Data transmission method, device, medium and equipment based on virtual keyboard

Abstract

The present application discloses a data transmission method, apparatus, medium, and device based on a virtual keyboard, which relates to the field of data transmission. The method includes: displaying a virtual keyboard in the interface of the current application, and obtaining request data in response to an input instruction based on the virtual keyboard; determining a session key and a session identifier, and encrypting the request data using the session key to obtain request ciphertext data; sending the session identifier and the request ciphertext data to the server, and receiving response ciphertext data and the session identifier returned by the server based on the request ciphertext data; decrypting the response ciphertext data according to the session key corresponding to the session identifier to obtain response data. The technical solution provided by the present application can improve the security of keyboard data during transmission.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a data transmission method, apparatus, medium and device based on a virtual keyboard. Background Art

[0002] To prevent information from being stolen on the client side, when users are required to enter sensitive data such as login passwords and payment passwords to verify their identity or permissions, the application can use a virtual keyboard to prevent users from using the client's system keyboard for input, which makes it easier for intruders to read keyboard input data.

[0003] Although virtual keyboards can dynamically input passwords, for example, banks often use dynamic passwords to ensure account security for online banking users who don't apply for certificates, data transmission can be vulnerable to attacks. A man-in-the-middle could steal the encryption or decryption keys and crack the input password, seriously compromising the security of the user's account or assets. Therefore, the security of data transmission using virtual keyboards still needs to be improved. Summary of the Invention

[0004] In order to improve the security of data transmission, this application provides a data transmission method, device, medium and equipment based on a virtual keyboard. The technical solution is as follows:

[0005] In a first aspect, the present application provides a data transmission method based on a virtual keyboard, applied to a client, the method comprising:

[0006] Displaying a virtual keyboard in the interface of the current application program, and acquiring requested data in response to an input instruction based on the virtual keyboard;

[0007] Determining a session key and a session identifier, and encrypting the request data using the session key to obtain ciphertext request data; the session key is generated by the client when the virtual keyboard is initialized, the session identifier is the current communication identifier between the client and the server, and the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0008] Sending the session identifier and the request ciphertext data to the server, and receiving the response ciphertext data and the session identifier returned by the server based on the request ciphertext data;

[0009] The response ciphertext data is decrypted according to the session key corresponding to the session identifier to obtain response data.

[0010] In a second aspect, the present application provides a data transmission method based on a virtual keyboard, which is applied to a server, and the method includes:

[0011] Receive a session identifier and request ciphertext data sent by a client, wherein the session identifier is a current communication identifier between the client and the server;

[0012] Determine a session key corresponding to the session identifier, and decrypt the request ciphertext data according to the session key to obtain corresponding request data; the session key is generated by the client when the virtual keyboard is initialized; the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0013] Determine corresponding response data based on the request data, and encrypt the response data using the session key to obtain response ciphertext data;

[0014] The response ciphertext data and the session identifier are sent to the client, so that the client determines the corresponding session key according to the session identifier and uses the session key to decrypt the response ciphertext data.

[0015] In a third aspect, the present application provides a data transmission device based on a virtual keyboard, applied to a client, the device comprising:

[0016] A data acquisition module, configured to display a virtual keyboard in the interface of the current application program and acquire requested data in response to an input instruction based on the virtual keyboard;

[0017] a first session encryption module, configured to determine a session key and a corresponding session identifier, and encrypt the request data using the session key to obtain ciphertext request data; the session key is generated by the client when the virtual keyboard is initialized, the session identifier is a current communication identifier between the client and the server, and the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0018] A first data transceiver module is configured to send the session identifier and the request ciphertext data to the server, and receive the response ciphertext data and the session identifier returned by the server based on the request ciphertext data;

[0019] The first session decryption module is configured to decrypt the response ciphertext data according to the session key corresponding to the session identifier to obtain response data.

[0020] In a fourth aspect, the present application provides a data transmission device based on a virtual keyboard, which is applied to a server, and the device includes:

[0021] A second data receiving module is configured to receive a session identifier and a request ciphertext data sent by a client, wherein the session identifier is a current communication identifier between the client and the server;

[0022] a second session decryption module, configured to determine a session key corresponding to the session identifier, and decrypt the request ciphertext data according to the session key to obtain corresponding request data; the session key is generated by the client when the virtual keyboard is initialized; the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0023] a second session encryption module, configured to determine corresponding response data based on the request data, and encrypt the response data using the session key to obtain response ciphertext data;

[0024] The second data sending module is used to send the response ciphertext data and the session identifier to the client, so that the client determines the corresponding session key according to the session identifier and uses the session key to decrypt the response ciphertext data.

[0025] In a fifth aspect, the present application provides a computer-readable storage medium, which stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by a processor to implement a data transmission method based on a virtual keyboard as described in the first aspect or the second aspect.

[0026] In a sixth aspect, the present application provides a computer device, comprising a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement a data transmission method based on a virtual keyboard as described in the first aspect or the second aspect.

[0027] In a seventh aspect, the present application provides a computer program product, characterized in that the computer program product includes computer instructions, which, when executed by a processor, implement a data transmission method based on a virtual keyboard as described in the first aspect or the second aspect.

[0028] The data transmission method, apparatus, medium, and device based on a virtual keyboard provided in this application have the following technical effects:

[0029] The solution provided by this application, during the initialization process of the virtual keyboard, the client and the server negotiate a session key and session identifier. Thus, during the data transmission process, in addition to using the session key to encrypt the request data to obtain the request ciphertext data and decrypt the request ciphertext data, encrypting the response data and decrypting the response ciphertext data, the communication interaction between the client and the server also carries the session identifier, so that the client and the server can determine the corresponding session key based on the session identifier, thereby performing the corresponding decryption operation on the ciphertext data, and there is no need to transmit the encrypted session key during the transmission process. The solution provided by this application, during the data transmission process, uses the session identifier to ensure normal communication interaction between the client and the server, and network intermediaries cannot obtain the session key. Network intermediaries also cannot decrypt data encrypted with the session key based on the session identifier, which can effectively improve the security of data transmission.

[0030] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0032] FIG1 (1) is a schematic diagram of an implementation environment of a data transmission method based on a virtual keyboard provided in an embodiment of the present application;

[0033] Figure 1 (2) is a schematic diagram of an implementation environment of another data transmission method based on a virtual keyboard provided in an embodiment of the present application;

[0034] Figure 2 This is a flow chart of a data transmission method based on a virtual keyboard provided in an embodiment of the present application;

[0035] Figure 3 This is a schematic diagram of a data transmission method based on a virtual keyboard based on data middleware provided in an embodiment of the present application;

[0036] Figure 4 This is a schematic diagram of a process for initializing a virtual keyboard provided in an embodiment of the present application;

[0037] Figure 5 (1) is a schematic diagram of a virtual keyboard provided in an embodiment of the present application;

[0038] Figure 5 (2) is a schematic diagram of another virtual keyboard provided in an embodiment of the present application;

[0039] Figure 6 This is another flowchart of initializing a virtual keyboard provided in an embodiment of the present application;

[0040] Figure 7 This is a flow chart of initializing a virtual keyboard based on data middleware provided in an embodiment of the present application;

[0041] Figure 8 This is a flow chart of a verification process based on signature information provided by an embodiment of the present application;

[0042] Figure 9 This is a process intention for generating signature information provided by an embodiment of the present application;

[0043] Figure 10 This is a schematic diagram of a process for constructing plaintext data for generating signature information provided by an embodiment of the present application;

[0044] Figure 11 This is a flow chart of generating signature information based on signature configuration information provided by an embodiment of the present application;

[0045] Figure 12 is a schematic diagram of a data transmission device based on a virtual keyboard provided in an embodiment of the present application;

[0046] Figure 13 is a schematic diagram of another data transmission device based on a virtual keyboard provided in an embodiment of the present application;

[0047] Figure 14 This is a hardware structure diagram of a device for implementing a data transmission method based on a virtual keyboard provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to improve the security of data transmission, the embodiments of the present application provide a data transmission method, device, medium and equipment based on a virtual keyboard. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, where the same or similar numbers throughout represent the same or similar elements or elements with the same or similar functions.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0050] In order to facilitate understanding of the technical solutions and the technical effects produced by the embodiments of the present application, the embodiments of the present application explain the relevant professional terms involved:

[0051] Virtual keyboard: The virtual keyboard provides comprehensive security protection for users when entering key information. It is a randomly distributed virtual security keyboard provided by the component, also known as a secure keyboard. It protects input data from multiple dimensions, including the bottom layer, before startup, during input, and after input, effectively preventing the leakage of important personal information.

[0052] SM4: Formerly known as SMS4.0, it is a block cipher standard adopted by the government of the People's Republic of China. It was issued by the State Cryptography Administration on March 21, 2012. The relevant standard is "GM / T 0002-2012 SM4 Block Cipher Algorithm."

[0053] Middleware: Middleware is an independent system software service program that allows distributed application software to share resources between different technologies. Middleware is located on the operating system of the client server and manages computing resources and network communications.

[0054] A digital signature, also known as a public key digital signature, is a string of numbers that can only be generated by the sender and cannot be forged by others. This string also effectively proves the authenticity of the information sent by the sender. A digital signature typically defines two complementary operations: one for signing and the other for verification. Digital signatures are the application of asymmetric key encryption technology and digital digest technology.

[0055] URL encoding: URL encoding, also known as percent encoding, is an encoding mechanism for Uniform Resource Locators (URLs) in a specific context.

[0056] HMAC: Hash-based Message Authentication Code. An HMAC algorithm uses a hash algorithm to take a key and a message as input and generate a message digest as output. HMAC can be used for encryption, digital signatures, and message authentication.

[0057] MD5 Message Digest Algorithm: Message-Digest Algorithm MD5, a widely used cryptographic hash function, can generate a 128-bit (16-byte) hash value to ensure the integrity and consistency of information transmission.

[0058] Base64 encoding: A method of representing binary data using 64 printable characters. It converts binary data into characters and is used to transmit long identifiers in HTTP (Hypertext Transfer Protocol) environments. Base64 encoding is unreadable and requires decoding.

[0059] Please refer to Figure 1 (1), which is a schematic diagram of the implementation environment of a data transmission method based on a virtual keyboard provided in an embodiment of the present application. As shown in Figure 1 (1), the implementation environment may include at least a client 01 and a server 02.

[0060] Specifically, the client 01 may include devices such as smartphones, desktop computers, tablet computers, laptops, in-vehicle terminals, digital assistants, smart wearable devices, and voice interaction devices. It may also include software running on the device, such as web pages provided to users by service providers, or applications provided to users by these service providers. Specifically, during the virtual keyboard initialization process, the client 01 may be configured to randomly generate a session key and encrypt the session key using the client public key corresponding to the current application to obtain a ciphertext key. The client 01 may then send the ciphertext key to the server 02 and receive a session identifier corresponding to the session key returned by the server 02. Specifically, during the data transmission process, the client 01 may be configured to obtain request data and encrypt the request data using the session key generated during the virtual keyboard initialization process to obtain request ciphertext data. The client 01 may then be configured to send the request ciphertext data and the session identifier negotiated during the virtual keyboard initialization process to the server 02. The client 01 may also be configured to decrypt the response ciphertext data returned by the server 02 using the session key to obtain response data corresponding to the request data.

[0061] Specifically, the server 02 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server 02 may include a network communication unit, a processor, and a memory, etc. The terminal and the server can be connected directly or indirectly via wired or wireless communication, and this application does not impose any restrictions here. Specifically, during the virtual keyboard initialization process, the server 02 can be used to decrypt the received ciphertext key according to the server private key corresponding to the application to obtain a session key, save the session key and assign a session identifier to the session key, and send the session identifier to the client 01 to complete the negotiation of the session key and session identifier between the client and the server. Specifically, during the data transmission process, the server 02 can be used to determine the corresponding session key based on the received session identifier, and use the session key to decrypt the request ciphertext data to obtain the request data, and encrypt the response data obtained based on the request data and send it to the client 01.

[0062] Please refer to Figure 1(2), which is a schematic diagram of the implementation environment of another virtual keyboard-based data transmission method provided in an embodiment of the present application. As shown in Figure 1(2), the implementation environment can at least include a client 01, a server 02 and a data middleware 03.

[0063] Specifically, the client 01 may include devices such as smartphones, desktop computers, tablet computers, laptops, in-vehicle terminals, digital assistants, smart wearable devices, and voice interaction devices. It may also include software running on the device, such as web pages provided by service providers to users, or applications provided by these service providers to users. Specifically, during the virtual keyboard-based data transmission process, the client 01 may be used to display the application interface and the virtual keyboard within the interface, as well as to obtain request data and send the request data to the data middleware 03.

[0064] Specifically, the data middleware 03 can be a system software service program located on the operating system of the client server, which manages computing resources and network communications. Specifically, during the data transmission process based on the virtual keyboard, the data middleware 03 generates corresponding signature information based on the request data sent by the client 01; the data middleware 03 encrypts the request data according to the session key determined after negotiation between the client 01 and the server 02 during the virtual keyboard initialization process to obtain the request ciphertext data; and the data middleware 03 sends the session identifier determined after negotiation between the client and the server together with the request ciphertext data to the server 02; the data middleware 03 can also send the response ciphertext data returned by the server 02 to the corresponding client 01 based on the session identifier.

[0065] Specifically, the server 02 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server 02 may include a network communication unit, a processor, and a memory, etc. The terminal and the server can be connected directly or indirectly via wired or wireless communication, and this application does not limit this. Specifically, during the data transmission process based on the virtual keyboard, the server 02 can be used to receive the session identifier and request ciphertext data sent by the data middleware 02. The server 02 determines the corresponding session key based on the session identifier and uses the session key to decrypt the request ciphertext data to obtain the request data. The server 02 processes the request data to obtain the response data. The server 02 uses the session key to encrypt the response data and sends the encrypted response ciphertext data and the session identifier to the data middleware 03.

[0066] The embodiments of the present application can also be implemented in conjunction with cloud technology. Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software and network in a wide area network or a local area network to realize the calculation, storage, processing and sharing of data. It can also be understood as a general term for network technology, information technology, integration technology, management platform technology and application technology based on the cloud computing business model. Cloud technology needs to be supported by cloud computing. Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called a "cloud". Specifically, the server 02 and the database are located in the cloud, and the server 02 can be a physical machine or a virtualized machine.

[0067] The following describes a data transmission method based on a virtual keyboard provided by this application. Figure 2 This is a flowchart of a data transmission method based on a virtual keyboard provided in an embodiment of the present application. The present application provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many steps, and does not represent the only execution order. When the actual system or server product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. Please refer to Figure 2 , a data transmission method based on a virtual keyboard provided in an embodiment of the present application may include the following steps:

[0068] S210: The client displays a virtual keyboard in the interface of the current application program, and obtains requested data in response to an input instruction based on the virtual keyboard.

[0069] In an embodiment of the present application, when a current application requires a user to enter sensitive data, a virtual keyboard provided by the application can be provided. The virtual keyboard can be a functional control of the current application and can be displayed in the current interface with a certain data type and character sort order, so that the user can enter sensitive data through the virtual keyboard. When the virtual keyboard detects the user's input, it triggers an input instruction. The client responds to the input instruction and obtains the corresponding request data. The request data is used by the server to process the request event.

[0070] In one embodiment of the present application, the request data may include input data and parameter data. The input data is data entered by the user using the virtual keyboard after initialization, such as sensitive data such as ID number, login password, and payment password; the parameter data may include request parameters of the request event and may also include public parameters. For example, taking the payment request event as an example, after the user enters the payment password, the request parameters may include parameter names and values ​​corresponding to the transaction order number, transaction amount, currency type, merchant ID, and product ID; public parameters may include parameter names and values ​​corresponding to the timestamp, random string, application ID, signature method, and signature version number; and the input data is the payment password entered by the user.

[0071] S220: The client determines the session key and session identifier, and uses the session key to encrypt the request data to obtain the request ciphertext data; and sends the session identifier and the request ciphertext data to the server.

[0072] The session key is generated by the client when the virtual keyboard is initialized, and the session identifier is the current communication identifier between the client and the server. The session identifier is allocated by the server based on the session key when the virtual keyboard is initialized.

[0073] In one embodiment of the present application, after the initialization of the virtual keyboard is completed, the client stores the session identifier assigned by the service client to the session key.

[0074] It is feasible that the client uses the session key to symmetrically encrypt the request data to obtain ciphertext data, and the encryption algorithm can use the SM4 algorithm.

[0075] S230: The server determines the session key corresponding to the session identifier, and decrypts the request ciphertext data according to the session key to obtain the corresponding request data.

[0076] In one embodiment of the present application, after completing the initialization of the virtual keyboard, the server constructs a mapping relationship between the session key and the corresponding session identifier and stores the mapping relationship. After receiving the session identifier and the request ciphertext data, the server determines the corresponding session key based on the session identifier and then uses the session key to decrypt the request ciphertext data.

[0077] Because the client uses the same session key to encrypt and decrypt the request data, the encryption algorithm used by the client and server is a symmetric encryption algorithm. If feasible, the server uses the SM4 algorithm and the session key to symmetric decrypt the request ciphertext data to obtain the request data.

[0078] S240: The server determines the corresponding response data based on the request data, encrypts the response data using the session key to obtain ciphertext response data, and sends the ciphertext response data and the session identifier to the client.

[0079] Based on the request data, the server processes the request event indicated by the request data, uses the processing result as the corresponding response data, and then uses the session key and the symmetric encryption algorithm to symmetrically encrypt the response data to obtain the response ciphertext data.

[0080] If feasible, the server uses the SM4 algorithm and the session key to symmetrically encrypt the response data to obtain the response ciphertext data.

[0081] S250: The client decrypts the response ciphertext data according to the session key corresponding to the session identifier to obtain response data.

[0082] When the client receives the session identifier and response ciphertext data sent by the server, it determines the corresponding session key based on the session identifier, and uses the session key and the decryption algorithm corresponding to the symmetric encryption algorithm adopted by the server to decrypt the response ciphertext data to obtain the response data. The response data represents the processing result of the server.

[0083] Furthermore, the client displays the event processing result based on the virtual keyboard input according to the decrypted response data, such as payment success or failure, account login success or failure, etc.

[0084] In the above embodiment, in the process of transmitting data based on the virtual keyboard, in addition to using the session key to encrypt and decrypt the data, the communication interactions between the client and the server carry a session identifier, so that the decryption end can determine the corresponding session key based on the session identifier, so that there is no need to transmit the encrypted session key during the transmission process, and the network middleman cannot obtain the session key, and also cannot decrypt the data encrypted with the session key based on the session identifier, which can effectively improve the security of data transmission.

[0085] In another embodiment of the present application, based on the implementation environment shown in FIG1 (2), the data middleware acts as a proxy server of the client, which can separate the data transmission process. By using the data middleware, the data transmission or data encryption and decryption steps in the data transmission method based on the virtual keyboard provided by the present application can be performed by the data middleware. For example, Figure 3As shown, the data middleware stores a session identifier. The data middleware determines the corresponding session identifier, which corresponds to the communication between the client and server and the current application. The data middleware sends the request ciphertext data and the session identifier to the corresponding server, receives the response ciphertext data and the session identifier returned from the server, and forwards the response ciphertext data to the corresponding client based on the session identifier. It can be understood that the data middleware can provide communication support and application support for the applications it supports, primarily by providing standard interfaces and standard encapsulation services to the applications, which can meet the needs of a large number of applications and support distributed computing.

[0086] In one embodiment of the present application, a session key is generated by the client when the virtual keyboard is initialized, and a session identifier is the current communication identifier between the client and the server. The session identifier is assigned by the server based on the session key when the virtual keyboard is initialized. That is, before executing data transmission based on the virtual keyboard, the virtual keyboard is first initialized.

[0087] Specifically, if Figure 4 As shown, the initialization process of the virtual keyboard may include the following steps:

[0088] S410: The client randomly generates a session key in response to the initialization instruction of the virtual keyboard.

[0089] In an embodiment of the present application, the application provides a self-made virtual keyboard to prevent users from using the client's system keyboard for input, which makes it easier for intruders to read the keyboard input data. The client parses the digital certificate for the application issued by the server to obtain the keyboard data type, arrangement order and other parameters when the client loads the virtual keyboard. Figures 5 (1) and 5 (2) show two different styles of virtual keyboards. Figure 5 (1) shows a virtual keyboard with 26 English characters as the data type, and Figure 5 (2) shows a virtual keyboard with ID card numbers as the data type and the numbers are randomly arranged. In addition, the digital certificate issued by the server also includes the client public key used to encrypt communication data, and the corresponding server private key is saved by the server.

[0090] In an embodiment of the present application, the initialization process of the virtual keyboard not only loads the virtual keyboard on the client and displays it in a certain style, but also includes a negotiation process of the session key and session identifier to improve the security during data transmission.

[0091] Specifically, the client can use a pseudo-random number generator to generate a session key, which is used to encrypt and decrypt communications between the client and the server, or the client can randomly generate a session key based on the parameters of the current scenario. The parameters of the current scenario may include but are not limited to timestamp, IP address (Internet Protocol Address), user account, etc.

[0092] In one embodiment of the present application, the session key is a temporary communication key between the client and the server. It can be stored in the client's memory, reducing the risk of local client data being stolen. In addition, when the current communication connection between the client and the server is closed, the session key becomes invalid. The session keys at different connection stages are different, providing further security for subsequent data transmission.

[0093] S420: The client determines the client public key corresponding to the application, and uses the client public key to encrypt the session key to obtain a ciphertext key, and sends the ciphertext key to the server.

[0094] In one embodiment of the present application, the client obtains the client public key corresponding to the application from a digital certificate created and issued by the server. The corresponding server private key is stored by the server, and the client public key and the server private key are different. Optionally, the digital certificate can also specify key negotiation methods and asymmetric encryption algorithms, allowing encryption schemes to be upgraded without impacting services.

[0095] In one embodiment of the present application, the client public key is used to perform asymmetric encryption on the session key to obtain a ciphertext key. Asymmetric encryption algorithms may include, but are not limited to, the SM2 algorithm (an elliptic curve public key cryptography algorithm) and the RSA algorithm (a factorization-based cryptography algorithm).

[0096] S430: The server decrypts the ciphertext key according to the server private key corresponding to the application to obtain the session key.

[0097] Correspondingly, based on the decryption algorithm corresponding to the client asymmetric encryption algorithm, the server private key is used to decrypt the received ciphertext key to obtain the session key.

[0098] In one embodiment of the present application, the session key can be stored in the memory of the server. In addition, when the current communication connection between the client and the server is closed, the session key becomes invalid. The session keys at different connection stages are different, providing further security for subsequent data transmission.

[0099] S440: The server assigns a corresponding session identifier to the session key and sends the session identifier to the client for storage.

[0100] In the embodiment of the present application, the session identifier corresponding to the session key can be used to identify the current communication status between the client and the server. After the server assigns a unique corresponding session identifier to the session key, it stores the mapping relationship between the session identifier and the session key.

[0101] In one embodiment of the present application, the session key can be configured with an expiration mechanism. After a preset period of time or a preset event (such as an input event based on a virtual keyboard), the session key will expire and become invalid. A new round of key negotiation will need to be initiated between the client and the server, and a corresponding session identifier will be reassigned for the new session key. Even if an attacker steals the session key during a particular initialization process, the key cannot be used continuously, thereby minimizing the damage caused by the theft of the session key.

[0102] Furthermore, the client may also store the session identifier in memory.

[0103] In the above embodiment, during the initialization process of the virtual keyboard, a session key is randomly generated, and the session key is encrypted using the client public key corresponding to the current application to obtain a ciphertext key; the ciphertext key is then sent to the server, and the server decrypts the ciphertext key based on the server private key corresponding to the application to obtain the session key, and assigns a session identifier to the session key, and returns the session identifier to the client, completing the negotiation of the session key and session identifier between the client and the server; the session key and session identifier are used for subsequent communication interactions between the client and the server, so that there is no need to transmit the session key during the communication interaction, and the communication data cannot be decrypted by the session identifier, which provides a guarantee for the security of data transmission.

[0104] In one embodiment of the present application, the process of initializing the virtual keyboard may include, in addition to the negotiation process of the session key and the session identifier, an interactive process based on data, such as Figure 6 As shown, the initialization process of the virtual keyboard may further include the following steps:

[0105] S610: The client randomly generates a session key and determines initialization request data in response to the initialization instruction.

[0106] In one embodiment of the present application, the initialization request data can be used to request the server to respond to and process relevant parameter data regarding the loading of the virtual keyboard. The relevant parameter data may be, for example, keyboard data type, keyboard arrangement order, display style parameters, etc.; alternatively, the initialization request data can also be used to verify whether the server is in a normal working state or to verify whether the encryption and decryption functions of the server are operating normally. The initialization request data may be an initialization timestamp of the virtual keyboard, etc.

[0107] S620: The client determines the client public key corresponding to the application, and uses the client public key to encrypt the session key to obtain a ciphertext key.

[0108] In one embodiment of the present application, the client obtains the client public key corresponding to the application from a digital certificate created and issued by the server. The corresponding server private key is stored by the server, and the client public key and the server private key are different. Optionally, the digital certificate can also specify key negotiation methods and asymmetric encryption algorithms, allowing encryption schemes to be upgraded without impacting services.

[0109] In one embodiment of the present application, the client public key is used to perform asymmetric encryption on the session key to obtain a ciphertext key. Asymmetric encryption algorithms may include, but are not limited to, the SM2 algorithm (an elliptic curve public key cryptography algorithm) and the RSA algorithm (a factorization-based cryptography algorithm).

[0110] S630: The client encrypts the initialization request data using the session key to obtain the initialization request ciphertext data, and sends the ciphertext key and the initialization request ciphertext data to the server.

[0111] In a feasible implementation, the client uses the SM4 algorithm and the session key to symmetrically encrypt the initialization request data to obtain the initialization request ciphertext data.

[0112] Furthermore, the ciphertext key and the initialization request ciphertext data are encapsulated to generate an initialization request, which is then sent to the server.

[0113] S640: The server decrypts the ciphertext key according to the server private key corresponding to the application to obtain the session key.

[0114] Correspondingly, based on the decryption algorithm corresponding to the client asymmetric encryption algorithm, the server private key is used to decrypt the received ciphertext key to obtain the session key.

[0115] In one embodiment of the present application, the session key can be stored in the memory of the server. In addition, when the current communication connection between the client and the server is closed, the session key becomes invalid. The session keys at different connection stages are different, providing further security for subsequent data transmission.

[0116] S650: The server decrypts the initialization request ciphertext data according to the session key to obtain the initialization request data, and generates initialization response data based on the initialization request data.

[0117] Because the client and server use the same session key to encrypt and decrypt data, the cryptographic algorithm used by the client and server is a symmetric algorithm. If feasible, the server uses the SM4 algorithm and the session key to symmetric decrypt the initialization request ciphertext data to obtain the initialization request data.

[0118] Furthermore, the initialization request event indicated by the initialization request data can be processed, and the processing result can be used as the initialization response data. The event processing logic can be configured based on the communication protocol and the request response mechanism.

[0119] In a feasible implementation, the server side uses the SM4 algorithm and the session key to symmetrically decrypt the initialization request ciphertext data to obtain the initialization request data.

[0120] S660: The server allocates a corresponding session identifier for the session key.

[0121] The session identifier is the current communication identifier between the client and the server, and is used to identify the communication interaction between the client and the server.

[0122] If feasible, the server randomly selects an idle session identifier from the available session identifiers to match the session key, or generates a new session identifier to match the session key.

[0123] Furthermore, the server stores the mapping relationship between the session key and the session identifier. The server and the client complete the negotiation of the session key, that is, within the subsequent preset time, both use the session key to encrypt and decrypt data.

[0124] S670: The server encrypts the initialization response data according to the session key to obtain the initialization response ciphertext data, and sends the session identifier and the initialization response ciphertext data to the client.

[0125] The server uses the session key to symmetrically encrypt the initialization response data to obtain the initialization response ciphertext data. If feasible, the server uses the SM4 algorithm and the session key to symmetrically encrypt the initialization response data.

[0126] The server and the client have completed the negotiation of the session identifier, that is, within the subsequent preset time, the session identifier is used to determine the data sending object and the receiving object.

[0127] S680: The client stores the session identifier, decrypts the initialization response ciphertext data according to the session key, obtains initialization response data, and completes the initialization of the virtual keyboard according to the initialization response data.

[0128] In a feasible implementation, the client may use the SM4 algorithm and the session key to symmetrically decrypt the initialization response ciphertext data to obtain the initialization response data.

[0129] Preferably, the client can store the session identifier in memory to reduce the risk of data theft.

[0130] In one embodiment of the present application, the initialization request data is used to request the server to return relevant parameter data about the loading of the virtual keyboard, such as keyboard data type, keyboard arrangement order, display style parameters, etc., and the relevant parameter data is determined based on the decrypted initialization response data, and the initialization of the virtual keyboard is completed based on the relevant parameter data.

[0131] In one embodiment of the present application, the initialization request data is used to verify whether the server is in a normal working state or whether the encryption and decryption functions of the server are operating normally. The verification can be performed based on the decrypted initialization response data. If the initialization request data and the initialization response data meet the preset communication protocol, it can be determined that the server is currently in a normal working state and the encryption and decryption functions are operating normally.

[0132] In another embodiment of the present application, based on the implementation environment shown in FIG1 (2), the data transmission or data encryption and decryption during the initialization process of the virtual keyboard in the data transmission method based on the virtual keyboard provided by the present application can be performed by the data middleware. Based on the embodiment of the present application, the data transmission or processing method based on the client-data middleware-server can also be planned according to the application requirements or architecture design, and the embodiment of the present application does not limit this.

[0133] For example, Figure 7 As shown, the server sends the session identifier to the data middleware, which then stores it to support subsequent communication interactions. Furthermore, the data middleware can store the digital certificates issued by the server for different applications, allowing the client to identify the client public key corresponding to the application. The data middleware provides communication and application support for the applications it supports, primarily by providing standard interfaces and standard encapsulation services. This can meet the needs of a wide range of applications and support distributed computing.

[0134] In one embodiment of the present application, on the basis of encrypting the data, signature information can also be constructed to enable the server to verify the authenticity of the transmitted data. Specifically, Figure 8 As shown, the method may further include:

[0135] S810: Determine corresponding signature information based on the request data.

[0136] It is understandable that signature information (also known as digital signature) is some data attached to the request data, or a transformation made to the request data, which allows the server receiving the data to use the signature information to confirm the source of the request data or the integrity and authenticity of the input data to prevent forgery.

[0137] Specifically, digital summary and asymmetric encryption are performed based on the request data to obtain corresponding signature information.

[0138] It is understood that a set of digital signatures usually defines two complementary operations, one for signing and the other for verification.

[0139] S820: Generate an application request based on the request ciphertext data and signature information, and send the session identifier and the application request to the server.

[0140] Specifically, the request ciphertext data and signature information are encapsulated, that is, the above data and information are encapsulated in the protocol header and protocol footer, which can be understood as the packaging of the request ciphertext data and signature information, thereby obtaining an application request.

[0141] S830: The server verifies the ciphertext data in the application request based on the signature information in the application request and obtains a signature verification result. The signature verification result indicates whether the ciphertext data has been tampered with.

[0142] Accordingly, the server decapsulates the application request and obtains the request ciphertext data and signature information.

[0143] Specifically, the server asymmetrically decrypts the signature information to obtain a digital digest. The server then extracts the same digest from the decrypted request data. The two digests are then compared. If they match, the original data, i.e., the ciphertext request data, has not been tampered with. If they do not match, the authenticity of the original data remains to be verified. For example, a hash algorithm may be used for the digest extraction technique.

[0144] In a feasible implementation, the request data includes parameter data and input data, such as Figure 9 As shown, determining the corresponding signature information based on the request data may include the following steps:

[0145] S811: Obtain first character information according to the parameter name in the parameter data and the parameter value corresponding to the parameter name.

[0146] In one embodiment of the present application, the parameter names and corresponding parameter values ​​in the parameter data are converted into a unified string format and concatenated into complete first character information. Specifically, Figure 10 As shown, the following steps may be included:

[0147] S8111: Encode the parameter name and the parameter value corresponding to the parameter name to obtain the target parameter name and the target parameter value corresponding to the target parameter name; the target parameter name and the target parameter value are in character format.

[0148] Alternatively, URL encoding is performed on the parameter name and the parameter value to obtain a target parameter name and a corresponding target parameter value in character format.

[0149] Parameter data may include request parameters of the request event and public parameters. For example, taking the payment request event as an example, when the user enters the payment password, the request parameters may include parameter names and parameter values ​​corresponding to the transaction order number, transaction amount, currency type, merchant ID, product ID, etc. Public parameters may include parameter names and parameter values ​​corresponding to timestamps, random strings, application IDs, signature methods, signature version numbers, etc.

[0150] S8113: Determine the order of the target parameter names according to the target parameter names.

[0151] Preferably, the target parameter names are sorted according to the order of the first characters of the target parameter names in the 26 English letters to determine the arrangement order.

[0152] S8115: Based on the arrangement order, concatenate the target parameter name and the target parameter value corresponding to the target parameter name to obtain the first character information.

[0153] For example, the target parameter names are arranged in the order of target parameter name 1, target parameter name 2 and target parameter name 3. The target parameter names and the target parameter values ​​corresponding to the target parameter names are concatenated, and the first character information obtained can be expressed as: target parameter name 1 = target parameter value 1 & target parameter name 2 = target parameter value 2 & target parameter name 3 = target parameter value 3.

[0154] S813: Concatenate the first character string information and the input data to obtain second character information.

[0155] Alternatively, characters in the input data may be sequentially taken out and concatenated after the first character string information to obtain the second character information. In the embodiment of the present application, there is no limitation on whether the input data is concatenated before or after the first character string information.

[0156] S815: Encrypt and encode the second character information to obtain the signature information.

[0157] Based on the second character information, the signature method is used for encryption and the encoding method is used for encoding to obtain the signature parameter value, and the signature parameter name (sign) and the signature parameter value (signvalue) are used as a set of signature parameters to obtain the signature information. Specifically, Figure 11 As shown, the following steps may be included:

[0158] S8151: Determine signature configuration information based on the parameter data, where the signature configuration information includes a signature algorithm and a signature key.

[0159] The parameter data may include data such as the signature method and signature version number. The specified signature algorithm is determined based on the signature method parameter value. The signature algorithm may include, but is not limited to, the HMAC algorithm and the MD5 message digest algorithm. The parameter data may also include an application identifier. The signature key corresponding to the application is determined based on the application identifier. The signature key can be issued by the server when the virtual keyboard is initialized. In addition, the signature configuration information may also include a signature version number, which is used to update the signature configuration information by controlling the signature version number when upgrading the security solution.

[0160] S8153: Encrypt the second character information according to the signature configuration information to obtain third character information.

[0161] Feasibly, the second character information is encrypted using the signature algorithm and signature key specified in the signature configuration information to obtain third character information, which is equivalent to the digital summary of the second character information. The third character information can be expressed as a binary data string.

[0162] S8155: Encode the third character information to obtain a signature parameter value, and use the signature parameter value and signature parameter name as the signature information.

[0163] Alternatively, the third character information is base64 encoded and URL encoded to obtain a signature parameter value (signvalue).

[0164] In another embodiment of the present application, based on the implementation environment shown in Figure 1 (2), the data middleware acts as a proxy server for the client and can execute the construction of signature information. Exemplarily, in the process of constructing signature information, the data middleware obtains and saves input data and parameter data from the client. The data middleware stores digital certificates of different applications, and generates signature information based on the input data and parameter data based on the signature configuration information corresponding to the current application defined in the digital certificate. The specific process can refer to steps S810-S830, which will not be repeated here. In addition, the data middleware can also encapsulate the ciphertext data, signature information and parameter data to generate an application request sent to the server. The data middleware also stores a session identifier, sends the application request and the corresponding session identifier to the server together, and receives the result data and session identifier returned from the server. It can be understood that the data middleware can provide communication support and application support for the applications it supports, mainly providing standard interfaces and standard encapsulation services to the applications, which can meet a large number of application requirements and support distributed computing.

[0165] As can be seen from the above embodiments, the solution provided by the present application negotiates the session key and session identifier during the initialization process of the virtual keyboard. Thus, during the data transmission process, in addition to using the session key to encrypt the request data to obtain the request ciphertext data and decrypt the request ciphertext data, encrypting the response data and decrypting the response ciphertext data, the communication interaction between the client and the server carries the session identifier, so that the client and the server can determine the corresponding session key based on the session identifier, thereby performing the corresponding decryption operation on the ciphertext data, and there is no need to transmit the encrypted session key during the transmission process. The solution provided by the present application ensures the normal communication interaction between the client and the server during the data transmission process by using the session identifier, and the network middleman cannot obtain the session key. The network middleman also cannot decrypt the data encrypted with the session key based on the session identifier, which can effectively improve the security of data transmission.

[0166] The embodiment of the present application provides a data transmission device 1200 based on a virtual keyboard, such as Figure 12 As shown, the apparatus 1200 may include:

[0167] The data acquisition module 1210 is configured to display a virtual keyboard in the interface of the current application program and acquire requested data in response to an input instruction based on the virtual keyboard;

[0168] a first session encryption module 1220 configured to determine a session key and a corresponding session identifier, and encrypt the request data using the session key to obtain ciphertext request data; the session key is generated by the client when the virtual keyboard is initialized, the session identifier is the current communication identifier between the client and the server, and the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0169] The first data transceiver module 1230 is configured to send the session identifier and the request ciphertext data to the server, and receive the response ciphertext data and the session identifier returned by the server based on the request ciphertext data;

[0170] The first session decryption module 1240 is configured to decrypt the response ciphertext data according to the session key corresponding to the session identifier to obtain response data.

[0171] In one embodiment of the present application, the apparatus 1200 may further include:

[0172] a signature information determining unit, configured to determine corresponding signature information based on the request data;

[0173] a request generating unit, configured to generate an application request according to the request ciphertext data and the signature information;

[0174] The first sending unit is configured to send the session identifier and the application request to the server, so that the server verifies the request ciphertext data based on the signature information.

[0175] In one embodiment of the present application, the signature information determining unit may include:

[0176] A first character information generating unit, configured to obtain first character information according to a parameter name in the parameter data and a parameter value corresponding to the parameter name;

[0177] A second character information generating unit, configured to concatenate the first character string information and the input data to obtain second character information;

[0178] The signature information generating unit is configured to encrypt and encode the second character information to obtain the signature information.

[0179] In one embodiment of the present application, the first character information generating unit may include:

[0180] an encoding subunit, configured to encode the parameter name and the parameter value corresponding to the parameter name to obtain a target parameter name and a target parameter value corresponding to the target parameter name; the target parameter name and the target parameter value are in character format;

[0181] an arrangement order determination subunit, configured to determine an arrangement order of the target parameter names according to the target parameter names;

[0182] The first character information generating subunit is configured to concatenate the target parameter name and the target parameter value corresponding to the target parameter name based on the arrangement order to obtain the first character information.

[0183] In one embodiment of the present application, the signature information generation unit may include:

[0184] a signature configuration information determining subunit, configured to determine signature configuration information according to the parameter data, the signature configuration information including a signature algorithm and a signature key;

[0185] an encryption subunit, configured to encrypt the second character information according to the signature configuration information to obtain third character information;

[0186] The signature information generating subunit is configured to encode the third character information to obtain a signature parameter value, and use the signature parameter value and the signature parameter name as the signature information.

[0187] In one embodiment of the present application, the apparatus 1200 may further include a virtual keyboard initialization module, and the virtual keyboard initialization module may include:

[0188] a session key generating unit, configured to randomly generate the session key in response to an initialization instruction of the virtual keyboard;

[0189] a session key encryption unit, configured to determine a client public key corresponding to the application, and encrypt the session key using the client public key to obtain a ciphertext key;

[0190] A first information sending unit is configured to send the ciphertext key to the server, so that the server decrypts the ciphertext key according to the server private key corresponding to the application to obtain the session key, and assigns the corresponding session identifier to the session key;

[0191] The first information receiving unit is configured to receive and store the session identifier returned by the server, where the session identifier is a current communication identifier between the client and the server.

[0192] In one embodiment of the present application, the virtual keyboard initialization module may further include:

[0193] an initialization request data determining unit, configured to determine initialization request data in response to the initialization instruction;

[0194] a data encryption unit, configured to encrypt the initialization request data using the session key to obtain initialization request ciphertext data;

[0195] a data sending unit, configured to send the initialization request ciphertext data to the server, so that the server decrypts the initialization request ciphertext data according to the decrypted session key to obtain the initialization request data, and generates initialization response data based on the initialization request data;

[0196] a data receiving unit, configured to receive the initialization response ciphertext data returned by the server, wherein the initialization response ciphertext data is obtained by encrypting the initialization response data according to the session key;

[0197] a data decryption unit, configured to decrypt the initialization response ciphertext data according to the session key to obtain the initialization response data;

[0198] An initialization unit is used to complete the initialization of the virtual keyboard according to the initialization response data.

[0199] It should be noted that the apparatus provided in the above embodiments, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0200] The embodiment of the present application also provides another data transmission device 1300 based on a virtual keyboard, such as Figure 13 As shown, the apparatus 1300 may include:

[0201] The second data receiving module 1310 is configured to receive a session identifier and a request ciphertext data sent by a client, wherein the session identifier is a current communication identifier between the client and the server;

[0202] a second session decryption module 1320, configured to determine a session key corresponding to the session identifier, and decrypt the request ciphertext data according to the session key to obtain the corresponding request data; the session key is generated by the client when the virtual keyboard is initialized; the session identifier is assigned by the server based on the session key when the virtual keyboard is initialized;

[0203] The second session encryption module 1330 is configured to determine corresponding response data based on the request data, and encrypt the response data using the session key to obtain ciphertext response data;

[0204] The second data sending module 1340 is configured to send the response ciphertext data and the session identifier to the client, so that the client determines the corresponding session key according to the session identifier and decrypts the response ciphertext data using the session key.

[0205] In one embodiment of the present application, the apparatus 1300 may further include:

[0206] An application request receiving unit, configured to receive a session identifier and an application request sent by the client, wherein the application request includes the request ciphertext data and corresponding signature information;

[0207] The signature verification unit is used to verify the requested ciphertext data based on the signature information to obtain a signature verification result, wherein the signature verification result indicates whether the requested ciphertext data has been tampered with.

[0208] In one embodiment of the present application, the apparatus 1300 may further include:

[0209] a ciphertext key receiving unit, configured to receive a ciphertext key sent by the client during the initialization process of the virtual keyboard, wherein the ciphertext key is obtained by encrypting the session key by the client using the client public key corresponding to the application, and the session key is generated by the client when the virtual keyboard is initialized;

[0210] The session identifier allocation unit is used to decrypt the ciphertext key according to the server private key corresponding to the application to obtain the session key, and allocate the corresponding session identifier to the session key.

[0211] It should be noted that the apparatus provided in the above embodiments, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0212] An embodiment of the present application provides a computer device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement a data transmission method based on a virtual keyboard as provided in the above method embodiment.

[0213] Figure 14 A hardware structure diagram of a device for implementing a data transmission method based on a virtual keyboard provided in an embodiment of the present application is shown. The device may participate in or include the apparatus or system provided in an embodiment of the present application. Figure 14 As shown, the device 10 may include one or more (illustrated as 1002a, 1002b, ..., 1002n in the figure) processors 1002 (the processor 1002 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 1004 for storing data, and a transmission device 1006 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 14 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 14 More or fewer components than shown, or with Figure 14 Different configurations shown.

[0214] It should be noted that the one or more processors 1002 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the device 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0215] The memory 1004 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the methods described in the embodiments of the present application. The processor 1002 executes various functional applications and data processing by running the software programs and modules stored in the memory 1004, that is, implementing the above-mentioned data transmission method based on a virtual keyboard. The memory 1004 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1004 may further include a memory remotely located relative to the processor 1002, and these remote memories may be connected to the device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0216] The transmission device 1006 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of the device 10. In one embodiment, the transmission device 1006 may include a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In one embodiment, the transmission device 1006 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0217] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of device 10 (or mobile device).

[0218] An embodiment of the present application also provides a computer-readable storage medium, which can be set in a server to store at least one instruction or at least one program related to a data transmission method based on a virtual keyboard in an embodiment of the method. The at least one instruction or the at least one program is loaded and executed by the processor to implement a data transmission method based on a virtual keyboard provided in the above-mentioned embodiment of the method.

[0219] Optionally, in this embodiment, the storage medium may be located in at least one of a plurality of network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0220] An embodiment of the present invention further provides a computer program product or computer program, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a virtual keyboard-based data transmission method provided in any of the aforementioned optional embodiments.

[0221] From the embodiments of the virtual keyboard-based data transmission method, apparatus, medium, and device provided by the present application, it can be seen that:

[0222] The solution provided by this application, during the initialization process of the virtual keyboard, the client and the server negotiate a session key and session identifier. Thus, during the data transmission process, in addition to using the session key to encrypt the request data to obtain the request ciphertext data and decrypt the request ciphertext data, encrypting the response data and decrypting the response ciphertext data, the communication interaction between the client and the server also carries the session identifier, so that the client and the server can determine the corresponding session key based on the session identifier, thereby performing the corresponding decryption operation on the ciphertext data, and there is no need to transmit the encrypted session key during the transmission process. The solution provided by this application, during the data transmission process, uses the session identifier to ensure normal communication interaction between the client and the server, and network intermediaries cannot obtain the session key. Network intermediaries also cannot decrypt data encrypted with the session key based on the session identifier, which can effectively improve the security of data transmission.

[0223] It should be noted that the order of the embodiments of the present application described above is for descriptive purposes only and does not represent the superiority or inferiority of the embodiments. The above description is of specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0224] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device, equipment, and storage medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0225] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0226] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A data transmission method based on a virtual keyboard, characterized in that: Applied to a client, the method includes: Displaying a virtual keyboard in the interface of the current application program, and acquiring requested data in response to an input instruction based on the virtual keyboard; Determining a session key and a session identifier, and encrypting the request data using the session key to obtain ciphertext request data; the session key is randomly generated by the client when the virtual keyboard is initialized, and the session identifier is the current communication identifier between the client and the server, and the session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized; Sending the session identifier and the request ciphertext data to the server, so that the server determines the session key corresponding to the session identifier, decrypts the request ciphertext data according to the session key to obtain corresponding request data, determines corresponding response data based on the request data, and encrypts the response data using the session key to obtain response ciphertext data; Receiving the response ciphertext data and the session identifier returned by the server based on the request ciphertext data; The response ciphertext data is decrypted according to the session key corresponding to the session identifier to obtain response data.

2. The method according to claim 1, characterized in that The method further comprises: Determining corresponding signature information based on the request data; Generate an application request according to the request ciphertext data and the signature information; The session identifier and the application request are sent to the server, so that the server verifies the request ciphertext data based on the signature information.

3. The method according to claim 2, characterized in that The request data includes parameter data and input data, and determining corresponding signature information based on the request data includes: Obtaining first character information according to a parameter name in the parameter data and a parameter value corresponding to the parameter name; Concatenate the first character string information and the input data to obtain second character information; The second character information is encrypted and encoded to obtain the signature information.

4. The method according to claim 3, characterized in that The obtaining of the first character information according to the parameter name in the parameter data and the parameter value corresponding to the parameter name includes: Encoding the parameter name and the parameter value corresponding to the parameter name to obtain a target parameter name and a target parameter value corresponding to the target parameter name; the target parameter name and the target parameter value are in character format; Determining the order of the target parameter names according to the target parameter names; Based on the arrangement order, the target parameter name and the target parameter value corresponding to the target parameter name are concatenated to obtain first character information.

5. The method according to claim 3, characterized in that The encrypting and encoding the second character information to obtain the signature information includes: Determine signature configuration information based on the parameter data, the signature configuration information including a signature algorithm and a signature key; Encrypting the second character information according to the signature configuration information to obtain third character information; The third character information is encoded to obtain a signature parameter value, and the signature parameter value and the signature parameter name are used as the signature information.

6. The method according to claim 1, characterized in that The session key is generated by the client when the virtual keyboard is initialized, and the session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized, including: randomly generating the session key in response to an initialization instruction of the virtual keyboard; Determine the client public key corresponding to the application, and encrypt the session key using the client public key to obtain a ciphertext key; Sending the ciphertext key to the server, so that the server decrypts the ciphertext key according to the server private key corresponding to the application to obtain the session key, and assigning the corresponding session identifier to the session key; Receive and store the session identifier returned by the server, where the session identifier is a current communication identifier between the client and the server.

7. The method according to claim 6, characterized in that The method further comprises: In response to the initialization instruction, determining initialization request data; Encrypting the initialization request data using the session key to obtain initialization request ciphertext data; Sending the initialization request ciphertext data to the server, so that the server decrypts the initialization request ciphertext data according to the decrypted session key to obtain the initialization request data, and generates initialization response data based on the initialization request data; receiving the initialization response ciphertext data returned by the server, wherein the initialization response ciphertext data is obtained by encrypting the initialization response data according to the session key; Decrypting the initialization response ciphertext data according to the session key to obtain the initialization response data; The initialization of the virtual keyboard is completed according to the initialization response data.

8. A data transmission method based on a virtual keyboard, characterized in that: Applied to the server, the method includes: Receive a session identifier and request ciphertext data sent by a client, wherein the session identifier is a current communication identifier between the client and the server; Determine a session key corresponding to the session identifier, and decrypt the request ciphertext data according to the session key to obtain corresponding request data; the session key is randomly generated by the client when the virtual keyboard is initialized; the session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized; Determine corresponding response data based on the request data, and encrypt the response data using the session key to obtain response ciphertext data; The response ciphertext data and the session identifier are sent to the client, so that the client determines the corresponding session key according to the session identifier and uses the session key to decrypt the response ciphertext data.

9. The method according to claim 8, characterized in that The method further comprises: Receive a session identifier and an application request sent by the client, wherein the application request includes the request ciphertext data and corresponding signature information; Based on the signature information, the requested ciphertext data is verified to obtain a signature verification result, where the signature verification result indicates whether the requested ciphertext data has been tampered with.

10. The method according to claim 8, characterized in that The session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized, and includes: During the initialization of the virtual keyboard, receiving a ciphertext key sent by the client, where the ciphertext key is obtained by encrypting the session key by the client using the client public key corresponding to the application, where the session key is generated by the client when the virtual keyboard is initialized; The ciphertext key is decrypted according to the server private key corresponding to the application to obtain the session key, and the corresponding session identifier is allocated to the session key.

11. A data transmission device based on a virtual keyboard, characterized in that: Applied to a client, the device includes: A data acquisition module, configured to display a virtual keyboard in the interface of the current application program and acquire requested data in response to an input instruction based on the virtual keyboard; a first session encryption module, configured to determine a session key and a corresponding session identifier, and encrypt the request data using the session key to obtain ciphertext request data; the session key is randomly generated by the client when the virtual keyboard is initialized, the session identifier is a current communication identifier between the client and the server, and the session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized; A first data transceiver module is configured to send the session identifier and the request ciphertext data to the server, so that the server determines the session key corresponding to the session identifier, decrypts the request ciphertext data according to the session key to obtain corresponding request data, determines corresponding response data based on the request data, and encrypts the response data using the session key to obtain response ciphertext data; and receives the response ciphertext data and the session identifier returned by the server based on the request ciphertext data; The first session decryption module is configured to decrypt the response ciphertext data according to the session key corresponding to the session identifier to obtain response data.

12. The device according to claim 11, characterized in that The device further comprises: a signature information determining unit, configured to determine corresponding signature information based on the request data; a request generating unit, configured to generate an application request according to the request ciphertext data and the signature information; The first sending unit is configured to send the session identifier and the application request to the server, so that the server verifies the request ciphertext data based on the signature information.

13. The device according to claim 12, characterized in that The request data includes parameter data and input data, and the signature information determination unit includes: A first character information generating unit, configured to obtain first character information according to a parameter name in the parameter data and a parameter value corresponding to the parameter name; A second character information generating unit, configured to concatenate the first character string information and the input data to obtain second character information; The signature information generating unit is configured to encrypt and encode the second character information to obtain the signature information.

14. The device according to claim 13, characterized in that The first character information generating unit includes: an encoding subunit, configured to encode the parameter name and the parameter value corresponding to the parameter name to obtain a target parameter name and a target parameter value corresponding to the target parameter name; the target parameter name and the target parameter value are in character format; an arrangement order determination subunit, configured to determine an arrangement order of the target parameter names according to the target parameter names; The first character information generating subunit is configured to concatenate the target parameter name and the target parameter value corresponding to the target parameter name based on the arrangement order to obtain the first character information.

15. The device according to claim 13, characterized in that The signature information generation unit includes: a signature configuration information determining subunit, configured to determine signature configuration information according to the parameter data, the signature configuration information including a signature algorithm and a signature key; an encryption subunit, configured to encrypt the second character information according to the signature configuration information to obtain third character information; The signature information generating subunit is configured to encode the third character information to obtain a signature parameter value, and use the signature parameter value and the signature parameter name as the signature information.

16. The device according to claim 11, characterized in that The device further includes a virtual keyboard initialization module, and the virtual keyboard initialization module includes: a session key generating unit, configured to randomly generate the session key in response to an initialization instruction of the virtual keyboard; a session key encryption unit, configured to determine a client public key corresponding to the application, and encrypt the session key using the client public key to obtain a ciphertext key; A first information sending unit is configured to send the ciphertext key to the server, so that the server decrypts the ciphertext key according to the server private key corresponding to the application to obtain the session key, and assigns the corresponding session identifier to the session key; The first information receiving unit is configured to receive and store the session identifier returned by the server, where the session identifier is a current communication identifier between the client and the server.

17. The device according to claim 16, characterized in that The virtual keyboard initialization module also includes: an initialization request data determining unit, configured to determine initialization request data in response to the initialization instruction; a data encryption unit, configured to encrypt the initialization request data using the session key to obtain initialization request ciphertext data; a data sending unit, configured to send the initialization request ciphertext data to the server, so that the server decrypts the initialization request ciphertext data according to the decrypted session key to obtain the initialization request data, and generates initialization response data based on the initialization request data; a data receiving unit, configured to receive the initialization response ciphertext data returned by the server, wherein the initialization response ciphertext data is obtained by encrypting the initialization response data according to the session key; a data decryption unit, configured to decrypt the initialization response ciphertext data according to the session key to obtain the initialization response data; An initialization unit is used to complete the initialization of the virtual keyboard according to the initialization response data.

18. A data transmission device based on a virtual keyboard, characterized in that: Applied to the server, the device includes: A second data receiving module is configured to receive a session identifier and a request ciphertext data sent by a client, wherein the session identifier is a current communication identifier between the client and the server; a second session decryption module, configured to determine a session key corresponding to the session identifier, and decrypt the request ciphertext data according to the session key to obtain corresponding request data; the session key is randomly generated by the client when the virtual keyboard is initialized; and the session identifier is randomly assigned by the server based on the session key when the virtual keyboard is initialized; a second session encryption module, configured to determine corresponding response data based on the request data, and encrypt the response data using the session key to obtain response ciphertext data; The second data sending module is used to send the response ciphertext data and the session identifier to the client, so that the client determines the corresponding session key according to the session identifier and uses the session key to decrypt the response ciphertext data.

19. The device according to claim 18, characterized in that The device further comprises: An application request receiving unit, configured to receive a session identifier and an application request sent by the client, wherein the application request includes the request ciphertext data and corresponding signature information; The signature verification unit is used to verify the requested ciphertext data based on the signature information to obtain a signature verification result, wherein the signature verification result indicates whether the requested ciphertext data has been tampered with.

20. The device according to claim 18, characterized in that The device further comprises: a ciphertext key receiving unit, configured to receive a ciphertext key sent by the client during the initialization process of the virtual keyboard, wherein the ciphertext key is obtained by encrypting the session key by the client using the client public key corresponding to the application, and the session key is generated by the client when the virtual keyboard is initialized; The session identifier allocation unit is used to decrypt the ciphertext key according to the server private key corresponding to the application to obtain the session key, and allocate the corresponding session identifier to the session key.

21. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement a data transmission method based on a virtual keyboard as described in any one of claims 1 to 10.

22. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement a data transmission method based on a virtual keyboard as described in any one of claims 1 to 10.

23. A computer program product, characterized in that The computer program product includes computer instructions, and when the computer instructions are executed by a processor, a data transmission method based on a virtual keyboard according to any one of claims 1 to 10 is implemented.

Images