Data transmission method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides a data transmission method, device, electronic device and readable storage medium, the method comprising: obtaining the transmission data of the client, a data signature for the transmission data and the signature parameter information used to generate the data signature; using the first signature parameter information to generate a third signature, and using the second signature parameter information to generate a fourth signature; if the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, then it is determined that the two-layer signature verification is successful, and data processing operations are allowed on the transmission data. By adopting the above method, two layers of signature verification are required for the signature verification to be truly successful, which greatly improves the security of signature verification, and the encryption key information used by the two layers of signatures is different, which solves the problem that the existing signature algorithm only generates a single-layer signature for the parameters related to the transmission data, and the key is easily cracked after being obtained by others.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data transmission method, a data transmission device, an electronic device and a computer-readable storage medium. Background Art

[0002] Signatures are generally used to ensure that information cannot be denied. For example, contract negotiations and bank withdrawals all use user signatures. Signature authentication is a comprehensive application of asymmetric encryption technology and digital summary technology. It refers to encrypting the summary information of the communication content with the sender's private key, and then transmitting the ciphertext and the original text to the receiver of the information. The receiver decrypts the encrypted summary using the sender's public key information, and then uses the same summary algorithm as the sender to generate a summary string for the received content in the same way, and compares it with the decrypted summary string. If they are the same, it means that the received content is complete and has not been tampered with by a third party during the transmission process. Otherwise, it means that the communication content has been modified by a third party. Each signature has its own unique private key, which is kept confidential to the outside world, and the information encrypted by the private key can only be decrypted by its corresponding public key. Therefore, the private key can represent the identity of the private key holder, and the identity of the private key holder can be verified by the public key corresponding to the private key. Commonly used signature algorithms include MD5 algorithm, SHA-1 algorithm, SHA-256 algorithm and slow hash Bcrypt algorithm. However, if the keys of these signature algorithms are obtained by others, there is a high probability that the signatures corresponding to the keys can be cracked. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a data transmission method and a corresponding data transmission device, an electronic device, and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0004] An embodiment of the present invention discloses a data transmission method, the method comprising:

[0005] Acquire the transmission data of the client, the data signature for the transmission data, and the signature parameter information used to generate the data signature; the data signature includes a first signature and a second signature; the signature parameter information includes first signature parameter information for generating the first signature, and second signature parameter information for generating the second signature;

[0006] The first signature parameter information is used to generate a third signature, and the second signature parameter information is used to generate a fourth signature; wherein the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature;

[0007] If the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, it is determined that the two-layer signature verification is successful, and data processing operations are allowed to be performed on the transmission data.

[0008] Optionally, the first signature and the third signature are obtained based on signing a password, the first signature parameter information includes an encryption key, an encryption rule, a password, and an encryption time, and the step of using the first signature parameter information to generate the third signature includes:

[0009] The third signature is generated using a hash value of the encryption key, the encryption rule, the password, and the encryption time.

[0010] Optionally, the second signature and the fourth signature are obtained by signing a password and a user name, the second signature parameter information includes the encryption key, the encryption rule, the password, the user name and the encryption time, and the generating the fourth signature by using the second signature parameter information includes:

[0011] The fourth signature is generated using the encryption key, the encryption rule, the password, the user name and the encryption time.

[0012] Optionally, the adopting the hash value of the encryption key, the encryption rule, the password and the encryption time to generate the third signature includes:

[0013] extracting a first character string from the password according to the encryption rule, and extracting a second character string from a hash value of the encryption key;

[0014] Calculating the encryption time to obtain a third character string;

[0015] The first character string, the second character string and the third character string are concatenated in sequence, and the third signature is generated according to the concatenated first target character string.

[0016] Optionally, the adopting the encryption key, the encryption rule, the password, the user name and the encryption time to generate the fourth signature includes:

[0017] extracting a fourth character string from the user name, a fifth character string from the password, and a sixth character string from the encryption key according to the encryption rule;

[0018] The fourth character string, the fifth character string, the sixth character string and the third character string are concatenated in sequence, and the fourth signature is generated according to the concatenated second target character string.

[0019] Optionally, generating the third signature according to the concatenated first target character string includes:

[0020] A plurality of first characters to be encrypted are selected from the first target character string, and a first encrypted character corresponding to the first characters to be encrypted is searched from a preset code table based on the encryption rule, and the third signature is generated using the first encrypted character.

[0021] Optionally, generating the fourth signature according to the concatenated second target character string includes:

[0022] A plurality of second characters to be encrypted are selected from the second target character string, and a second encrypted character corresponding to the second character to be encrypted is searched from the preset code table based on the encryption rule, and the fourth signature is generated by using the second encrypted character.

[0023] The embodiment of the present invention further discloses a data transmission device, the device comprising:

[0024] an acquisition module, configured to acquire transmission data of a client, a data signature for the transmission data, and signature parameter information used to generate the data signature; the data signature includes a first signature and a second signature; the signature parameter information includes first signature parameter information for generating the first signature, and second signature parameter information for generating the second signature;

[0025] a generating module, configured to generate a third signature using the first signature parameter information, and to generate a fourth signature using the second signature parameter information; wherein the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature;

[0026] A determination module is used to determine that the two-layer signature verification is successful if the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, and allow data processing operations to be performed on the transmission data.

[0027] Optionally, the first signature and the third signature are obtained based on signing a password, the first signature parameter information includes an encryption key, an encryption rule, a password and an encryption time, and the generation module includes:

[0028] The first generating submodule is used to generate the third signature by adopting the hash value of the encryption key, the encryption rule, the password and the encryption time.

[0029] Optionally, the second signature and the fourth signature are obtained based on signing the password and the user name, the second signature parameter information includes the encryption key, the encryption rule, the password, the user name and the encryption time, and the generation module includes:

[0030] The second generating submodule is used to generate the fourth signature by using the encryption key, the encryption rule, the password, the user name and the encryption time.

[0031] Optionally, the first generating submodule includes:

[0032] A first extraction unit, configured to extract a first character string from the password according to the encryption rule, and to extract a second character string from a hash value of the encryption key;

[0033] A calculation unit, used for calculating the encryption time to obtain a third character string;

[0034] The first concatenation and generation unit is used to concatenate the first character string, the second character string and the third character string in sequence, and generate the third signature according to the concatenated first target character string.

[0035] Optionally, the second generating submodule includes:

[0036] a second extraction unit, configured to extract a fourth character string from the user name, a fifth character string from the password, and a sixth character string from the encryption key according to the encryption rule;

[0037] The second concatenation and generation unit is used to sequentially concatenate the fourth character string, the fifth character string, the sixth character string and the third character string, and generate the fourth signature according to the concatenated second target character string.

[0038] Optionally, the first splicing and generating unit includes:

[0039] The first selection, search and generation subunit is used to select a plurality of first characters to be encrypted from the first target character string, and search for a first encrypted character corresponding to the first character to be encrypted from a preset code table based on the encryption rule, and use the first encrypted character to generate the third signature.

[0040] Optionally, the second splicing and generating unit includes:

[0041] The second selection, search and generation subunit is used to select a plurality of second characters to be encrypted from the second target character string, and search the preset code table for second encrypted characters corresponding to the second characters to be encrypted based on the encryption rule, and use the second encrypted characters to generate the fourth signature.

[0042] An embodiment of the present invention further discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the steps of the data transmission method described above when executed by the processor.

[0043] The embodiment of the present invention further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data transmission method described above are implemented.

[0044] The embodiments of the present invention include the following advantages:

[0045] In the embodiment of the present invention, the third signature can be generated by using the first signature parameter information, and the fourth signature can be generated by using the second signature parameter information. Only when the first signature is verified to be consistent with the third signature, and the second signature is verified to be consistent with the fourth signature, can the data processing operation on the transmission data be allowed. By adopting the above method, two layers of signature verification are required to truly succeed in signature verification, which greatly improves the security of signature verification. The encryption key information used by the two layers of signatures is different, which solves the problem that the existing signature algorithm only generates a single layer of signature for the parameters related to the transmission data, and the key is easily cracked after being obtained by others. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flowchart of a data transmission method provided by an embodiment of the present invention;

[0047] Figure 2 is a flowchart of another data transmission method provided by an embodiment of the present invention;

[0048] Figure 3 is a schematic diagram of a process of generating a first signature on a client in an embodiment of the present invention;

[0049] Figure 4 is a schematic diagram of a process of generating a second signature on a client in an embodiment of the present invention;

[0050] Figure 5 is a flow chart of a data transmission method according to an embodiment of the present invention;

[0051] Figure 6 This is a schematic diagram of an application scenario of a data transmission method provided by an embodiment of the present invention;

[0052] Figure 7 It is a structural block diagram of a data transmission device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0054] Commonly used signature algorithms include MD5, SHA-1, SHA-256, and slow hash Bcrypt. These signature algorithms generate signatures for the relevant parameters of the transmitted data in a single layer. Once the key is obtained by others, it is very likely that the signature can be cracked. Therefore, it is urgent to solve the technical problems of low security of single-layer encrypted signatures and how to prevent signatures from being cracked after key leakage.

[0055] In order to solve the above problems, the present invention intends to provide a data transmission method and a corresponding data transmission device, an electronic device, and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0056] One of the core concepts of the embodiment of the present invention is that the third signature can be generated by using the first signature parameter information, and the fourth signature can be generated by using the second signature parameter information. Only when the first signature is verified to be consistent with the third signature, and the second signature is verified to be consistent with the fourth signature, can data processing operations be allowed on the transmitted data. By adopting the above method, two layers of signature verification are required to truly succeed in signature verification, which greatly improves the security of signature verification and solves the problem that the existing signature algorithm only generates a single-layer signature for the parameters related to the transmitted data, and the encryption key information used by the two layers of signatures is different, and the key is easily cracked after being obtained by others.

[0057] Reference Figure 1 , shows a flowchart of a data transmission method provided by an embodiment of the present invention, which may specifically include the following steps:

[0058] Step 101: Acquire the transmission data of the client, the data signature for the transmission data, and the signature parameter information used to generate the data signature.

[0059] Among them, the data signature includes a first signature and a second signature; the signature parameter information includes the first signature parameter information used to generate the first signature, and the second signature parameter information used to generate the second signature.

[0060] A data transmission method according to an embodiment of the present application can be applied to a server, and data transmission can be performed between the server and a client.

[0061] In an embodiment of the present invention, the client may transmit transmission data, a data signature for the transmission data, and signature parameter information used to generate the data signature to the server. The transmission data may include at least two data signatures, namely a first signature and a second signature. Accordingly, the signature parameter information includes at least first signature parameter information for generating the first signature and second signature parameter information for generating the second signature. After the first signature parameter information is used to generate the first signature in the client, and the second signature parameter information is used to generate the second signature, the first signature, the second signature, the first signature parameter information, the second signature parameter information, and the transmission data are transmitted to the server.

[0062] Step 102: Generate a third signature using the first signature parameter information, and generate a fourth signature using the second signature parameter information.

[0063] Among them, the signature generation method used to generate the third signature is different from the signature generation method used to generate the fourth signature; the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature. In an example, the encryption key information used to generate the third signature can be the first encryption key, the encryption key information used to generate the fourth signature can be the second encryption key, and the first encryption key can be the hash value of the second encryption key. Furthermore, the second encryption key is a public key.

[0064] The first signature parameter information can be used to generate a signature according to the steps of generating the first signature to obtain a corresponding third signature; and the second signature parameter information can be used to generate a signature according to the steps of generating the second signature to obtain a corresponding fourth signature.

[0065] Step 103: If the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, then it is determined that the two-layer signature verification is successful, and data processing operations are allowed on the transmission data.

[0066] In the embodiment of the present invention, if the first signature is consistent with the third signature verification, and the second signature is consistent with the fourth signature verification, then it is determined that the two-layer signature verification is successful, and data processing operations can be allowed for the transmission data. Among them, it can be verified whether the first signature is consistent with the third signature first, and then the second signature is verified whether it is consistent with the fourth signature if the verification is consistent.

[0067] In summary, in the embodiment of the present invention, the first signature parameter information can be used to generate the third signature, and the second signature parameter information can be used to generate the fourth signature. Only when the first signature is verified to be consistent with the third signature, and the second signature is verified to be consistent with the fourth signature, can the data processing operation on the transmission data be allowed. By adopting the above method, two layers of signature verification are required to truly succeed in signature verification, which greatly improves the security of signature verification. The encryption key information used by the two layers of signatures is different, which solves the problem that the existing signature algorithm only generates a single layer of signature for the parameters related to the transmission data, and the key is easily cracked after being obtained by others.

[0068] Reference Figure 2 , shows a flowchart of another data transmission method provided by an embodiment of the present invention, which may specifically include the following steps:

[0069] Step 201: Acquire the transmission data of the client, the data signature for the transmission data, and the signature parameter information used to generate the data signature.

[0070] The data signature includes a first signature and a second signature; the signature parameter information includes first signature parameter information for generating the first signature, and second signature parameter information for generating the second signature.

[0071] In the embodiment of the present invention, the client generates a first signature using the first signature parameter information for the transmission data, and generates a second signature using the second signature parameter information. Therefore, the transmission data, the first signature and the second signature for the transmission data, and the corresponding first signature parameter information and the second signature parameter information can be obtained from the client.

[0072] In this embodiment, the first signature and the third signature are obtained based on signing the password, and the first signature parameter information includes an encryption key, an encryption rule, a password, and an encryption time.

[0073] Step 202: Generate a third signature using the hash value of the encryption key, the encryption rule, the password, and the encryption time.

[0074] The encryption key is an encryption key defined by both the signer and the signer. The encryption key can be a public key. The encryption rule can include an encryption array. The password is provided by the signer. The encryption time is the system time of the signature generated provided by the signer.

[0075] In the embodiment of the present invention, the first signature and the third signature are obtained based on signing the password. The first signature and the third signature can be generated based on the hash value of the encryption key, the encryption rule, the password and the encryption time.

[0076] In an optional embodiment of the present invention, the third signature is generated using the hash value of the encryption key, the encryption rule, the password and the encryption time in step 202, which may specifically include the following sub-steps:

[0077] Sub-step S11, extracting a first character string from the password according to the encryption rule, and extracting a second character string from the hash value of the encryption key.

[0078] Sub-step S12, calculating the encryption time to obtain a third character string.

[0079] Sub-step S13, concatenating the first character string, the second character string and the third character string in sequence, and generating a third signature according to the concatenated first target character string.

[0080] In the embodiment of the present invention, the first character string and the second character string are extracted from the password and the encryption key respectively according to the encryption rule, the encryption time is calculated to obtain the third character string, and the various character strings are concatenated in sequence to obtain the first target character string that can be used to generate the third signature.

[0081] In an optional embodiment of the present invention, generating a third signature according to the concatenated first target character string in sub-step S13 may specifically include the following sub-steps:

[0082] A plurality of first characters to be encrypted are selected from the first target character string, and a first encrypted character corresponding to the first characters to be encrypted is searched from a preset code table based on an encryption rule, and a third signature is generated using the first encrypted character.

[0083] In the embodiment of the present invention, a plurality of first characters to be encrypted may be selected from the first target character string, converted into corresponding first encrypted characters for encryption protection, and then the first encrypted characters are used to generate the third signature.

[0084] The second signature and the fourth signature are obtained based on signing the password and the user name, and the second signature parameter information includes an encryption key, an encryption rule, a password, a user name, and an encryption time.

[0085] Step 203: Generate a fourth signature using the encryption key, encryption rule, password, user name and encryption time.

[0086] The user name is provided by the party generating the signature.

[0087] In the embodiment of the present invention, the second signature and the fourth signature are obtained based on signing the password and the user name. The second signature and the fourth signature can be generated based on the encryption key, encryption rule, password, user name and encryption time.

[0088] The signature generation method used to generate the first signature / third signature is different from the signature generation method used to generate the second signature / fourth signature; the encryption key information used to generate the first signature / third signature is the hash value of the encryption key, while the encryption key information used to generate the second signature / fourth signature is the original encryption key. Through this design, even if the key is leaked, the signature is not easily cracked. The segmented signature greatly improves the security of signature verification.

[0089] In an optional embodiment of the present invention, the fourth signature is generated using the encryption key, encryption rule, password, user name and encryption time in step 203, which may specifically include the following sub-steps:

[0090] Sub-step S21 , extracting a fourth character string from the user name, extracting a fifth character string from the password, and extracting a sixth character string from the encryption key according to the encryption rule.

[0091] Sub-step S22, concatenating the fourth character string, the fifth character string, the sixth character string and the third character string in order, and generating a fourth signature according to the concatenated second target character string.

[0092] In the embodiment of the present invention, the fourth character string, the fifth character string and the sixth character string are extracted from the user name, the password and the encryption key respectively according to the encryption rules, and the third character string obtained by previously operating the encryption time is obtained, and the various character strings are concatenated in sequence to obtain the second target character string that can be used to generate the fourth signature.

[0093] In an optional embodiment of the present invention, generating a fourth signature according to the concatenated second target character string in sub-step S22 may specifically include the following sub-steps:

[0094] A plurality of second characters to be encrypted are selected from the second target character string, and a second encrypted character corresponding to the second character to be encrypted is searched from a preset code table based on an encryption rule, and a fourth signature is generated using the second encrypted character.

[0095] In the embodiment of the present invention, a plurality of second characters to be encrypted may be selected from the second target character string, converted into corresponding second encrypted characters for encryption protection, and then the second encrypted characters are used to generate the fourth signature.

[0096] Step 204: If the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, then it is determined that the two-layer signature verification is successful, and data processing operations are allowed on the transmission data.

[0097] The step of generating the first signature using the first signature parameter information is the same as the step of generating the third signature using the first signature parameter information, and the step of generating the second signature using the second signature parameter information is the same as the step of generating the fourth signature using the second signature parameter information. If the generated third signature is consistent with the first signature, and the generated fourth signature is consistent with the second signature, it can be considered that the transmitted data has not been tampered with during the transmission process, and subsequent data processing operations can be performed on the transmitted data.

[0098] In order to enable those skilled in the art to better understand the embodiments of the present invention, an example is given below to illustrate:

[0099] Reference Figure 3 FIG. 1 is a schematic diagram of a process of generating a first signature on a client according to an embodiment of the present invention. The specific process includes:

[0100] 1. Obtain the data required to generate the first signature: the hash value of the encryption key, the encryption rule, the password, and the encryption time. The encryption array in the encryption rule can contain four elements.

[0101] For example:

[0102] Ytb9u4KpVXaXZhB7awmY7paoLYN0ie3LnjT1 (encryption key);

[0103] [4,1,6,2](encrypted array);

[0104] Uk@rLd+rYce#jnd (password provided by the user);

[0105] 1658217304335 (encryption time, the time provided can be in milliseconds).

[0106] 2. Extract the first and second strings from the hash values ​​of the password and encryption key according to the encryption rules. For example, if the first element in the encryption array is 4, extract the first 4 characters in the password to get Uk@; if the hash value of the encryption key is 25615523422 and the third element in the encryption array is 6, extract the first 6 characters from the hash value of the encryption key to get 256155.

[0107] 3. Perform a modulo operation based on the encryption time to obtain a third character string. For example, the encryption time is modulo 10000000 to obtain 7304335.

[0108] 4. Concatenate the first character string, the second character string, and the third character string in order to obtain the first target character string: Uk@2561557304335.

[0109] 5. Select several first characters to be encrypted from the first target character string, and search the first encrypted character corresponding to the first character to be encrypted from the preset code table based on the encryption rule, and use the first encrypted character to generate the first signature. The characters in the code table and their corresponding binary are mapped to each other. This table specifies the mapping relationship between characters and binary. When the computer stores characters, it queries the code table according to the characters, and then stores the corresponding binary. When the computer takes out the characters, it queries the code table according to the binary, and then converts them into corresponding characters for display. For example, the first 4 characters in the first target character string can be selected, and the code numbers of these 4 characters in the code table can be determined respectively, and then the code numbers are added to the elements in the encryption array respectively, and the characters corresponding to the obtained new code numbers are used as the encrypted characters of the original characters, that is, the first character U corresponds to the code number 85, and 85 is added to the first element in the encryption array to obtain the new code number 85+4=89, and the corresponding character is Y. By analogy, the encrypted characters of the original 4 characters are Y / qB, and the final processing results are as follows:

[0110] Original first target string array: [U,.,k,@,2,5,6,1,5,5,7,3,0,4,3,3,5];

[0111] The first target string array after processing: [Y, / ,q,B,2,5,6,1,5,5,7,3,0,4,3,3,5];

[0112] The first 10 elements in the processed first target string array are combined into the final string Y / qB256155, which is the generated first signature.

[0113] Reference Figure 4 FIG. 1 is a schematic diagram of a process of generating a second signature on a client according to an embodiment of the present invention. The specific process includes:

[0114] 1. Obtain the data required to generate the second signature: encryption key, encryption rule, password, user name, encryption time. The encryption key, encryption array in the encryption rule, password and encryption time used to generate the second signature are the same as those used to generate the first signature.

[0115] For example:

[0116] Ytb9u4KpVXaXZhB7awmY7paoLYN0ie3LnjT1 (encryption key);

[0117] [4,1,6,2](encrypted array);

[0118] KmmVCscMgd7X5H(user name);

[0119] Uk@rLd+rYce#jnd (password provided by the user);

[0120] 1658217304335 (encryption time, in milliseconds).

[0121] 2. Extract the fourth character string, the fifth character string and the sixth character string from the user name, the password and the encryption key according to the encryption rules. For example, extract the first 4 characters of the user name (KmmV), the first 1 character of the password (U), and the first 6 characters of the encryption key (Ytb9u4) according to the encryption rules.

[0122] 3. Perform a modulo operation based on the encryption time to obtain a third character string. The processed third character string is 7304335.

[0123] 4. Concatenate the fourth character string, the fifth character string, the sixth character string and the third character string in order to obtain the second target character string: KmmVUYtb9u47304335.

[0124] 5. Select several second characters to be encrypted from the second target character string, and search the preset code table for the second encrypted characters corresponding to the second characters to be encrypted based on the encryption rule, and use the second encrypted characters to generate the second signature. For example, the first four characters in the second target character string can be selected, and the code numbers of these four characters in the code table can be determined respectively, and then the code numbers are added to the elements in the encryption array respectively, and the characters corresponding to the obtained new code numbers are used as the encrypted characters of the original characters, that is, the encrypted character corresponding to the first character K is O, and so on, the encrypted characters of the original four characters are OnsX, and the processing results are as follows:

[0125] Original second target string array: [K,m,m,V,U,Y,t,b,9,u,4,7,3,0,4,3,3,5];

[0126] The second target string array after processing: [O,n,s,X,U,Y,t,b,9,u,4,7,3,0,4,3,3,5];

[0127] The first 10 elements in the processed second target string array are combined into the final string OnsXUYtb9u, which is the generated second signature.

[0128] Reference Figure 5 FIG. 1 is a flow chart of a data transmission method according to an embodiment of the present invention, which is applied to a server. The specific flow includes:

[0129] 1. Obtain the transmission data transmitted by the client, the first signature for the transmission data, and the encryption key, encryption rule, password and encryption time used to generate the first signature.

[0130] 2. Use the hash value of the encryption key, encryption rules, password and encryption time to generate the third signature according to the original process of generating the first signature.

[0131] 3. Compare the first signature and the third signature.

[0132] 4. If the first signature and the third signature are consistent, the second signature for the transmitted data and the user name used to generate the second signature are obtained; if the first signature and the third signature are inconsistent, the process is terminated directly, and corresponding data processing operations on the client's transmitted data are not allowed.

[0133] 5. Generate a fourth signature using the encryption key, encryption rule, password, user name and encryption time according to the original process for generating the second signature.

[0134] 6. Compare the second signature and the fourth signature.

[0135] 7. If the second signature and the fourth signature are consistent, the signature verification is successful, and the corresponding data processing operations can be performed on the client's transmission data; if the second signature and the fourth signature are inconsistent, the process is terminated directly, and the corresponding data processing operations on the client's transmission data are not allowed.

[0136] Reference Figure 6 As shown, it is a schematic diagram of an application scenario of a data transmission method provided by an embodiment of the present invention. The data transmission method provided by the present invention is based on the AKA (Authentication and Key Agreement, the authentication and key negotiation protocol of the third generation mobile communication network) authentication mechanism, and can be applied to the HTTP (Hyper Text Transfer Protocol, Hypertext Transfer Protocol) request identity verification and the user operating system identity verification scenario. In a specific embodiment, before the server performs data processing operations on the transmission data transmitted by the client, it is necessary to first perform identity verification on the transmission data to ensure confidentiality during the data transmission process. The server needs to undergo two layers of signature verification, the first layer is password signature verification, and the second layer is user name password signature verification. After the password signature verification passes, the user name password signature needs to be verified. Among them, the hashCode (hash code) of the encryption key is used to generate the password signature, and the original encryption key is used to generate the user name password signature. Through this design, even if the encryption key is leaked, the signature is difficult to be cracked, and the segmented signature greatly improves the security of signature verification. The client can be any electronic device, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The client can also be various application software that can be installed in the above-mentioned device. The server can also be part of a server cluster, or a cloud computing resource pool.

[0137] In summary, in the embodiment of the present invention, the first signature parameter information can be used to generate the third signature, and the second signature parameter information can be used to generate the fourth signature. Only when the first signature is verified to be consistent with the third signature, and the second signature is verified to be consistent with the fourth signature, can the data processing operation on the transmission data be allowed. By adopting the above method, two layers of signature verification are required to truly succeed in signature verification, which greatly improves the security of signature verification. The encryption key information used by the two layers of signatures is different, which solves the problem that the existing signature algorithm only generates a single layer of signature for the parameters related to the transmission data, and the key is easily cracked after being obtained by others.

[0138] In the embodiment of the present invention, the encryption key information used to generate the password signature and the username password signature is inconsistent. The password signature uses the hashCode of the encryption key, while the username password signature uses the original encryption key. The segmented signature greatly improves the security of signature verification and the anti-attack capability after the key is leaked. After the password signature of the present invention passes, the username password signature needs to be verified. Only when both layers of verification pass can the corresponding data processing operation be performed on the transmitted data.

[0139] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the described action sequence, because according to the embodiments of the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0140] Reference Figure 7 , shows a structural block diagram of a data transmission device provided by an embodiment of the present invention, which may specifically include the following modules:

[0141] The acquisition module 701 is used to acquire the transmission data of the client, the data signature for the transmission data, and the signature parameter information used to generate the data signature; the data signature includes a first signature and a second signature; the signature parameter information includes first signature parameter information for generating the first signature, and second signature parameter information for generating the second signature;

[0142] A generating module 702, configured to generate a third signature using the first signature parameter information, and to generate a fourth signature using the second signature parameter information; wherein the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature;

[0143] The determination module 703 is used to determine that the two-layer signature verification is successful if the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, and allow data processing operations to be performed on the transmission data.

[0144] In the embodiment of the present invention, the first signature and the third signature are obtained based on signing the password, the first signature parameter information includes an encryption key, an encryption rule, a password and an encryption time, and the generation module includes:

[0145] The first generating submodule is used to generate the third signature by adopting the hash value of the encryption key, the encryption rule, the password and the encryption time.

[0146] In the embodiment of the present invention, the second signature and the fourth signature are obtained based on signing the password and the user name, the second signature parameter information includes the encryption key, the encryption rule, the password, the user name and the encryption time, and the generation module includes:

[0147] The second generating submodule is used to generate the fourth signature by using the encryption key, the encryption rule, the password, the user name and the encryption time.

[0148] In an embodiment of the present invention, the first generating submodule includes:

[0149] A first extraction unit, configured to extract a first character string from the password according to the encryption rule, and to extract a second character string from a hash value of the encryption key;

[0150] A calculation unit, used for calculating the encryption time to obtain a third character string;

[0151] The first concatenation and generation unit is used to concatenate the first character string, the second character string and the third character string in sequence, and generate the third signature according to the concatenated first target character string.

[0152] In this embodiment of the present invention, the second generating submodule includes:

[0153] a second extraction unit, configured to extract a fourth character string from the user name, a fifth character string from the password, and a sixth character string from the encryption key according to the encryption rule;

[0154] The second concatenation and generation unit is used to sequentially concatenate the fourth character string, the fifth character string, the sixth character string and the third character string, and generate the fourth signature according to the concatenated second target character string.

[0155] In an embodiment of the present invention, the first splicing and generating unit includes:

[0156] The first selection, search and generation subunit is used to select a plurality of first characters to be encrypted from the first target character string, and search for a first encrypted character corresponding to the first character to be encrypted from a preset code table based on the encryption rule, and use the first encrypted character to generate the third signature.

[0157] In an embodiment of the present invention, the second splicing and generating unit includes:

[0158] The second selection, search and generation subunit is used to select a plurality of second characters to be encrypted from the second target character string, and search the preset code table for second encrypted characters corresponding to the second characters to be encrypted based on the encryption rule, and use the second encrypted characters to generate the fourth signature.

[0159] In summary, in the embodiment of the present invention, the first signature parameter information can be used to generate the third signature, and the second signature parameter information can be used to generate the fourth signature. Only when the first signature is verified to be consistent with the third signature, and the second signature is verified to be consistent with the fourth signature, can the data processing operation on the transmission data be allowed. By adopting the above method, two layers of signature verification are required to truly succeed in signature verification, which greatly improves the security of signature verification. The encryption key information used by the two layers of signatures is different, which solves the problem that the existing signature algorithm only generates a single layer of signature for the parameters related to the transmission data, and the key is easily cracked after being obtained by others.

[0160] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0161] An embodiment of the present invention also provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned data transmission method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0162] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned data transmission method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0163] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0164] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0165] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded into a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0168] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0169] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0170] The data transmission method and data transmission device, an electronic device and a computer-readable storage medium provided by the present invention are introduced in detail above. The principles and implementation methods of the present invention are explained in this article using specific examples. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data transmission method, characterized in that: The method comprises: Obtaining transmission data of a client, a data signature for the transmission data, and signature parameter information used to generate the data signature; the data signature includes a first signature and a second signature; the signature parameter information includes first signature parameter information for generating the first signature, and second signature parameter information for generating the second signature; wherein the first signature is generated by: obtaining a hash value of an encryption key, an encryption rule, a password, and an encryption time; extracting a first character string and a second character string from the password and the hash value of the encryption key according to the encryption rule; performing a modulus operation on the encryption time to obtain a third character string; concatenating the first character string, the second character string, and the third character string in order to obtain a first target character string; selecting a plurality of first characters to be encrypted from the first target character string, and querying the first character string from a preset code table based on the encryption rule; The first encrypted character corresponding to the first character to be encrypted is used to generate the first signature according to the first encrypted character; the encryption rule includes an encryption array; the second signature is generated in the following manner: an encryption key, the encryption rule, the password, the user name, and the encryption time are obtained; the user name, the password, and the encryption key are extracted according to the encryption rule to obtain a fourth character string, a fifth character string, and a sixth character string; a modulo operation is performed on the encryption time to obtain a third character string; the fourth character string, the fifth character string, the sixth character string, and the third character string are sequentially concatenated to obtain a second target character string; a plurality of second characters to be encrypted are selected from the second target character string, and a second encrypted character corresponding to the second character to be encrypted is searched from a preset code table based on the encryption rule, and the second signature is generated according to the second encrypted character; The first signature parameter information is used to generate a third signature, and the second signature parameter information is used to generate a fourth signature; wherein the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature; If the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, it is determined that the two-layer signature verification is successful, and data processing operations are allowed to be performed on the transmission data.

2. The method according to claim 1, characterized in that The first signature and the third signature are obtained based on signing the password, the first signature parameter information includes an encryption key, an encryption rule, a password, and an encryption time, and the third signature is generated by using the first signature parameter information, including: The third signature is generated using a hash value of the encryption key, the encryption rule, the password, and the encryption time.

3. The method according to claim 2, characterized in that The second signature and the fourth signature are obtained based on signing the password and the user name, the second signature parameter information includes the encryption key, the encryption rule, the password, the user name and the encryption time, and the fourth signature is generated by using the second signature parameter information, including: The fourth signature is generated using the encryption key, the encryption rule, the password, the user name and the encryption time.

4. The method according to claim 3, characterized in that The step of generating the third signature by using the hash value of the encryption key, the encryption rule, the password and the encryption time includes: extracting a first character string from the password according to the encryption rule, and extracting a second character string from a hash value of the encryption key; Calculating the encryption time to obtain a third character string; The first character string, the second character string and the third character string are concatenated in sequence, and the third signature is generated according to the concatenated first target character string.

5. The method according to claim 4, characterized in that The step of using the encryption key, the encryption rule, the password, the user name, and the encryption time to generate the fourth signature includes: extracting a fourth character string from the user name, a fifth character string from the password, and a sixth character string from the encryption key according to the encryption rule; The fourth character string, the fifth character string, the sixth character string and the third character string are concatenated in sequence, and the fourth signature is generated according to the concatenated second target character string.

6. The method according to claim 5, characterized in that The step of generating the third signature according to the concatenated first target character string includes: A plurality of first characters to be encrypted are selected from the first target character string, and a first encrypted character corresponding to the first characters to be encrypted is searched from a preset code table based on the encryption rule, and the third signature is generated using the first encrypted character.

7. The method according to claim 6, characterized in that Generating the fourth signature according to the concatenated second target character string includes: A plurality of second characters to be encrypted are selected from the second target character string, and a second encrypted character corresponding to the second character to be encrypted is searched from the preset code table based on the encryption rule, and the fourth signature is generated by using the second encrypted character.

8. A data transmission device, characterized in that: The device comprises: An acquisition module is used to acquire the transmission data of the client, the data signature for the transmission data, and the signature parameter information used to generate the data signature; the data signature includes a first signature and a second signature; the signature parameter information includes the first signature parameter information for generating the first signature, and the second signature parameter information for generating the second signature; wherein the first signature is generated by: acquiring the hash value of the encryption key, the encryption rule, the password, and the encryption time; the encryption rule includes an encryption array; extracting the first character string and the second character string from the hash value of the password and the encryption key according to the encryption rule; performing a modulo operation on the encryption time to obtain a third character string; splicing the first character string, the second character string, and the third character string in order to obtain a first target character string; selecting a plurality of first characters to be encrypted from the first target character string, and based on the encryption rule, According to the encryption rule, a first encrypted character corresponding to the first character to be encrypted is searched from a preset code table, and the first signature is generated according to the first encrypted character; the second signature is generated in the following manner: an encryption key, the encryption rule, the password, a user name, and the encryption time are obtained; the user name, the password, and the encryption key are extracted according to the encryption rule to obtain a fourth character string, a fifth character string, and a sixth character string; a modulo operation is performed on the encryption time to obtain a third character string; the fourth character string, the fifth character string, the sixth character string, and the third character string are concatenated in sequence to obtain a second target character string; a plurality of second characters to be encrypted are selected from the second target character string, and a second encrypted character corresponding to the second character to be encrypted is searched from a preset code table based on the encryption rule, and the second signature is generated according to the second encrypted character; a generating module, configured to generate a third signature using the first signature parameter information, and to generate a fourth signature using the second signature parameter information; wherein the encryption key information used to generate the third signature is different from the encryption key information used to generate the fourth signature; A determination module is used to determine that the two-layer signature verification is successful if the first signature is consistent with the third signature, and the second signature is consistent with the fourth signature, and allow data processing operations to be performed on the transmission data.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of a data transmission method as claimed in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a data transmission method as claimed in any one of claims 1 to 7 are implemented.

Images