Data processing method, device, electronic device and computer readable storage medium

Abstract

The embodiments of the present invention disclose a data processing method, device, electronic device and computer-readable storage medium; when an application access request is received, the embodiments of the present invention obtains an application resource package of a target terminal application corresponding to the application access request to run the target terminal application, and then, when a data input request sent by the target terminal application is received, a security certificate and security parameters are extracted from the application resource package, and then, according to the data input request, the input target data is received through a preset security component, and then, based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data, and the encrypted target data is sent to a business server corresponding to the target terminal application so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key; this scheme can improve the security of data processing.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data processing method, device, electronic device and computer-readable storage medium. Background Art

[0002] In recent years, with the rapid development of Internet technology, there are more and more terminal applications on terminals. When using these terminal applications, users may need to enter some sensitive data, such as various passwords or other data that they do not want to be maliciously obtained by others. These data often need to be processed before they can be sent to the business server corresponding to the terminal application. The existing data processing method is usually an encryption method based on Javascript (a script parsing language) script set during the application development stage to encrypt and decrypt these data.

[0003] In the process of research and practice of the prior art, the inventors of the present invention found that when using Javascript scripts to encrypt data, the encryption logic is easily leaked, and the encryption behavior may also be maliciously modified, thereby greatly reducing the security of data processing. Summary of the invention

[0004] Embodiments of the present invention provide a data processing method, device, electronic device, and computer-readable storage medium, which can improve the security of data processing.

[0005] A data processing method, comprising:

[0006] When an application access request is received, obtaining an application resource package of a target terminal application corresponding to the application access request to run the target terminal application;

[0007] When receiving a data input request sent by the target terminal application, extracting a security certificate and security parameters from the application resource package, wherein the security certificate includes a public key of the target terminal application and is a certificate issued by a security server based on the public key;

[0008] According to the data input request, receiving input target data through a preset security component, the target data being data that needs to be protected;

[0009] Encrypting the target data based on the security parameter and the public key to obtain encrypted target data;

[0010] The encrypted target data is sent to a service server corresponding to the target terminal application, so that the service server decrypts the encrypted target data according to a private key corresponding to the public key.

[0011] Optionally, the present invention may also provide another data processing method, including:

[0012] Receiving a security certificate acquisition request for a target terminal application, the security certificate acquisition request carrying a public key of the target terminal application;

[0013] Generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request;

[0014] Sending the security certificate to the service server of the target terminal application so that the service server generates an application resource package of the target terminal application according to the security certificate;

[0015] The application resource package sent by the business server is received, and the application resource package is sent to the terminal, so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0016] Accordingly, an embodiment of the present invention provides a data processing device, including:

[0017] an acquisition unit, configured to, when receiving an application access request, acquire an application resource package of a target terminal application corresponding to the application access request, so as to run the target terminal application;

[0018] an extraction unit, configured to extract security parameters and a security certificate from the application resource package when receiving a data input request sent by the target terminal application, wherein the security certificate includes a public key of the target terminal application and is a certificate issued by a security server based on the public key;

[0019] A receiving unit, configured to receive input target data through a preset security component according to the data input request, wherein the target data is data to be protected;

[0020] an encryption unit, configured to encrypt the target data based on the security parameter and the public key to obtain encrypted target data;

[0021] The first sending unit is used to send the encrypted target data to the service server corresponding to the target terminal application, so that the service server decrypts the encrypted target data according to the private key corresponding to the public key.

[0022] Optionally, the embodiment of the present invention may further provide another data processing device, including:

[0023] A second receiving unit, configured to receive a security certificate acquisition request for a target terminal application, wherein the security certificate acquisition request carries a public key of the target terminal application;

[0024] A generating unit, configured to generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request;

[0025] A second sending unit, configured to send the security certificate to a service server of the target terminal application, so that the service server generates an application resource package of the target terminal application according to the security certificate;

[0026] The third receiving unit is used to receive the application resource package sent by the business server, and send the application resource package to the terminal, so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0027] Optionally, in some embodiments, the first receiving unit can be specifically used to call a preset security component according to the data input request, and build a data input page based on the preset security component, wherein the data input page includes a security input control; and receive target data input on the data input page through the security input control.

[0028] Optionally, in some embodiments, the first receiving unit can be specifically used to obtain the current business data of the target terminal application according to the data input request; construct an initial data input page based on the current business data; and add a security input control to the initial data input page according to the preset security component to obtain the data input page.

[0029] Optionally, in some embodiments, the first receiving unit can be specifically used to determine the data type of the target data that needs to be input based on the current business data; generate a security input control corresponding to the data type based on the preset security component; and add the security input control to the initial data input page to obtain the data input page.

[0030] Optionally, in some embodiments, the first receiving unit can be specifically used to extract the application identifier of the target terminal application from the application resource package; obtain the target security certificate information corresponding to the application identifier through the preset security component; verify the security certificate according to the target security certificate information; and construct a data input page based on the preset security component, including: when the security certificate verification passes, constructing a data input page based on the preset security component.

[0031] Optionally, in some embodiments, the encryption unit may be specifically used to determine an encryption algorithm for the target data according to the security parameters; and encrypt the target data based on the encryption algorithm and the public key to obtain encrypted target data.

[0032] Optionally, in some embodiments, the encryption unit can be specifically used to identify auxiliary encryption parameters in the security parameters, and encrypt the target data according to the auxiliary encryption parameters and the auxiliary encryption algorithm to obtain initial encrypted target data; based on the public key and the public key encryption algorithm, encrypt the initial encrypted target data to obtain encrypted target data.

[0033] Optionally, in some embodiments, the encryption unit can be specifically used to determine the type of the challenge factor when the auxiliary encryption parameter is a challenge factor; obtain a target encryption factor corresponding to the type of the challenge factor, and merge the target encryption factor with the target data to obtain the target data after initial encryption.

[0034] Optionally, in some embodiments, the generation unit can be specifically used to obtain the identity information of the developer of the target terminal application according to the security certificate acquisition request; verify the identity of the developer based on the identity information; when the identity verification of the developer passes, generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request.

[0035] Optionally, in some embodiments, the generating unit can be specifically used to send the security certificate acquisition request to the authentication server, and receive the initial security certificate corresponding to the public key returned by the authentication server according to the security certificate acquisition request; associate the initial security certificate with the target terminal application to obtain the security certificate corresponding to the public key of the target terminal.

[0036] In addition, an embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to implement the data processing method provided by the embodiment of the present invention.

[0037] In addition, an embodiment of the present invention further provides a computer-readable storage medium, which stores a plurality of instructions, and the instructions are suitable for a processor to load to execute the steps in any data processing method provided by the embodiment of the present invention.

[0038] When an application access request is received, the embodiment of the present invention obtains the application resource package of the target terminal application corresponding to the application access request to run the target terminal application. Then, when a data input request sent by the target terminal application is received, the security certificate and security parameters are extracted from the application resource package. Then, according to the data input request, the input target data is received through a preset security component. Then, based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data, and the encrypted target data is sent to the business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key. Since the scheme calls the preset security component to receive the input target data, and can also encrypt the target data through the public key in the security certificate, so that the target terminal application decrypts the target data through the private key corresponding to the public key, it can effectively prevent the data from being maliciously obtained and maliciously decrypted, and increase the protection strength of the data. Therefore, the security of data processing can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 is a schematic diagram of a data processing system provided by an embodiment of the present invention;

[0041] Figure 2 is a schematic diagram of a scenario of a data processing method provided by an embodiment of the present invention;

[0042] Figure 3 is a flow chart of a data processing method provided by an embodiment of the present invention;

[0043] Figure 4 is a page schematic diagram of a data input page provided by an embodiment of the present invention;

[0044] Figure 5 is another flow chart of the data processing method provided by an embodiment of the present invention;

[0045] Figure 6 is a schematic diagram of the association relationship between the terminal application platform and the developer provided by an embodiment of the present invention;

[0046] Figure 7 is another flow chart of the data processing method provided by an embodiment of the present invention;

[0047] Figure 8It is a schematic diagram of the data processing flow of the mini program provided by an embodiment of the present invention;

[0048] Fig. 9 is a structural schematic diagram of a first data processing device provided by an embodiment of the present invention;

[0049] Fig.10 is a schematic structural diagram of a second data processing device provided by an embodiment of the present invention;

[0050] Fig.11 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0052] The embodiment of the present invention provides a data processing method, device and computer-readable storage medium. Among them, the data processing device can be integrated in an electronic device, and the electronic device can be a server or a terminal. Specifically, the embodiment of the present invention provides a data processing device suitable for a first electronic device (in order to distinguish, it can be called a first data processing device), and a data processing device suitable for a second electronic device (in order to distinguish, it can be called a second data processing device). Among them, the first electronic device can be a terminal and other devices, and the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The second electronic device can be a network-side device such as a server, and the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal and the server can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0053] In the embodiment of the present invention, the first electronic device is a terminal and the second electronic device is a server as an example. In order to distinguish the service server corresponding to the target terminal application, the second electronic device can be a security server to introduce the data processing method.

[0054] For example, see Figure 1An embodiment of the present invention provides a data processing system including a terminal 10, a security server 20 and a business server 30 corresponding to a target terminal application; the terminal 10 and the security server 20 are connected via a network, for example, via an effective or wireless network connection, wherein the data processing device can be integrated in the terminal, for example, in the form of a client.

[0055] Among them, the terminal 10 can be used to obtain the application resource package of the target terminal application corresponding to the application access request when receiving the application access request, so as to run the target terminal application, and then, when receiving the data input request sent by the target terminal application, extract the security certificate and security parameters from the application resource package, and then, according to the data input request, receive the input target data through the preset security component, and then, based on the security parameters and the public key, encrypt the target data to obtain the encrypted target data, and send the encrypted target data to the business server corresponding to the target terminal application, so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key, which can be specifically as follows: Figure 2 shown.

[0056] Among them, data processing can be understood as the process of protecting data, which may include encryption and decryption of data.

[0057] The terminal 10 may obtain the application resource package of the target terminal application from the security server. There are many ways to obtain the application resource package. The security server 20 may specifically:

[0058] Receive a security certificate acquisition request for a target terminal application, the security certificate acquisition request carries a public key of the target terminal application, generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request, send the security certificate to a business server of the target terminal application so that the business server generates an application resource package of the target terminal application according to the security certificate, receive the application resource package sent by the business server, and send the application resource package to the terminal so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0059] The client integrated in the terminal 10 for running the target terminal application and the security server 20 belong to the same business platform, that is, the client is the front end of the business platform, and the security server is the back end of the business platform. The business platform may also include a developer platform, which is used to receive a secure digital acquisition request uploaded by the developer of the target terminal application.

[0060] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0061] This embodiment will be described from the perspective of a first data processing device, which can be specifically integrated into an electronic device, and the electronic device can be a terminal or other device; wherein the terminal can include a tablet computer, a laptop computer, a personal computer (PC), a wearable device, a virtual reality device or other smart devices that can process data.

[0062] A data processing method, comprising:

[0063] When an application access request is received, an application resource package of the target terminal application corresponding to the application access request is obtained to run the target terminal application. When a data input request sent by the target terminal application is received, a security certificate and security parameters are extracted from the application resource package. The security certificate includes the public key of the target terminal application. The security certificate is a certificate issued by a security server based on the public key. According to the data input request, the input target data is received through a preset security component. The target data is the data that needs to be protected. The target data is encrypted based on the security parameters and the public key to obtain the encrypted target data. The encrypted target data is sent to the business server corresponding to the target terminal application so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key.

[0064] like Figure 3 As shown, the specific process of the data processing method is as follows:

[0065] 101. When an application access request is received, an application resource package of a target terminal application corresponding to the application access request is obtained to run the target terminal application.

[0066] The target terminal application may be an application program in the terminal, which may be an application program directly installed in the terminal, or may include a small program integrated and running on one or more application platforms on the terminal.

[0067] Among them, the application resource package can be a data package composed of resources required to run the terminal application. The application resource package is usually published by the developer of the target terminal application resources on the Internet or application platform. The application resource package can be an installation data package of the terminal application or a resource package in the installation data package.

[0068] There are many ways to run the target terminal application, which are as follows:

[0069] For example, when an application access request is received, an application resource package of a target terminal application corresponding to the application access request is obtained, and the application resource package is loaded to run the target terminal application on a data processing device. Alternatively, an application resource package of a target terminal application corresponding to the application access request is obtained, and operating parameters of the target terminal application are extracted from the application resource package. Based on the operating parameters, the target terminal application is run in an application container.

[0070] Among them, there are many ways to obtain the application resource package of the target terminal application corresponding to the application access request. For example, the terminal application engine can be called, and a resource package acquisition request can be generated through the terminal application engine, and the resource package acquisition request can be sent to the security server, and the resource package returned by the security server according to the resource package acquisition request can be received to obtain the application resource package of the target terminal application. Alternatively, the application identifier of the target terminal application can be extracted from the application access request, and the installation resource package corresponding to the application identifier can be obtained from the network or a third-party database through the terminal application engine, and the resources for running the target terminal application can be obtained from the installation resource package to obtain the application resource package of the target terminal application. Alternatively, the storage address of the application resource package can be extracted from the application access request, and the application resource package of the target terminal application can be obtained according to the storage address.

[0071] 102. When receiving a data input request sent by a target terminal application, extract a security certificate and security parameters from an application resource package.

[0072] The data input request is a request triggered by the target terminal application for receiving data input from the user into the target terminal application.

[0073] Among them, the security certificate includes the public key of the target terminal application. The security certificate is a certificate issued by the security server based on the public key of the target terminal application. The security certificate is used to process the data input into the target terminal application. The security certificate can be a digital certificate (CA certificate) obtained by the Certificate Authority (CA) after the public key of the target terminal application is authenticated by the CA. The role of the security certificate is to prove that the user listed in the certificate legally owns the public key listed in the certificate. The so-called public key is the non-secret half of the key pair used with the private key algorithm. The public key is usually used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted with the corresponding private key. The public key and private key are a key pair (i.e., a public key and a private key) obtained by an algorithm, one of which is open to the outside world and is called the public key; the other is kept by oneself and is called the private key. The key pair obtained by this algorithm can be guaranteed to be unique worldwide. When using this key pair, if one of the keys is used to encrypt a piece of data, the other key must be used to decrypt it. If the data is encrypted with the public key, it must be decrypted with the private key. If the data is encrypted with the private key, it must also be decrypted with the public key, otherwise the decryption will not be successful

[0074] The security parameters may be parameters for performing security operations on data of a target terminal application, for example, they may include information of an encryption algorithm and parameters for auxiliary encryption.

[0075] There are many ways to extract security certificates and security parameters, which are as follows:

[0076] For example, when a data input request is received from a target terminal application, security information can be directly extracted from the application resource package, and security certificates and security parameters can be identified in the security information. Alternatively, encrypted information can be extracted from the application resource package, and the key corresponding to the application identifier can be obtained. The encrypted information can be decrypted according to the key by the terminal application engine, and the security certificate and security parameters can be screened out from the decrypted information.

[0077] 103. According to the data input request, the input target data is received through the preset security component.

[0078] The target data is the data that needs to be protected, which may cause serious harm to society or individuals after being leaked. For example, it can include personal private data, such as name, identity, address, phone number, bank account, email, password, medical information, educational background, etc. It also includes data that is not suitable for enterprises or social institutions to publish, such as the business situation of the enterprise, the network structure of the enterprise, IP address list, etc.

[0079] Among them, the preset security component is a terminal application platform or a security component built into the terminal, which is a component used to securely process data of the terminal application, for example, it may include a native security keyboard, a data receiving component or a data sending component, etc.

[0080] There are many ways to receive data, which can be as follows:

[0081] S1. Call the preset security component according to the data input request.

[0082] For example, based on the data input request, the data type or data format of the target data that needs to be input into the target terminal application can be determined, and the data type or data format can be detected. When the data type or data format indicates that the target data is data in a preset format, the preset security component is invoked, and the preset security component is put into operation, thereby calling the preset security component.

[0083] S2. Receive input target data through a preset security component.

[0084] For example, a data input page may be constructed based on a preset security component, where the data input page includes a security input control and receives target data input through the security input control on the data input page.

[0085] Among them, there are many ways to build a data input page. For example, according to the data input request, the current business data of the target terminal application can be obtained, and based on the current business data, the initial data input page can be built. According to the preset security components, security input controls can be added to the initial data input page to obtain the data input page.

[0086] The current business data may be business data generated by the target terminal application when receiving the target data input by the user. For example, if the target data is a payment password, the current business data may include payment data generated by the target terminal application. There are many ways to obtain the current business data. For example, the current business data may be directly extracted from the running information of the target terminal application, or the current business data may be identified from the process information of the target terminal application, etc.

[0087] After obtaining the current business data, you can build the initial data page. There are many ways to build the initial data page. For example, determine the business type of the current business data, filter out the target page template corresponding to the business type from the preset page template set, add the current business data to the target page template, and obtain the initial data input page.

[0088] After building the initial data page, you can add security input controls to the initial data input page to obtain a data input page. For example, you can determine the data type of the target data that needs to be input based on the current business data, generate security input controls corresponding to the data type based on preset security components, and add the security input controls to the initial data input page to obtain a data input page.

[0089] There are many ways to determine the data type of the target data. For example, the business type of the current business data can be identified, and the data type of the target data can be determined based on the business type. For example, when the business type is a payment business, the data type of the target data can be a payment password. When the business type collects identity information, the data type of the target data can be identity information, and so on.

[0090] After determining the data type of the target data, a security input control corresponding to the data type can be generated. There are many ways to generate a security input control. For example, a security input control set can be obtained by presetting a security component, and the security input control corresponding to the data type can be filtered out from the security input control set. For example, when the data type is a payment password, the security input control can be a digital security input control, that is, a digital security keyboard. When the data type is identity information, the security input control can be a combination security keyboard composed of numbers, characters, and letters.

[0091] After generating the security input control, you can add the security input control to the initial data input page. There are many ways to add it. For example, identify the data input area on the initial data input page, determine the target position of the security input control based on the data input area, and add the security input control to the target position of the initial data input page to obtain the data input page.

[0092] After building the data input page, you can receive the input target data through the security input control in the data input page. For example, when the data input page is displayed in the target terminal application, when the user triggers the data input control in the data input page, you can get the input event, and determine the input target data based on the input event. For example, taking the payment password as the target data, the constructed data input page can be as follows: Figure 4As shown, it includes a payment information display area 41, a data input area 42 and a security input control 43. The user confirms the payment information displayed in the payment information display area 41. After confirmation, the user can select the payment password to be entered through the security input control 43. At this time, the input event generated by the user triggering the security input control 43 can be obtained, and the payment password entered by the user can be identified in the input event. When the user enters the payment password through the security input control 43, the ciphertext of the entered payment password can also be synchronously displayed in the data input area 42.

[0093] Optionally, before building the data input page based on the preset security component, the security certificate can also be verified. For example, the application identifier of the target terminal application is extracted from the application resource package, and the target security certificate information corresponding to the application identifier is obtained through the preset security component. The security certificate is verified according to the target security certificate information. When the security certificate verification passes, the data input page is built based on the preset security component.

[0094] Among them, there can be multiple ways to verify the security certificate. For example, the legitimacy of the security certificate can be verified based on the target security certificate information, or the validity period of the security certificate can be verified based on the target security certificate information, or the legitimacy and validity period of the security certificate can be verified based on the target security certificate information.

[0095] Among them, there can be multiple ways to verify the legitimacy of the security certificate. For example, based on the target security certificate information, the target certificate type of the security certificate is determined. When the current certificate type of the security certificate is the same as the target certificate type, it can be determined that the legitimacy of the security certificate has been verified. Alternatively, the target certificate identifier of the security certificate applied by the target terminal is identified in the target security certificate information, and the target certificate identifier is compared with the current certificate identifier of the security certificate. When the target certificate identifier and the current identifier are the same, it can be determined that the legitimacy of the security certificate has been verified.

[0096] Among them, there can be multiple ways to verify the validity period of a security certificate. For example, extract the validity period from the security certificate and compare the validity period with the current time. When the current time meets the validity period, it is determined that the validity period of the security certificate has been verified. Alternatively, the target validity period of the security certificate can be obtained from the target security certificate information, and the target validity period can be compared with the current validity period of the certificate. When the target validity period is the same as the current validity period, it can be determined that the validity period of the security certificate has been verified.

[0097] 104. Encrypt the target data based on the security parameter and the public key to obtain the encrypted target data.

[0098] For example, an encryption algorithm for target data may be determined according to security parameters, and the target data may be encrypted based on the encryption algorithm and a public key to obtain encrypted data.

[0099] Among them, there are many ways to determine the encryption algorithm. For example, the encryption algorithm type can be included in the security parameters. According to the type of encryption algorithm, the encryption algorithm of the target data can be determined. The encryption algorithm can include a public key encryption algorithm and an auxiliary encryption algorithm. The public key encryption algorithm is an encryption algorithm for the target data based on the public key, and the auxiliary encryption algorithm is an algorithm for auxiliary encryption of the target data.

[0100] After determining the encryption algorithm, the target data can be encrypted based on the encryption algorithm and the public key. There are many ways to encrypt. For example, auxiliary encryption parameters are identified in the security parameters, and the target data is encrypted according to the auxiliary encryption parameters and the auxiliary encryption algorithm to obtain the initial encrypted target data. The initial encrypted target data is encrypted based on the public key and the public key encryption algorithm to obtain the encrypted target data.

[0101] Among them, there are many ways to encrypt the target data using auxiliary encryption parameters and auxiliary encryption algorithms. For example, when the auxiliary encryption parameter is a challenge factor, the type of the challenge factor is determined, the target encryption factor corresponding to the type of the adjustment factor is obtained, and the target encryption factor is merged with the target data according to the auxiliary encryption algorithm to obtain the initial encrypted target data. For example, when the type of the challenge factor is a timestamp, the target timestamp corresponding to the current time is obtained, the target timestamp is used as the target encryption factor, and the target timestamp is added to the target data to obtain the initial encrypted target data. When the challenge factor is a hash value, the hash value of the target data is obtained, and the hash value is concatenated or combined with the target data to obtain the initial encrypted target data, and so on.

[0102] 105. Send the encrypted target data to a business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to a private key corresponding to the public key.

[0103] For example, the communication address of the business server corresponding to the target terminal application can be obtained, and a communication channel such as a long connection or a short connection can be established with the business server based on the communication address, and the encrypted target data can be sent to the business server through the communication channel. Alternatively, the encrypted target data can be encrypted and transmitted to the business server using an encryption algorithm.

[0104] When the business server receives the encrypted target data, the business server can use the private key corresponding to the public key to decrypt the encrypted target data to obtain the target data. There are many ways to decrypt. For example, the public key can be used to decrypt the encrypted target data to obtain the initial decrypted target data, and the target data can be extracted from the initial decrypted target data. For example, the timestamp or hash value can be identified in the initial decrypted target data, and the timestamp or hash value can be verified. After the verification is passed, the data other than the timestamp or hash value can be extracted from the initial decrypted target data to obtain the target data. After obtaining the target data, the business server can also verify the target data to perform the corresponding business. For example, taking the target data as a payment password as an example, the target data can be compared with the payment password pre-set by the user. When the target data is the same as the preset payment password, the payment business can be completed, otherwise, the payment business is stopped, and so on.

[0105] Optionally, in one embodiment, the target data device also includes storing the encrypted target data on the blockchain.

[0106] From the above, it can be seen that when an application access request is received, the embodiment of the present application obtains the application resource package of the target terminal application corresponding to the application access request to run the target terminal application. Then, when a data input request sent by the target terminal application is received, the security certificate and security parameters are extracted from the application resource package. Then, according to the data input request, the input target data is received through the preset security component. Then, based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data, and the encrypted target data is sent to the business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key. Since the scheme calls the preset security component to receive the input target data, and can also encrypt the target data through the public key in the security certificate, so that the target terminal application decrypts the target data through the private key corresponding to the public key, it can effectively prevent the data from being maliciously acquired and maliciously decrypted, increase the protection strength of the data, and therefore, improve the security of data processing.

[0107] According to the method described in the above embodiment, the following is further described in detail with examples.

[0108] In this embodiment, it will be described from the perspective of the second data processing device. The second data processing device can be specifically integrated in an electronic device, with the electronic device as a security server. The security server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms.

[0109] A data processing method, comprising:

[0110] Receive a security certificate acquisition request for a target terminal application, the security certificate acquisition request carries a public key of the target terminal application, generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request, send the security certificate to a business server of the target terminal application so that the business server generates an application resource package of the target terminal application according to the security certificate, receive the application resource package sent by the business server, and send the application resource package to the terminal so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0111] like Figure 5 As shown, the data processing method has the following specific process:

[0112] 201. Receive a security certificate acquisition request for a target terminal application.

[0113] The security certificate acquisition request carries the public key of the target terminal application, and is used to obtain the security certificate corresponding to the public key from the security server. The security certificate acquisition request may be a security certificate request string CSR.

[0114] There are multiple ways to receive a request for obtaining a security certificate, which can be as follows:

[0115] For example, you can directly receive a security certificate acquisition request triggered by the business server corresponding to the target terminal application based on the generated key pair, or you can also receive a security certificate acquisition request triggered by the developer of the target terminal application on the mini-program developer platform. For example, when a user applies to activate native security control capabilities on the mini-program developer platform and enters a CSR, it can trigger the generation of a security certificate acquisition request.

[0116] There are many ways to generate a key pair. For example, a key pair can be generated through a local tool. The key pair can be of many types, such as an RSA (a key type) key pair or an SM2 (a key type) key pair.

[0117] 202. Generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request.

[0118] For example, the identity information of the developer of the target terminal application can be obtained according to the security certificate acquisition request, and the identity of the developer can be verified based on the identity information. When the developer's identity verification passes, a security certificate corresponding to the public key of the target terminal application is generated according to the security certificate acquisition request.

[0119] Among them, there are many ways to verify the identity of the developer. For example, the developer's identity information can be compared with the preset identity information. When the identity information is the same as the preset identity information, it can be determined that the developer's identity information verification has passed. Alternatively, the developer's identity information can be sent to a third-party review server for review, and the review result returned by the review server can be received. The verification result of the developer's identity information is determined based on the review result.

[0120] After the developer's identity verification is passed, a security certificate corresponding to the public key of the target terminal application can be generated. There are many ways to generate a security certificate. For example, a security certificate acquisition request can be sent to an authentication server, and an initial security certificate corresponding to the public key returned by the authentication server based on the security certificate acquisition request can be received. The initial security certificate can be associated with the target terminal application to obtain a security certificate corresponding to the public key of the target terminal application.

[0121] Among them, the authentication server can be a server of a third-party authoritative CA organization, which is mainly used to issue security certificates. After obtaining the initial security certificate returned by the authentication server, the initial security certificate can be associated with the target terminal application, thereby establishing an association relationship between the application platform and the developer of the target terminal application, and adding the association relationship to the initial security certificate to obtain the security certificate corresponding to the public key of the target terminal application.

[0122] Among them, the significance of establishing the association between the initial security certificate and the target terminal application lies in that the target data encrypted based on the public key can only be decrypted by the private key of the corresponding target terminal application, and cannot be decrypted by other means. For example, the developer of terminal application A is company A, and the developer of terminal application B is company B. Company A and company B independently generate the public and private keys required for the asymmetric encryption algorithm, and submit the generated public and private keys to the data processing device (terminal application platform). The data processing device issues different security certificates to company A and company B respectively, and establishes an association between the terminal application platform and the developer. Specifically, it can be as follows Figure 6As shown in the figure. The password encrypted by company A using the public key A generated by it can only be decrypted using the private key A. No other company, even the terminal application platform, can decrypt it. The password encrypted by company B using the public key B generated by it can only be decrypted using the private key B. No other company, including the terminal application platform, can decrypt it. In this way, the passwords between different terminal applications can be independent.

[0123] Among them, the role of issuing a security certificate based on a public key for a data processing device is that, first of all, the security certificate contains the public key, so the security certificate can replace the public key, and the security certificate is cryptographically signed and cannot be forged by others. In this way, the data processing device (terminal application platform) can uniquely confirm the identity of the developer of the target terminal application based on the security certificate, thereby matching the security certificate with the association relationship of the target terminal application itself. If this step is missing, malicious hackers may replace the public key of Company A, causing information leakage.

[0124] 203. Send the security certificate to the service server of the target terminal application, so that the service server generates an application resource package of the target terminal according to the security certificate.

[0125] For example, the communication address of the business server of the target terminal application can be obtained, and based on the communication address, an information channel such as a long connection or a short connection can be established to send the security certificate to the business server. Alternatively, the security certificate can be encrypted using an encryption algorithm and sent to the business server.

[0126] After receiving the security certificate, the service server packages the security certificate into the application release package of the target terminal application, thereby obtaining an application resource package of the target terminal application.

[0127] Among them, the application release package is essentially a folder-like package that stores the code and resources of the target terminal application and is used to run the target terminal application on a terminal or application platform. There are many ways to package the security certificate into the application release package. For example, you can obtain the resource directory of the application release package, filter out the storage directory of the security certificate in the resource directory, and store the security certificate in the application release package according to the storage target. The storage directory of the security certificate can be set according to the actual application. For example, you can simply agree on the path <release package root directory> / CERTS / default.cert as the storage directory of the security certificate.

[0128] 204. Receive the application resource package sent by the business server, and send the application resource package to the terminal, so that the terminal encrypts the input target data according to the application resource package and the preset security component.

[0129] For example, when the target terminal application needs to be published, the application resource package of the target terminal application sent by the business server can be received and sent to the terminal. When the terminal receives the data input request sent by the target terminal application, the terminal can extract the security certificate and security parameters from the application resource package, call the preset security component according to the data input request, and receive the input target data through the preset security component. The target data is encrypte...d based on the security parameters and the public key in the security certificate to obtain the encrypted target data, and the encrypted target data is sent to the business server corresponding to the target terminal application so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key.

[0130] From the above, it can be seen that the embodiment of the present application receives a security certificate acquisition request for a target terminal application, generates a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request, and then sends the security certificate to the business server of the target terminal application, so that the business server generates an application resource package of the target terminal application according to the security certificate, and then receives the application resource package sent by the business server, and sends the application resource package to the terminal, so that the terminal encrypts the input target data according to the application resource package and the preset security component; because the scheme can generate a security certificate corresponding to the public key of the target terminal application, encrypt the target data by the public key in the security certificate, so that the target terminal application decrypts the target data by the private key corresponding to the public key, which can effectively prevent the data from being maliciously acquired and maliciously decrypted, increase the protection strength of the data, and therefore, can improve the security of data processing.

[0131] According to the method described in the above embodiment, the following is further described in detail with examples.

[0132] In this embodiment, the first data processing device is integrated in the terminal, the second data processing device is integrated in the security server, the terminal application is a small program, and the data is a payment password.

[0133] Figure 7 As shown, a data processing method, the specific process is as follows:

[0134] 301. The security server receives a security certificate acquisition request for a target applet.

[0135] For example, the developer of the target mini program generates an RSA or SM2 key pair through local tools, generates a certificate request string CSR based on the key pair, and sends the CSR as a security certificate acquisition request to the security server through the business server, so that the security server receives the security certificate acquisition request. Alternatively, the developer of the target mini program uploads the CSR on the developer platform of the security server, so that the security server receives the security certificate acquisition request.

[0136] 302. The security server generates a security certificate corresponding to the public key of the target applet according to the security certificate acquisition request.

[0137] For example, the security server obtains the identity information of the developer of the target mini-program based on the security certificate acquisition request, and compares the developer's identity information with the preset identity information. When the identity information is the same as the preset identity information, it can be determined that the developer's identity information verification has passed. Alternatively, the developer's identity information can be sent to a third-party review server for review, and the review result returned by the review server is received, and the verification result of the developer's identity information is determined based on the review result.

[0138] When the developer's identity verification passes, the security server sends a security certificate acquisition request to the authentication server of a third-party authoritative CA organization, and receives the initial security certificate corresponding to the public key returned by the authentication server based on the security certificate acquisition request. After obtaining the initial security certificate returned by the authentication server, the initial security certificate can be associated with the target mini program, thereby establishing an association relationship between the application platform and the developer of the target mini program, and adding the association relationship to the initial security certificate to obtain the security certificate corresponding to the public key of the target mini program.

[0139] 303. The security server sends the security certificate to the business server of the target applet, so that the business server generates an application resource package of the target applet according to the security certificate.

[0140] For example, the security server can obtain the communication address of the business server of the target applet, establish an information channel such as a long connection or a short connection based on the communication address, and send the security certificate to the business server. Alternatively, the security certificate can be encrypted using an encryption algorithm and sent to the business server.

[0141] After the business server receives the security certificate, it can obtain the resource directory of the application release package of the target applet, filter out the storage directory of the security certificate in the resource directory, and store the security certificate in the application release package according to the storage target. The path <release package root directory> / CERTS / default.cert can be simply agreed upon as the storage directory of the security certificate to obtain the application resource package of the target applet.

[0142] 304. The security server receives the application resource package sent by the business server.

[0143] For example, when the target mini program needs to be published, the security server can receive the application resource package of the target mini program sent by the business server, or the security server can also receive a mini program publishing request sent by the business server, which carries the storage address of the application resource package. The security server obtains the application resource package of the target mini program in the database based on the storage address.

[0144] 305. When receiving the application access request, the terminal obtains the application resource package of the target applet corresponding to the application access request to run the target applet.

[0145] For example, when a user triggers an access operation of an application access control on a terminal, an application access request is triggered. When the application access request is received, the terminal calls the mini-program engine, generates a resource package acquisition request through the mini-program engine, sends the resource package acquisition request to the security server, receives the resource package returned by the security server based on the resource package acquisition request, obtains the application resource package of the target mini-program, extracts the operating parameters of the target mini-program from the application resource package, runs the target mini-program in the application container of the terminal based on the operating parameters, or directly loads the application resource package to run the target mini-program on the terminal.

[0146] 306. When receiving the password input request sent by the target applet, the terminal extracts the security certificate and security parameters from the application resource package.

[0147] For example, when a user conducts a payment transaction on the target mini program, the target mini program can trigger the generation of a password input request. When receiving the password input request sent by the target mini program, the terminal can directly extract the security information from the application resource package, identify the security certificate and security parameters in the security information, etc. Alternatively, it can also extract the encrypted information from the application resource package, obtain the key corresponding to the application identifier, decrypt the encrypted information according to the key through the terminal application engine, and filter out the security certificate and security parameters from the decrypted information.

[0148] 307. The terminal receives the input payment password through a preset security component according to the data input request.

[0149] For example, the terminal can determine the data type or data format of the target data that needs to be input into the target applet based on the password input request, detect the data type or data format, and when the data type or data format indicates that the target data is a payment password, invoke the preset security component, put the preset security component into operation, and thus call the preset security component.

[0150] According to the password input request, the terminal directly extracts the current business data from the running information of the target applet, or can also identify the current business data in the process information of the target applet. Determine that the business type of the current business data is a payment business, select the target page template corresponding to the payment business from the preset page template set, add the current business data to the target page template, and obtain the initial payment password input page. Through the preset security component, obtain the security input control set, and select the security input control corresponding to the payment password from the security input control set. Identify the password input area on the initial data input page, determine the target position of the security input control according to the password input area, add the security input control to the target position of the initial payment password input page, and obtain the payment password input page. The payment password input page can display the payment information, and the user confirms the payment information. After confirming that it is correct, the payment password to be entered can be selected through the security input control. At this time, the input event generated by the user triggering the security input control can be obtained, and the payment password entered by the user can be identified in the input event. When the user enters the payment password through the security input control, the ciphertext of the entered payment password can also be synchronously displayed in the data input area.

[0151] Optionally, before building the payment password input page based on the preset security component, the security certificate can also be verified. For example, the application identifier of the target applet is extracted from the application resource package, and the target security certificate information corresponding to the application identifier is obtained through the preset security component. The legitimacy of the security certificate can be verified based on the target security certificate information, or the validity period of the security certificate can be verified based on the target security certificate information, or the legitimacy and validity period of the security certificate can be verified based on the target security certificate information. When the security certificate verification passes, the data input page is constructed based on the preset security component.

[0152] Among them, the legitimacy check can be to extract the application identifier of the target mini-program from the application resource package, obtain the target security certificate information corresponding to the application identifier through the preset security component, and determine the target certificate type of the security certificate based on the target security certificate information. When the current certificate type of the security certificate is the same as the target certificate type, it can be determined that the legitimacy check of the security certificate has passed. Alternatively, the target certificate identifier of the security certificate of the target mini-program can be identified in the target security certificate information, and the target certificate identifier is compared with the current certificate identifier of the security certificate. When the target certificate identifier and the current identifier are the same, it can be determined that the legitimacy check of the security certificate has passed.

[0153] Among them, the validity period verification can be to extract the validity period from the security certificate, compare the validity period with the current time, and when the current time meets the validity period, it is determined that the validity period verification of the security certificate has passed. Alternatively, the target validity period of the security certificate can be obtained from the target security certificate information, and the target validity period can be compared with the current validity period of the certificate. When the target validity period is the same as the current validity period, it can be determined that the validity period verification of the security certificate has passed.

[0154] 308. The terminal encrypts the payment password based on the security parameter and the public key to obtain the encrypted payment password.

[0155] For example, the terminal may include the encryption algorithm type in the security parameters, and according to the type of the encryption algorithm, the encryption algorithm of the payment password may be determined. The encryption algorithm may include a public key encryption algorithm and an auxiliary encryption algorithm.

[0156] The terminal identifies the auxiliary encryption parameter in the security parameter. When the auxiliary encryption parameter is a challenge factor, the terminal determines the type of the challenge factor, obtains the target encryption factor corresponding to the type of the adjustment factor, and merges the target encryption factor with the payment password according to the auxiliary encryption algorithm to obtain the initial encrypted payment password. For example, when the type of the challenge factor is a timestamp, the terminal obtains the target timestamp corresponding to the current time, uses the target timestamp as the target encryption factor, and adds the target timestamp to the payment password to obtain the initial encrypted payment password. When the challenge factor is a hash value, the terminal obtains the hash value of the payment password, and concatenates or combines the hash value with the payment password to obtain the initial encrypted payment password, etc. The terminal encrypts the initial encrypted payment password based on the public key and the public key encryption algorithm to obtain the encrypted payment password.

[0157] 309. The terminal sends the encrypted payment password to the business server corresponding to the target mini program.

[0158] For example, the terminal can obtain the communication address of the business server corresponding to the target mini program, establish a communication channel such as a long connection or a short connection with the business server based on the communication address, and send the encrypted payment password to the business server through the communication channel. Alternatively, the encrypted payment password can be encrypted and transmitted to the business server using an encryption algorithm.

[0159] 310. The business server decrypts the encrypted payment password according to the private key corresponding to the public key to process the current payment business.

[0160] For example, the business server can use the public key to decrypt the encrypted payment password to obtain the initial decrypted payment password, identify the timestamp or hash value in the initial decrypted payment password, and verify the timestamp or hash value. After the verification is passed, the data other than the timestamp or hash value can be extracted from the initial decrypted payment password to obtain the payment password. After obtaining the payment password, the business server can compare the payment password with the payment password pre-set by the user. When the payment password is the same as the pre-set payment password, the payment service can be completed. Otherwise, the payment service is stopped, and so on.

[0161] Taking the current business of the mini program as an example, this solution can be regarded as encrypting the payment password in the payment business from the platform level, using an asymmetric encryption algorithm, which essentially upgrades the insecurity of the JS script language itself to assembly-level security. The core of the entire solution includes two parts: one is the mini program developer applying for functions on the application platform during the release of the mini program, and the other is the mini program running on the application platform. Figure 8 As shown in the figure, during the function application stage of the mini program developer, the developer applies to activate the native security control capability on the developer platform and submits a security certificate application request. The application platform acts as the RA to verify the developer's true identity. When the developer's identity verification is passed, the application platform inherits the CSR request to the FIT CA background. The FIT CA background applies to the third-party authoritative CA organization for the issuance of a security certificate based on the CSR. The FIT CA background returns the security certificate to the application platform. The application platform stores and manages the security certificate, and then sends the security certificate to the developer platform. The developer of the mini program downloads the security certificate on the developer platform and packages the security certificate into the mini program release package. During the mini program running stage, when a user accesses the mini program, the mini program calls the mini program engine interface to invoke the original security control. The mini program engine requests the application platform to download the corresponding security certificate. The mini program engine passes the mini program ID, security certificate and other possible additional parameters (challenge factor and algorithm type, etc.) to the security control. The native security control verifies the legitimacy and validity period of the certificate. The user enters data in the native security control (keyboard), and the mini program can obtain the input event. After the user completes the input, the security control uses the public key corresponding to the certificate to encrypt the user input, and returns the public key encrypted ciphertext to the mini program. The mini program returns the ciphertext to the business server, and the business server uses the private key corresponding to the public key to decrypt the ciphertext to complete the payment service.

[0162] From the above, it can be seen that when the server of this embodiment receives an application access request, it obtains the application resource package of the target terminal application corresponding to the application access request to run the target terminal application. Then, when receiving a data input request sent by the target terminal application, it extracts the security certificate and security parameters from the application resource package. Then, according to the data input request, it calls the preset security component, and receives the input target data through the preset security component. Then, based on the security parameters and the public key, it encrypts the target data to obtain the encrypted target data, and sends the encrypted target data to the business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key. Since this scheme calls the preset security component to receive the input target data, and can also encrypt the target data through the public key in the security certificate, so that the target terminal application decrypts the target data through the private key corresponding to the public key, it can effectively prevent the data from being maliciously acquired and maliciously decrypted, increase the protection strength of the data, and therefore, improve the security of data processing.

[0163] In order to better implement the above method, an embodiment of the present invention further provides a data processing device (ie, a first data processing device), which can be integrated in a terminal, and the terminal can include a tablet computer, a laptop computer and / or a personal computer, etc.

[0164] For example, Fig. 9 As shown, the first data processing device may include an acquisition unit 401, an extraction unit 402, a first receiving unit 403, an encryption unit 404 and a first sending unit 405, as follows:

[0165] (1) Acquisition unit 401;

[0166] The acquisition unit 401 is used to acquire the application resource package of the target terminal application corresponding to the application access request when receiving the application access request, so as to run the target terminal application.

[0167] For example, the acquisition unit 401 can be specifically used to, when receiving an application access request, obtain the application resource package of the target terminal application corresponding to the application access request, load the application resource package to run the target terminal application on the data processing device, or obtain the application resource package of the target terminal application corresponding to the application access request, extract the operating parameters of the target terminal application from the application resource package, and run the target terminal application in the application container based on the operating parameters.

[0168] (2) Extraction unit 402;

[0169] The extraction unit 402 is used to extract security parameters and a security certificate from the application resource package when receiving a data input request sent by the target terminal application. The security certificate includes the public key and is a certificate issued by the security server based on the public key of the target terminal application.

[0170] For example, the extraction unit 402 can be specifically used to extract security information directly from the application resource package when a data input request sent by the target terminal application is received, and to identify security certificates and security parameters in the security information. Alternatively, it can also be used to extract encrypted information from the application resource package, obtain the key corresponding to the application identifier, decrypt the encrypted information according to the key through the terminal application engine, and filter out the security certificate and security parameters in the decrypted information.

[0171] (3) a first receiving unit 403;

[0172] The first receiving unit 403 is used to call a preset security component according to a data input request, and receive input target data through the preset security component, where the target data is data that needs to be protected.

[0173] For example, the first receiving unit 403 can be specifically used to determine the data type or data format of the target data that needs to be input into the target terminal application according to the data input request, detect the data type or data format, and when the data type or data format indicates that the target data is the target data, invoke the preset security component to make the preset security component run, thereby calling the preset security component, and based on the preset security component, constructing a data input page, which includes a security input control, and receives the target data entered on the data input page through the security input control.

[0174] (4) encryption unit 404;

[0175] The encryption unit 404 is used to encrypt the target data based on the security parameter and the public key to obtain the encrypted target data.

[0176] For example, the encryption unit 404 can be specifically used to determine the encryption algorithm of the target data based on the security parameters, identify the auxiliary encryption parameters in the security parameters, and encrypt the target data based on the auxiliary encryption parameters and the auxiliary encryption algorithm to obtain the initial encrypted target data, and encrypt the initial encrypted target data based on the public key and the public key encryption algorithm to obtain the encrypted target data.

[0177] (5) a first sending unit 405;

[0178] The first sending unit 405 is used to send the encrypted target data to the service server corresponding to the target terminal application, so that the service server decrypts the encrypted target data according to the private key corresponding to the public key.

[0179] For example, the first sending unit 405 can be specifically used to obtain the communication address of the business server corresponding to the target terminal application, establish a communication channel such as a long connection or a short connection with the business server based on the communication address, and send the encrypted target data to the business server through the communication channel. Alternatively, an encryption algorithm can be used to encrypt and transmit the encrypted target data to the business server, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key.

[0180] In specific implementation, the above units can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units can refer to the previous method embodiments, which will not be repeated here.

[0181] As can be seen from the above, in this embodiment, when the acquisition unit 401 receives an application access request, it acquires the application resource package of the target terminal application corresponding to the application access request to run the target terminal application. Then, when the extraction unit 402 receives a data input request sent by the target terminal application, it extracts the security certificate and security parameters from the application resource package. Then, the first receiving unit 403 receives the input target data through the preset security component according to the data input request. Then, the encryption unit 404 encrypts the target data based on the security parameters and the public key to obtain the encrypted target data. The first sending unit 405 sends the encrypted target data to the business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key. Since the scheme calls the preset security component to receive the input target data, and can also encrypt the target data through the public key in the security certificate, so that the target terminal application decrypts the target data through the private key corresponding to the public key, it can effectively prevent the data from being maliciously acquired and maliciously decrypted, and increase the protection strength of the data. Therefore, the security of data processing can be improved.

[0182] In order to better implement the above method, an embodiment of the present invention further provides a data processing device (ie, a second data processing device), which can be integrated in a server, and the server can be a single server or a server cluster composed of multiple servers.

[0183] For example, Fig.10 As shown, the second data processing device may include a second receiving unit 501, a generating unit 502, a second sending unit 503 and a third receiving unit 504, as follows:

[0184] (1) a second receiving unit 501;

[0185] The second receiving unit 501 is configured to receive a security certificate acquisition request for a target terminal application, where the security certificate acquisition request carries a public key of the target terminal application.

[0186] For example, the second receiving unit 501 can be specifically used to directly receive a security certificate acquisition request triggered by a business server corresponding to the target terminal application according to a generated key pair, or can also receive a security certificate acquisition request triggered by a developer of the target terminal application on a terminal application developer platform.

[0187] (2) generating unit 502;

[0188] The generating unit 502 is used to generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request.

[0189] For example, the generation unit 502 can be specifically used to obtain the identity information of the developer of the target terminal application based on the security certificate acquisition request, and verify the identity of the developer based on the identity information. When the developer's identity verification passes, the security certificate acquisition request is sent to the authentication server, and the initial security certificate corresponding to the public key returned by the authentication server according to the security certificate acquisition request is received, and the initial security certificate is associated with the target terminal application to obtain the security certificate corresponding to the public key of the target terminal application.

[0190] (3) a second sending unit 503;

[0191] The second sending unit 503 is used to send the security certificate to the service server of the target terminal application, so that the service server generates an application resource package of the target terminal application according to the security certificate.

[0192] For example, the second sending unit 503 can be used to obtain the communication address of the business server of the target terminal application, establish an information channel such as a long connection or a short connection according to the communication address, and send the security certificate to the business server, or use an encryption algorithm to encrypt the security certificate and send it to the business server. After receiving the security certificate, the business server packages the security certificate into the application release package of the target terminal application, thereby obtaining the application resource package of the target terminal application.

[0193] (4) a third receiving unit 504;

[0194] The third receiving unit 504 is configured to receive the application resource package sent by the service server, and send the application resource package to the terminal, so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0195] For example, the third receiving unit 504 can be specifically used to receive the application resource package of the target terminal application sent by the business server when the target terminal application needs to be released, and send the application resource package to the terminal. When the terminal receives the data input request sent by the target terminal application, the terminal can extract the security certificate and security parameters from the application resource package, and receive the input target data through the preset security component according to the data input request, encrypt the target data based on the security parameters and the public key in the security certificate to obtain the encrypted target data, and send the encrypted target data to the business server corresponding to the target terminal application, so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key.

[0196] In specific implementation, the above units can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units can refer to the previous method embodiments, which will not be repeated here.

[0197] As can be seen from the above, in this embodiment, the second receiving unit 501 receives a security certificate acquisition request for the target terminal application, and the generating unit 502 generates a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request. Then, the second sending unit 503 sends the security certificate to the business server of the target terminal application, so that the business server generates an application resource package for the target terminal application according to the security certificate. Then, the third receiving unit 504 receives the application resource package sent by the business server, and sends the application resource package to the terminal, so that the terminal encrypts the input target data according to the application resource package and the preset security component; since this scheme can generate a security certificate corresponding to the public key of the target terminal application, encrypt the target data by the public key in the security certificate, so that the target terminal application decrypts the target data by the private key corresponding to the public key, which can effectively prevent the data from being maliciously acquired and maliciously decrypted, increase the protection strength of the data, and therefore, improve the security of data processing.

[0198] The embodiment of the present invention further provides an electronic device, such as Fig.11 As shown, it shows a schematic diagram of the structure of an electronic device involved in an embodiment of the present invention, specifically:

[0199] The electronic device may include components such as a processor 601 with one or more processing cores, a memory 602 with one or more computer-readable storage media, a power supply 603, and an input unit 604. Those skilled in the art will appreciate that Fig.11 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0200] The processor 601 is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 602, and calling data stored in the memory 602, the processor 601 performs various functions of the electronic device and processes data. Optionally, the processor 601 may include one or more processing cores; preferably, the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 601.

[0201] The memory 602 can be used to store software programs and modules. The processor 601 executes various functional applications and data processing by running the software programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.

[0202] The electronic device also includes a power supply 603 for supplying power to each component. Preferably, the power supply 603 can be logically connected to the processor 601 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 603 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0203] The electronic device may further include an input unit 604, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0204] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 601 in the electronic device will load the executable files corresponding to the processes of one or more application programs into the memory 602 according to the following instructions, and the processor 601 will run the application programs stored in the memory 602, thereby realizing various functions, as follows:

[0205] When an application access request is received, the application resource package of the target terminal application corresponding to the application access request is obtained to run the target terminal application. When a data input request sent by the target terminal application is received, the security certificate and security parameters are extracted from the application resource package. The security certificate includes the public key of the target terminal application. The security certificate is a certificate issued by the security server based on the public key. According to the data input request, the input target data is received through the preset security component. The target data is the data that needs to be protected. Based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data. The encrypted target data is sent to the business server corresponding to the target terminal application so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key. Or

[0206] Receive a security certificate acquisition request for a target terminal application, the security certificate acquisition request carries a public key of the target terminal application, generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request, send the security certificate to a business server of the target terminal application so that the business server generates an application resource package of the target terminal application according to the security certificate, receive the application resource package sent by the business server, and send the application resource package to the terminal so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0207] The specific implementation of the above operations can be found in the previous embodiments and will not be described in detail here.

[0208] From the above, it can be seen that when an application access request is received, the embodiment of the present invention obtains the application resource package of the target terminal application corresponding to the application access request to run the target terminal application, and then, when a data input request sent by the target terminal application is received, the security certificate and security parameters are extracted from the application resource package, and then, according to the data input request, the input target data is received through the preset security component, and then, based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data, and the encrypted target data is sent to the business server corresponding to the target terminal application, so that the business server decrypts the encrypted target data according to the private key corresponding to the public key; because the scheme calls the preset security component to receive the input target data, and can also encrypt the target data through the public key in the security certificate, so that the target terminal application decrypts the target data through the private key corresponding to the public key, it can effectively prevent the data from being maliciously obtained and maliciously decrypted, increase the protection strength of the data, and therefore, can improve the security of data processing.

[0209] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0210] To this end, an embodiment of the present invention provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any data processing method provided in the embodiment of the present invention. For example, the instructions can execute the following steps:

[0211] When an application access request is received, the application resource package of the target terminal application corresponding to the application access request is obtained to run the target terminal application. When a data input request sent by the target terminal application is received, the security certificate and security parameters are extracted from the application resource package. The security certificate includes the public key of the target terminal application. The security certificate is a certificate issued by the security server based on the public key. According to the data input request, the input target data is received through the preset security component. The target data is the data that needs to be protected. Based on the security parameters and the public key, the target data is encrypted to obtain the encrypted target data. The encrypted target data is sent to the business server corresponding to the target terminal application so that the business server can decrypt the encrypted target data according to the private key corresponding to the public key. Or

[0212] Receive a security certificate acquisition request for a target terminal application, the security certificate acquisition request carries a public key of the target terminal application, generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request, send the security certificate to a business server of the target terminal application so that the business server generates an application resource package of the target terminal application according to the security certificate, receive the application resource package sent by the business server, and send the application resource package to the terminal so that the terminal encrypts the input target data according to the application resource package and a preset security component.

[0213] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0214] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0215] Since the instructions stored in the computer-readable storage medium can execute the steps in any data processing method provided in the embodiments of the present invention, the beneficial effects that can be achieved by any data processing method provided in the embodiments of the present invention can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0216] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above-mentioned data processing aspect or data encryption and decryption aspect.

[0217] It can be understood that in the specific implementation of the present application, related data such as the current business data of the target terminal application, target data, target security certificate information corresponding to the application identifier, etc., when the above embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0218] The above is a detailed introduction to a data processing method, device, electronic device and computer-readable storage medium provided in an embodiment of the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data processing method, characterized in that: include: When an application access request is received, obtaining an application resource package of a target terminal application corresponding to the application access request to run the target terminal application; When receiving a data input request sent by the target terminal application, extracting a security certificate and security parameters from the application resource package, wherein the security certificate includes a public key of the target terminal application and is a certificate issued by a security server based on the public key; According to the data input request, receiving input target data through a preset security component, the target data being data that needs to be protected; Encrypting the target data based on the security parameter and the public key to obtain encrypted target data; The encrypted target data is sent to the service server corresponding to the target terminal application, so that the service server decrypts the encrypted target data according to the private key corresponding to the public key.

2. The data processing method according to claim 1, characterized in that: The step of receiving input target data through a preset security component according to the data input request includes: Invoke a preset security component according to the data input request; Based on the preset security component, construct a data input page, wherein the data input page includes a security input control; Receive target data input through the security input control on the data input page.

3. The data processing method according to claim 2, characterized in that: The step of constructing a data input page according to the preset security component includes: According to the data input request, obtaining current business data of the target terminal application; Based on the current business data, construct an initial data input page; According to the preset security component, a security input control is added to the initial data input page to obtain the data input page.

4. The data processing method according to claim 3, characterized in that: The step of adding a security input control to the initial data input page according to the preset security component to obtain the data input page includes: Determine the data type of the target data to be input according to the current business data; Based on the preset security component, generate a security input control corresponding to the data type; The security input control is added to the initial data input page to obtain the data input page.

5. The data processing method according to claim 2, characterized in that: Before constructing the data input page based on the preset security component, the method further includes: Extracting the application identifier of the target terminal application from the application resource package; Obtaining target security certificate information corresponding to the application identifier through the preset security component; Verifying the security certificate according to the target security certificate information; The constructing of the data input page based on the preset security component includes: when the security certificate verification passes, constructing the data input page based on the preset security component.

6. The data processing method according to any one of claims 1 to 5, characterized in that: The step of encrypting the target data based on the security parameter and the public key to obtain the encrypted target data includes: Determining an encryption algorithm for the target data according to the security parameter; Based on the encryption algorithm and the public key, the target data is encrypted to obtain encrypted target data.

7. The data processing method according to claim 6, characterized in that: The encryption algorithm includes a public key encryption algorithm and an auxiliary encryption algorithm. The target data is encrypted based on the encryption algorithm and the public key to obtain the encrypted target data, including: identifying an auxiliary encryption parameter from the security parameter, and encrypting the target data according to the auxiliary encryption parameter and the auxiliary encryption algorithm to obtain the initially encrypted target data; Based on the public key and the public key encryption algorithm, the initially encrypted target data is encrypted to obtain encrypted target data.

8. The data processing method according to claim 7, characterized in that: The step of encrypting the target data according to the auxiliary encryption parameter and the auxiliary encryption algorithm to obtain the initially encrypted target data comprises: When the auxiliary encryption parameter is a challenge factor, determining a type of the challenge factor; A target encryption factor corresponding to the type of the challenge factor is obtained, and the target encryption factor is merged with the target data to obtain the initially encrypted target data.

9. A data processing method, characterized in that: include: Receiving a security certificate acquisition request for a target terminal application, the security certificate acquisition request carrying a public key of the target terminal application; Generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request; Sending the security certificate to the service server of the target terminal application so that the service server generates an application resource package of the target terminal application according to the security certificate; Receive the application resource package sent by the business server, the application resource package including a security certificate and security parameters, the security certificate including the public key of the target terminal application, and the security certificate is a certificate issued by the security server based on the public key; The application resource package is sent to the terminal, so that after the terminal receives the input target data through a preset security component, the terminal encrypts the target data based on the security parameter and the public key.

10. The data processing method according to claim 9, characterized in that: The step of generating a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request includes: Acquire the identity information of the developer of the target terminal application according to the security certificate acquisition request; Based on the identity information, verify the identity of the developer; When the identity verification of the developer passes, a security certificate corresponding to the public key of the target terminal application is generated according to the security certificate acquisition request.

11. The data processing method according to claim 10, characterized in that: The step of generating a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request includes: Sending the security certificate acquisition request to the authentication server, and receiving the initial security certificate corresponding to the public key returned by the authentication server according to the security certificate acquisition request; The initial security certificate is associated with the target terminal application to obtain a security certificate corresponding to the public key of the target terminal.

12. A data processing device, characterized in that: include: an acquisition unit, configured to, when receiving an application access request, acquire an application resource package of a target terminal application corresponding to the application access request, so as to run the target terminal application; an extraction unit, configured to extract security parameters and a security certificate from the application resource package when receiving a data input request sent by the target terminal application, wherein the security certificate includes a public key of the target terminal application and is a certificate issued by a security server based on the public key; A first receiving unit, configured to receive input target data through a preset security component according to the data input request, wherein the target data is data to be protected; an encryption unit, configured to encrypt the target data based on the security parameter and the public key to obtain encrypted target data; The first sending unit is used to send the encrypted target data to the service server corresponding to the target terminal application, so that the service server decrypts the encrypted target data according to the private key corresponding to the public key.

13. A data processing device, characterized in that: include: A second receiving unit, configured to receive a security certificate acquisition request for a target terminal application, wherein the security certificate acquisition request carries a public key of the target terminal application; A generating unit, configured to generate a security certificate corresponding to the public key of the target terminal application according to the security certificate acquisition request; A second sending unit, configured to send the security certificate to a service server of the target terminal application, so that the service server generates an application resource package of the target terminal application according to the security certificate; The third receiving unit is used to receive the application resource package sent by the business server, the application resource package includes a security certificate and security parameters, the security certificate includes the public key of the target terminal application, and the security certificate is a certificate issued by the security server based on the public key. The application resource package is sent to the terminal so that the terminal receives the input target data through a preset security component and encrypts the target data based on the security parameters and the public key.

14. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to execute the steps in the data processing method according to any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the data processing method according to any one of claims 1 to 11.

Images