannot be replaced) in the handshake stage, the mini program Server can decrypt the handshake request and identify the illegal host, and subsequent package request services can be intercepted. Furthermore, it is also possible to perform mini program package management on illegal hosts.

[0117] The disclosed embodiment takes the service of requesting to download a mini-program package as an example. The process of requesting a mini-program package may include two stages: a handshake request stage and a service request stage. In the handshake request stage, the mini-program SDK constructs the ClientHello protocol and the ServerHello protocol by agreeing on a set of its own network communication protocols such as TLS (Transport Layer Security) with the mini-program server (server), ensuring that the mini-program SDK (native) and the mini-program server are both trusted and obtain a trusted key. The handshake request may be a ciphertext request. In the service request stage (for example, requesting a mini-program package), the key obtained in the handshake stage can be used to encrypt the service uplink parameters, obtain a ciphertext request, and return the protocol buffer data in ciphertext. The mini-program SDK uses a key to decrypt internally. The entire communication link is encrypted throughout, and third-party developers cannot capture packets or forge information.

[0118] like Figure 8 As shown, the process of pulling (downloading) the mini-program package includes:

[0119] S801. The host APP client obtains host information from an open source host platform (also referred to as a host server). The host information may include registration information assigned to the host APP client by the host platform after the host APP client registers as a legitimate user on the host platform. The registration information may include the ID (identity) of the host APP client, key materials, etc.

[0120] S802. The host APP client initializes the host information in the mini program SDK.

[0121] S803. The mini program SDK obtains the package name of the host APP from the host APP client, and performs MD5 operation on the package name to obtain the signature information (MD5 string) corresponding to the package name of the host APP.

[0122] The handshake phase may include S804 to S810.

[0123] S804. Generate a public key using the host information corresponding to the host APP client, such as identification information and key materials therein.

[0124] S805: Use the public key to encrypt the ClientHello protocol to obtain protocol buffer extension package data. The extension package data may include signature information, a public number (key-share) for generating a shared key, and the like.

[0125] S806. The mini program SDK sends a handshake request to the mini program server. The uplink parameter of the handshake request may include the extension package data encrypted by the public key. The handshake request may also include the registered ID in the host information, and the registered ID may also be encrypted together with the signature information, the public number of the mini program SDK, etc.

[0126] S807. After receiving the handshake request, the mini program server uses the private key to decrypt it. Use the decrypted data to verify the host APP client. Verify whether the signature information is legal, whether the registered ID is legal, etc. If it is legal, continue to execute other steps in the handshake phase. If it is illegal, it can be considered that the handshake has failed, and the subsequent handshake steps and business request steps will no longer be executed. If the verification is successful, the mini program server can generate a ServerHello protocol package (or protocol data package). The ServerHello protocol package can include the public number of the mini program server. In addition, the mini program server can also use the public number of the received mini program SDK to calculate the shared key of the mini program server.

[0127] S808: The mini program server returns a handshake response to the mini program SDK, and the handshake response may include a ServerHello protocol packet. The ServerHello protocol packet may be encrypted.

[0128] S809: Decrypt the ServerHello protocol packet using the public key.

[0129] S810. The mini program SDK uses the public key of the mini program server obtained by decrypting the ServerHello protocol packet to generate a key such as a shared key. In this way, the mini program SDK and the mini program server can store the same shared key.

[0130] The service request phase may include S811 to S818.

[0131] S811. The mini program SDK uses the key obtained in the handshake phase, such as the shared key, to encrypt the uplink service data and generate an application protocol package. This step can encrypt the uplink service data and the host program's verification information together. The host program's verification information may include the signature information used in the handshake phase, the registered ID, etc.

[0132] S812: The mini program SDK sends a service request, such as a request to download a mini program package, to the mini program server. The uplink parameter of the service request may include the application protocol package encrypted in the previous step.

[0133] S813. The mini program server decrypts the service request using its own shared key and processes the decrypted uplink service data, for example, checking whether there is a mini program package requested to be downloaded by the mini program SDK.

[0134] S814: Encrypt the service response of the mini-program server, such as a ServerHello protocol packet, using the shared key. The ServerHello protocol packet may include service processing results, such as whether to allow the mini-program package to be downloaded, the mini-program package download address, etc.

[0135] S815. The mini program server returns a ServerHello protocol packet of the service request to the mini program SDK.

[0136] S816. The mini program SDK uses the shared key to decrypt the ServerHello protocol packet and obtain content business data.

[0137] The disclosed embodiments can safely and effectively prevent host developers from arbitrarily pulling mini-program packages and running mini-programs without review by the mini-program server.

[0138] Fig. 9 : is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure, the device comprising:

[0139] The first encryption module 901 is used to encrypt the handshake data of the mini-program client to obtain first encrypted data, where the handshake data of the mini-program client includes first information of the host program;

[0140] A first sending module 902, configured to send a handshake request including the first encrypted data to the mini program server;

[0141] A first receiving module 903 is used to receive a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, wherein the handshake response includes handshake data of the mini-program server;

[0142] The first processing module 904 is used to generate a shared key according to the handshake data of the mini-program server, and the shared key is used to encrypt and decrypt business data.

[0143] In a possible implementation, Fig.10 As shown, the device further includes: an acquisition module 1001, configured to acquire second information of the host program from the host program, wherein the second information of the host program includes key material for generating a public key acquired by the host program from the host server;

[0144] The first encryption module 901 is also used to encrypt the handshake data of the mini-program client using the public key.

[0145] In a possible implementation, the first information of the host program includes first verification information obtained according to information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information;

[0146] The first encryption module 901 is further used to encrypt the first verification information and the second verification information using the public key;

[0147] The first receiving module 903 is further configured to receive a handshake response returned by the mini-program server when the first verification information and the second verification information are successfully verified.

[0148] In a possible implementation, the information related to the host program identity stored locally by the host program includes the package name of the host program, such as Fig.10 As shown, the device also includes:

[0149] The second encryption module 1002 is used to encrypt the package name of the host program by using an information digest algorithm to obtain the first verification information.

[0150] In a possible implementation, the handshake data of the applet client includes a first public number that needs to be exchanged with the applet server; the handshake data of the applet server includes a second public number that needs to be exchanged with the applet client;

[0151] The first processing module 904 is further configured to perform a modulo operation on the second public number to obtain the shared key of the mini-program client.

[0152] In a possible implementation, Fig.10 As shown, the device also includes:

[0153] The second sending module 1003 is used to send a service request to the mini program server, where the service request includes uplink service data encrypted by the shared key;

[0154] The second receiving module 1004 is used to receive a service response returned by the mini-program server, wherein the service response includes downlink service data encrypted by using the shared key after the mini-program server decrypts and processes the encrypted uplink service data by using the shared key.

[0155] In a possible implementation manner, the service request further includes the first verification information and / or the second verification information of the host program;

[0156] The second receiving module 1004 is further used to receive a business response returned by the mini-program server when the first verification information and / or the second verification information are successfully verified.

[0157] Fig.11 : is a schematic diagram of the structure of a data processing device for a mini-program according to an embodiment of the present disclosure, the device comprising:

[0158] The third receiving module 1101 is used to receive a handshake request including first encrypted data sent by the mini program client, where the first encrypted data includes data obtained by the mini program client encrypting the handshake data of the mini program client, where the handshake data of the mini program client includes first information of the host program;

[0159] A first verification module 1102, used to verify the first information of the host program obtained by decrypting the first encrypted data;

[0160] The first returning module 1103 is used to return a handshake response to the mini-program client if the verification is successful, and the handshake response includes the handshake data of the mini-program server;

[0161] The second processing module 1104 is used to generate a shared key according to the handshake data of the mini-program client, and the shared key is used to encrypt and decrypt the business data.

[0162] In a possible implementation, the first verification module 1102 is further configured to decrypt the first encrypted data using a private key corresponding to the public key of the mini program client to obtain the first information of the host program; and verify the first information of the host program;

[0163] The public key of the mini-program client is generated based on the second information of the host program obtained from the host program; the second information of the host program includes the key material for generating the public key obtained by the host program from the host server.

[0164] In a possible implementation, the first information of the host program includes first verification information obtained by encrypting information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information;

[0165] The first verification module 1102 is further used to verify the first verification information and the second verification information.

[0166] In a possible implementation, the information related to the host program identity stored locally by the host program includes a package name of the host program;

[0167] The first information of the host program is verified, including: verifying whether there is information matching the first verification information in the mini-program server.

[0168] In a possible implementation, the handshake data of the applet client includes a first public number that needs to be exchanged with the applet server; the handshake data of the applet server includes a second public number that needs to be exchanged with the applet client;

[0169] Generate a shared key based on the handshake data of the applet server, including:

[0170] A modulo operation is performed on the first public number to obtain the shared key of the mini-program server.

[0171] In a possible implementation, Fig.12 As shown, the device also includes:

[0172] The fourth receiving module 1201 is used to receive a service request sent by the mini-program client, where the service request includes uplink service data encrypted by using the shared key;

[0173] The third processing module 1202 is used to decrypt and process the encrypted uplink service data using the shared key to obtain downlink service data;

[0174] The third encryption module 1203 is used to encrypt the downlink service data using the shared key;

[0175] The second returning module 1204 is used to return a service response to the mini-program client, including the encrypted downlink service data.

[0176] In a possible implementation manner, the service request further includes the first verification information and / or the second verification information of the host program;

[0177] like Fig.12 As shown, the device further includes: a second verification module 1205, configured to verify the first verification information and / or the second verification information;

[0178] The second returning module 1204 is further used to return the service response to the mini program client when the verification is successful.

[0179] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0180] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0181] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0182] Fig.13 A schematic block diagram of an example electronic device 1300 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0183] like Fig.13 As shown, the device 1300 includes a computing unit 1301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1302 or a computer program loaded from a storage unit 1308 into a random access memory (RAM) 1303. In the RAM 1303, various programs and data required for the operation of the device 1300 can also be stored. The computing unit 1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. An input / output (I / O) interface 1305 is also connected to the bus 1304.

[0184] A number of components in the device 1300 are connected to the I / O interface 1305, including: an input unit 1306, such as a keyboard, a mouse, etc.; an output unit 1307, such as various types of displays, speakers, etc.; a storage unit 1308, such as a disk, an optical disk, etc.; and a communication unit 1309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1309 allows the device 1300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0185] The computing unit 1301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1301 performs the various methods and processes described above, such as the data processing method of the applet. For example, in some embodiments, the data processing method of the applet may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1308. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1300 via the ROM 1302 and / or the communication unit 1309. When the computer program is loaded into the RAM 1303 and executed by the computing unit 1301, one or more steps of the data processing method of the applet described above may be executed. Alternatively, in other embodiments, the computing unit 1301 may be configured to execute the data processing method of the applet in any other appropriate manner (eg, by means of firmware).

[0186] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0187] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0188] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0189] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0190] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0191] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0192] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0193] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A data processing method for a mini program, comprising: Encrypting the handshake data of the mini-program client to obtain first encrypted data, wherein the handshake data of the mini-program client includes first information of the host program; Sending a handshake request including the first encrypted data to the mini program server; receiving a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, wherein the handshake response includes the handshake data of the mini-program server; A shared key is generated according to the handshake data of the mini-program server, and the shared key is used to encrypt and decrypt business data.

2. The method according to claim 1, further comprising: Acquire second information of the host program from the host program, wherein the second information of the host program includes key material for generating a public key obtained by the host program from a host server; Encrypting the handshake data of the mini-program client includes: encrypting the handshake data of the mini-program client using the public key.

3. The method according to claim 2, wherein: The first information of the host program includes first verification information obtained according to information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information; Encrypting the handshake data of the mini-program client using the public key includes: encrypting the first verification information and the second verification information using the public key; Receiving a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data includes: receiving a handshake response returned by the mini-program server when the first verification information and the second verification information are successfully verified.

4. The method according to claim 3, wherein: The information related to the host program identity stored locally by the host program includes a package name of the host program, and the method further includes: The package name of the host program is encrypted using an information digest algorithm to obtain the first verification information.

5. The method according to any one of claims 1 to 4, wherein: The handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client; Generating a shared key according to the handshake data of the mini-program server includes: performing a modulo operation on the second public number to obtain the shared key of the mini-program client.

6. The method according to claim 5, further comprising: Sending a service request to the mini-program server, wherein the service request includes uplink service data encrypted by using the shared key; A service response returned by the mini-program server is received, wherein the service response includes downlink service data encrypted by using the shared key after the mini-program server decrypts and processes the encrypted uplink service data by using the shared key.

7. The method according to claim 6, wherein: The service request also includes first verification information and / or second verification information of the host program; Receiving a service response returned by the mini program server, including: Receive a service response returned by the mini-program server when the first verification information and / or the second verification information are successfully verified.

8. A data processing method for a mini program, comprising: Receive a handshake request including first encrypted data sent by the mini-program client, where the first encrypted data includes data obtained by the mini-program client encrypting handshake data of the mini-program client, where the handshake data of the mini-program client includes first information of the host program; Verifying first information of the host program obtained by decrypting the first encrypted data; If the verification is successful, a handshake response is returned to the mini-program client, wherein the handshake response includes handshake data of the mini-program server; A shared key is generated according to the handshake data of the mini-program client, and the shared key is used to encrypt and decrypt business data.

9. The method according to claim 8, wherein: Verifying the first information of the host program obtained by decrypting the first encrypted data includes: Decrypting the first encrypted data using a private key corresponding to the public key of the mini-program client to obtain first information of the host program; Verifying the first information of the host program; The public key of the mini-program client is generated based on the second information of the host program obtained from the host program; the second information of the host program includes the key material for generating the public key obtained by the host program from the host server.

10. The method according to claim 9, wherein: The first information of the host program includes first verification information obtained by encrypting information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; The handshake data of the mini program client includes the first verification information and the second verification information; Verifying the first information of the host program includes: verifying the first verification information and the second verification information.

11. The method according to claim 10, wherein: The information related to the identity of the host program stored locally by the host program includes the package name of the host program; Verifying the first information of the host program includes: verifying whether there is information matching the first verification information in the mini-program server.

12. The method according to any one of claims 8 to 11, wherein: The handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client; Generating a shared key according to the handshake data of the applet server, including: The shared key of the mini-program server is obtained by performing a modulo operation on the first public number.

13. The method according to claim 12, further comprising: Receiving a service request sent by the mini-program client, wherein the service request includes uplink service data encrypted by using the shared key; Decrypting and processing the encrypted uplink service data using the shared key to obtain downlink service data; Encrypting the downlink service data using the shared key; A service response is returned to the mini-program client, wherein the service response includes encrypted downlink service data.

14. The method according to claim 13, wherein: The service request also includes first verification information and / or second verification information of the host program; The method further comprises: verifying the first verification information and / or the second verification information; Returning a service response to the mini-program client includes: returning the service response to the mini-program client when verification is successful.

15. A data processing device for a small program, comprising: A first encryption module, used to encrypt the handshake data of the mini-program client to obtain first encrypted data, wherein the handshake data of the mini-program client includes first information of the host program; A first sending module, used to send a handshake request including the first encrypted data to the mini program server; A first receiving module, configured to receive a handshake response returned by the mini-program server after successfully verifying the first information of the host program obtained by decrypting the first encrypted data, wherein the handshake response includes handshake data of the mini-program server; The first processing module is used to generate a shared key according to the handshake data of the mini-program server, and the shared key is used to encrypt and decrypt business data.

16. The apparatus according to claim 15, further comprising: An acquisition module, configured to acquire second information of the host program from the host program, wherein the second information of the host program includes key material for generating a public key acquired by the host program from a host server; The first encryption module is also used to encrypt the handshake data of the mini-program client using the public key.

17. The device according to claim 16, wherein: The first information of the host program includes first verification information obtained according to information related to the identity of the host program stored locally by the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information; The first encryption module is further used to encrypt the first verification information and the second verification information using the public key; The first receiving module is further configured to receive a handshake response returned by the mini-program server when the first verification information and the second verification information are successfully verified.

18. The device according to claim 17, wherein: The information related to the identity of the host program stored locally by the host program includes a package name of the host program, and the device further includes: The second encryption module is used to encrypt the package name of the host program by using an information digest algorithm to obtain the first verification information.

19. The device according to any one of claims 15 to 18, wherein: The handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client; The first processing module is further used to perform a modulo operation according to the second public number to obtain the shared key of the mini-program client.

20. The apparatus according to claim 19, further comprising: A second sending module, configured to send a service request to the mini-program server, wherein the service request includes uplink service data encrypted by using the shared key; The second receiving module is used to receive a service response returned by the mini-program server, wherein the service response includes downlink service data encrypted by using the shared key after the mini-program server decrypts and processes the encrypted uplink service data by using the shared key.

21. The device according to claim 20, wherein: The service request also includes first verification information and / or second verification information of the host program; The second receiving module is further used to receive a business response returned by the mini program server when the first verification information and / or the second verification information are successfully verified.

22. A data processing device for a small program, comprising: A third receiving module is used to receive a handshake request including first encrypted data sent by the mini-program client, where the first encrypted data includes data obtained by the mini-program client encrypting the handshake data of the mini-program client, and the handshake data of the mini-program client includes first information of the host program; A first verification module, used for verifying first information of the host program obtained by decrypting the first encrypted data; A first returning module, configured to return a handshake response to the mini-program client if the verification is successful, wherein the handshake response includes handshake data of the mini-program server; The second processing module is used to generate a shared key according to the handshake data of the mini-program client, and the shared key is used to encrypt and decrypt business data.

23. The device according to claim 22, wherein: The first verification module is further used to decrypt the first encrypted data using a private key corresponding to the public key of the mini-program client to obtain the first information of the host program; and verify the first information of the host program; The public key of the mini-program client is generated based on the second information of the host program obtained from the host program; the second information of the host program includes the key material for generating the public key obtained by the host program from the host server.

24. The device according to claim 23, wherein: The first information of the host program includes first verification information obtained by encrypting information related to the identity of the host program stored locally in the host program; the second information of the host program also includes second verification information related to the identity of the host program obtained by the host program from the host server; the handshake data of the mini program client includes the first verification information and the second verification information; The first verification module is further used to verify the first verification information and the second verification information.

25. The device according to claim 24, wherein: The information related to the identity of the host program stored locally by the host program includes the package name of the host program; Verifying the first information of the host program includes: verifying whether there is information matching the first verification information in the mini-program server.

26. The device according to any one of claims 22 to 25, wherein: The handshake data of the mini-program client includes a first public number that needs to be exchanged with the mini-program server; the handshake data of the mini-program server includes a second public number that needs to be exchanged with the mini-program client; Generating a shared key according to the handshake data of the applet server, including: The shared key of the mini-program server is obtained by performing a modulo operation on the first public number.

27. The apparatus according to claim 26, further comprising: A fourth receiving module, configured to receive a service request sent by the mini-program client, wherein the service request includes uplink service data encrypted by using the shared key; A third processing module, configured to decrypt and process the encrypted uplink service data using the shared key to obtain downlink service data; A third encryption module, used to encrypt the downlink service data using the shared key; The second returning module is used to return a service response to the mini program client, and the service response includes encrypted downlink service data.

28. The device according to claim 27, wherein The service request also includes first verification information and / or second verification information of the host program; The device further includes: a second verification module, configured to verify the first verification information and / or the second verification information; The second returning module is further configured to return the service response to the mini program client when the verification is successful.

29. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 14.

30. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-14.

31. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 14.

Images