Data secure transmission method, device, equipment and medium

Abstract

The present disclosure provides a data security transmission method, which relates to the field of information security. The method used for the local client includes: receiving encrypted information sent by the browser, the encrypted information is sent to the browser by the server in response to the client's operation of opening a specific web page, and the specific web page includes a web page that allows the client to perform input operations; obtaining encrypted transmission data based on the client's input data on the specific web page and the encrypted information; sending the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain the input data. The method can utilize the interaction of the local client, browser and server to realize encryption protection of customer data during the transmission process, prevent data theft attacks and man-in-the-middle hijacking and tampering attacks, and enhance the security attack and defense capabilities of sensitive data.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and more specifically, to a data security transmission method, apparatus, device, medium, and program product. Background Art

[0002] The proliferation of phishing websites has led to data leaks and even significant financial losses for customers. Phishing websites attempt to manipulate data by tricking customers into using legitimate websites, stealing or tampering with transmitted data, and performing man-in-the-middle attacks.

[0003] Most websites handle sensitive customer information input using simple methods, such as using a specific password input box for simple data processing. However, this is easily cracked or parsed, leading to the disclosure of sensitive information, resulting in customer data leakage and asset loss. Therefore, improving customer data security and defense capabilities is an urgent issue that needs to be addressed. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a data secure transmission method, apparatus, device, medium and program product.

[0005] One aspect of an embodiment of the present disclosure provides a method for secure data transmission for a local client, comprising: receiving encrypted information sent by a browser, the encrypted information being sent by a server to the browser in response to a client opening a specific web page, the specific web page including a web page allowing the client to perform input operations; obtaining encrypted transmission data based on input data of the client on the specific web page and the encrypted information; and sending the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain the input data.

[0006] In some embodiments, the encryption information includes an N-bit first random number, and before obtaining the encrypted transmission data, it also includes: generating an N-bit second random number, N is greater than or equal to 2; splitting the N-bit first random number and the N-bit second random number respectively to obtain M random number sequences, wherein each random number sequence includes at least one random number, M is greater than or equal to 2; obtaining a first encryption key and / or a second encryption key based on the M random number sequences, wherein the first encryption key and / or the second encryption key are used to obtain the encrypted transmission data.

[0007] In some embodiments, obtaining the first encryption key based on the M random number sequences includes: determining S random number sequences from the M random number sequences; performing an XOR operation on the S random number sequences, at least one sequence of the S random number sequences comes from the N-bit first random number, and at least one sequence comes from the N-bit second random number, S is greater than or equal to 2; and obtaining the first encryption key based on the XOR operation result of the S random number sequences.

[0008] In some embodiments, the encrypted transmission data includes first ciphertext data, and obtaining the encrypted transmission data based on the encryption information and the input data includes: obtaining the first ciphertext data based on the first encryption key, the input data and any random number sequence among the M random number sequences.

[0009] In some embodiments, obtaining the second encryption key based on the M random number sequences includes: determining K random number sequences from random number sequences other than the S random number sequences; performing an XOR operation on the K random number sequences, at least one sequence of the K random number sequences comes from the N-bit first random number, and at least one sequence comes from the N-bit second random number, K is greater than or equal to 2; and obtaining the second encryption key based on the XOR operation result of the K random number sequences.

[0010] In some embodiments, the encrypted transmission data includes a message digest, and obtaining the encrypted transmission data based on the encryption information and the input data includes: processing the first ciphertext data according to the second encryption key and any random number sequence among the M random number sequences to obtain the message digest.

[0011] In some embodiments, the encryption information includes an encryption public key, the encrypted transmission data includes second ciphertext data, and further includes: using the encryption public key to process the M random number sequences to obtain the second ciphertext data.

[0012] In some embodiments, the local client and the server have pre-agreed on a number sequence determination rule, and the determining of S random number sequences includes: determining the S random number sequences according to the number sequence determination rule; the determining of K random number sequences includes: determining the K random number sequences according to the number sequence determination rule; wherein the server is configured to obtain the first encryption key and the second encryption key according to the number sequence determination rule and the second ciphertext data.

[0013] In some embodiments, the encrypted transmission data includes third ciphertext information, and also includes: obtaining Q device attribute information of the terminal where the local client is located, Q is greater than or equal to 1; using the first encryption key to process the Q device attribute information to obtain the third ciphertext information, and the server is configured to obtain the device fingerprint information of the terminal based on the third ciphertext information.

[0014] In some embodiments, the input data includes R texts, and before obtaining the encrypted transmission data, it also includes: monitoring the R texts entered locally by the customer, where R is greater than or equal to 1; in response to the customer entering any one of the R texts, randomly generating a third encryption key to encrypt the text.

[0015] In some embodiments, before obtaining the encrypted transmission data, it also includes: receiving a data processing request from the browser, the browser being configured to send the data processing request in response to the customer completing the operation on the specific web page; in response to the data processing request, decrypting the encrypted R texts to obtain the input data.

[0016] In some embodiments, the encrypted information includes signature information obtained by the server based on the signature verification private key. After receiving the encrypted information sent by the browser, it also includes: verifying the signature information using the signature verification public key; after the verification is passed, sending a pass message to the browser, and the browser is configured to allow the customer to continue operating on the specific web page after receiving the pass message.

[0017] Another aspect of an embodiment of the present disclosure provides a method for secure data transmission for a server, comprising: receiving a request message sent by a browser, wherein the browser is configured to send the request message in response to a client's operation of opening a specific web page, and the specific web page includes a web page that allows the client to perform input operations; in response to the request message, generating and sending the encrypted information to the browser, and the browser is configured to send the encrypted information to a local client; receiving encrypted transmission data sent by the local client, and the local client is configured to execute the method as described in any one of the above items to obtain the encrypted transmission data; and decrypting the encrypted transmission data to obtain the input data of the client on the specific web page.

[0018] Another aspect of an embodiment of the present disclosure provides a method for secure data transmission for a browser, comprising: sending a request message to a server in response to the client opening a specific web page, the specific web page including a web page that allows the client to perform input operations; receiving encrypted information sent by the server in response to the request message; sending the encrypted information to a local client; wherein the local client is configured to execute the method as described in any one of the above items to obtain encrypted transmission data, and send the encrypted transmission data to the server, and the server is configured to decrypt the encrypted transmission data to obtain the input data of the client on the specific web page.

[0019] Another aspect of an embodiment of the present disclosure provides a data security transmission device for a local client, comprising: a first receiving module for receiving encrypted information sent by a browser, wherein the encrypted information is sent by a server to the browser in response to a client's operation of opening a specific web page, wherein the specific web page includes a web page that allows the client to perform input operations; an encryption processing module for obtaining encrypted transmission data based on the client's input data on the specific web page and the encrypted information; a first sending module for sending the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain the input data.

[0020] Another aspect of an embodiment of the present disclosure provides a data security transmission device for a server, comprising: a second receiving module for receiving a request message sent by a browser, wherein the browser is configured to send the request message in response to a client's operation of opening a specific web page, and the specific web page includes a web page that allows the client to perform input operations; a second sending module for generating and sending the encrypted information to the browser in response to the request message, and the browser is configured to send the encrypted information to a local client; a third receiving module for receiving encrypted transmission data sent by the local client, and the local client is configured to execute the method as described in any one of the above items to obtain the encrypted transmission data; a data decryption module for decrypting the encrypted transmission data to obtain the input data of the client on the specific web page.

[0021] Another aspect of an embodiment of the present disclosure provides a data security transmission device for a browser, comprising: a third sending module, for sending a request message to a server in response to the client's operation of opening a specific web page, wherein the specific web page includes a web page that allows the client to perform input operations; a fourth receiving module, for receiving encrypted information sent by the server in response to the request message; a fourth sending module, for sending the encrypted information to a local client; wherein the local client is configured to execute the method as described in any one of the above items to obtain encrypted transmission data, and send the encrypted transmission data to the server, and the server is configured to decrypt the encrypted transmission data to obtain the client's input data on the specific web page.

[0022] Another aspect of an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute any of the methods described above.

[0023] Another aspect of the embodiments of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute any of the above methods.

[0024] Another aspect of the embodiments of the present disclosure further provides a computer program product, including a computer program, which implements any of the above methods when executed by a processor.

[0025] One or more of the above-mentioned embodiments have the following beneficial effects: compared with the browser, the local client can implement lower-level data processing locally, and can call more computing resources than the browser to implement more complex encryption processing operations. The encrypted transmission data obtained is not easy to be cracked. The local client, browser and server are used to interact with each other to implement encryption protection of customer data during the transmission process, prevent data theft attacks and man-in-the-middle hijacking and tampering attacks, and enhance the security attack and defense capabilities of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0027] Figure 1 The following schematically illustrates an application scenario diagram of secure data transmission according to an embodiment of the present disclosure;

[0028] Figure 2 The following schematically shows a flow chart of a method for secure data transmission for a local client according to an embodiment of the present disclosure;

[0029] Figure 3 Schematically illustrates a flow chart for obtaining a first encryption key and / or a second encryption key according to an embodiment of the present disclosure;

[0030] Figure 4 Schematically shows a flow chart of obtaining a first encryption key according to an embodiment of the present disclosure;

[0031] Figure 5 Schematically shows a flow chart of obtaining a second encryption key according to an embodiment of the present disclosure;

[0032] Figure 6 Schematically shows a flow chart for obtaining third ciphertext information according to an embodiment of the present disclosure;

[0033] Figure 7 Schematically shows a flow chart of monitoring client input according to an embodiment of the present disclosure;

[0034] Figure 8 Schematically shows a flow chart of obtaining input data according to an embodiment of the present disclosure;

[0035] Figure 9 The following schematically shows a flow chart of a method for secure data transmission for a server according to an embodiment of the present disclosure;

[0036] Figure 10 The flowchart of the data security transmission method for a browser according to an embodiment of the present disclosure is schematically shown;

[0037] Figure 11 The following schematically illustrates a data security transmission flow chart of the interaction among the client, browser, and server according to an embodiment of the present disclosure;

[0038] Figure 12 Schematically shows a structural block diagram of a data secure transmission device for a local client according to an embodiment of the present disclosure;

[0039] Figure 13 The following schematically shows a structural block diagram of a data security transmission device for a server according to an embodiment of the present disclosure;

[0040] Figure 14 A schematic diagram of a structure of a data security transmission device for a browser according to an embodiment of the present disclosure is shown; and

[0041] Figure 15 A block diagram of an electronic device suitable for implementing a method for secure data transmission according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0042] In order to facilitate understanding of the technical solutions of the embodiments of the present disclosure, some technical terms involved in the present disclosure are first introduced.

[0043] Encrypted information: generated and sent by the server for encryption and decryption between the local client and the server, including the first random number, encrypted public key, and signature information;

[0044] Input data: data entered by customers on the website;

[0045] First encryption key: generated by the local client based on the first random number and the second random number;

[0046] Second encryption key: generated by the local client based on the first random number and the second random number;

[0047] Third encryption key: generated by the local client based on the encryption algorithm;

[0048] Signature verification public key: generated by the server and used to verify signature information;

[0049] Verification private key: generated by the server and used for server signature;

[0050] Encryption public key: generated by the server and used to encrypt one or more random number sequences;

[0051] Encryption private key: generated by the server and used to decrypt ciphertext encrypted by the encryption public key;

[0052] Random number sequence: includes at least one random number;

[0053] SM2 algorithm: is an elliptic curve public key cryptography algorithm;

[0054] SM4 algorithm: a Feistel-structured block cipher algorithm.

[0055] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0056] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0057] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0058] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0059] Figure 1 The application scenario diagram of secure data transmission according to an embodiment of the present disclosure is schematically shown, but the present disclosure is not limited thereto.

[0060] like Figure 1 As shown, an application scenario 100 according to this embodiment may include terminal devices 101 and 102, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the terminal devices 101 and 102 and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0061] Clients can use terminal devices 101 and 102 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101 and 102, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0062] The terminal devices 101 and 102 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0063] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by clients using the terminal devices 101 and 102. The background management server may analyze and process received client requests and other data, and feed back the processing results (e.g., web pages, information, or data obtained or generated according to client requests) to the terminal device.

[0064] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0065] The following will be based on Figure 1 The scene described by Figures 2 to 11 The data security transmission method of the embodiment of the present disclosure is described in detail.

[0066] Figure 2 The flowchart of the method for secure data transmission for a local client according to an embodiment of the present disclosure is schematically shown.

[0067] like Figure 2 As shown, the data security transmission method of this embodiment includes operations S210 to S230.

[0068] In operation S210, encrypted information sent by the browser is received. The encrypted information is sent by the server to the browser in response to a client's operation of opening a specific web page. The specific web page includes a web page that allows the client to perform input operations.

[0069] Reference Figure 1 The local client and browser are installed on terminal devices 101 and 102. The client opens a specific webpage through terminal devices 101 and 102. The specific webpage can be a webpage of a specific business system, a webpage of a specific organization, or a webpage requiring sensitive information. The scope of the specific webpage can be pre-set in the browser or server, or the client can set the scope of the specific webpage. The encrypted information includes data that enables the local client to perform encryption processing.

[0070] In some embodiments, the encrypted information includes signature information obtained by the server using a private signature verification key. After receiving the encrypted information from the browser, the local client can verify the signature information using the public signature verification key. If the verification is successful, a pass message is sent to the browser. The browser is configured to allow the client to continue operating on the specific webpage after receiving the pass message.

[0071] For example, the private and public signature verification keys can be generated by the server using an asymmetric algorithm, such as the SM2 algorithm or the RSA algorithm. For example, the local client is an EXE (executable program) with the public signature verification key pre-installed in its installation package. In other embodiments, the local client can also obtain the public signature verification key through other channels by communicating with the server.

[0072] In some embodiments, the local client can communicate directly with the web page of the browser. A custom browser can also be programmed, and the local client is only allowed to accept calls from the custom browser. In other embodiments, a browser extension program can be obtained by programming a js program in javascript language, which is installed in the browser in the form of an extension plug-in, and the extension plug-in communicates with the local client. In this way, it can be installed in multiple browsers, with less modification to existing browsers, a larger scope of application, and data security transmission can be implemented in multiple operating systems. The extension plug-in can be directly installed without the need for separate development, and the adaptability is higher.

[0073] Exemplarily, allowing the user to continue the operation may include providing an input box to the customer after the user passes the operation to allow the customer to input information, or allowing the local device to send the customer's input data to the outside world.

[0074] In related technologies, most websites use the request domain name recorded in the Referer attribute in the header as the basis for determining the source of upstream requests. When phishing websites clear the Referer attribute, legitimate websites cannot determine the source of the request and can only release the transaction request.

[0075] According to an embodiment of the present disclosure, in the case where the source of the upstream request cannot be confirmed in the request link, whether the request source is trustworthy can be determined by whether the signature verification is passed, and the browser can be notified, thereby further improving the security of the customer sensitive data input link.

[0076] In operation S220, encrypted transmission data is obtained based on the customer's input data on the specific web page and the encryption information.

[0077] For example, the input data may include part or all of the data entered by the customer on the webpage, such as the customer's basic information, identity information or property information, which is protected by relevant laws and regulations, or customer-defined information that requires protection.

[0078] For example, when a customer enters their password on a payment page, the local client invokes the computing resources of the terminal device where they are located, and encrypts the transmitted data based on the password and encryption information, effectively protecting the password. In some embodiments, a Trusted Execution Environment (TEE) can be configured for the local client to implement secure computing based on memory isolation, improving protection capabilities.

[0079] In operation S230 , the encrypted transmission data is sent to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain input data.

[0080] For example, the local client can send the encrypted transmission data to the browser, and then the browser or its extension program can send the encrypted transmission data to the server. In other embodiments, the local client can directly send the encrypted transmission data to the server, which can save data transmission links and reduce the probability of being stolen or attacked.

[0081] For example, the encrypted transmission data can be encapsulated in an HTTP / HTTPS request message and sent to the server, which can achieve secure data transmission based on the existing network protocol-based data transmission.

[0082] For example, the server and the local client can pre-agree on encryption algorithms, encryption keys or processing rules, which have anti-attack capabilities during the transmission process, and can decrypt the encrypted transmission data normally after receiving it, and further process the input data without affecting the customer's business handling.

[0083] According to the embodiments of the present disclosure, the use of a local client can implement lower-level data processing locally compared to a browser, and can call on more computing resources than a browser to implement more complex encryption processing operations. The resulting encrypted transmission data is not easily cracked. The interaction of the local client, browser, and server is used to encrypt and protect customer data during transmission, preventing data theft attacks and man-in-the-middle hijacking and tampering attacks, and improving the security attack and defense capabilities of sensitive data.

[0084] Figure 3 A flowchart for obtaining a first encryption key and / or a second encryption key according to an embodiment of the present disclosure is schematically shown.

[0085] Before getting the encrypted transmission data, Figure 3 As shown, this embodiment includes operations S310 to S330, wherein the encrypted information includes an N-bit first random number.

[0086] In operation S310 , an N-digit second random number is generated, where N is greater than or equal to 2.

[0087] For example, when a client opens a specific webpage, the server transmits a 64-bit random number, the SM2 encryption public key, and the data signed with the SM2 encryption public key using the signature verification private key to the browser as signature information. The browser then passes the 64-bit random number to the local client. The N-bit first random number is the 64-bit random number transmitted by the server, and the local client generates a corresponding 64-bit random number, the N-bit second random number.

[0088] In operation S320 , the N-bit first random number and the N-bit second random number are split respectively to obtain M random number sequences, where each random number sequence includes at least one random number, and M is greater than or equal to 2.

[0089] The local client splits the 64-bit random number sent by the server into four 16-bit data elements: rc1, rc2, rc3, and rc4. The local client splits the 64-bit random number it generates into four 16-bit data elements: cr1, cr2, cr3, and cr4. The M random number sequences include rc1, rc2, rc3, rc4, cr1, cr2, cr3, and cr4.

[0090] In operation S330, a first encryption key and / or a second encryption key are obtained according to the M random number sequences, wherein the first encryption key and / or the second encryption key are used to obtain encrypted transmission data.

[0091] For example, one encryption key may be used for encryption. Alternatively, two encryption keys may be used for encryption to improve security. The first encryption key and the second encryption key may be used for the same or different encryption algorithms.

[0092] It is understood that 64 bits is determined by the specific rules of a pre-agreed encryption algorithm. For example, existing or future encryption algorithms can be used to encrypt data using block or stream encryption, with the data block size being the same as the key length. This disclosure does not limit N to 64, nor does it limit M to 8.

[0093] According to the embodiment of the present disclosure, not only the first random number from the server is used, but also a second random number is generated locally, and the two numbers are combined to obtain an encryption key. Even if the encrypted information is stolen during transmission, it is difficult to further crack the encrypted transmission data to obtain the input data.

[0094] Figure 4 The flowchart of obtaining the first encryption key according to an embodiment of the present disclosure is schematically shown.

[0095] Before getting the encrypted transmission data, Figure 4 As shown, the process of obtaining the first encryption key according to M random number sequences in this embodiment includes operations S410 to S430.

[0096] In operation S410, S random number sequences are determined from among M random number sequences.

[0097] In operation S420 , an exclusive-OR operation is performed on S random number sequences, where at least one sequence among the S random number sequences comes from an N-bit first random number and at least one sequence comes from an N-bit second random number, and S is greater than or equal to 2.

[0098] In operation S430, a first encryption key is obtained according to an XOR operation result of the S random number sequences.

[0099] Exemplarily, the XOR operation means that if two numerical values ​​are the same, it is false, and if two numerical values ​​are different, it is true. The XOR operation can be performed on multiple number sequences to obtain an encryption key in the form of an XOR cipher.

[0100] According to the embodiments of the present disclosure, the first encryption key is obtained based on the XOR operation result, which can avoid the generation of repeated keys and overcome the defect that the key can be cracked by using frequency analysis.

[0101] In some embodiments, the encrypted transmission data includes first ciphertext data, and the first ciphertext data can be obtained according to a first encryption key, input data, and any random number sequence among M random number sequences.

[0102] According to an embodiment of the present disclosure, after obtaining the first encryption key, any random number sequence can be introduced as an initialization vector to encrypt the input data to obtain the first ciphertext data, which is difficult to crack even if an attacker obtains the first encryption key.

[0103] Figure 5 The flowchart of obtaining the second encryption key according to an embodiment of the present disclosure is schematically shown.

[0104] Before getting the encrypted transmission data, Figure 5 As shown, the process of obtaining the second encryption key according to M random number sequences in this embodiment includes operations S510 to S530.

[0105] In operation S510, K random number sequences are determined from among the M random number sequences, excluding the S random number sequences.

[0106] In operation S520, an XOR operation is performed on K random number sequences, wherein at least one sequence of the K random number sequences is derived from an N-bit first random number, and at least one sequence of the K random number sequences is derived from an N-bit second random number, and K is greater than or equal to 2.

[0107] In operation S530, a second encryption key is obtained according to an XOR operation result of the K random number sequences.

[0108] According to the embodiments of the present disclosure, obtaining the second encryption key based on the XOR operation result can also avoid the generation of repeated keys, overcoming the drawback of being crackable using frequency analysis. Furthermore, the determined K random number sequences are different from the S random number sequences, resulting in different first and second encryption keys, further increasing the difficulty of cracking both keys simultaneously.

[0109] In some embodiments, the encrypted transmission data includes a message digest, and obtaining the encrypted transmission data according to the encryption information and the input data includes: processing the first ciphertext data according to the second encryption key and any random number sequence among M random number sequences to obtain the message digest.

[0110] Exemplarily, in this embodiment, the first encryption key and the second encryption key are used in different encryption algorithms. The function of the first encryption key is to encrypt plaintext data (such as customer input data) into ciphertext data, and the function of the second encryption key is to generate a message digest based on the first ciphertext data, which can detect when the data is tampered with.

[0111] For example, the second encryption key is used in a general hash algorithm or an HMAC (Hash-Based Message Authentication Code) algorithm. Taking the HMAC algorithm as an example, the first ciphertext data can be used as the message, the second encryption key and any random number sequence from among the M random number sequences can be used as the key, the message and the key can be used as input, and the output can be a message digest.

[0112] In some embodiments, the encrypted transmission data includes second ciphertext data, and the second ciphertext data can be obtained by processing M random number sequences using the encryption public key.

[0113] According to an embodiment of the present disclosure, after receiving the encrypted transmission data, the server can determine the first encryption key and / or the second encryption key according to the second ciphertext data, thereby achieving subsequent decryption.

[0114] In some embodiments, the local client and the server pre-agreed on a number sequence determination rule, and determining S random number sequences includes determining S random number sequences according to the number sequence determination rule. Determining K random number sequences includes determining K random number sequences according to the number sequence determination rule. The server is configured to obtain the first encryption key and the second encryption key based on the number sequence determination rule and the second ciphertext data.

[0115] Exemplarily, the number sequence determination rule may include the number of split random number sequences, a determination rule for S random number sequences, a determination rule for K random number sequences, and a determination rule for random number sequences involved in obtaining the first ciphertext data and the second ciphertext data.

[0116] For example, the first encryption key is cr1^cr2^rc1^rc3, where "^" represents the exclusive OR operator, and cr1, cr2, rc1, and rc3 correspond to S random number sequences. The second encryption key is cr3^cr4^rc2^rc4, where cr3, cr4, rc2, and rc4 correspond to K random number sequences. The first encryption key, combined with rc3, participates in the process of obtaining the first ciphertext data, while the second encryption key, combined with rc4, participates in the process of obtaining the message digest.

[0117] As shown above, the server receives the second ciphertext data and parses it to obtain rc1, rc2, rc3, rc4, cr1, cr2, cr3 and cr4. According to the number series determination rule, we can get "cr1^cr2^rc1^rc3" and "cr3^cr4^rc2^rc4", and the first encryption key corresponds to rc3, and the second encryption key corresponds to rc4.

[0118] According to the embodiments of the present disclosure, by predetermining the number series determination rules, it is possible to obtain a first encryption key and a second encryption key with strong randomness, which plays an anti-attack role, and to verify the signature of the message digest and decrypt the customer's input data, so that services can be provided normally.

[0119] Figure 6 The flowchart of obtaining the third ciphertext information according to an embodiment of the present disclosure is schematically shown.

[0120] like Figure 6 As shown, the process of obtaining the terminal fingerprint information in the encrypted transmission data in this embodiment includes operations S610 to S620.

[0121] In operation S610 , Q pieces of device attribute information of the terminal where the local client is located are obtained, where Q is greater than or equal to 1.

[0122] In operation S620, the Q pieces of device attribute information are processed using the first encryption key to obtain third ciphertext information, and the server is configured to obtain device fingerprint information of the terminal according to the third ciphertext information.

[0123] For example, Q device attribute information of the terminal device where the local client is located, including IP, MAC (Ethernet physical address), CPU, motherboard, memory, trusted execution environment attributes, etc., is obtained, and one or more of these information is encrypted using the first encryption key. In some embodiments, the encryption result can also be processed with Base64 to obtain terminal fingerprint information.

[0124] According to an embodiment of the present disclosure, the server is configured to compare the terminal fingerprint information transmitted this time with the terminal fingerprint information last time, and can further enhance data protection capabilities by determining whether a new device has been replaced (if it is an old device, continue to input data; if it is a new device, perform other operations).

[0125] Figure 7 The flowchart of monitoring client input according to an embodiment of the present disclosure is schematically shown.

[0126] Before getting the encrypted transmission data, Figure 7 As shown, the monitoring of customer input in this embodiment includes operations S710 to S720, wherein the input data includes R texts.

[0127] In operation S710 , R texts input locally by a client are monitored, where R is greater than or equal to 1.

[0128] For example, the local client can monitor the physical keyboard input events of the operating system to monitor and identify the underlying keyboard messages, and can also monitor the text generated by the client through methods such as mouse input, voice input, touch input, or gesture input.

[0129] In operation S720, in response to the customer inputting any one of the R texts, a third encryption key is randomly generated to encrypt the text.

[0130] Exemplarily, the local client monitors the client's physical keyboard input. After the local client monitors the client's physical key input, it randomly generates an SM4 key each time to encrypt the input data. In some embodiments, the browser can also monitor user input, but the local client intercepts the input. The browser can display an "*" inside the corresponding input box (such as a password box) on the web page when it monitors the input event. In other embodiments, the client sends the encrypted text to the browser, and the browser displays an "*" inside the corresponding input box (such as a password box) after receiving the encrypted text.

[0131] According to the embodiments of the present disclosure, the text input by the client is encrypted each time, which increases the difficulty for attackers to steal the input data and ensures the security of the input link between the local client and the browser.

[0132] Figure 8 The flowchart of obtaining input data according to an embodiment of the present disclosure is schematically shown.

[0133] like Figure 8 As shown, the step of obtaining input data in this embodiment includes operations S810 to S820.

[0134] In operation S810 , a data processing request from a browser is received, and the browser is configured to send the data processing request in response to a client completing an operation on a specific web page.

[0135] For example, if a customer enters their password on a webpage and clicks a payment button to initiate a transaction request to the backend, the click completes the operation. In response to this click, the browser calls the local client and issues a data processing request. The browser can also send relevant transaction information to the local client, which encrypts it, generates encrypted transmission data, and packages it into a request message.

[0136] In operation S820, in response to the data processing request, the encrypted R texts are decrypted to obtain input data. The local client decrypts each encrypted data to obtain input data.

[0137] It is understood that if a webpage contains multiple input boxes, at least one of which receives sensitive information, the browser and the local client can interact in real time. When a user enters information in the at least one input box, the local client randomly generates a third encryption key and encrypts it. Other input boxes that do not contain sensitive information are not encrypted. In another embodiment, the local client can also encrypt data in all input boxes.

[0138] According to the embodiments of the present disclosure, after the customer completes the input, the input data can be decrypted in time, which improves the transmission security between the local client and the browser, and can process the data in time to quickly provide services and improve customer experience.

[0139] Figure 9 The flowchart of the method for secure data transmission for a server according to an embodiment of the present disclosure is schematically shown.

[0140] like Figure 9 As shown, the data security transmission method of this embodiment includes operations S910 to S940.

[0141] In operation S910 , a request message sent by a browser is received, wherein the browser is configured to send the request message in response to an operation of a client opening a specific web page.

[0142] In operation S920 , in response to the request message, encryption information is generated and sent to the browser, and the browser is configured to send the encryption information to the local client.

[0143] In operation S930, the encrypted transmission data sent by the local client is received, and the local client is configured to execute Figures 2 to 8 The method of one or more corresponding embodiments obtains encrypted transmission data.

[0144] In operation S940, the encrypted transmission data is decrypted to obtain the input data of the client on the specific web page.

[0145] It can be understood that the terms such as specific web page, encrypted information, encrypted transmission data and input data in this embodiment are the same as above and are not repeated here.

[0146] According to the embodiments of the present disclosure, the server can confirm the security of the transmitted data from the terminal device, thereby avoiding customer losses caused by man-in-the-middle attacks.

[0147] Figure 10 The flowchart of the method for secure data transmission for a browser according to an embodiment of the present disclosure is schematically shown.

[0148] like Figure 10 As shown, the data security transmission method of this embodiment includes operations S1010 to S1030.

[0149] In operation S1010 , in response to a client opening a specific web page, a request message is sent to a server.

[0150] For example, a client can enter the URL of a specific webpage, or click a bookmark or URL hyperlink to open the webpage. The browser then sends an HTTP / HTTPS request message to the server to obtain data and load the webpage. The process by which the browser and server interact to display and serve the webpage to the client can be referenced by existing or future web front-end technologies and is not detailed here.

[0151] In operation S1020, encrypted information sent by the server in response to the request message is received.

[0152] During client operations, the browser can also send request messages in real time or asynchronously. For example, it can request encrypted information when opening a webpage, or it can request only the webpage data when opening a webpage, and then send a request message for encrypted information when the client is about to enter sensitive information. Therefore, the browser and server can pre-arrange the timing of sending encrypted information.

[0153] In operation S1030, the encrypted information is sent to the local client. The local client is configured to execute Figures 2 to 8 The method of one or more corresponding embodiments obtains encrypted transmission data and sends the encrypted transmission data to a server. The server is configured to decrypt the encrypted transmission data to obtain the input data of the client on a specific web page.

[0154] It can be understood that the terms such as specific web page, encrypted information, encrypted transmission data and input data in this embodiment are the same as above and are not repeated here.

[0155] According to the embodiments of the present disclosure, on the basis of the original web browsing service provided by the browser, the encryption processing process is executed by the local client, and the local client can call more computing resources to implement more complex encryption processing operations. The browser and the local client cooperate on the terminal device to encrypt and protect the customer's sensitive data input link and transmission process, prevent data theft attacks and man-in-the-middle hijacking and tampering attacks, and enhance the security attack and defense capabilities of sensitive data.

[0156] Figure 11 The diagram schematically shows a data security transmission flow chart of the interaction among the client, browser and server according to an embodiment of the present disclosure.

[0157] like Figure 11As shown, the data security transmission of this embodiment consists of three parts, including a local client, a browser, and a server. The local client is responsible for performing operations on the data that needs to be encrypted and signed in the encryption request. The browser or its extension program (such as a js program programmed in JavaScript, the following takes the js program as an example) is responsible for communicating to the local client. The server is installed with a corresponding back-end program that provides encryption, signing, data comparison and other functions. The specific execution process is as follows:

[0158] In operation S1101, the customer opens the webpage of the online banking in a browser.

[0159] In operation S1102, the js program detects whether the client is installed locally. If not, operation S1103 is executed, and if so, operation S1104 is executed.

[0160] In operation S1103, the client program (with the signature verification public key embedded) is downloaded and installed, and then operation S1104 is executed.

[0161] In operation S1104, the server generates and sends encryption information, such as an N-bit first random number, an SM2 encryption public key, and data signed by the SM2 encryption public key using the signature verification private key as signature information.

[0162] In operation S1105 , the js program receives the encrypted information and sends it to the local client.

[0163] In operation S1106 , the local client receives the encrypted information.

[0164] In operation S1107, an interactive key is generated and the key credibility is verified.

[0165] Reference Figure 4 and Figure 5 The interaction key includes the first encryption key and the second encryption key. The signature information is verified using the signature verification public key. If the signature verification fails, the request is deemed untrustworthy and the transaction is blocked. If the signature verification passes, the transaction proceeds, and a password input box is created in the corresponding location in the browser according to the control's display parameters.

[0166] In operation S1108 , after the client completes entering the password in the browser, the request is submitted.

[0167] In this process, refer to Figure 7 and Figure 8 , encrypt each cipher text.

[0168] In operation S1109 , the local client encrypts the key data and organizes the message.

[0169] For example, if the first encryption key is cr1^cr2^rc1^rc3, and the second encryption key is cr3^cr4^rc2^rc4, the client decrypts the encrypted data of each ciphertext separately to generate input data m. The input data m is encrypted using the negotiated first encryption key and rc3 to generate ciphertext E (i.e., the first ciphertext data). Ciphertext E is calculated using the negotiated second encryption key (e.g., Hmac key) and rc4 to generate ciphertext Erc (i.e., message digest). rcl, rc2, rc3, rc4, cr1, cr2, cr3, and cr4 are encrypted using the SM2 key transmitted from the server to obtain the second ciphertext data. One or more of the following information, such as the IP address, MAC address (Ethernet physical address), CPU, information, motherboard, memory, and trusted execution environment of the client's terminal device, is obtained and encrypted using the first encryption key and processed in base64. The generated information is combined and encapsulated into a JSON message (e.g., including encrypted transmission data) that is uploaded to the server.

[0170] In operation S1110 , the server decrypts the JSON message and completes confidentiality and integrity verification.

[0171] For example, when the server receives a client message, it first parses rc1, rc2, rc3, rc4, cr1, cr2, cr3, and cr4 based on the SM2 encryption private key. It then decrypts the uploaded message's terminal information and verifies the HMAC signature using the algorithm. After integrity and confidentiality verification are complete, proceed to the next steps.

[0172] In operation S1111 , the follow-up information generates a device fingerprint.

[0173] The third ciphertext in the message is parsed to obtain client environment parameters such as the terminal IP, MAC (Ethernet physical address), CPU, information, motherboard, and memory. A unique device fingerprint is calculated using a specific algorithm. This algorithm can include simhash, hash, or AES algorithms, which use specific algorithmic rules based on device attribute information to generate an output result to identify the device.

[0174] In operation S1112, determine whether the terminal device used this time is consistent with the last login. If not, execute operation S1113; if so, execute operation S1114.

[0175] In operation S1113, if there is any inconsistency, additional authentication and device binding are required. If the authentication fails, the process ends. If the authentication passes, operation S1114 is executed.

[0176] In operation S1114, the subsequent transaction continues.

[0177] It should be noted that some steps of the above method can be executed individually or in combination, and can be executed in parallel or sequentially, and are not limited to the specific operation sequence shown in the figure.

[0178] According to the embodiments of the present disclosure, for the request link between the browser and the server, encryption protection can be performed on the sensitive data input link and transmission process to prevent data theft attacks and man-in-the-middle hijacking and tampering attacks, thereby improving the security attack and defense capabilities of sensitive data.

[0179] Based on the above data security transmission method, the present disclosure also provides data security transmission devices for local clients, browsers and servers respectively. Figure 12 、 Figure 13 and Figure 14 The device is described in detail.

[0180] Figure 12 The structural block diagram of the data secure transmission device for a local client according to an embodiment of the present disclosure is schematically shown.

[0181] like Figure 12 As shown, the data security transmission device 1200 of this embodiment includes a first receiving module 1210 , an encryption processing module 1220 and a first sending module 1230 .

[0182] The first receiving module 1210 may perform operation S210 to receive encrypted information sent by the browser, where the encrypted information is sent by the server to the browser in response to a client opening a specific web page, where the specific web page includes a web page that allows the client to perform input operations.

[0183] The encryption processing module 1220 may perform operation S220 to obtain encrypted transmission data based on the input data of the client on a specific web page and the encryption information.

[0184] In some embodiments, the encryption processing module 1220 may perform Figures 3 to 8 One or more actions in .

[0185] The first sending module 1230 may perform operation S230 to send the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain input data.

[0186] Figure 13 The structural block diagram of the data security transmission device for the server according to the embodiment of the present disclosure is schematically shown.

[0187] like Figure 13 As shown, the data security transmission device 1300 of this embodiment includes a second receiving module 1310 , a second sending module 1320 , a third receiving module 1330 and a data decryption module 1340 .

[0188] The second receiving module 1310 may perform operation S910 to receive a request message sent by a browser, wherein the browser is configured to send a request message in response to a client's operation of opening a specific webpage, where the specific webpage includes a webpage allowing the client to perform input operations.

[0189] The second sending module 1320 may perform operation S920 to generate and send encrypted information to the browser in response to the request message, and the browser is configured to send the encrypted information to the local client.

[0190] The third receiving module 1330 may perform operation S930 for receiving the encrypted transmission data sent by the local client. The local client is configured to perform Figures 2 to 8 The method of one or more corresponding embodiments obtains encrypted transmission data.

[0191] The data decryption module 1340 may perform operation S940 to decrypt the encrypted transmission data to obtain the input data of the client on the specific web page.

[0192] Figure 14 The following schematically shows a structural block diagram of a data security transmission device for a browser according to an embodiment of the present disclosure.

[0193] like Figure 14 As shown, the data security transmission device 1400 of this embodiment includes a third sending module 1410 , a fourth receiving module 1420 , and a fourth sending module 1430 .

[0194] The third sending module 1410 may perform operation S1010 to send a request message to the server in response to the client's operation of opening a specific webpage, where the specific webpage includes a webpage that allows the client to perform input operations.

[0195] The fourth receiving module 1420 may perform operation S1020 to receive the encrypted information sent by the server in response to the request message.

[0196] The fourth sending module 1430 may perform operation S1030 to send the encrypted information to the local client.

[0197] The local client is configured to execute Figures 2 to 8 The method of one or more corresponding embodiments obtains encrypted transmission data and sends the encrypted transmission data to a server. The server is configured to decrypt the encrypted transmission data to obtain the input data of the client on a specific web page.

[0198] It should be noted that the implementation methods, technical problems solved, functions achieved, and technical effects achieved of each module / unit / sub-unit, etc. in the device embodiments are the same or similar to the implementation methods, technical problems solved, functions achieved, and technical effects achieved of each corresponding step in the method embodiments, and are not further described here. For example, the data security transmission device 1200 includes modules for executing each step of any of the above methods, and the same is true for the data security transmission devices 1300 or 1400.

[0199] According to embodiments of the present disclosure, any multiple modules in the secure data transmission apparatus 1200, 1300, or 1400 may be combined into a single module, or any one of the modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module.

[0200] According to an embodiment of the present disclosure, at least one module in the data security transmission device 1200, 1300 or 1400 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one module in the data security transmission device 1200, 1300 or 1400 can be at least partially implemented as a computer program module, which can perform corresponding functions when executed.

[0201] Figure 15 A block diagram of an electronic device suitable for implementing a method for secure data transmission according to an embodiment of the present disclosure is schematically shown.

[0202] like Figure 15 As shown, the electronic device 1500 according to an embodiment of the present disclosure includes a processor 1501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1502 or a program loaded from a storage portion 1508 into a random access memory (RAM) 1503. The processor 1501 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1501 may also include an onboard memory for caching purposes. The processor 1501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0203] Various programs and data required for the operation of the electronic device 1500 are stored in the RAM 1503. The processor 1501, the ROM 1502, and the RAM 1503 are connected to each other via a bus 1504. The processor 1501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 1502 and / or the RAM 1503. It should be noted that the programs may also be stored in one or more memories other than the ROM 1502 and the RAM 1503. The processor 1501 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0204] According to an embodiment of the present disclosure, the electronic device 1500 may further include an input / output (I / O) interface 1505, which is also connected to the bus 1504. The electronic device 1500 may further include one or more of the following components connected to the I / O interface 1505: an input portion 1506 including a keyboard, a mouse, etc.; an output portion 1507 including a cathode ray tube (CRT), a liquid crystal display (LCD), a speaker, etc.; a storage portion 1508 including a hard disk, etc.; and a communication portion 1509 including a network interface card such as a LAN card or a modem. The communication portion 1509 performs communication processing via a network such as the Internet. A drive 1510 is also connected to the I / O interface 1505 as needed. A removable medium 1511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 1510 as needed, so that a computer program read therefrom can be installed into the storage portion 1508 as needed.

[0205] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments. Alternatively, the computer-readable storage medium may exist independently, without being incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the methods according to the embodiments of the present disclosure.

[0206] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1502 and / or RAM 1503 described above and / or one or more memories other than ROM 1502 and RAM 1503.

[0207] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiments of the present disclosure.

[0208] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 1501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0209] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 1509, and / or installed from a removable medium 1511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0210] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1509 and / or installed from the removable medium 1511. When the computer program is executed by the processor 1501, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0211] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the client computing device, partially on the client device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the client computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0212] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0213] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0214] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A data security transmission method, used for a local client, comprising: receiving encrypted information sent by a browser, wherein the encrypted information is sent by a server to the browser in response to a client's operation of opening a specific web page, wherein the specific web page includes a web page allowing the client to perform input operations; Obtaining encrypted transmission data based on the input data of the customer on the specific webpage and the encryption information; sending the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain the input data; The encryption information includes an N-bit first random number. Before obtaining the encrypted transmission data, the method further includes: generating an N-bit second random number, where N is greater than or equal to 2; splitting the N-bit first random number and the N-bit second random number respectively to obtain M random number sequences, where each random number sequence includes at least one random number, where M is greater than or equal to 2; and obtaining a first encryption key and a second encryption key based on the M random number sequences, where the first encryption key and the second encryption key are used to obtain the encrypted transmission data. The obtaining of the first encryption key according to the M random number sequences includes: determining S random number sequences from the M random number sequences; performing an exclusive-OR operation on the S random number sequences, wherein at least one of the S random number sequences is derived from the N-bit first random number and at least one is derived from the N-bit second random number, and S is greater than or equal to 2; and obtaining the first encryption key according to a result of the exclusive-OR operation on the S random number sequences. Wherein, obtaining the second encryption key based on the M random number sequences includes: determining K random number sequences from random number sequences other than the S random number sequences; performing an exclusive-OR operation on the K random number sequences, where at least one sequence of the K random number sequences comes from the N-bit first random number and at least one sequence comes from the N-bit second random number, and K is greater than or equal to 2; and obtaining the second encryption key based on the exclusive-OR operation result of the K random number sequences.

2. The method according to claim 1, wherein The encrypted transmission data includes first ciphertext data, and obtaining the encrypted transmission data according to the encryption information and the input data includes: The first ciphertext data is obtained according to the first encryption key, the input data, and any random number sequence among the M random number sequences.

3. The method according to claim 2, wherein: The encrypted transmission data includes a message digest, and obtaining the encrypted transmission data according to the encryption information and the input data includes: The first ciphertext data is processed according to the second encryption key and any random number sequence among the M random number sequences to obtain the message digest.

4. The method according to claim 1, wherein The encryption information includes an encryption public key, the encrypted transmission data includes second ciphertext data, and further includes: The M random number sequences are processed using the encryption public key to obtain the second ciphertext data.

5. The method according to claim 4, wherein The local client and the server pre-agreed on a sequence determination rule. The determining of the S random number sequences comprises: determining the S random number sequences according to the sequence determination rule; The determining of the K random number sequences comprises: determining the K random number sequences according to the sequence determination rule; The server is configured to obtain the first encryption key and the second encryption key according to the number sequence determination rule and the second ciphertext data.

6. The method according to claim 1, wherein The encrypted transmission data includes third ciphertext information and further includes: Obtain Q device attribute information of the terminal where the local client is located, where Q is greater than or equal to 1; The Q device attribute information is processed using the first encryption key to obtain the third ciphertext information, and the server is configured to obtain the device fingerprint information of the terminal according to the third ciphertext information.

7. The method according to any one of claims 1 to 4, wherein: The input data includes R texts, and before obtaining the encrypted transmission data, further includes: Monitoring the R texts entered locally by the client, where R is greater than or equal to 1; In response to the customer inputting any one of the R texts, a third encryption key is randomly generated to encrypt the text.

8. The method according to claim 7, wherein: Before obtaining encrypted transmission data, it also includes: receiving a data processing request from the browser, wherein the browser is configured to send the data processing request in response to the client completing an operation on the specific webpage; In response to the data processing request, the R encrypted texts are decrypted to obtain the input data.

9. The method according to claim 1, wherein: The encrypted information includes signature information obtained by the server based on the signature verification private key, and after receiving the encrypted information sent by the browser, further includes: Verify the signature information using the signature verification public key; After the verification is passed, a pass message is sent to the browser, and the browser is configured to allow the client to continue operating on the specific web page after receiving the pass message.

10. A data security transmission method, used in a server, comprising: receiving a request message sent by a browser, wherein the browser is configured to send the request message in response to a client's operation of opening a specific webpage, wherein the specific webpage includes a webpage that allows the client to perform input operations; In response to the request message, generating and sending the encrypted information to the browser, wherein the browser is configured to send the encrypted information to the local client; Receiving encrypted transmission data sent by the local client, wherein the local client is configured to execute the method according to any one of claims 1 to 9 to obtain the encrypted transmission data; The encrypted transmission data is decrypted to obtain the input data of the customer on the specific web page.

11. A data security transmission method for a browser, comprising: In response to the client opening a specific webpage, sending a request message to a server, wherein the specific webpage includes a webpage that allows the client to perform input operations; receiving encrypted information sent by the server in response to the request message; Sending the encrypted information to the local client; The local client is configured to execute the method described in any one of claims 1 to 9 to obtain encrypted transmission data, and send the encrypted transmission data to the server, and the server is configured to decrypt the encrypted transmission data to obtain the input data of the customer on the specific web page.

12. A data security transmission device, used for a local client, comprising: a first receiving module, configured to receive encrypted information sent by a browser, wherein the encrypted information is sent by a server to the browser in response to a client opening a specific web page, wherein the specific web page includes a web page allowing the client to perform input operations; An encryption processing module, configured to obtain encrypted transmission data based on the input data of the customer on the specific web page and the encryption information; a first sending module, configured to send the encrypted transmission data to the server, wherein the server is configured to decrypt the encrypted transmission data to obtain the input data; The encryption information includes an N-bit first random number. Before obtaining the encrypted transmission data, the method further includes: generating an N-bit second random number, where N is greater than or equal to 2; splitting the N-bit first random number and the N-bit second random number respectively to obtain M random number sequences, where each random number sequence includes at least one random number, where M is greater than or equal to 2; and obtaining a first encryption key and a second encryption key based on the M random number sequences, where the first encryption key and the second encryption key are used to obtain the encrypted transmission data. The obtaining of the first encryption key according to the M random number sequences includes: determining S random number sequences from the M random number sequences; performing an exclusive-OR operation on the S random number sequences, wherein at least one of the S random number sequences is derived from the N-bit first random number and at least one is derived from the N-bit second random number, and S is greater than or equal to 2; and obtaining the first encryption key according to a result of the exclusive-OR operation on the S random number sequences. Wherein, obtaining the second encryption key based on the M random number sequences includes: determining K random number sequences from random number sequences other than the S random number sequences; performing an exclusive-OR operation on the K random number sequences, where at least one sequence of the K random number sequences comes from the N-bit first random number and at least one sequence comes from the N-bit second random number, and K is greater than or equal to 2; and obtaining the second encryption key based on the exclusive-OR operation result of the K random number sequences.

13. A data security transmission device, used in a server, comprising: a second receiving module, configured to receive a request message sent by a browser, wherein the browser is configured to send the request message in response to a client's operation of opening a specific webpage, wherein the specific webpage includes a webpage that allows the client to perform input operations; A second sending module is configured to generate and send the encrypted information to the browser in response to the request message, wherein the browser is configured to send the encrypted information to the local client; a third receiving module, configured to receive the encrypted transmission data sent by the local client, wherein the local client is configured to execute the method according to any one of claims 1 to 9 to obtain the encrypted transmission data; The data decryption module is used to decrypt the encrypted transmission data to obtain the input data of the customer on the specific web page.

14. A data security transmission device for a browser, comprising: a third sending module, configured to send a request message to a server in response to the client opening a specific webpage, wherein the specific webpage includes a webpage allowing the client to perform input operations; a fourth receiving module, configured to receive the encrypted information sent by the server in response to the request message; A fourth sending module, configured to send the encrypted information to a local client; The local client is configured to execute the method described in any one of claims 1 to 9 to obtain encrypted transmission data, and send the encrypted transmission data to the server, and the server is configured to decrypt the encrypted transmission data to obtain the input data of the customer on the specific web page.

15. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 11. 16 . A computer-readable storage medium having executable instructions stored thereon, wherein when the instructions are executed by a processor, the processor is caused to perform the method according to claim 1 .

17. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images