A data transmission method, system, device, computer device and storage medium

Abstract

The present disclosure provides a data transmission method, system, device, computer device and storage medium, wherein the method comprises: in response to a data transmission instruction, generating a first key based on a temporary private key generated by the client and a first public key generated by a target server; encrypting target data in the to-be-transmitted data based on the first key to obtain target encrypted data; and sending target transmission data to the target server, so that the target server generates a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypts the target encrypted data based on the second key; wherein the target transmission data comprises a temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and in particular, to a data transmission method, system, device, computer device and storage medium. BACKGROUND

[0002] With the development of information technology, more and more people use clients to communicate on the network. After the client sends the to-be-transmitted data, the to-be-transmitted data usually needs to be processed by multiple intermediate servers (such as gateway servers, load balancing servers, cache servers, etc.) and then forwarded to a target server. When the to-be-transmitted data is sent to the intermediate server, sensitive data (such as personal information of a user) in the to-be-transmitted data is easily leaked.

[0003] In related technologies, according to the Hypertext Transfer Protocol Secure (HTTPS), the to-be-transmitted data sent by the client is encrypted. However, each intermediate server stores a key for decrypting the encrypted to-be-transmitted data. Therefore, each intermediate server can still decrypt the encrypted to-be-transmitted data to obtain the sensitive data in the to-be-transmitted data. Therefore, how to ensure the data security of the sensitive data in the to-be-transmitted data becomes a problem to be solved. SUMMARY

[0004] The present disclosure at least provides a data transmission method, system, device, computer device and storage medium.

[0005] In a first aspect, the present disclosure provides a data transmission method, comprising:

[0006] In response to a data transmission instruction, a first key is generated based on a temporary private key generated by the client and a first public key generated by a target server;

[0007] Target data in the to-be-transmitted data is encrypted based on the first key to obtain target encrypted data;

[0008] The target transmission data is sent to the target server, so that the target server generates a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypts the target encrypted data based on the second key; wherein the target transmission data includes a temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0009] In a possible implementation, after responding to the data transmission instruction, the method further comprises:

[0010] sending a data transmission request to the target server;

[0011] receiving a verification certificate sent by the target server;

[0012] sending the target transmission data to the target server, including:

[0013] determining a second public key included in the verification certificate;

[0014] encrypting the target transmission data based on the second public key to obtain encrypted target transmission data;

[0015] sending the encrypted target transmission data to the target server.

[0016] In a possible implementation, the sending of the target transmission data to the target server includes:

[0017] sending the target transmission data to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

[0018] In a possible implementation, the at least one intermediate server includes a load balancing server, a gateway server, and a cache server.

[0019] In a possible implementation, the method further includes:

[0020] In response to a key generation condition being met, generating the temporary private key and a temporary public key corresponding to the temporary private key based on a preset key generation algorithm.

[0021] In a second aspect, the present disclosure also provides a data transmission method, including:

[0022] receiving target transmission data sent by a client; wherein the target transmission data includes a temporary public key generated by the client, target encrypted data, and other data in to-be-transmitted data except the target data, the target encrypted data being data obtained by encrypting target data in the to-be-transmitted data based on a first key, and the first key being generated by the client based on a temporary private key corresponding to the temporary public key and a first public key generated by the target server;

[0023] generating a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypting the target encrypted data based on the second key.

[0024] In a possible implementation, the method further includes:

[0025] receive the data transmission request sent by the client, and send a verification certificate to the client;

[0026] receive target transmission data sent by the client, including:

[0027] receive encrypted target transmission data sent by the client, the encrypted target transmission data including data obtained by encrypting the target transmission data based on a second public key in the verification certificate;

[0028] decrypt the encrypted target transmission data based on a second private key corresponding to the second public key to obtain the target transmission data.

[0029] In a possible implementation, the first public key generated by the target server is transmitted to the client through a non-network transmission mode.

[0030] In a third aspect, the embodiments of the present disclosure further provide a data transmission system, including:

[0031] a client, configured to generate a first key based on a temporary private key generated by the client and a first public key generated by a target server in response to a data transmission instruction; encrypt target data in to-be-transmitted data based on the first key to obtain target encrypted data; and send target transmission data to the target server, wherein the target transmission data includes a temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0032] a target server, configured to generate a second key corresponding to the first key based on the temporary public key and a first private key corresponding to the first public key, and decrypt the target encrypted data based on the second key.

[0033] In a fourth aspect, the embodiments of the present disclosure further provide a data transmission apparatus, including:

[0034] a generating module, configured to generate a first key based on a temporary private key generated by a client and a first public key generated by a target server in response to a data transmission instruction;

[0035] an encrypting module, configured to encrypt target data in to-be-transmitted data based on the first key to obtain target encrypted data;

[0036] The sending module is configured to send target transmission data to the target server, so that the target server generates a second key corresponding to the first key based on the first private key corresponding to the first public key and the temporary public key corresponding to the temporary private key, and performs decryption processing on the target encrypted data based on the second key.

[0037] In a possible implementation, after responding to the data transmission instruction, the apparatus is further configured to:

[0038] send a data transmission request to the target server;

[0039] receive the verification certificate sent by the target server;

[0040] The sending module, when sending the target transmission data to the target server, is configured to:

[0041] determine a second public key included in the verification certificate;

[0042] perform encryption processing on the target transmission data based on the second public key to obtain encrypted target transmission data;

[0043] send the encrypted target transmission data to the target server.

[0044] In a possible implementation, the sending module, when sending the target transmission data to the target server, is configured to:

[0045] send the target transmission data to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

[0046] In a possible implementation, the at least one intermediate server includes a load balancing server, a gateway server, and a cache server.

[0047] In a possible implementation, the apparatus is further configured to:

[0048] generate the temporary private key and the temporary public key corresponding to the temporary private key based on a preset key generation algorithm in response to a key generation condition being met.

[0049] In a fifth aspect, the embodiments of the present disclosure further provide a data transmission apparatus, which includes:

[0050] receive a target transmission data sent by a client; wherein the target transmission data comprises a temporary public key generated by the client, target encrypted data, and other data in the to-be-transmitted data except the target data, the target encrypted data being data obtained by performing encryption processing on the target data in the to-be-transmitted data based on a first key, and the first key being generated by the client based on a temporary private key corresponding to the temporary public key and a first public key generated by the target server;

[0051] decrypt the target encrypted data based on a second key corresponding to the temporary public key and the first public key.

[0052] In a possible implementation, the apparatus is further configured to:

[0053] receive a data transmission request sent by the client, and send an authentication certificate to the client;

[0054] The receiving module, when receiving the target transmission data sent by the client, is configured to:

[0055] receive the encrypted target transmission data sent by the client, the encrypted target transmission data comprising data obtained by performing encryption processing on the target transmission data based on a second public key in the authentication certificate;

[0056] decrypt the encrypted target transmission data based on a second private key corresponding to the second public key to obtain the target transmission data.

[0057] In a possible implementation, the first public key generated by the target server is transmitted to the client through a non-network transmission mode.

[0058] In a sixth aspect, the embodiments of the present disclosure further provide a computer device, including a processor, a memory and a bus, the memory stores machine readable instructions executable by the processor, when the computer device is running, the processor and the memory communicate through the bus, and the machine readable instructions are executed by the processor to perform the steps of the first aspect or any possible implementation manner of the first aspect, or perform the steps of the second aspect or any possible implementation manner of the second aspect.

[0059] In a seventh aspect, the embodiments of the present disclosure further provide a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by the processor to perform the steps of the first aspect or any possible implementation manner of the first aspect, or perform the steps of the second aspect or any possible implementation manner of the second aspect.

[0060] The data transmission method, system, device, computer device and storage medium provided by the embodiments of the present disclosure can generate a first key based on the temporary private key generated by the client and the first public key generated by the target server after responding to the data transmission instruction; then encrypt the target data in the to-be-transmitted data based on the first key to obtain target encrypted data; and finally send target transmission data including the temporary public key corresponding to the temporary private key generated by the client, the target encrypted data and other data in the to-be-transmitted data except the target data to the target server. In this way, since the target server receives the temporary public key and the target server stores the first private key corresponding to the first public key, the target server can generate a second key corresponding to the first key and decrypt the target encrypted data based on the second key to obtain the target data. Even if the intermediate server obtains the target encrypted data, the intermediate server cannot generate a key for decrypting the target encrypted data because the intermediate server can only obtain the temporary public key, so the intermediate server cannot decrypt the target encrypted data to obtain the target data, thereby ensuring the data security of the target data and avoiding the leakage of the target data.

[0061] In order to make the above objectives, characteristics and advantages of the present disclosure more apparent and understandable, the following preferred embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. The drawings herein are incorporated into the specification and form a part of the specification, which illustrate the embodiments consistent with the present disclosure, and are used to explain the technical solutions of the present disclosure together with the specification. It should be understood that the following drawings only show some embodiments of the present disclosure, and therefore should not be considered as a limitation to the scope, and other related drawings can also be obtained by those skilled in the art without creative labor.

[0063] Figure 1 A flowchart of a data transmission method provided by an embodiment of the present disclosure is shown;

[0064] Figure 2 A flowchart of another data transmission method provided by an embodiment of the present disclosure is shown;

[0065] Figure 3 A schematic diagram of a data transmission system provided by an embodiment of the present disclosure is shown;

[0066] Figure 4 A flowchart of a data transmission method provided by an embodiment of the present disclosure is shown;

[0067] Figure 5 An architecture schematic diagram of a data transmission apparatus provided by an embodiment of the present disclosure is shown.

[0068] Figure 6 An architecture schematic diagram of another data transmission apparatus provided by an embodiment of the present disclosure is shown.

[0069] Figure 7 A structure schematic diagram of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0070] To make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the following will be combined with the accompanying drawings for the embodiments of the present disclosure to clearly and completely describe the technical solutions of the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The components of the embodiments of the present disclosure described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed present disclosure, but only represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present disclosure.

[0071] In the encryption method of Hypertext Transfer Protocol Secure (HTTPS), a symmetric key is usually generated by the target server and the client, and the client sends the to-be-transmitted data to be encrypted and decrypted, respectively, to ensure the data security of the to-be-transmitted data in the transmission process. However, before the to-be-transmitted data is sent to the target server, it usually needs to be processed by an intermediate server, such as the distribution servers in the Content Delivery Network (CDN), which need to distribute the to-be-transmitted data to different servers for processing according to part of the data in the to-be-transmitted data, and the gateway server can audit the to-be-transmitted data. Therefore, the intermediate server usually holds the key to decrypt the encrypted to-be-transmitted data, so that each intermediate server can directly obtain the plaintext data of the to-be-transmitted data, which may easily cause the sensitive information in the to-be-transmitted data to be leaked.

[0072] Based on the above research, the present disclosure provides a data transmission method, system, device, computer equipment and storage medium, which can generate a first key based on the temporary private key generated by the client and the first public key generated by the target server after responding to the data transmission instruction; then encrypt the target data in the to-be-transmitted data based on the first key to obtain target encrypted data; and finally send the target transmission data including the temporary public key corresponding to the temporary private key generated by the client, the target encrypted data and other data in the to-be-transmitted data except the target data to the target server. In this way, since the target server receives the temporary public key and the target server stores the first private key corresponding to the first public key, the target server can generate a second key corresponding to the first key and decrypt the target encrypted data based on the second key to obtain the target data. Even if the intermediate server obtains the target encrypted data, the intermediate server can only obtain the temporary public key and cannot generate a key for decrypting the target encrypted data, so it cannot decrypt the target encrypted data to obtain the target data, thereby ensuring the data security of the target data and avoiding the leakage of the target data.

[0073] It should be noted that similar reference numerals and letters refer to like items in the accompanying drawings, and thus once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0074] The term "and / or" herein is merely descriptive and represents three relationships, for example, A and / or B can represent three cases of A alone, A and B together, and B alone. In addition, the term "at least one" herein represents any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B and C can represent including any one or more elements selected from the set consisting of A, B and C.

[0075] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of the personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0076] For example, when responding to the active request of the user, prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using the personal information of the user. Thus, the user can voluntarily choose whether to provide personal information to the electronic device, application program, server or storage medium, etc. software or hardware performing the operation of the technical solutions of the present disclosure according to the prompt information.

[0077] As an optional but non-limiting implementation, in response to receiving the active request of the user, the sending of the prompt information to the user can be in the form of a pop-up window, in which the prompt information can be presented in the form of text. In addition, the pop-up window can also carry a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0078] It can be understood that the above notification and user authorization process is only illustrative and does not limit the implementation of the present disclosure, and other ways that meet the relevant laws and regulations can also be applied to the implementation of the present disclosure.

[0079] For the convenience of understanding the present embodiment, first, a data transmission method disclosed by the present embodiment is introduced in detail, and the execution subject of the data transmission method provided by the present embodiment is a client, which can be exemplarily a personal computer, a tablet computer, a smart phone, etc. In some possible implementation, the data transmission method can be realized by calling the computer readable instructions stored in the memory by the processor.

[0080] Referring to Figure 1 The flowchart of the data transmission method provided by the present embodiment is shown, and the method comprises steps 101-103, wherein:

[0081] Step 101, in response to a data transmission instruction, generating a first key based on a temporary private key generated by the client and a first public key generated by a target server;

[0082] Step 102, based on the first key, encrypting target data in the to-be-transmitted data to obtain target encrypted data;

[0083] Step 103, sending the target transmission data to the target server, so that the target server generates a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypts the target encrypted data based on the second key; wherein the target transmission data comprises a temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0084] The following is a detailed description of the above steps:

[0085] For step 101,

[0086] Specifically, the data transmission instruction can be generated in response to a first trigger operation, which includes but is not limited to single click, double click, long press, slide, drag, etc. Exemplarily, the data transmission instruction can be generated in response to a click operation on a target button.

[0087] In a possible implementation, after responding to the data transmission instruction, the client can send a data transmission request to the target server and receive a verification certificate sent by the target server. Specifically, the verification certificate can be an example of a secure socket layer (SSL) certificate, also known as an SSL certificate. The verification certificate can include a second public key, to-be-verified data, and signature data. The to-be-verified data can include data such as the subject of the verification certificate, the issuer, the validity period, and the like. By verifying the to-be-verified data, it can be determined whether the data sent by the target server to the client is tampered with. For example, the signature data can be decrypted by the second public key to obtain first verification data. The to-be-verified data is processed by a preset algorithm (such as a hash function) to obtain second verification data. If the first verification data and the second verification data are consistent, it is determined that the verification certificate has not been tampered with.

[0088] In a possible implementation, when the first key is generated based on the temporary private key generated by the client and the first public key generated by the target server, the first key can be generated based on the temporary private key, the first public key, at least one random number, and a target key generation algorithm. The at least one random number can be generated by the client and / or the target server. The random number generated by the target server can be sent by the target server to the client after receiving the data transmission request.

[0089] In a possible implementation, the temporary private key can be generated by the following method: in response to satisfying a key generation condition, generating the temporary private key and a temporary public key corresponding to the temporary private key based on a preset key generation algorithm.

[0090] The key generation condition may be, for example, in response to the start of the target application, in response to a data transmission instruction, the time interval between the current time and the latest generation time of the temporary key (including the temporary private key and the temporary public key) exceeds a preset time length, and the like. In a specific example, the temporary key can be deleted in response to the closing of the target application, and the temporary key can be generated in response to the start of the target application. In another example, the temporary key can be generated when the time interval between the current time and the latest generation time exceeds one week. The preset key generation algorithm may be, for example, a key generation algorithm in an elliptic curve cryptography (ECC) algorithm, and the embodiments of the present disclosure are not limited to other key generation algorithms. In this way, the temporary key can be automatically updated, the temporary key has a time limit, and information security is ensured.

[0091] For step 102,

[0092] The target data that needs to be encrypted in the to-be-transmitted data may be pre-set, and the target data may be, for example, sensitive data (such as user personal data). Alternatively, in another possible implementation, content recognition can be performed on the to-be-transmitted data, and in a case where it is detected that the to-be-transmitted data contains a preset keyword, a field containing the preset keyword in the to-be-transmitted data is determined as the target data. The preset keyword may be, for example, an address, a contact number, travel information, and the like.

[0093] For example, in a case where the temporary key is a key generated based on a key generation algorithm in an ECC algorithm, the target data can be encrypted based on a key encryption algorithm in the ECC algorithm, and the embodiments of the present disclosure are not limited to other key encryption algorithms.

[0094] For step 103,

[0095] The other data may be, for example, a requested address, a data length, a supported language format, and the like. In a case where the to-be-transmitted data (or any data in the to-be-transmitted data) contains non-sensitive data in addition to the target data (such as sensitive data), the other data also contains the non-sensitive data. For example, user private data and user public data published publicly are contained in a field in the to-be-transmitted data, the user private data is the target data, and the other data contains the public data.

[0096] If only the target data in the to-be-transmitted data is encrypted, other data in the to-be-transmitted data except the target data can be intercepted and acquired. Therefore, after the target data is encrypted, the to-be-transmitted data can be further encrypted. Specifically, in a possible implementation, when the target transmission data is sent to the target server, the second public key included in the verification certificate can be determined first; then the target transmission data is encrypted based on the second public key to obtain encrypted target transmission data; finally, the encrypted target transmission data is sent to the target server.

[0097] Specifically, after the verification certificate is verified, the second public key in the verification certificate can be acquired. When the target transmission data is encrypted based on the second public key, an example can be an RSA algorithm, a data encryption standard (DES), and the like. The present embodiment does not limit other encryption algorithms. By encrypting the target transmission data into the encrypted target transmission data, even if the encrypted target transmission data is intercepted by other terminals, the encrypted target transmission data cannot be decrypted, thereby ensuring information security.

[0098] In a possible implementation, when the target transmission data is sent to the target server, the target transmission data can be sent to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

[0099] The at least one intermediate server includes a load balancing server, a gateway server, and a cache server. The load balancing server is configured to allocate servers for request data (that is, the target transmission data in the present embodiment) sent by a client. The gateway server can be configured to perform communication protocol conversion, data format conversion, data language conversion, security audit, and the like on the request data. The cache server can be configured to generate response data of the request data. For example, in a network composed of multiple servers, such as a content delivery network (CDN), each CDN node is the at least one intermediate server, and each device node in a mesh network is the at least one intermediate server.

[0100] Specifically, in the case that there is only one intermediate server, the intermediate server can send the target transmission data to the target server after the client sends the target transmission data to the intermediate server; in the case that there are multiple intermediate servers, the intermediate server at the previous node can send the target transmission data to the intermediate server at the next node after receiving the target transmission data, and finally the intermediate server at the last node sends the target transmission data to the target server.

[0101] It can be understood that, after the client sends the target transmission data, the target transmission data usually needs to be processed by multiple intermediate servers and then sent to the target server, but since only the temporary public key sent by the client can be obtained in the intermediate servers, the key for decrypting the target encrypted data cannot be generated, so the intermediate servers can only obtain the plaintext information of the other data and cannot obtain the target data.

[0102] In a possible implementation, when the target transmission data is sent to at least one intermediate server, the second public key contained in the verification certificate can be determined first; then the target transmission data is encrypted based on the second public key to obtain encrypted target transmission data; and finally the encrypted target transmission data is sent to the at least one intermediate server.

[0103] Specifically, in the case that there is only one intermediate server, the intermediate server can send the encrypted target transmission data to the target server after the client sends the encrypted target transmission data to the intermediate server; in the case that there are multiple intermediate servers, the intermediate server at the previous node can send the encrypted target transmission data to the intermediate server at the next node after receiving the encrypted target transmission data, and finally the intermediate server at the last node sends the encrypted target transmission data to the target server.

[0104] It can be understood that the at least one intermediate server stores a second private key corresponding to the second public key, and the at least one intermediate server can decrypt the received encrypted target transmission data based on the second private key to obtain the target transmission data (including the temporary public key, the target encrypted data, and the other data). Therefore, the at least one intermediate server can obtain the plaintext data of the other data, but the at least one intermediate server cannot obtain the key for decrypting the target encrypted data, so the at least one intermediate server cannot decrypt the target encrypted data to obtain the target data. Therefore, by using this method, the at least one intermediate server can process the other data and cannot view the target data, thereby ensuring the data security of the target data.

[0105] Here, it should be noted that after the intermediate server of any node decrypts the encrypted target transmission data into the target transmission data, when sending data to the intermediate server of the next node or the target server, the encrypted target transmission data can be sent, or the target transmission data can be sent.

[0106] The data transmission method provided by the embodiments of the present disclosure can generate a first key based on the temporary private key generated by the client and the first public key generated by the target server in response to a data transmission instruction; then encrypt the target data in the to-be-transmitted data based on the first key to obtain target encrypted data; and finally send target transmission data including the temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data to the target server. In this way, since the target server receives the temporary public key and stores the first private key corresponding to the first public key in the target server, the target server can generate a second key corresponding to the first key and decrypt the target encrypted data based on the second key to obtain the target data. Even if the intermediate server obtains the target encrypted data, the intermediate server cannot generate a key for decrypting the target encrypted data because the intermediate server can only obtain the temporary public key, so the intermediate server cannot decrypt the target encrypted data to obtain the target data, thereby ensuring the data security of the target data and avoiding the leakage of the target data.

[0107] Based on the same inventive concept, the embodiments of the present disclosure also provide a data transmission method applied to a target server, as shown in Figure 2 The method includes steps 201-202, wherein:

[0108] Step 201, receiving target transmission data sent by a client; wherein the target transmission data comprises a temporary public key generated by the client, target encrypted data, and other data in the to-be-transmitted data except the target data, the target encrypted data is data obtained by encrypting the target data in the to-be-transmitted data based on a first key, and the first key is generated by the client based on a temporary private key corresponding to the temporary public key and a first public key generated by the target server;

[0109] Step 202, generating a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypting the target encrypted data based on the second key.

[0110] The following is a detailed description of the above steps:

[0111] For step 201,

[0112] In a possible implementation, before step 201 is performed, the target server can generate a first public key and a first private key corresponding to the first public key, the first public key and the first private key are asymmetric encryption keys, data encrypted by the first public key can be decrypted by the first private key. For example, the first public key and the first private key can be generated based on an ECC algorithm, and then the target server can transmit the first public key to the client.

[0113] Here, the first public key and the first private key can be generated when the target server first receives the data transmission request.

[0114] In order to prevent the first public key from being maliciously intercepted and stolen by other terminals, in a possible implementation, the first public key generated by the target server can be transmitted to the client by a non-network transmission mode. For example, the non-network transmission mode can be transmission by Bluetooth, manual input, wired transmission, etc. By using this method, the first public key can be securely transmitted to the client.

[0115] In a possible implementation, in order to perform identity authentication of the target server, the target server can also receive the data transmission request sent by the client, and send an authentication certificate to the client, so that the client authenticates the identity of the target server based on the authentication certificate.

[0116] The authentication certificate comprises a second public key, and the second public key and a second private key corresponding to the second public key can be generated by the target server in advance. For example, the second public key and the second private key can be generated based on an RSA algorithm.

[0117] Then, when receiving the target transmission data sent by the client, the encrypted target transmission data sent by the client can be received first, the encrypted target transmission data including data obtained by encrypting the target transmission data based on the second public key in the verification certificate, and then the encrypted target transmission data can be decrypted based on the second private key corresponding to the second public key to obtain the target transmission data.

[0118] In this way, the target transmission data can be transmitted in an encrypted form during transmission, so that other terminals cannot decrypt the encrypted target transmission data after intercepting the encrypted target transmission data, thereby ensuring data transmission security.

[0119] Here, it should be noted that, in the case that the encrypted target transmission data is encrypted based on a symmetric encryption algorithm, the target server can decrypt the encrypted target transmission data based on the second public key.

[0120] For step 202,

[0121] Specifically, when generating the second key corresponding to the first key based on the temporary public key and the first private key corresponding to the first public key, the second key can be generated based on the first private key, the temporary public key, at least one random number, and a target key generation algorithm. The at least one random number can be generated by the client and / or the target server. The random number generated by the client can be sent to the target server by the client.

[0122] The first key and the second key can be symmetric keys. For example, an Elliptic Curve Diffie-Hellman key exchange (ECDH) can be used. If the temporary public key and the temporary private key are generated based on an ECC algorithm, and the first public key and the first private key are generated based on an ECC algorithm, the first key generated based on the first public key and the temporary private key and the second key generated based on the first private key and the temporary public key are symmetric keys. Therefore, data encrypted by the first key can be decrypted by the second key.

[0123] Finally, after the target server decrypts the target encrypted data based on the second key, the target server can process the other data and the target data.

[0124] Based on the same inventive concept, the embodiments of the present disclosure also provide a data transmission system, which is described with reference toFigure 3 As shown in FIG. 1, a schematic diagram of a data transmission system provided by an embodiment of the present disclosure is shown, and the system comprises:

[0125] A client 301 is configured to generate a first key based on a temporary private key generated by the client and a first public key generated by a target server in response to a data transmission instruction, encrypt target data in to-be-transmitted data based on the first key to obtain target encrypted data, and send target transmission data to the target server, wherein the target transmission data comprises a temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0126] A target server 302 is configured to generate a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and decrypt the target encrypted data based on the second key.

[0127] Finally, as shown in FIG. 9, a whole process of a data transmission method provided by an embodiment of the present disclosure is shown, and the whole process comprises the following steps 401 to 409: Figure 4

[0128] Step 401: A target server generates a second public key and a second private key corresponding to the second public key.

[0129] Step 402: The target server generates a first public key and a first private key corresponding to the first public key, and transmits the first public key to a client in a non-network transmission manner.

[0130] Here, the execution sequence of step 401 and step 402 is not limited, and step 401 and step 402 can also be executed after step 403.

[0131] Step 403: In response to a first trigger operation, the client generates a data transmission request and sends the data transmission request to the target server, and the client generates a temporary public key and a temporary private key corresponding to the temporary public key.

[0132] Step 404: The target server sends a verification certificate to the client.

[0133] Step 405: The client verifies the verification certificate, and the client generates a first key based on the temporary private key and the first public key, and encrypts target data in to-be-transmitted data based on the first key to obtain target encrypted data.

[0134] ​Step 406, the client determines the second public key contained in the verification certificate; based on the second public key, the target transmission data is encrypted to obtain encrypted target transmission data; the encrypted target transmission data is sent to at least one intermediate server; wherein the encrypted target transmission data includes the temporary public key, the target encrypted data and other data in the to-be-transmitted data except the target data.

[0135] Step 407, the at least one intermediate server decrypts the encrypted target transmission data based on the pre-stored second private key to obtain the target transmission data; after processing the other data, the at least one intermediate server sends the encrypted target transmission data to the target server.

[0136] Step 408, the target server decrypts the encrypted target transmission data based on the second private key to obtain the target transmission data.

[0137] Step 409, the target server generates a second key corresponding to the first key based on the temporary public key and the first private key, and decrypts the target encrypted data based on the second key.

[0138] Those skilled in the art can understand that in the above method of the specific embodiment, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process, and the specific execution order of each step should be determined by its function and possible internal logic.

[0139] Based on the same inventive concept, the data transmission method is also provided in the embodiments of the present disclosure. Since the principle of solving problems of the device in the embodiments of the present disclosure is similar to the above-mentioned data transmission method, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0140] Referring to Figure 5 Fig. 1 is an architecture schematic diagram of a data transmission device provided by the embodiments of the present disclosure, the device comprises: a generation module 501, an encryption module 502 and a sending module 503; wherein,

[0141] The generation module 501 is configured to generate a first key based on a temporary private key generated by a client and a first public key generated by a target server in response to a data transmission instruction.

[0142] The encryption module 502 is configured to encrypt target data in to-be-transmitted data based on the first key to obtain target encrypted data.

[0143] The sending module 503 is configured to send target transmission data to the target server, so that the target server generates a second key corresponding to the first key based on the first private key corresponding to the first public key and the temporary public key corresponding to the temporary private key, and performs decryption processing on the target encrypted data based on the second key; wherein the target transmission data includes the temporary public key corresponding to the temporary private key, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0144] In a possible implementation, after responding to the data transmission instruction, the apparatus is further configured to:

[0145] send a data transmission request to the target server;

[0146] receive the verification certificate sent by the target server;

[0147] The sending module 503, when sending the target transmission data to the target server, is configured to:

[0148] determine the second public key included in the verification certificate;

[0149] perform encryption processing on the target transmission data based on the second public key to obtain encrypted target transmission data;

[0150] send the encrypted target transmission data to the target server.

[0151] In a possible implementation, the sending module 503, when sending the target transmission data to the target server, is configured to:

[0152] send the target transmission data to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

[0153] In a possible implementation, the at least one intermediate server includes a load balancing server, a gateway server, and a cache server.

[0154] In a possible implementation, the apparatus is further configured to:

[0155] generate the temporary private key and the temporary public key corresponding to the temporary private key based on a preset key generation algorithm in response to a key generation condition being met.

[0156] Reference is made to FIG. 6, Figure 6 which is a schematic diagram of an architecture of another data transmission apparatus provided by an embodiment of the present disclosure. The apparatus includes a receiving module 601 and a decryption module 602, wherein the receiving module 601 is configured to receive a data transmission request from a client, and the decryption module 602 is configured to perform decryption processing on target encrypted data based on a first private key corresponding to a first public key.

[0157] The receiving module 601 is configured to receive target transmission data sent by a client; wherein the target transmission data comprises a temporary public key generated by the client, target encrypted data, and other data in to-be-transmitted data except the target data, the target encrypted data is data obtained by performing encryption processing on the target data in the to-be-transmitted data based on a first key, and the first key is generated by the client based on a temporary private key corresponding to the temporary public key and a first public key generated by the target server.

[0158] The decryption module 602 is configured to generate a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and perform decryption processing on the target encrypted data based on the second key.

[0159] In a possible implementation, the apparatus is further configured to:

[0160] receive a data transmission request sent by the client, and send an authentication certificate to the client;

[0161] The receiving module 601, when receiving target transmission data sent by a client, is configured to:

[0162] receive encrypted target transmission data sent by the client, wherein the encrypted target transmission data comprises data obtained by performing encryption processing on the target transmission data based on a second public key in the authentication certificate;

[0163] perform decryption processing on the encrypted target transmission data based on a second private key corresponding to the second public key, to obtain the target transmission data.

[0164] In a possible implementation, the first public key generated by the target server is transmitted to the client through a non-network transmission mode.

[0165] The description of the processing procedure of each module in the apparatus and the interaction procedure between the modules can refer to the related description in the above method embodiments, and will not be described here in detail.

[0166] Based on the same technical concept, the present disclosure also provides a computer device. Refer to Figure 7As shown, a structural schematic diagram of the computer device 700 provided by the embodiments of the present disclosure is shown, including a processor 701, a memory 702, and a bus 703. The memory 702 is used to store execution instructions, including an internal memory 7021 and an external memory 7022; the internal memory 7021 is also called an internal memory, used to temporarily store operation data in the processor 701 and exchange data with the external memory 7022 such as a hard disk, and the processor 701 exchanges data with the external memory 7022 through the internal memory 7021, and when the computer device 700 is running, the processor 701 and the memory 702 communicate through the bus 703, so that the processor 701 executes the following instructions:

[0167] In response to the data transmission instruction, a first key is generated based on the temporary private key generated by the client and the first public key generated by the target server;

[0168] Based on the first key, target data in the to-be-transmitted data is encrypted to obtain target encrypted data;

[0169] The target transmission data is sent to the target server, so that the target server generates a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and performs decryption processing on the target encrypted data based on the second key; wherein the target transmission data includes the temporary public key corresponding to the temporary private key generated by the client, the target encrypted data, and other data in the to-be-transmitted data except the target data.

[0170] In a possible implementation, in the instructions executed by the processor 701, after responding to the data transmission instruction, the method further includes:

[0171] Sending a data transmission request to the target server;

[0172] Receiving the verification certificate sent by the target server;

[0173] The target transmission data is sent to the target server, including:

[0174] Determining the second public key contained in the verification certificate;

[0175] Based on the second public key, the target transmission data is encrypted to obtain encrypted target transmission data;

[0176] The encrypted target transmission data is sent to the target server.

[0177] In a possible implementation, in the instructions executed by the processor 701, the target transmission data is sent to the target server, including:

[0178] sending the target transmission data to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

[0179] In a possible implementation, the at least one intermediate server includes a load balancing server, a gateway server, and a cache server.

[0180] In a possible implementation, the instructions executed by the processor 701 include that the method further includes:

[0181] In response to the key generation condition being met, generating the temporary private key and a temporary public key corresponding to the temporary private key based on a preset key generation algorithm.

[0182] Alternatively, the processor 701 can execute the following instructions:

[0183] receiving target transmission data sent by a client; wherein the target transmission data includes a temporary public key generated by the client, target encrypted data, and other data in the to-be-transmitted data except the target data, the target encrypted data is data obtained by performing encryption processing on the target data in the to-be-transmitted data based on a first key, and the first key is generated by the client based on a temporary private key corresponding to the temporary public key and a first public key generated by the target server;

[0184] generating a second key corresponding to the first key based on a first private key corresponding to the temporary public key and the first public key, and performing decryption processing on the target encrypted data based on the second key.

[0185] In a possible implementation, the instructions executed by the processor 701 include that the method further includes:

[0186] receiving a data transmission request sent by the client, and sending an authentication certificate to the client;

[0187] The receiving target transmission data sent by the client includes:

[0188] receiving encrypted target transmission data sent by the client, the encrypted target transmission data including data obtained by performing encryption processing on the target transmission data based on a second public key in the authentication certificate;

[0189] performing decryption processing on the encrypted target transmission data based on a second private key corresponding to the second public key, to obtain the target transmission data.

[0190] In a possible implementation, the first public key generated by the target server is transmitted to the client through a non-network transmission mode in the instructions executed by the processor 701.

[0191] The embodiments of the present disclosure further provide a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, steps of the data transmission method described in the above method embodiments are executed. The storage medium can be a volatile or non-volatile computer readable storage medium.

[0192] The embodiments of the present disclosure further provide a computer program product, which carries a program code. The program code includes instructions for executing steps of the data transmission method described in the above method embodiments. For details, refer to the above method embodiments, which will not be repeated here.

[0193] The computer program product can be implemented by hardware, software or a combination thereof. In an optional embodiment, the computer program product is embodied as a computer storage medium. In another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0194] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system and device can refer to the corresponding process in the above method embodiments, which will not be repeated here. In several embodiments provided by the present disclosure, it should be understood that the disclosed system, device and method can be implemented by other ways. The above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interface, device or unit, which can be electrical, mechanical or other forms.

[0195] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the present embodiment.

[0196] In addition, each function unit in various embodiments of the present disclosure can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0197] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a nonvolatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present disclosure essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present disclosure. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0198] Finally, it should be noted that: the above-described embodiments are merely specific embodiments of the present disclosure, used to illustrate the technical solutions of the present disclosure, rather than limit them. The protection scope of the present disclosure is not limited thereto, although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: any skilled person familiar with the technical field of the present disclosure can modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A data transmission method, characterized in that, Applied to the client side, including: In response to a data transmission command, a first key is generated based on the temporary private key generated by the client and the first public key generated by the target server; Based on the first key, the target data in the data to be transmitted is encrypted to obtain the target encrypted data. The target transmission data is sent to the target server, so that the target server generates a second key corresponding to the first key based on the temporary public key and the first private key corresponding to the first public key, and decrypts the target encrypted data based on the second key; wherein, the target transmission data includes the temporary public key generated by the client corresponding to the temporary private key, the target encrypted data, and other data in the data to be transmitted except for the target data; The method further includes, in response to the data transmission instruction, sending a data transmission request to the target server and receiving a verification certificate sent by the target server, wherein the verification certificate includes a second public key, data to be verified, and signature data. The step of sending the target transmission data to the target server includes: The signature data is decrypted using the second public key to obtain first verification data. Then, based on the data to be verified and the first verification data, it is determined that the verification certificate has not been tampered with. Finally, the target transmission data is encrypted using the second public key to obtain encrypted target transmission data. The encrypted target transmission data is sent to the target server.

2. The method according to claim 1, characterized in that, Sending the target transmission data to the target server includes: The target transmission data is sent to at least one intermediate server, so that the at least one intermediate server sends the target transmission data to the target server.

3. The method according to claim 2, characterized in that, The at least one intermediate server includes a load balancer, a gateway server, and a cache server.

4. The method according to claim 1, characterized in that, The method further includes: In response to the key generation conditions being met, a temporary private key and a temporary public key corresponding to the temporary private key are generated based on a preset key generation algorithm.

5. A data transmission method, characterized in that, Applied to the target server, including: The system receives a data transmission request sent by a client and sends a verification certificate to the client, wherein the verification certificate includes a second public key, data to be verified, and signature data. The system receives encrypted target transmission data sent by the client; wherein the encrypted target transmission data includes data encrypted based on the second public key in the verification certificate, the target transmission data includes a temporary public key generated by the client, target encrypted data, and other data in the data to be transmitted except for the target data, the target encrypted data is data encrypted based on a first key, the first key being generated by the client based on the temporary private key corresponding to the temporary public key and the first public key generated by the target server; Based on the temporary public key and the first private key corresponding to the first public key, a second key corresponding to the first key is generated, and the target encrypted data is decrypted based on the second key; The second public key is used to decrypt the signature data to obtain the first verification data. When it is determined that the verification certificate has not been tampered with based on the data to be verified and the first verification data, the second public key is used to encrypt the target transmission data.

6. The method according to claim 5, characterized in that, After receiving the encrypted target transmission data sent by the client, the method further includes: Based on the second private key corresponding to the second public key, the encrypted target transmission data is decrypted to obtain the target transmission data.

7. The method according to claim 5, characterized in that, The first public key generated by the target server is transmitted to the client via a non-network transmission method.

8. A data transmission system, characterized in that, include: The client is used to generate a first key based on the temporary private key generated by the client and the first public key generated by the target server in response to the data transmission command; Based on the first key, the target data in the data to be transmitted is encrypted to obtain the target encrypted data; the target transmission data is then sent to the target server; wherein, the target transmission data includes the temporary public key generated by the client corresponding to the temporary private key, the target encrypted data, and other data in the data to be transmitted besides the target data; The target server is configured to generate a second key corresponding to the first key based on the temporary public key and the first private key corresponding to the first public key, and to decrypt the target encrypted data based on the second key; In response to the data transmission instruction, the client is further configured to: send a data transmission request to the target server and receive a verification certificate sent by the target server, wherein the verification certificate includes a second public key, data to be verified, and signature data; Wherein, when the client sends the target transmission data to the target server, the client is further configured to: The signature data is decrypted using the second public key to obtain first verification data. Then, based on the data to be verified and the first verification data, it is determined that the verification certificate has not been tampered with. Finally, the target transmission data is encrypted using the second public key to obtain encrypted target transmission data. The encrypted target transmission data is sent to the target server.

9. A data transmission device, characterized in that, include: The generation module is used to generate a first key in response to a data transmission command, based on the temporary private key generated by the client and the first public key generated by the target server. An encryption module is used to encrypt target data in the data to be transmitted, based on the first key, to obtain target encrypted data. A sending module is used to send target transmission data to the target server, so that the target server generates a second key corresponding to the first key based on a temporary public key and a first private key corresponding to the first public key, and decrypts the target encrypted data based on the second key; wherein, the target transmission data includes a temporary public key generated by the client corresponding to the temporary private key, the target encrypted data, and other data in the data to be transmitted except for the target data; In response to the data transmission instruction, the data transmission device is further configured to: send a data transmission request to the target server and receive a verification certificate sent by the target server, wherein the verification certificate includes a second public key, data to be verified, and signature data; Wherein, when sending the target transmission data to the target server, the sending module is further configured to: The signature data is decrypted using the second public key to obtain first verification data. Then, based on the data to be verified and the first verification data, it is determined that the verification certificate has not been tampered with. Finally, the target transmission data is encrypted using the second public key to obtain encrypted target transmission data. The encrypted target transmission data is sent to the target server.

10. A data transmission device, characterized in that, The data transmission device includes: a receiving module and a decryption module. The data transmission device is used to receive data transmission requests sent by the client and send a verification certificate to the client. The verification certificate includes a second public key, data to be verified, and signature data. The receiving module is used to receive encrypted target transmission data sent by the client; wherein, the encrypted target transmission data includes data after encrypting the target transmission data based on the second public key in the verification certificate, the target transmission data includes a temporary public key generated by the client, target encrypted data, and other data in the data to be transmitted except for the target data, the target encrypted data is data after encrypting the target data in the data to be transmitted based on a first key, the first key being generated by the client based on the temporary private key corresponding to the temporary public key and the first public key generated by the target server; The decryption module is used to generate a second key corresponding to the first key based on the temporary public key and the first private key corresponding to the first public key, and to decrypt the target encrypted data based on the second key; The second public key is used to decrypt the signature data to obtain the first verification data. When it is determined that the verification certificate has not been tampered with based on the data to be verified and the first verification data, the second public key is used to encrypt the target transmission data.

11. A computer device, characterized in that, include: The computer device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the data transmission method as described in any one of claims 1 to 4, or the steps of the data transmission method as described in any one of claims 5 to 7.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the data transmission method as described in any one of claims 1 to 4, or the steps of the data transmission method as described in any one of claims 5 to 7.

Images