A network data security operation method, device, equipment and storage medium

Abstract

This invention provides a secure operation method, apparatus, device, and storage medium for network data, comprising the steps of: receiving encrypted data from an application side based on a server-side public key; decrypting the encrypted data using its own private key to obtain a key sequence; and returning response data to the application side; reconstructing a temporary symmetric key from a pre-stored master key according to a pre-agreed selection method and key sequence; obtaining first plaintext data; encrypting the first plaintext data using the temporary symmetric key; and sending the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side. This invention can simultaneously ensure the security of network data transmission and the timeliness of processing.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a secure operation method, apparatus, device, and storage medium for network data. Background Technology

[0002] With the rise of data asset and data privacy protection, people are paying increasing attention to the security of network data. Specifically, in the process of data transmission between different applications, the security of network data includes ensuring the legitimacy of the source of network data during transmission, its immutability, its non-forgeability, and its non-theft, among other things.

[0003] Current methods for securing network data typically involve data encryption. Data encryption algorithms include reversible algorithms such as symmetric and asymmetric encryption, as well as irreversible algorithms like hash functions and message digests. However, each individual encryption algorithm has its own application scenarios and limitations. Symmetric encryption algorithms use the same key for both sending and receiving data, resulting in fast encryption and decryption speeds but generally lower security. Asymmetric encryption algorithms use a public key for encryption and a private key for decryption, offering higher security but with moderate encryption and decryption speeds. Digital signatures, which further enhance security, also further reduce encryption and decryption speeds. Therefore, each approach has its own emphasis in cross-network communication scenarios.

[0004] In existing technologies, if asymmetric encryption algorithms are used for network data encryption and decryption between the server and application sides, the data processing speed will be limited by the performance of the application side. If symmetric encryption algorithms are used for network data encryption and decryption, there are security issues with the symmetric key during transmission and storage. Once the symmetric key on the device side is leaked, all subsequent data transmissions will be compromised. Therefore, there is an urgent need for an operational method that can simultaneously ensure the security of network data transmission and the timeliness of processing. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, the present invention provides a method, apparatus, device, and storage medium for operating network data, which can simultaneously ensure the security of network data transmission and the timeliness of processing.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] In a first aspect, the present invention provides a method for securely operating network data, comprising the following steps:

[0008] The application receives encrypted data based on the server's public key, decrypts the encrypted data using its own private key to obtain a key sequence, and returns response data to the application. The response data is used by the application to reconstruct a temporary symmetric key from a pre-stored master key according to a pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key.

[0009] A temporary symmetric key is reconstructed from the pre-stored master key according to a pre-agreed selection method and key sequence;

[0010] Obtain the first plaintext data, encrypt the first plaintext data using the temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

[0011] The beneficial effects of this invention are as follows: by storing the master key on both the application side and the service side, and generating the temporary symmetric key based on the master key and a key sequence during communication, the temporary symmetric key is dynamic and unpredictable due to the diversity of key sequences and selection methods. This solves the security problem of symmetric key storage. Only the key sequence is transmitted, not the symmetric key used for encryption and decryption, and it is transmitted through an asymmetric encryption algorithm. Therefore, the security problem during transmission is guaranteed, thus ensuring both the security of network data transmission and the timeliness of processing.

[0012] Optionally, the step of reconstructing a temporary symmetric key from a pre-stored master key according to a pre-agreed selection method and key sequence specifically includes:

[0013] The timestamps of the encrypted data and the response data are processed according to a preset calculation method to obtain a starting number with a character length less than the master key;

[0014] The character at the starting number of the master key is used as the starting character of the temporary symmetric key;

[0015] Starting from the initial number on the master key, each number in the key sequence that differs from the character length of the temporary symmetric key by one is offset sequentially to obtain the corresponding character until the temporary symmetric key is obtained. The key sequence does not include 0 or uses 0 as the base number when it is generated. The offset returns to the first character when it reaches the last character of the master key and continues.

[0016] As described above, the initial number is obtained by calculating based on the timestamps of both parties, and the temporary symmetric key is obtained by offsetting the key sequence on the master key. This means that the key sequence itself is not the only basis for generating the temporary symmetric key, and the security of the temporary symmetric key can be further improved by relying on the concealment of the timestamp.

[0017] Optionally, if the application side has an application-side public key and an application-side private key, then the receiving application side, based on the server-side public key, decrypts the encrypted data using its own private key to obtain a key sequence and returns an acknowledgment to the application side includes:

[0018] The system receives encrypted data from the application side based on a digital signature and a random key. It then decrypts the encrypted data using its own private key to obtain encrypted ciphertext and a random key. Next, it decrypts the encrypted ciphertext using the random key to obtain a key sequence and a digital signature. Finally, it decrypts the digital signature using the application side's private key to obtain a first message digest. Then, it performs a hash operation on the key sequence to obtain a second message digest. If the first message digest and the second message digest are consistent, it returns response data to the application side; otherwise, it returns security warning data to the application side.

[0019] As described above, digital signatures offer higher security, thereby enhancing the security of key sequences during transmission.

[0020] Optionally, returning the response data to the application side includes: encrypting the response data using the application side's public key and then returning it to the application side.

[0021] Optionally, the key sequence is a random number.

[0022] Optionally, the step of encrypting the first plaintext data using the temporary symmetric key and sending the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side further includes the following steps:

[0023] The first plaintext data is encrypted using the temporary symmetric key to obtain the first ciphertext data.

[0024] A heartbeat packet is sent to the application side before and after sending the first encrypted data.

[0025] Receive the response data of the corresponding heartbeat packet sent by the application side and the second data ciphertext corresponding to the first data ciphertext sent by the application side;

[0026] The theoretical transmission times are obtained by the difference between the sending timestamps of the two heartbeat packets and the receiving timestamps of the corresponding response data, and the data transmission time is obtained by the difference between the sending timestamps of the first data ciphertext and the receiving timestamps of the second data ciphertext.

[0027] The data transmission time is determined based on the two theoretical transmission times before and after. If the data transmission time is not reasonable, a security warning is issued.

[0028] As described above, the theoretical transmission time of two consecutive heartbeat packets is used to determine the communication performance of the network environment in which the data to be transmitted is located. This determines whether the data transmission time of the data to be transmitted is reasonable, thus eliminating data delays caused by the network environment. In this way, the transmission time difference of network data can be used to detect whether there is data theft or application-side monitoring, so as to provide timely warning and handling in the event of a data security incident.

[0029] Optionally, determining whether the data transmission time is reasonable based on two theoretical transmission times includes:

[0030] The data transmission time is compensated based on the data length and encryption / decryption time to obtain the compensated transmission time. The reasonableness of the compensated transmission time is then determined based on the two theoretical transmission times.

[0031] In a second aspect, the present invention provides a secure network data operation device, comprising:

[0032] The acquisition module is used to receive encrypted data from the application side based on the public key of the service side, decrypt the encrypted data using its own private key to obtain a key sequence, and return response data to the application side. The response data is used by the application side to reconstruct a temporary symmetric key from the pre-stored master key according to a pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key.

[0033] The reconstruction module is used to reconstruct a temporary symmetric key from the pre-stored master key according to a pre-agreed selection method and key sequence;

[0034] An encryption module is used to acquire first plaintext data, encrypt the first plaintext data using the temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

[0035] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a secure network data operation method according to the first aspect.

[0036] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed, it implements a secure network data operation method according to the first aspect.

[0037] The technical effects of the network data security operation device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect are described in the relevant description of the network data security operation method provided in the first aspect. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the main process of a secure network data operation method according to Embodiment 1 of the present invention;

[0039] Figure 2 This is a schematic diagram of the application framework of a secure network data operation method according to Embodiment 1 of the present invention;

[0040] Figure 3 This is a schematic diagram of the main process of a secure network data operation method according to Embodiment 2 of the present invention;

[0041] Figure 4 This is a schematic diagram of a network data security operation device according to Embodiment 3 of the present invention.

[0042] Figure 5 This is a schematic diagram of the structure of an electronic device according to Embodiment 4 of the present invention. Detailed Implementation

[0043] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0044] The application scenarios in the various embodiments of this invention are communication scenarios between a server and multiple application sides. Existing methods typically use either asymmetric or symmetric encryption algorithms for network data encryption and decryption, neither of which can simultaneously guarantee the security of network data transmission and the timeliness of processing. Therefore, this invention uses a pre-agreed master key and generates a temporary symmetric key based on a temporary key sequence and the agreed master key. This solves the problem of symmetric key security during transmission and storage while preserving the timeliness of symmetric key processing.

[0045] The following detailed explanation uses several examples.

[0046] Example 1

[0047] Please refer to Figure 1 and Figure 2 A method for securely operating network data, comprising the following steps:

[0048] Step 100: Receive encrypted data from the application side based on the server side's public key, decrypt the encrypted data using its own private key to obtain a key sequence, and return response data to the application side. The response data is used by the application side to reconstruct a temporary symmetric key from the pre-stored master key according to the pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key.

[0049] In this embodiment, the steps are executed by the server.

[0050] like Figure 2 As shown, a pre-agreed master key SK is stored on both the application side and the service side. Since the master key is not the symmetric key used for communication with each application side, its leakage during storage does not constitute a key leak. However, as the basis for generating temporary symmetric keys, the secure storage of the master key can improve the security of network data communication to a certain extent. Therefore, this embodiment further explains the storage of the master key on the application side and the service side as follows:

[0051] Step 1000: An original long key is stored in each predetermined storage location. Each original long key is different from the others. The storage locations include at least two locations.

[0052] The storage locations include at least year, quarter, month, week, day, hour, minute, etc., so there can be two to seven storage locations. In this embodiment, considering communication stability and security, frequent key updates need to be avoided. Therefore, there are three storage locations, corresponding to year, month, and day respectively, resulting in three distinct original long keys.

[0053] Step 1001: Obtain the time parameter corresponding to each storage location in the current time. Starting from the position on the original long key that is equal to the value of the time parameter, take values ​​at intervals according to the number of storage locations to obtain the original subkey. Combine the original subkeys of all storage locations into the final master key.

[0054] In this embodiment, the year, month, and day of the current time are the corresponding time parameters. For example, July 6, 2023, the time parameters are 2023, 7, and 6 respectively. The year is taken as the starting number from 2000, the year the company was founded, or any other selected year, in order to reduce unnecessary waste of key characters. In this embodiment, 2018 is taken as the starting number.

[0055] At this point, starting from the sixth bit of the original long key stored at the corresponding year location, a value is taken every two bits to obtain an original subkey. For example, using the original long key 16F5AC587415A…, the sixth bit is C. Every two bits are 7 and 5 respectively, therefore the original subkey is C75… Similarly, the original subkeys for the month and day can be obtained as 53A… and 224…

[0056] Among them, all combinations of original subkeys can be directly combined according to the time order of year, month, and day, such as C75……53A……224…….

[0057] Therefore, the character length of the original subkey is about one-third of the character length of the required master key. Thus, the character length of the original long key is basically the same as the character length of the required master key, which can protect the master key to a certain extent.

[0058] When the application needs to communicate securely with the server, it obtains the master key by following the steps described above, then generates a random number as the key sequence, and uses the server's public key PUK. s After the key sequence is encrypted, it is transmitted to the server. The server uses its own private key to decrypt the encrypted data to obtain the key sequence and returns the response data to the application.

[0059] If the application side has an application-side public key and an application-side private key, i.e. Figure 2 As shown, application side A1 has application side public key PUK1 and application side private key PRK1, application side A2 has application side public key PUK2 and application side private key PRK2, and so on. n Application-side public key (PUK) n and application-side private key PRK n Meanwhile, each application side A1 to A n All of them store the server-side public key PUK. s The server-side S, in addition to its own server-side public key PUK, s Service-side private key PRK s It also includes each application side A1 to A n Application-side public key PUK1... Application-side public key PUK n .

[0060] The system receives encrypted data from the application based on the server's public key, decrypts the encrypted data using its own private key to obtain the key sequence, and returns a response to the application, including:

[0061] The system receives encrypted data from the application side based on a digital signature and a random key. It then decrypts the encrypted data using its own private key to obtain encrypted ciphertext and a random key. It further decrypts the encrypted ciphertext using the random key to obtain a key sequence and a digital signature. Finally, it decrypts the digital signature using the application side's private key to obtain a first message digest. The system then performs a hash operation on the key sequence to obtain a second message digest. If the first and second message digests match, the system returns response data to the application side; otherwise, it returns security warning data to the application side.

[0062] Digital signatures can be used to further enhance the security of key sequences during transmission.

[0063] Meanwhile, returning response data to the application side includes: encrypting the response data using the application side's public key before returning it to the application side.

[0064] The response data serves as a confirmation credential for communication between the two parties. When the application receives the response data, it begins to reconstruct a temporary symmetric key using the master key, key sequence, and a pre-agreed selection method. At the same time, the server also begins to generate the sequence of the temporary symmetric key when sending the response data, as detailed in step 101 below.

[0065] Step 101: Reconstruct a temporary symmetric key from the pre-stored master key according to the pre-agreed selection method and key sequence;

[0066] In this embodiment, step 101 specifically includes:

[0067] Step 1010: Process the timestamps of the encrypted data and the response data according to the preset calculation method to obtain a starting number with a character length less than the master key;

[0068] The preset calculation methods include initial calculation methods and final calculation methods. The initial calculation methods for two timestamps include, but are not limited to: addition, subtraction, averaging, taking the maximum value, taking the minimum value, etc. The final calculation methods for the time values ​​obtained from the initial calculation methods include: using the time values ​​to take the modulo of the character length of the master key, etc. The final calculation methods ensure that the resulting starting number is less than the character length of the master key.

[0069] In this embodiment, the temporary symmetric key is 16 characters long, therefore the master key must also be at least 16 characters long, with a reasonable range being above 320, and in this embodiment, it is 1024 characters long. In this embodiment, the starting number is 185.

[0070] Step 1011: Use the character at the starting number of the master key as the starting character of the temporary symmetric key;

[0071] In this embodiment, the 185th bit of the master key is used as the starting character of the temporary symmetric key. The master key illustrated in step 1001 is: C75……53A……224……, which does not involve the 185th bit. Therefore, the string starting at the 185th bit of the master key is:……84652F6565FD546B…….

[0072] Step 1012: Starting from the first number on the master key, offset each number in the key sequence that differs from the character length of the temporary symmetric key by one to obtain the corresponding character, until the temporary symmetric key is obtained. The key sequence does not include 0 or uses 0 as the base when it is generated. When the offset reaches the last character of the master key, it returns to the first character and continues.

[0073] In this embodiment, the required temporary symmetric key is 16 characters long. Therefore, the key sequence is 15 characters long: 5426852179563399. The starting character of the temporary symmetric key is 8. After shifting 5 characters, it becomes 6. After shifting 4 characters again, it becomes D. After shifting 2 characters again, it becomes 6, resulting in the temporary symmetric key 86D6...

[0074] Therefore, the initial number obtained by calculating based on the timestamps of both parties is used to obtain the temporary symmetric key by offsetting the key sequence on the master key. This means that the key sequence itself is not the only basis for generating the temporary symmetric key, and the security of the temporary symmetric key can be further improved by relying on the concealment of the timestamp.

[0075] The master key selection method can be protected by existing technologies such as hardware encryption and anti-recompilation of program code to prevent cracking. On the one hand, the symmetric key used does not need to consider transmission, which reduces the security risks during key transmission. Only the key sequence is transmitted, and it is transmitted through an asymmetric encryption algorithm. Therefore, the risk of key sequence leakage is extremely low, thus solving the problem of symmetric key transmission security. On the other hand, due to the diversity of key sequences and selection methods, the temporary symmetric key is dynamic and unpredictable. Moreover, only the master key, not the symmetric key, is stored locally, which also solves the security risk that other software can obtain the symmetric key after gaining access. Therefore, this embodiment can solve the security problems of existing symmetric keys in the transmission and storage processes, thereby ensuring both the security of network data transmission and the timeliness of processing.

[0076] Step 102: Obtain the first plaintext data, encrypt the first plaintext data using a temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

[0077] Thus, both the application side and the service side generate the same pair of temporary symmetric keys, which are used for data encryption, thereby enabling encrypted transmission of network data between the service side and the application side.

[0078] The validity period of the temporary symmetric key can be based on a preset update cycle or on the amount of communication data.

[0079] While key selection takes some time, the time spent on key selection in memory is negligible. Compared to traditional one-machine-one-key schemes, which require key verification for every communication, this method is actually faster. Furthermore, the ephemeral symmetric key is generated only on the application side of the communication. This means that the ephemeral symmetric key does not need to be stored when the user is not using the application. Therefore, the storage pressure on the ephemeral symmetric key is less than that of the one-machine-one-key scheme, and it also enables periodic key updates.

[0080] Example 2

[0081] Please refer to Figure 3 Based on Embodiment 1 above, this embodiment further includes the following steps: Encrypting the first plaintext data using a temporary symmetric key and sending the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

[0082] Step 200: Encrypt the first plaintext data using a temporary symmetric key to obtain the first ciphertext data;

[0083] Step 201: Send a heartbeat packet to the application side before and after sending the first encrypted data;

[0084] The heartbeat packet is a very simple data packet containing only some basic data agreed upon by both parties, or even empty data. This minimizes the performance impact on the application side.

[0085] Step 202: Receive the response data of the corresponding heartbeat packet sent by the application side and the second data ciphertext corresponding to the first data ciphertext sent by the application side;

[0086] Step 203: The theoretical transmission times are obtained by the difference between the sending timestamp of the two heartbeat packets and the receiving timestamp of the corresponding response data, and the data transmission time is obtained by the difference between the sending timestamp of the first data ciphertext and the receiving timestamp of the second data ciphertext.

[0087] Step 204: Determine whether the data transmission time is reasonable based on the two theoretical transmission times. If it is unreasonable, issue a security warning.

[0088] Judging whether the data transmission time is reasonable based on the two theoretical transmission times includes:

[0089] The compensated transmission time is obtained by compensating for the data length and encryption / decryption time. The reasonableness of the compensated transmission time is then judged based on the two theoretical transmission times.

[0090] In this regard, disregarding data transmission time, time compensation based on data length and encryption / decryption time can be obtained through statistical analysis of past data from the application side, including but not limited to filtering invalid data, data with excessively long transmission times, data with excessively short transmission times, etc., and then aggregating all data similar to the current scenario for statistical analysis.

[0091] Therefore, by using the theoretical transmission time of the two heartbeat packets, the communication performance of the network environment in which the data to be transmitted is located can be determined. This determines whether the data transmission time of the data to be transmitted is reasonable, thus eliminating data delays caused by the network environment. In this way, the transmission time difference of network data can be used to detect whether there is data theft or application-side monitoring, so as to provide timely warning and handling in the event of a data security incident.

[0092] In this embodiment, steps 200 to 204 can be initiated based on certain conditions. The following three methods are provided to illustrate the initiation conditions:

[0093] (1) An operation key is provided on the application side for users to choose whether to start.

[0094] (2) Start up according to the preset cycle.

[0095] (3) Start in case of abnormal situations such as data delay or data corruption.

[0096] In this embodiment, at startup, the application side uses a temporary symmetric key to encrypt the agreed value and sets the agreed value to be counted when it is accessed, generating a probe packet. The service side decrypts the probe packet and then judges whether the agreed value is reasonable. If it is reasonable, it then sends the actual network data.

[0097] Example 3

[0098] Please refer to Figure 4 A network data security operation device, comprising:

[0099] The acquisition module is used to receive encrypted data from the application side based on the server side's public key, decrypt the encrypted data using its own private key to obtain a key sequence, and return response data to the application side. The response data is used by the application side to reconstruct a temporary symmetric key from the pre-stored master key according to the pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key.

[0100] The reconstruction module is used to reconstruct a temporary symmetric key from the pre-stored master key according to a pre-agreed selection method and key sequence;

[0101] The encryption module is used to obtain the first plaintext data, encrypt the first plaintext data using a temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

[0102] The specific execution steps of the acquisition module, reconstruction module, and encryption module are as described in Embodiment 1 or 2 above.

[0103] Example 4

[0104] Please refer to Figure 5 An electronic device includes a memory 401, a processor 400, and a computer program stored in the memory 401 and executable on the processor 400. When the processor 400 executes the computer program, it implements the method described in Embodiment 1 or 2 above.

[0105] Example 5

[0106] A computer-readable storage medium storing a computer program, which, when executed, implements the method described in Embodiment 1 or 2 above.

[0107] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and modifications of the systems / devices based on the methods described in the above embodiments of the present invention, and therefore will not be repeated here. All systems / devices used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0108] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0110] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0111] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0112] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0113] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A method for secure operation of network data, characterized by, Including the following steps: The application receives encrypted data based on the server's public key, decrypts the encrypted data using its own private key to obtain a key sequence, and returns response data to the application. The response data is used by the application to reconstruct a temporary symmetric key from a pre-stored master key according to a pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key. A temporary symmetric key is reconstructed from the pre-stored master key according to a pre-agreed selection method and key sequence; Obtain the first plaintext data, encrypt the first plaintext data using the temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side. The step of reconstructing a temporary symmetric key from a pre-stored master key according to a pre-agreed selection method and key sequence specifically includes: The timestamps of the encrypted data and the response data are processed according to a preset calculation method to obtain a starting number with a character length less than the master key; The character at the starting number of the master key is used as the starting character of the temporary symmetric key; Starting from the initial number on the master key, each number in the key sequence that differs from the character length of the temporary symmetric key by one is offset sequentially to obtain the corresponding character until the temporary symmetric key is obtained. The key sequence does not include 0 or uses 0 as the base number when it is generated. When the offset reaches the last character of the master key, it returns to the first character and continues.

2. The method of claim 1, wherein, If the application side possesses an application-side public key and an application-side private key, then the receiving application side, based on the server-side public key, decrypts the encrypted data using its own private key to obtain a key sequence, and returns an acknowledgment to the application side includes: The system receives encrypted data from the application side based on a digital signature and a random key. It then decrypts the encrypted data using its own private key to obtain encrypted ciphertext and a random key. Next, it decrypts the encrypted ciphertext using the random key to obtain a key sequence and a digital signature. Finally, it decrypts the digital signature using the application side's private key to obtain a first message digest. Then, it performs a hash operation on the key sequence to obtain a second message digest. If the first message digest and the second message digest are consistent, it returns response data to the application side; otherwise, it returns security warning data to the application side.

3. The method of claim 2, wherein, The step of returning response data to the application side includes: encrypting the response data using the application side's public key and then returning it to the application side.

4. The method of claim 1, wherein, The key sequence is a random number.

5. The method of claim 1 to 4, wherein, The step of encrypting the first plaintext data using the temporary symmetric key and sending the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side further includes the following steps: The first plaintext data is encrypted using the temporary symmetric key to obtain the first ciphertext data. A heartbeat packet is sent to the application side before and after sending the first encrypted data. Receive the response data of the corresponding heartbeat packet sent by the application side and the second data ciphertext corresponding to the first data ciphertext sent by the application side; The theoretical transmission times are obtained by the difference between the sending timestamps of the two heartbeat packets and the receiving timestamps of the corresponding response data, and the data transmission time is obtained by the difference between the sending timestamps of the first data ciphertext and the receiving timestamps of the second data ciphertext. The data transmission time is determined based on the two theoretical transmission times before and after. If the data transmission time is not reasonable, a security warning is issued.

6. The method of claim 5, wherein, The step of determining whether the data transmission time is reasonable based on two theoretical transmission times includes: The data transmission time is compensated based on the data length and encryption / decryption time to obtain the compensated transmission time. The reasonableness of the compensated transmission time is then determined based on the two theoretical transmission times.

7. A device for secure operation of network data, characterized by include: The acquisition module is used to receive encrypted data from the application side based on the public key of the service side, decrypt the encrypted data using its own private key to obtain a key sequence, and return response data to the application side. The response data is used by the application side to reconstruct a temporary symmetric key from the pre-stored master key according to a pre-agreed selection method and key sequence. The character length of the master key is greater than the character length of the temporary symmetric key. The reconstruction module is used to reconstruct a temporary symmetric key from the pre-stored master key according to a pre-agreed selection method and key sequence, specifically including: The timestamps of the encrypted data and the response data are processed according to a preset calculation method to obtain a starting number with a character length less than the master key; The character at the starting number of the master key is used as the starting character of the temporary symmetric key; Starting from the starting number on the master key, each number in the key sequence that differs from the character length of the temporary symmetric key by one is offset sequentially to obtain the corresponding character until the temporary symmetric key is obtained. The key sequence does not include 0 or uses 0 as the base number when it is generated. When the offset reaches the last character of the master key, it returns to the first character and continues. An encryption module is used to acquire first plaintext data, encrypt the first plaintext data using the temporary symmetric key, and send the encrypted first ciphertext data to the application side to complete the encrypted data transmission with the application side.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a secure operation method for network data according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed, implements a secure network data operation method as described in any one of claims 1 to 6.

Images