Gateway-based data processing method and device, computer and medium

Abstract

The application discloses a gateway-based data processing method and device, a computer and a medium, and the method comprises the following steps: receiving a service request containing first encrypted data and a service identifier sent by a target client, determining a business processing object from all service ends according to the service identifier; obtaining a gateway private key matched with the gateway public key from the business processing object, and decrypting the first encrypted data through the gateway private key; sending the decrypted first encrypted data to the business processing object, so that the business processing object processes the business according to the decrypted first encrypted data; receiving the plaintext feedback data generated after the business processing object processes the business, signing the plaintext feedback data through the gateway private key to obtain second encrypted data; and sending the second encrypted data to the target client, so that the target client verifies the signature of the second encrypted data through the gateway public key and obtains a verification result. The application improves the efficiency of data encryption and decryption processing.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more particularly to a gateway-based data processing method, apparatus, computer, and medium. Background Technology

[0002] During the data exchange between the client and server, both the client's request data and the server's response data are at risk of being intercepted during data transmission. Therefore, the data sender needs to encrypt the data transmitted in the request chain, and the data receiver needs to decrypt the encrypted data to complete the entire data transmission process. Currently, the method to solve the above encryption and decryption problem is that each client and server manages its own encryption and decryption sub-services, and internal network communication between servers also requires corresponding encryption and decryption operations, thus increasing the consumption of server resources. Summary of the Invention

[0003] Based on this, the present invention provides a gateway-based data processing method, apparatus, computer, and medium to solve the problem that existing encryption and decryption operations increase the consumption of server resources.

[0004] A gateway-based data processing method includes:

[0005] The system receives a service request from a target client containing first encrypted data and a service identifier, and determines the service processing object from all the servers based on the service identifier; the first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier; the target client is the client that sent the service request from among all the clients.

[0006] Obtain the gateway private key that matches the gateway public key from the business processing object, and decrypt the first encrypted data using the gateway private key;

[0007] The decrypted first encrypted data is sent to the business processing object so that the business processing object can perform business processing based on the decrypted first encrypted data;

[0008] Receive plaintext feedback data generated after the business processing object performs business processing, and sign the plaintext feedback data with the gateway private key to obtain second encrypted data;

[0009] The second encrypted data is sent to the target client so that the target client can verify the second encrypted data using the gateway public key and obtain the verification result.

[0010] A gateway-based data processing device includes:

[0011] The first receiving module is configured to receive a service request sent by a target client, which includes first encrypted data and a service identifier, and determine the service processing object from all the servers based on the service identifier; the first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier; the target client is the client that sent the service request from all the clients.

[0012] The decryption module is used to obtain the gateway private key that matches the gateway public key from the business processing object, and decrypt the first encrypted data using the gateway private key;

[0013] The first sending module is used to send the decrypted first encrypted data to the business processing object, so that the business processing object can perform business processing based on the decrypted first encrypted data.

[0014] The second receiving module is used to receive plaintext feedback data generated after the business processing object performs business processing, and to sign the plaintext feedback data with the gateway private key to obtain the second encrypted data.

[0015] The second sending module is used to send the second encrypted data to the target client, so that the target client can verify the second encrypted data using the gateway public key and obtain the verification result.

[0016] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the gateway-based data processing method described above.

[0017] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned gateway-based data processing method.

[0018] The aforementioned gateway-based data processing method, apparatus, computer, and medium, in the gateway-based data processing method, after receiving first encrypted data encrypted with the gateway's public key sent by the client, decrypts the first encrypted data using the gateway's private key; thereby sending the decrypted first encrypted data to a business processing object (i.e., one or more servers) for the business processing object to perform business processing based on the decrypted first encrypted data; and after receiving plaintext feedback data generated after the business processing object performs business processing, signing the plaintext feedback data with the gateway's private key, and sending the resulting second encrypted data to the target client, so that the target client can verify the signature of the second encrypted data using the gateway's public key and obtain the verification result. This invention, by encrypting and decrypting business request data and business feedback data between clients and servers at gateways that communicate with multiple clients and multiple servers respectively, eliminates the need for servers to encrypt and decrypt business request data and business feedback data, thereby reducing server resource consumption and improving the efficiency of data encryption and decryption processing while ensuring data transmission security. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the application environment of a gateway-based data processing method according to an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of a gateway-based data processing method according to an embodiment of the present invention;

[0022] Figure 3 This is a flowchart of step S120 of a gateway-based data processing method in one embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of the application environment of a gateway-based data processing method in another embodiment of the present invention;

[0024] Figure 5 This is a flowchart of a gateway-based data processing method in another embodiment of the present invention;

[0025] Figure 6 This is a flowchart of a gateway-based data processing method in another embodiment of the present invention;

[0026] Figure 7This is a flowchart of step S220 of the gateway-based data processing method in another embodiment of the present invention;

[0027] Figure 8 This is a schematic diagram of a gateway-based data processing device according to an embodiment of the present invention;

[0028] Figure 9 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] The gateway-based data processing method provided in this application can be applied to applications such as... Figure 1 In the application environment shown, the client (computer device / terminal device) communicates with the server (server) via a network and a gateway. The client (computer device / terminal device) includes, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0031] In one embodiment, a gateway-based data processing method is provided, which is applied to... Figure 1 Taking the gateway in the example, the gateway communicates and connects with multiple clients and multiple servers, such as... Figure 2 As shown, the method includes the following steps:

[0032] S110: Receive a service request sent by a target client containing first encrypted data and a service identifier; determine the service processing object from all the servers based on the service identifier; the first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier; the target client is the client that sent the service request among all the clients. Understandably, the service identifier included in the service request includes the device identifier corresponding to one or more servers processing the service request; furthermore, in the case of multiple servers, the service identifier also includes the service processing order among the servers; the first encrypted data included in the service request is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier, used to ensure data transmission security. In one embodiment, the gateway public key uses the RSA (Rivest-Shamir-Adleman, an encryption algorithm) encryption method to encrypt the plaintext request data.

[0033] S120: Obtain the gateway private key matching the gateway public key from the service processing object, and decrypt the first encrypted data using the gateway private key. It is understood that the first encrypted data included in the service request matches the service identifier; that is, the gateway private key associated with the service identifier can be used to decrypt the first encrypted data. Therefore, a service processing object can be determined from all the servers based on the service identifier. Each server in the service processing object stores the gateway private key associated with the service identifier, and the first encrypted data can be decrypted using the gateway private key. In one embodiment, the gateway private key uses an RSA encryption method matching the gateway public key to decrypt the first encrypted data.

[0034] In one embodiment, the first encrypted data includes key-encrypted data generated by the target client encrypting the plaintext request data using its client key, and an encryption key generated by encrypting the client key using the gateway's public key. That is, the client first encrypts the plaintext request data using its client key to generate key-encrypted data; then, it encrypts the client key using the gateway's public key to generate an encryption key; and finally, the key-encrypted data and the encryption key are combined to generate the first encrypted data. In one embodiment, the client key uses AES (Advanced Encryption Standard) encryption to encrypt the plaintext request data.

[0035] like Figure 3As shown, in one embodiment, step S120, decrypting the first encrypted data using the gateway private key, includes:

[0036] S121, the encryption key in the first encrypted data is decrypted using the gateway private key to obtain the client key. It is understood that the first encrypted data includes the key-encrypted data generated by encrypting the client key, and the encryption key generated by encrypting the client key using the gateway public key. Therefore, the encryption key needs to be decrypted first to obtain the client key.

[0037] S122, the key-encrypted data is decrypted using the client key to obtain the decrypted first encrypted data. It can be understood that after obtaining the client key, the key-encrypted data can be decrypted using the client key to obtain the decrypted first encrypted data.

[0038] S130, the decrypted first encrypted data is sent to the service processing object so that the service processing object can perform service processing based on the decrypted first encrypted data. It can be understood that after the gateway decrypts the first encrypted data, it sends the decrypted first encrypted data to the service processing object, and the service processing object does not need to decrypt the first encrypted data again, but can directly use the decrypted first encrypted data for service processing.

[0039] The gateway-based data processing method provided in this application can also be applied to, for example, Figure 4 In the illustrated application environment, the client (computer device / terminal device) communicates with the server (server) via a network and a gateway. The gateway and server communicate with the registry center via the network. Clients include, but are not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented as a standalone server or a server cluster consisting of multiple servers.

[0040] In one embodiment, all the servers have successfully registered and verified through the registration center. Each server is connected to the registration center, the gateway is connected to the registration center, the gateway is connected to each server, and the servers themselves are connected via an intranet. Understandably, once a server has successfully registered and verified through the registration center, it can be discovered by the gateway and other servers that have also successfully registered and verified through the registration center. The gateway can then route received service requests to the servers that have successfully registered and verified through the registration center. Furthermore, the servers that have successfully registered and verified through the registration center can directly connect to each other via the intranet, thereby accelerating data transmission efficiency between the servers.

[0041] In one embodiment, step S130, which involves sending the decrypted first encrypted data to the service processing object so that the service processing object can perform service processing based on the decrypted first encrypted data, includes:

[0042] When the business processing object includes at least two servers, each server in the business processing object is recorded as a target server, and the business processing order of all target servers is determined according to the service identifier. It can be understood that if the service identifier included in the business request includes at least two business processing objects and a business processing order between the at least two business processing objects, then the business processing object also correspondingly includes at least two servers, and it is necessary to first determine the target servers and the business processing order of all target servers according to the service identifier.

[0043] The decrypted first encrypted data is sent via the intranet to the first target server in the business processing sequence for processing. The processed data is then directly sent via the intranet to the next target server in the same sequence for processing, until the last target server completes its processing. Understandably, all servers that have successfully registered and verified through the registration center can connect via the intranet. Therefore, after determining the target servers and their processing sequence, after sending the decrypted first encrypted data to the first target server via the intranet, the first target server can directly send the processed data to the next target server via the intranet for processing, until the last target server completes its processing, thus accelerating the efficiency of the business processing.

[0044] In another embodiment, step S130, which involves sending the decrypted first encrypted data to the service processing object so that the service processing object can perform service processing based on the decrypted first encrypted data, includes:

[0045] When the business processing object includes only one server, the decrypted first encrypted data is sent to the business processing object via the intranet, so that the business processing object can perform business processing based on the decrypted first encrypted data. It can be understood that if the business processing object includes only one server, then it is only necessary to send the decrypted first encrypted data to the business processing object via the intranet, so that the business processing object can perform business processing based on the decrypted first encrypted data.

[0046] S140: Receive plaintext feedback data generated by the service processing object after performing service processing, and sign the plaintext feedback data using the gateway's private key to obtain second encrypted data. Understandably, in this embodiment, the plaintext feedback data is generated by the service processing object. Since both the service processing object and the gateway are within the intranet, the service processing object can send the generated plaintext feedback data directly to the gateway without encrypting it after performing service processing. After receiving the plaintext feedback data, the gateway signs the plaintext feedback data using the gateway's private key to obtain the second encrypted data.

[0047] S150, the second encrypted data is sent to the target client, so that the target client can verify the second encrypted data using the gateway's public key and obtain a verification result. Understandably, after receiving the plaintext feedback data, the gateway signs the plaintext feedback data using its private key to obtain the second encrypted data, and then sends the second encrypted data to the target client, thereby ensuring the security of data transmission. The target client can obtain the verification result after verifying the second encrypted data using the gateway's public key.

[0048] The gateway-based data processing method provided by this invention, upon receiving first encrypted data encrypted with the gateway's public key from a client, decrypts the first encrypted data using the gateway's private key. The decrypted first encrypted data is then sent to a business processing object (i.e., the server) for business processing. Furthermore, after receiving plaintext feedback data generated by the business processing object, the method signs the plaintext feedback data using the gateway's private key and sends the resulting second encrypted data to the target client. The target client then verifies the signature using the gateway's public key and obtains the verification result. This invention encrypts and decrypts business request data and business feedback data between clients and servers at gateways that communicate with multiple clients and servers respectively. This eliminates the need for the server to encrypt and decrypt the business request data and business feedback data, reducing server resource consumption and improving data encryption and decryption efficiency while ensuring data transmission security.

[0049] like Figure 5 As shown, in one embodiment, before receiving the service request containing the first encrypted data and the service identifier sent by the target client in step S110, the method further includes:

[0050] S160: Receive a creation instruction containing a device identifier, create a security key pair associated with the device identifier, send the gateway private key of the security key pair to the server associated with the device identifier, and send the gateway public key of the security key pair to all clients. Understandably, the security key pair created by the gateway includes the gateway private key and the gateway public key corresponding to the gateway private key. In one embodiment, the number of security key pairs is equal to the number of servers, thereby ensuring that all servers have a security key pair associated with their device identifier (the device identifier is used to characterize the uniqueness of each server). Each security key pair is associated with one device identifier, and the gateway private key in the security key pair is created by the gateway and sent to the server associated with the device identifier for storage; while the network management public key matching the gateway private key is sent to all clients for storage and use.

[0051] The gateway-based data processing method provided by this invention creates a security key pair associated with a device identifier through the gateway, sends the gateway private key of the security key pair to the server associated with the device identifier, and sends the gateway public key of the security key pair to all clients. When the encryption and decryption service needs to be updated, there is no need to operate on the client and server. The security key pair created by the gateway can be updated directly, which improves the practicality and convenience of updating and maintaining the encryption and decryption service.

[0052] like Figure 6 As shown, in one embodiment, a gateway-based data processing method is also provided, which is applied to... Figure 1 Taking a client as an example, the client communicates with a gateway, and the gateway communicates with multiple servers. The method includes:

[0053] S210, after receiving a service processing instruction containing plaintext request data and a service identifier, the gateway public key associated with the service identifier is determined. It is understood that the gateway public key stored on the client matches the gateway private key, and each server stores a gateway private key corresponding to its own service identifier. Therefore, the multiple gateway public keys stored on the client correspond to different service identifiers. Upon receiving a service processing instruction containing a service identifier, the gateway public key associated with the service identifier must first be determined so that the gateway private key associated with the service identifier can decrypt the plaintext request data encrypted by the gateway public key.

[0054] S220, the plaintext request data is encrypted using the gateway public key to obtain first encrypted data. Understandably, the gateway public key is stored on the client and used by the client to encrypt the plaintext request data, thereby generating the first encrypted data.

[0055] S230, after sending a service request containing the first encrypted data and the service identifier to the gateway, if second encrypted data sent by the gateway is received, the second encrypted data is verified using the gateway's public key to obtain a verification result. The second encrypted data is obtained after the gateway determines the service processing object from all the servers based on the service identifier, and decrypts the first encrypted data using a gateway private key obtained from the service processing object that matches the gateway's public key. The decrypted first encrypted data is then sent to the service processing object, which processes the data and sends back plaintext feedback data. The plaintext feedback data is then signed using the gateway's private key. It is understood that the gateway's public key can also decrypt the second encrypted data signed with a gateway private key matching the gateway's public key, and verify the second encrypted data using the gateway's public key to obtain a verification result, i.e., the decrypted second encrypted data.

[0056] like Figure 7 As shown, in one embodiment, step S220, encrypting the plaintext request data using the gateway public key to obtain first encrypted data, includes:

[0057] S221, the plaintext request data is encrypted using the client key to generate key-encrypted data. Understandably, the client key is created by the client itself, and the plaintext request data is encrypted using the client key to generate key-encrypted data. In one embodiment, the client key uses AES (Advanced Encryption Standard) encryption to encrypt the plaintext request data.

[0058] S222, the client key is encrypted using the gateway public key to generate an encrypted key. Understandably, after encrypting the plaintext request data to generate encrypted key data, the encrypted key data and the client key need to be sent together to the business processing object so that the business processing object can use the client key to decrypt the encrypted key data. Since the client key is unencrypted, encrypting it using the gateway public key to generate an encrypted key further ensures the security of the client key.

[0059] S223, Generate first encrypted data based on the key-encrypted data and the encryption key. Understandably, the encryption key can be decrypted to generate the client key, which is used to decrypt the key-encrypted data. Therefore, the key-encrypted data and the encryption key need to be merged to generate the first encrypted data, so that the business processing object can decrypt the first encrypted data.

[0060] like Figure 8 As shown, in one embodiment, a gateway-based data processing device is also provided, which corresponds one-to-one with the gateway-based data processing method in the above embodiments. The gateway-based data processing device includes:

[0061] The first receiving module 100 is configured to receive a service request sent by a target client, which includes first encrypted data and a service identifier, and determine the service processing object from all the servers based on the service identifier; the first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier; the target client is the client that sent the service request from among all the clients.

[0062] The decryption module 200 is used to obtain a gateway private key that matches the gateway public key from the business processing object, and decrypt the first encrypted data using the gateway private key;

[0063] The first sending module 300 is used to send the decrypted first encrypted data to the business processing object so that the business processing object can perform business processing based on the decrypted first encrypted data.

[0064] The second receiving module 400 is used to receive plaintext feedback data generated after the business processing object performs business processing, and to sign the plaintext feedback data with the gateway private key to obtain second encrypted data.

[0065] The second sending module 500 is used to send the second encrypted data to the target client, so that the target client can verify the second encrypted data using the gateway public key and obtain the verification result.

[0066] Specific limitations regarding the gateway-based data processing device can be found in the limitations of the gateway-based data processing method described above, and will not be repeated here. Each module in the aforementioned gateway-based data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0067] In one embodiment, a computer device is also provided, which may be a gateway or a client, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps of the aforementioned gateway-based data processing method.

[0068] In one embodiment, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of the gateway-based data processing method described above.

[0069] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0070] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0071] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A gateway-based data processing method, characterized in that, The method is applied to a gateway that communicates with multiple clients and multiple servers. The method includes: The system receives a service request from a target client containing first encrypted data and a service identifier. Based on the service identifier, it determines the service processing target from all the servers. The service identifier includes the device identifier corresponding to one or more servers processing the service request, and, in the case of multiple servers, the service processing order among them. The first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier. The target client is the client that sent the service request among all the clients. Obtain the gateway private key that matches the gateway public key from the business processing object, and decrypt the first encrypted data using the gateway private key; According to the business processing order, the decrypted first encrypted data is sent to the corresponding business processing object so that the business processing object can perform business processing based on the decrypted first encrypted data; Receive plaintext feedback data generated after the business processing object performs business processing, and sign the plaintext feedback data with the gateway private key to obtain second encrypted data; The second encrypted data is sent to the target client so that the target client can verify the second encrypted data using the gateway public key and obtain the verification result; Before receiving the service request containing the first encrypted data and the service identifier sent by the target client, the method further includes: receiving a creation instruction containing a device identifier, creating a security key pair associated with the device identifier, sending the gateway private key of the security key pair to the server associated with the device identifier, and sending the gateway public key of the security key pair to all the clients.

2. The gateway-based data processing method as described in claim 1, characterized in that, All of the aforementioned servers have been successfully registered and verified by the registration center; each of the aforementioned servers and the registration center, the gateway and the registration center, the gateway and each of the aforementioned servers, and each of the aforementioned servers are all connected via intranet communication; The step of sending the decrypted first encrypted data to the business processing object, so that the business processing object can perform business processing based on the decrypted first encrypted data, includes: When the business processing object includes at least two servers, each server in the business processing object is recorded as a target server, and the business processing order of all target servers is determined according to the service identifier; the decrypted first encrypted data is sent to the first target server in the business processing order for business processing through the intranet, and the processed data is sent directly to the next target server in the business processing order for business processing through the intranet, until the last target server completes the business processing.

3. The gateway-based data processing method as described in claim 1, characterized in that, All of the aforementioned servers have been successfully registered and verified by the registration center; each of the aforementioned servers and the registration center, the gateway and the registration center, the gateway and each of the aforementioned servers, and each of the aforementioned servers are all connected via intranet communication; The step of sending the decrypted first encrypted data to the business processing object so that the business processing object can perform business processing based on the decrypted first encrypted data includes: when the business processing object includes only one server, sending the decrypted first encrypted data to the business processing object through the intranet so that the business processing object can perform business processing based on the decrypted first encrypted data.

4. The gateway-based data processing method as described in claim 1, characterized in that, The first encrypted data includes key-encrypted data generated by the target client encrypting the plaintext request data using the client key, and an encrypted key generated by encrypting the client key using the gateway public key; The step of decrypting the first encrypted data using the gateway's private key includes: The client key is obtained by decrypting the encryption key in the first encrypted data using the gateway private key. The encrypted data is decrypted using the client key to obtain the first encrypted data after decryption.

5. A gateway-based data processing method, characterized in that, The method is applied to a client, which communicates with a gateway, and the gateway communicates with multiple servers. The method includes: Upon receiving a business processing instruction containing plaintext request data and a service identifier, a gateway public key associated with the service identifier is determined. The service identifier includes the device identifier corresponding to one or more servers processing the business request, and the business processing order among the servers in the case of multiple servers. The gateway public key is obtained by the gateway receiving a creation instruction containing the device identifier, creating a security key pair associated with the device identifier, sending the gateway private key of the security key pair to the server associated with the device identifier, and sending the gateway public key of the security key pair to all the clients. The plaintext request data is encrypted using the gateway's public key to obtain first encrypted data. After sending a service request containing the first encrypted data and the service identifier to the gateway, if second encrypted data is received from the gateway, the second encrypted data is verified using the gateway's public key to obtain a verification result. The second encrypted data is obtained after the gateway determines the service processing object from all the servers based on the service identifier, and decrypts the first encrypted data using a gateway private key obtained from the service processing object that matches the gateway's public key. The decrypted first encrypted data is then sent to the corresponding service processing object according to the service processing order, so that the service processing object can process the service based on the decrypted first encrypted data and then provide plaintext feedback data, which is then signed using the gateway's private key.

6. The gateway-based data processing method as described in claim 5, characterized in that, The step of encrypting the plaintext request data using the gateway public key to obtain the first encrypted data includes: The plaintext request data is encrypted using the client key to generate key-encrypted data; The client key is encrypted using the gateway public key to generate an encrypted key; the data is then encrypted using the encrypted key, and first encrypted data is generated.

7. A gateway-based data processing device, characterized in that, include: The first receiving module is configured to receive a service request sent by a target client, which includes first encrypted data and a service identifier, and determine the service processing object from all servers based on the service identifier; the service identifier includes the device identifier corresponding to one or more servers processing the service request, and the service processing order among the servers in the case of multiple servers; the first encrypted data is obtained by the target client encrypting plaintext request data using the gateway public key corresponding to the service identifier. The target client is the client that sent the service request among all clients; Before receiving the service request containing the first encrypted data and service identifier sent by the target client, the method further includes: receiving a creation instruction containing a device identifier, creating a security key pair associated with the device identifier, sending the gateway private key of the security key pair to the server associated with the device identifier, and sending the gateway public key of the security key pair to all the clients. The decryption module is used to obtain the gateway private key that matches the gateway public key from the business processing object, and decrypt the first encrypted data using the gateway private key; The first sending module is used to send the decrypted first encrypted data to the corresponding business processing object according to the business processing order, so that the business processing object can perform business processing based on the decrypted first encrypted data. The second receiving module is used to receive plaintext feedback data generated after the business processing object performs business processing, and to sign the plaintext feedback data with the gateway private key to obtain second encrypted data; the second sending module is used to send the second encrypted data to the target client, so that the target client can verify the second encrypted data with the gateway public key and obtain the verification result.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the gateway-based data processing method as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the gateway-based data processing method as described in any one of claims 1 to 6.

Images