Data processing method, device, equipment, readable storage medium and program product

Abstract

Embodiments of the present application provide a data processing method, device and equipment, readable storage medium and program product, which can be applied in the fields or scenarios of cloud technology, application software, vehicle-mounted, etc. The method comprises: in response to a data acquisition request of a business module, calling an original communication module, the original communication module being configured to encrypt information according to a first encryption suite and send the encrypted information to a server; when detecting that the original communication module is called, determining a data transmission mode corresponding to the data acquisition request; and when the data transmission mode is a target data transmission mode, sending the data acquisition request to a target communication module; through the target communication module, encrypting the data acquisition request by using a second encryption suite, and sending the encrypted data acquisition request to the server through a target data transmission channel between the target communication module and the server. Through the embodiments of the present application, the security of data transmission can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to data processing methods, data processing apparatus, computer equipment, computer-readable storage media, and computer program products. Background Technology

[0002] With the rapid development of communication technology, both parties can easily obtain each other's information through technical means, increasing the risk of data misuse. Therefore, secure communication between parties requires data encryption. Currently, most older projects (such as older application versions) rely on simple encryption methods for communication. Furthermore, considering the complexity of code refactoring, it's impossible to use the latest encryption controls for data encryption on top of the original business code, resulting in compromised data transmission security. Therefore, improving data transmission security is a pressing issue that needs to be addressed. Summary of the Invention

[0003] This application provides a data processing method, apparatus, device, readable storage medium, and program product that can improve the security of data transmission.

[0004] Firstly, this application provides a data processing method, which includes:

[0005] In response to the data acquisition request from the business module, the original communication module is invoked. The original communication module is used to encrypt the information according to the first encryption suite and send it to the server.

[0006] When the above-mentioned original communication module is detected to be invoked, the data transmission method corresponding to the above data acquisition request is determined;

[0007] When the data acquisition request corresponds to the target data transmission method, the data acquisition request is sent to the target communication module.

[0008] The target communication module uses a second encryption suite to encrypt the data acquisition request and sends the encrypted data acquisition request to the server through the target data transmission channel. The second encryption suite corresponds to the target data transmission channel. The second encryption suite is generated by agreement between the target communication module and the server. The target data transmission channel is a dedicated data transmission channel between the target communication module and the server.

[0009] Secondly, this application provides a data processing apparatus, which includes:

[0010] The processing module is used to respond to the data acquisition request from the business module by calling the original communication module. The original communication module is used to encrypt the information according to the first encryption suite and send it to the server.

[0011] The judgment module is used to determine the data transmission method corresponding to the data acquisition request when the above-mentioned original communication module is detected to be called.

[0012] The aforementioned processing module is also used to send the aforementioned data acquisition request to the target communication module when the data transmission method corresponding to the aforementioned data acquisition request is the target data transmission method;

[0013] The communication module is used to encrypt the data acquisition request using the second encryption suite through the target communication module, and send the encrypted data acquisition request to the server through the target data transmission channel; the second encryption suite corresponds to the target data transmission channel, the second encryption suite is generated by agreement between the target communication module and the server, and the target data transmission channel is a dedicated data transmission channel created between the target communication module and the server.

[0014] Thirdly, this application provides a computer device, including: a processor, a storage device, and a communication interface, wherein the processor, the communication interface, and the storage device are interconnected, wherein the storage device stores executable program code, and the processor is used to call the executable program code to implement the data processing method described above.

[0015] Fourthly, this application provides a computer-readable storage medium storing a computer program, the computer program including program instructions that are executed by a processor to implement the data processing method described above.

[0016] Fifthly, this application provides a computer program product, which includes a computer program or computer instructions, which are executed by a processor to implement the above-described data processing method.

[0017] This application hooks the original communication module and, upon detecting a call to the original communication module, performs subsequent processing via a custom method. This transforms the data acquisition request from being encrypted using a first encryption suite before data transmission to being encrypted using a second encryption suite before transmission through the target data transmission channel. This achieves the change of data encryption and data transmission methods without modifying the business layer. This method does not require rewriting the entire project's code, reducing the cost of changing data encryption and transmission methods. Since the target data transmission channel in this application supports the more secure and applicable national cryptographic encryption suite, it improves data transmission security while maintaining data sending and receiving operations based on the original business module. Furthermore, this application categorizes data transmission methods based on the business attributes of the data acquisition request, improving the matching degree between data transmission methods and business attributes, increasing data processing flexibility, and reducing data transmission resource costs. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the architecture of a data processing system provided in an exemplary embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating a data processing method provided in an exemplary embodiment of this application;

[0021] Figure 3 This is a flowchart illustrating a network request processing method provided in an exemplary embodiment of this application;

[0022] Figure 4 This is a flowchart illustrating another data processing method provided in an exemplary embodiment of this application;

[0023] Figure 5A This is a flowchart illustrating a data encryption process provided in an exemplary embodiment of this application;

[0024] Figure 5B This is a flowchart illustrating an exemplary embodiment of this application for establishing a target data transmission channel;

[0025] Figure 5C This is a flowchart illustrating the setting of a target communication module according to an exemplary embodiment of this application;

[0026] Figure 5DThis is a flowchart illustrating another setting of a target communication module, provided in an exemplary embodiment of this application.

[0027] Figure 5E This is a flowchart of request processing provided in an exemplary embodiment of this application;

[0028] Figure 6 This is a schematic block diagram of a data processing apparatus provided in an exemplary embodiment of this application;

[0029] Figure 7 This is a schematic block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0031] It should be noted that the terms "first," "second," etc., used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a technical feature specified with "first" or "second" may explicitly or implicitly include at least one of those features.

[0032] To better understand the solutions of the embodiments of this application, the relevant terms and concepts that may be involved in the embodiments of this application will be introduced below.

[0033] The OpenSecure Sockets Layer (OpenSSL) software library is an open-source library that applications can use for secure communication, preventing data leaks and verifying the identity of the other party. This library is widely used on internet web servers. Its main library is written in C and implements basic encryption functions, including the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols. This application uses the OpenSSL library to create protocol sockets and encapsulates them as upper-layer data interfaces to bridge the application layer of client applications.

[0034] Associated Attributes: Adding attributes to a category only generates declarations for the setter and getter methods; they are not implemented. We need to implement these methods ourselves. Associated attributes allow us to bind the getter and setter methods to objects. Since network requests are multi-threaded, this application marks each request using associated attributes on the object, facilitating callbacks from the business layer and improving their accuracy.

[0035] Method swiizzling (also called hooking functions): In Objective-C, an object-oriented programming language extended from C, calling a method is actually sending a message to an object. The sole criterion for finding the message is the name of the selector. Leveraging Objective-C's dynamic nature, the method implementation corresponding to the selector can be replaced at runtime, achieving the purpose of hooking the method. Each class has a method list that stores the mapping relationship between selector names and method implementations. This application uses method swiizzling functions to intercept network requests and perform secure communication through a self-built target communication module.

[0036] National Cryptographic Algorithms (Guochongqing) are domestic cryptographic algorithm standards published by the State Cryptography Administration. They include symmetric encryption, hash algorithms, asymmetric encryption, signature verification, and key exchange algorithms. Currently, the use of national cryptographic algorithms is being promoted in various fields, driving their implementation across industries.

[0037] The embodiments of this application can be applied to various fields or scenarios such as cloud computing, cloud IoT, cloud gaming, artificial intelligence, vehicle scenarios, smart transportation, and assisted driving. Several typical fields or scenarios will be introduced below.

[0038] Cloud computing refers to the delivery and usage model of IT infrastructure, meaning obtaining necessary resources in an on-demand and easily scalable manner through a network. In a broader sense, cloud computing also refers to the delivery and usage model of services, meaning obtaining necessary services in an on-demand and easily scalable manner through a network. These services can be IT and software related, internet-related, or other services. Cloud computing is a product of the convergence of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing. Driven by the development of the internet, real-time data streams, the diversification of connected devices, and the demands of search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Unlike previous parallel and distributed computing, the emergence of cloud computing will fundamentally revolutionize the entire internet model and enterprise management model. This application can store encryption suites, authentication information, and other data on a cloud server. When these different data are needed, they can be directly retrieved from the cloud server, greatly improving data retrieval speed.

[0039] Cloud gaming, also known as gaming on demand, is an online gaming technology based on cloud computing. It enables thin clients with relatively limited graphics processing and data processing capabilities to run high-quality games. In cloud gaming, the game does not reside on the player's terminal but runs on a cloud server. The cloud server renders the game scene as a video and audio stream, which is then transmitted to the player's terminal via the network. The player's terminal does not need powerful graphics processing and data processing capabilities; it only needs basic streaming media playback capabilities and the ability to receive player input commands and send them to the cloud server. This application applies to cloud gaming by constructing a dedicated data channel for game operations. When there are corresponding business needs, data is transmitted through this dedicated data channel to improve the security of data transmission during functions such as game content loading, mobile terminal acceleration, and page redirection.

[0040] Intelligent Traffic Systems (ITS), also known as Intelligent Transportation Systems, effectively integrate advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) into transportation, service control, and vehicle manufacturing. This strengthens the connection between vehicles, roads, and users, thereby forming a comprehensive transportation system that ensures safety, improves efficiency, enhances the environment, and saves energy.

[0041] Intelligent Vehicle Infrastructure Cooperative Systems (IVICS), or simply vehicle-road cooperative systems, represent a development direction for Intelligent Transportation Systems (ITS). IVICS utilizes advanced wireless communication and next-generation Internet technologies to implement comprehensive, real-time dynamic information interaction between vehicles and infrastructure. Based on the collection and fusion of dynamic traffic information across all times and spaces, it conducts active vehicle safety control and cooperative road management, fully realizing effective collaboration between people, vehicles, and roads. This ensures traffic safety, improves traffic efficiency, and ultimately forms a safe, efficient, and environmentally friendly road traffic system. This application can be applied to the aforementioned fields. For example, the method described in this application can be used to implement the aforementioned intelligent transportation system or intelligent vehicle-road cooperative system. Without modifying the business layer, data encryption is performed using national cryptographic encryption controls to ensure data transmission security while reducing the cost of changing the data encryption method.

[0042] Most legacy projects typically rely on simple encryption methods for communication, such as the inability to use national cryptographic encryption suites or support for national cryptographic channels, resulting in low communication security and necessitating a change in encryption methods. Due to limitations in the underlying interface, it's impossible to use the latest encryption controls for data encryption on top of the original business code, compromising data transmission security. While code refactoring can change the encryption method, it is complex and costly. Therefore, this application focuses on improving data transmission security by modifying the underlying layer without altering the business layer of legacy projects, enabling the use of the latest encryption controls (such as encryption controls based on domestic cryptographic algorithms recognized by the State Cryptography Administration) for data encryption. Specifically, this application uses the openSSL software library to construct the initialization, certificate verification, key loading, and connection delivery of the Transmission Control Protocol (TCP) channel to the target data transmission channel (e.g., a national cryptographic channel). At the network layer, MethodSwizzling is used to intercept system requests, and a custom target communication module transmits data through the target data transmission channel.

[0043] It is understood that in the specific embodiments of this application, data related to data acquisition requests, verification information, etc. are involved. When the above embodiments of this application are applied to specific products or technologies, the collection, use and processing of related data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0044] This application will be specifically illustrated through the following embodiments:

[0045] Please see Figure 1 This figure is a schematic diagram of the architecture of a data processing system provided in an exemplary embodiment of this application. The data processing system may specifically include a terminal device 101 and a server 102. The terminal device 101 and the server 102 are connected via a network, such as a local area network (LAN), a wide area network (WAN), or the mobile internet. The user operates on a browser or client application on the terminal device 101 to access various types of data. The server 102 can respond to the operation by returning the corresponding requested data to the user.

[0046] In one embodiment, when a certain business module on terminal device 101 needs to perform a data acquisition operation, it generates a corresponding data acquisition request. Terminal device 101 can respond to this data acquisition request by calling its original communication module to perform related processing. Since the original communication module is already linked to a custom function routine, when the original communication module is detected to be called, terminal device 101 will immediately jump to the custom function routine for subsequent processing. Specifically, through the custom function routine, terminal device 101 first determines the data transmission method corresponding to the data acquisition request, and when the data transmission method is the target data transmission method, sends the data acquisition request to the target communication module. Terminal device 101 then uses the target communication module to encrypt the data acquisition request using a second encryption suite, and sends the encrypted data acquisition request to server 102 through a dedicated target data transmission channel between the target communication module and the server.

[0047] In one embodiment, when server 102 receives an encrypted data acquisition request sent by terminal device 101 through the target data transmission channel, it decrypts the request and determines the response data corresponding to the data acquisition request. Server 102 then encrypts the response data using a second encryption suite and sends the encrypted response data to the target communication module of terminal device 101 through the target data transmission channel. At this time, the target communication module performs data format conversion processing on the response data to obtain request data that the original communication module can receive. Finally, the service module of terminal device 101 receives the request data.

[0048] Terminal equipment 101 is also referred to as terminal, user equipment (UE), access terminal, user unit, mobile device, user terminal, wireless communication equipment, user agent, or user device. Terminal equipment can be smart home appliances, handheld devices with wireless communication capabilities (such as smartphones and tablets), computing devices (such as personal computers (PCs), in-vehicle terminals, smart voice interaction devices, wearable devices, or other smart devices, but is not limited to these).

[0049] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0050] In one embodiment, the architecture of the data processing system proposed in this application may further include a database. The database can be used to store data such as data acquisition requests and pending requests, as well as data related to encryption suites and data transmission channels. This data can be recorded in different database tables. For example, the database can be a database located on a server, i.e., a database built into or integrated with the server; the database can also be an external database connected to the server, such as a cloud database (i.e., a database deployed in the cloud). Specifically, it can be deployed based on any of the following: private cloud, public cloud, hybrid cloud, edge cloud, etc., thus allowing the cloud database to focus on different functions. For example, a database deployed in a private cloud uses basic cloud hardware that is for individual users, focusing more on serving a small group of users. A database deployed in a public cloud, on the other hand, is based on a third-party cloud platform, allowing the data stored in the database to be shared. Data from any object can be stored in this database, and any object can use the data in the database.

[0051] It is understood that the system architecture diagrams described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. For example, the data processing method provided in the embodiments of this application can be executed not only by the terminal device 101, but also by other servers or server clusters that are different from the terminal device 101 and can communicate with the terminal device 101 and / or the server 102. Those skilled in the art will understand that... Figure 1The number of terminal devices and servers shown is merely illustrative. Any number of terminal devices and servers can be configured according to business needs. Furthermore, as system architecture evolves and new business scenarios emerge, the technical solutions provided in this application are also applicable to similar technical problems. In subsequent embodiments, "terminal device" will refer to the aforementioned terminal device 101, and "server" will refer to the aforementioned server 102; further details will not be repeated in subsequent embodiments.

[0052] Please see Figure 2 This figure is a schematic flowchart of a data processing method provided in an exemplary embodiment of this application, applied to a terminal device (referring to...). Figure 1 Taking terminal device 101 as an example, the method may include the following steps:

[0053] S201. In response to the data acquisition request from the business module, the original communication module is invoked.

[0054] In this embodiment, the business module is a functional module on the terminal device. Taking a short video business module of an application on the terminal device as an example, the short video business module can generate a data acquisition request for the target video when it receives an operation instruction (e.g., receiving a trigger operation for the video playback control corresponding to the target video). This data acquisition request is used to obtain the target video from the server. The original communication module is the communication module on the terminal device that performs data interaction with the server. Since this application performs data encryption processing using encryption controls (e.g., the second encryption suite) that are not supported by the original communication module without modifying the business layer, it is still necessary to call the original communication module for subsequent processing. This application performs hook processing on the original communication module (which can be understood as changing the implementation function corresponding to the method, the main function of which is to replace the implementation of the original method with the implementation of the custom method at runtime). After hook processing, when the terminal device detects that the original communication module is called (e.g., when a certain interface in the original communication module is called), it can jump to the hooked custom method for processing, that is, execute the subsequent steps S201 and beyond. The above method does not modify the business layer; it achieves the change of the communication module during data transmission by modifying the underlying implementation. Furthermore, since the operation object still uses the original business module to perform data sending and receiving operations, it ensures a seamless user experience during the operation.

[0055] In one embodiment, the original communication module encrypts information according to a first encryption suite and sends it to the server. The encryption suite is used to complete the handshake phase of information exchange between the terminal device and the server, determining the specific process of subsequent information exchange. The encryption suite may include algorithms used for authentication, encryption / decryption, key exchange, etc. The first encryption suite is the encryption suite corresponding to the original data transmission channel (e.g., a non-national cryptographic encryption suite using an asymmetric encryption algorithm (RSA)). The first encryption suite is generated by agreement between the original communication module and the server, and the original data transmission channel is the data transmission channel between the original communication module and the server.

[0056] In simple terms, during the establishment of a secure connection between a terminal device and a server, the encryption algorithms used by both are those in a cipher suite. A cipher suite is a set of encryption algorithms provided to the terminal device and server during the connection establishment process. Typically, the encryption algorithm combination in a cipher suite can be an asymmetric encryption algorithm like RSA, a symmetric encryption algorithm like AES, or a hash algorithm like SHA. After the secure connection is established, the terminal device and server can transmit data using the negotiated symmetric key. For example, the terminal device or server encrypts the communication content using a symmetric key, and the other end decrypts it using the same key, thus enabling data transmission.

[0057] It should be noted that the data acquisition request in this application can also refer to a network request, such as an execution request sent by a terminal device to a server, so that the server can perform the corresponding operation after receiving the execution request. In this case, the server may not return response data to the terminal device. The server may return the execution status information of the execution request to the terminal device. The execution status information is used to indicate the execution status of the execution operation corresponding to the execution request (e.g., execution successful, execution failed). This application does not limit its form. In the following embodiments, the data acquisition request will be described, and this application will not repeat it.

[0058] S202. When the original communication module is detected to be invoked, determine the data transmission method corresponding to the data acquisition request.

[0059] In this embodiment, by hooking the original communication module, a custom method is used for subsequent processing when a certain interface is detected to be called. Since different data acquisition requests have different business attributes (including data importance, confidentiality, etc.), dividing data transmission methods based on the business attributes of the data acquisition requests improves the matching degree between data transmission methods and business attributes, thereby increasing the flexibility of data processing and reducing the resource cost of data transmission.

[0060] This application first determines the data transmission method corresponding to the data acquisition request through a custom method, that is, the data sending method of the terminal device for the data acquisition request and the corresponding data receiving method for the requested data. For example, when the importance of the requested data corresponding to a certain data acquisition request is low, the data acquisition request and the corresponding requested data can be transmitted through a normal data transmission method; when the confidentiality of the requested data corresponding to a certain data acquisition request is high, the data has high requirements in terms of data transmission security, therefore the data acquisition request and the corresponding requested data can be transmitted through a target data transmission method (such as a national cryptographic channel).

[0061] S203. When the data acquisition request corresponds to the target data transmission method, the data acquisition request is sent to the target communication module.

[0062] In this embodiment, the service module communicates with the original communication module, and the original communication module communicates with the target communication module. When the data acquisition request corresponds to the target data transmission method, the terminal device can send the data acquisition request to the target communication module for subsequent data transmission processing.

[0063] In one embodiment, a data acquisition request may be sent directly from a service module on the terminal device to a target communication module; alternatively, a data acquisition request may be sent first by a service module on the terminal device to an original communication module, which then forwards it to the target communication module.

[0064] In one embodiment, when the data acquisition request corresponds to a non-target data transmission method, the terminal device can perform corresponding data transmission processing on the data acquisition request through the original communication module. For example, the process of performing data transmission processing on the data acquisition request through the original communication module can be as follows: the data acquisition request is encrypted using a first encryption suite through the original communication module, and the encrypted data acquisition request is sent to the server through the original data transmission channel (e.g., an RSA channel).

[0065] In one embodiment, when the data transmission mode corresponding to the data acquisition request is not the target data transmission mode, the method by which the original communication module acquires the data acquisition request can be that the terminal device returns the data acquisition request to the original communication module through the target communication module (in this case, the target communication module determines the data transmission mode and then returns the data); or the terminal device can directly send the data acquisition request to the original communication module (in this case, a judgment module independent of the target communication module in the terminal device determines the data transmission mode, and the terminal device sends the data to the original communication module when the judgment result is the target data transmission mode). This method improves the flexibility of data transmission mode determination.

[0066] In one embodiment, the target data transmission channel needs to be pre-built by the terminal device and the server. The terminal device creates a target communication module based on the OpenSSL software library package, and then initiates a Transmission Control Protocol (TCP) handshake with the server through the target communication module, ultimately establishing the target data transmission channel between the target communication module and the server. The specific process of establishing the target data transmission channel will be described in subsequent embodiments, and will not be repeated here.

[0067] S204. The data acquisition request is encrypted using the second encryption suite through the target communication module, and the encrypted data acquisition request is sent to the server through the target data transmission channel.

[0068] In this embodiment, the target data transmission channel is a dedicated data transmission channel between the created target communication module and the server. The second encryption suite is the encryption suite corresponding to the target data transmission channel (e.g., a Chinese national cryptographic encryption suite based on the Transmission Control Protocol (TCP)). The second encryption suite can provide a set of encryption algorithms (which may include multiple encryption algorithms) for the terminal device and the server during the establishment of a secure connection. The terminal device uses the second encryption suite to encrypt the data acquisition request through the target communication module, and then sends the encrypted data acquisition request to the server through the target data transmission channel. This changes the data acquisition request from being encrypted using the first encryption suite and transmitted through the original data transmission channel to being encrypted using the second encryption suite and transmitted through the target data transmission channel. Without modifying the business layer, this achieves the change of data encryption method and data transmission method.

[0069] Meanwhile, because the target data transmission channel supports Chinese national cryptographic encryption suites, which offer higher security and wider applicability, the security of data transmission is improved while still implementing data sending and receiving operations based on the original business modules. The terminal device also receives the requested data returned by the server through the target data transmission channel, ensuring the accuracy of the received requested data.

[0070] In one embodiment, the second cipher suite is generated by agreement between the target communication module and the server. For example, it may be determined during the handshake process between the terminal device and the server. During the handshake, the server sends a ClientHello message and the terminal device sends a ServerHello message. Subsequently, the client sends a list of its supported cipher suites in preferred order; the server responds with the cipher suite it has selected from the client's list. The selection process for the cipher suite can be determined through multiple rounds of data interaction, which will not be elaborated upon in this embodiment.

[0071] This application can be well applied to old project applications (APPs) of banks, securities, insurance and other clients that have undergone many iterations. By intercepting the original request and using hook routines to process data transmission, it achieves the purpose of transmitting requests through the national cryptographic channel without making any modifications to the business layer.

[0072] The following illustrations will explain the data encryption method and data transmission method conversion process in this application. Please refer to... Figure 3 This diagram is a flowchart of a network request processing method provided in an embodiment of this application. Taking the original application as an example, a business module in the original application on the terminal device can construct a corresponding data acquisition request when it receives a certain operation instruction; the terminal device passes the data acquisition request to the original communication module for processing; since the original communication module is hooked, when the original communication module (i.e., a certain interface of the original communication module) is called, the data acquisition request will be intercepted and handed over to the target communication module for subsequent processing; since the target communication module is built based on the software library package OpenSSL, the target communication module sends the data acquisition request to the server through the constructed target data transmission channel based on the software library package OpenSSL.

[0073] The OpenSSL software library is an open-source library that applications can use for secure communication, preventing data leaks and verifying the identity of the other party. The original communication module can be an NSURLSession object in the target operating system (e.g., iOS), and the corresponding original data transmission channel can be an RSA channel. The target communication module can be a TXURLSession object built in the target operating system, and the corresponding target data transmission channel can be a TCP channel (Chinese cryptographic channel). The specific implementation methods for data encryption and data transmission method modification in the above environment will be described in detail in subsequent embodiments and will not be repeated in this embodiment.

[0074] Based on the above embodiments, the beneficial effects of this application are as follows: By hooking the original communication module, this application performs subsequent processing through a custom method when the original communication module is detected to be called. This transforms the data acquisition request from being encrypted using the first encryption suite before data transmission to being encrypted using the second encryption suite before data transmission through the target data transmission channel. This achieves the change of data encryption and data transmission methods without modifying the business layer. This method does not require rewriting the entire project's code, reducing the cost of changing data encryption and transmission methods. Since the target data transmission channel in this application supports the more secure and applicable national cryptographic encryption suite, the security of data transmission is improved while still implementing data sending and receiving operations based on the original business module. Furthermore, this application divides the data transmission method according to the business attributes of the data acquisition request, which can improve the matching degree between the data transmission method and business attributes, increase the flexibility of data processing, and reduce the resource cost of data transmission. At the same time, since the operation object still implements data sending and receiving operations based on the original business module, a seamless experience is guaranteed for the operation object during the operation process.

[0075] Please see Figure 4 This figure is a schematic flowchart of a data processing method provided in an exemplary embodiment of this application, applied to a terminal device (referring to...). Figure 1 Taking terminal device 101 as an example, the method may include the following steps:

[0076] S401. In response to a data retrieval request from a business module, the original communication module is invoked.

[0077] In this embodiment, the original communication module is used to encrypt information according to the first encryption suite and send it to the server. The specific implementation of step S401 is described in the preceding embodiment of step S201, and will not be repeated here.

[0078] The following steps, S402-S404, will describe the method for determining the data transmission method corresponding to the data acquisition request.

[0079] S402. When the original communication module is detected to be called, obtain the relevant information of the request data included in the data acquisition request, and obtain the Uniform Resource Locator (URL) information of the request data.

[0080] In this embodiment, the data acquisition request carries relevant information about the requested data. This information uniquely indicates the data requested by the data acquisition request. For example, the relevant information could be the data storage name of the requested data, a unique identifier corresponding to the requested data, etc. The terminal device can determine the corresponding requested data based on this information, and then obtain the Uniform Resource Locator (URL) information. This URL information indicates the storage information of the requested data, such as the domain name of the storage server corresponding to the requested data, the path of the storage resource, and the specific storage parameters of the requested data. By obtaining the URL information of the requested data, the terminal device can determine whether the data acquisition request corresponding to the requested data needs to undergo data encryption and data transmission method changes; that is, whether the data acquisition request transmits data through the original data transmission channel or through the target data transmission channel.

[0081] S403. Determine the security analysis results of the requested data based on the unified resource location information.

[0082] In this embodiment, the terminal device can determine the security analysis result of the requested data based on the unified resource positioning information. The security analysis result is used to indicate the business attributes of the requested data, such as data type (ordinary business data, risky business data, confidential business data, etc.), the business module to which it belongs (game business, private attribute query business, short video business), and the importance of the data (general data, urgent data), etc. The terminal device can determine the data transmission method through one or more indicators in the security analysis result, which improves the flexibility of the determination.

[0083] S404. Determine the data transmission method corresponding to the data acquisition request based on the security analysis results.

[0084] In this embodiment, since the security analysis result corresponds to the requested data, the terminal device can directly determine the data transmission method of the requested data based on the security analysis result, which is also the data transmission method by which the server returns the requested data to the terminal device. Because data interaction between the server and the terminal device is based on the same data transmission channel, the data transmission method of the requested data is also the data transmission method corresponding to the data acquisition request. This application uses the security analysis result to make multi-dimensional judgments to determine the data transmission method corresponding to the data acquisition request, improving the accuracy of data transmission method judgment. Processing the determined data transmission method improves the matching degree between the data transmission method and business attributes, thereby increasing the flexibility of data processing and reducing the resource cost of data transmission.

[0085] In one embodiment, the above-mentioned determination of the data transmission method corresponding to the data acquisition request based on the security analysis results can be achieved according to the following steps: when the security analysis results indicate that the requested data needs to be transmitted through the target data transmission channel, the data transmission method corresponding to the data acquisition request is determined as the target data transmission method.

[0086] For example, if a terminal device receives a data acquisition request, and the Uniform Resource Locator (URL) information corresponding to this request indicates that the data type is confidential business data and the business module it belongs to is private attribute query business, then the terminal device can determine that the data transmission method corresponding to the data acquisition request is the target data transmission method (e.g., transmission via a national cryptographic channel). Conversely, if the terminal device receives another data acquisition request, and the URL information corresponding to this request indicates that the data type is ordinary business data and the business module it belongs to is short video business, then the terminal device can determine that the data transmission method corresponding to this request is the original data transmission method (e.g., transmission via an RSA channel).

[0087] In one embodiment, determining the data transmission method corresponding to the data acquisition request in steps S402-S404 can be implemented by the terminal device calling the target communication module. In this case, when the target communication module determines that transmission through the target data transmission channel is required, it performs subsequent processing; when the target communication module determines that transmission through the target data transmission channel is not required, the terminal device returns the data acquisition request to the original communication module through the target communication module, which then performs subsequent processing. Alternatively, steps S402-S404 can be implemented by the terminal device through a judgment module independent of both the target and original communication modules. In this case, when the judgment module determines that transmission through the target data transmission channel is required, it sends the data acquisition request to the target communication module for subsequent processing; when the judgment module determines that transmission through the target data transmission channel is not required, it sends the data acquisition request to the original communication module for subsequent processing. This method improves the flexibility of data transmission method determination.

[0088] S405. When the data acquisition request corresponds to the target data transmission method, the data acquisition request is sent to the target communication module.

[0089] S406. The data acquisition request is encrypted using the second encryption suite through the target communication module, and the encrypted data acquisition request is sent to the server through the target data transmission channel.

[0090] In this embodiment, the second encryption suite corresponds to the target data transmission channel. The second encryption suite is generated by agreement between the target communication module and the server, and the target data transmission channel is a dedicated data transmission channel created between the target communication module and the server. The specific implementation of steps S405-S406 is described in the preceding embodiments for steps S203-S204, and will not be repeated here.

[0091] The following describes the data storage method of the terminal device: The terminal device can store data acquisition requests in a buffer through the target communication module. If the data acquisition request does not carry a processing identifier, it will store the pending request in the buffer when it receives a pending request from the business module. The pending request and the data acquisition request are not the same request. The terminal device performs encryption processing when it detects a processing identifier (e.g., an end command in the request body) in a acquired request. The terminal device checks the processing identifier for each acquired request. If no processing identifier is detected, the request is stored in the buffer. New requests are continuously acquired until a request carrying a processing identifier is detected at a certain point. This request is then stored in the buffer (it should be noted that the last pending request carrying a processing identifier received by the terminal device may not be stored in the buffer). At this point, the terminal device begins batch encryption processing of the currently acquired but unprocessed requests.

[0092] Because network requests are executed asynchronously, the parameters for each request from the terminal device or the response data from the server are typically not sent all at once. The method described above improves data encryption efficiency, ensures overall request processing efficiency, and reduces resource consumption.

[0093] In one embodiment, the terminal device can store data acquisition requests and other pending requests from the business module in the same cache. Alternatively, the terminal device can store data acquisition requests and other pending requests from the business module in different caches according to the order in which they are received. For example, data acquisition requests can be stored in a first cache, and pending requests can be stored in a second cache, etc.

[0094] Based on the above method, the encryption of the data acquisition request using the second encryption suite can be achieved according to the following steps:

[0095] (a1) When a pending request carrying a processing identifier is detected, unprocessed requests are retrieved from the cache. Unprocessed requests include data retrieval requests and unprocessed pending requests.

[0096] In one embodiment, unprocessed requests may further include one or more requests that the terminal device received before receiving the data acquisition request, which do not carry processing identifiers and are stored in the cache. The terminal device performs batch encryption processing based on the pending requests and all previously unprocessed requests.

[0097] (a2) The obtained unprocessed requests are concatenated to obtain concatenated data.

[0098] In one embodiment, the terminal device may add a tag field to the target communication module. The tag field is used to indicate the count of the obtained requests during a batch encryption process.

[0099] For example, when the first request (which does not carry a processing identifier and is used to obtain video 1) is received, the tag value is incremented by 1, the first request is associated with tag=1, a buffer1 corresponding to tag=1 is allocated, and the first request is stored in buffer1. When the second request (which does not carry a processing identifier and is used to obtain video 2) is received, the tag value is incremented by 1, the first request is associated with tag=2, a buffer2 corresponding to tag=2 is allocated, and the second request is stored in buffer2. When the third request (which carries a processing identifier and is used to obtain video 3) is received, the tag value is incremented by 1, the first request is associated with tag=3, a buffer3 corresponding to tag=3 is allocated, and the third request is stored in buffer3. At this time, the terminal device can retrieve the stored first, second, and third requests from buffer1, buffer2, and buffer3 respectively, and concatenate the first, second, and third requests in the order they were received to obtain the concatenated data.

[0100] (a3) Use the second encryption kit to encrypt the spliced ​​data to obtain the encrypted data.

[0101] In this embodiment, the terminal device can use the target communication module and the second encryption suite to perform overall encryption processing on concatenated data containing multiple requests, thereby obtaining encrypted data and realizing batch encryption processing of multiple requests. This method improves the efficiency of encryption processing.

[0102] In one embodiment, the terminal device may first retrieve unprocessed requests (including data retrieval requests and one or more unprocessed pending requests) sequentially from the cache, then use the second encryption suite to encrypt each request individually, and finally concatenate the encrypted requests to obtain the encrypted data. This method improves the flexibility of the encryption process.

[0103] The data encryption method in this application will be illustrated below with diagrams. Please refer to... Figure 5AThis diagram is a flowchart of a data encryption process provided in an embodiment of this application. The terminal device detects the data stream input in real time and receives requests. When a request is received, it determines whether it carries a processing identifier. If it does not carry a processing identifier, the request is stored in the cache (i.e., a new category is added to the request, the tag value is incremented by 1, and it is stored in the allocated cache). If a request carries a processing identifier, the request is also stored in the cache (i.e., a new category is added to the request, the tag value is incremented by 1, and it is stored in the allocated cache). It is worth noting that the last request received by the terminal device carrying a processing identifier may not need to be reclassified, its tag value incremented by 1, or stored in the allocated cache, because after the batch encryption process is completed, the tag field and the allocated cache will be released for the next batch of encryption processing. The above method ensures that tag values ​​can be effectively reused within a certain value range, and also improves resource utilization.

[0104] When a terminal device receives a request that does not carry a processing identifier, it concatenates and encrypts all currently received unprocessed requests to obtain a complete request body. Finally, the terminal device executes the sending, that is, it encrypts the information and sends it to the server through the target communication module (or the original communication module) according to the second encryption suite (or the first encryption suite).

[0105] The process of obtaining request data by the business module will be described below through steps S407-S409.

[0106] S407. Receive the response data returned by the server through the target communication module.

[0107] In one embodiment, the response data matches the requested data in the data retrieval request. That is, the response data is the server's response to the data retrieval request. Based on the requested data in the data retrieval request, the server determines the storage server for the requested data (e.g., a business server connected to the server, or the server itself), and retrieves the response data from the storage server to correspond to this data retrieval request. Since the terminal device uses the target communication module to transmit the data retrieval request to the server through the target data transmission channel, the server, after determining the response data for the data retrieval request, also transmits the response data to the target communication module of the terminal device through the target data transmission channel.

[0108] When the target communication module receives the response data, the server has successfully sent data back to the terminal device. However, since this application encrypts the data using encryption controls (such as a second encryption suite) that the original communication module does not support, without modifying the business layer, subsequent processing still requires calling the original communication module. Furthermore, the network interfaces and data formats used by the original and target communication modules may not be entirely identical. Therefore, when the target communication module of the terminal device receives the response data returned by the server, it needs to convert the data into data that the original communication module can receive, thus enabling the callback of the response data.

[0109] The following will describe the process of data callback to the target communication module through steps S408-S409.

[0110] S408. The target communication module performs data format conversion processing on the response data to obtain the request data. The data format of the request data is the standard data format corresponding to the original communication module.

[0111] In this embodiment, since the original communication module and the target communication module differ in data format and network interface, in order to ensure that the business layer does not need to be modified, it is necessary to construct a parameter execution callback that the original communication module can recognize at the underlying level, so as to implement the method of using the national cryptographic channel in this application without making any modifications to the business layer.

[0112] For example, the target communication module can first convert the received binary response data into a C++ `std::string` string, then convert it to an Objective-C string using UTF8String (a character encoding method), and then objectify these strings to generate various parameters for the callback method, such as `session`, `dataTask`, `NSData`, and `response`. Finally, the target communication module sends the generated parameters back to the original communication module.

[0113] S409. The target communication module sends the request data to the original communication module, and the original communication module sends the request data to the business module.

[0114] At this point, the original communication module can successfully receive the request data after data format conversion and processing, and then send the request data to the business module. After receiving the request data, the business module can perform corresponding data processing operations. For example, if the requested data is video, the business module can play or display it on the corresponding interface or window on the terminal device.

[0115] It should be noted that the data acquisition request in this application can also refer to a network request, such as an execution request sent by a terminal device to a server, so that the server can perform the corresponding operation after receiving the execution request. In this case, the server may not return response data to the terminal device. Instead, the server can return the execution status information of the execution request to the target communication module of the terminal device. This execution status information indicates the execution status of the corresponding execution operation (e.g., successful execution, failed execution). The target communication module returns the execution status information to the business module, which then outputs it. For example, when the execution request is successfully executed on the server, the business module displays the execution status information "execution successful" on the corresponding interface or window; when the execution request fails to execute on the server, the business module displays the execution status information "execution failed" on the corresponding interface or window.

[0116] The following section will use the OpenSSL software library package as an example, taking the NSURLSession object in the iOS operating system as the original communication module and the TXURLSession object built in the iOS operating system as the target communication module, to provide a detailed explanation of the construction and setting of the target communication module, the establishment of the target data transmission channel, and the hooking process in this application.

[0117] In one embodiment, the terminal device first needs to construct a target communication module and establish a target data transmission channel with the server, and then switch data transmission channels based on the target data transmission channel. The specific implementation method is as follows:

[0118] (b1) Create the target communication module based on the software library package OpenSSL.

[0119] At this point, the terminal device creates an initial target communication module. During subsequent interactions between the terminal device and the server, the terminal device will pass relevant data (such as cipher suites, server communication parameters, etc.) to the initial target communication module, ultimately realizing the data transmission task through the target communication module.

[0120] (b2) The target communication module initiates a Transmission Control Protocol (TCP) handshake with the server to establish a target data transmission channel between the target communication module and the server.

[0121] After the target communication module initiates a Transmission Control Protocol (TCP) handshake with the server, multiple rounds of data exchange can occur between the target communication module and the server. For example, the target communication module can send its supported cipher suites and a random value (used to generate a key) to the server; the server sends its selected cipher suites and a random value (used to generate a key) to the target communication module; the server then sends a certificate to the client, which may include information such as the RSA private key and signature. The server can also transmit key exchange parameters to the target communication module, which vary depending on the algorithm.

[0122] During the TCP handshake process, the target communication module verifies the authentication information returned by the server. The target data transmission channel is established based on the verification result. In other words, when the verification result indicates that the verification process has passed, it means that the target communication module and the server have successfully established the target data transmission channel. The aforementioned authentication information can be one or more of a signature certificate, signature key, encryption certificate, and encryption key. The signature certificate and signature key are used in the digital signature process, while the encryption certificate and encryption key are used in the data encryption process. The target communication module verifies one or more of these data types based on the actual business situation to obtain the verification result.

[0123] In one embodiment, the encryption control can be a cipher suite, a concept within the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) network protocols. The encryption control can include various basic encryption algorithms, such as the following four categories: authentication algorithms, symmetric encryption algorithms, message authentication code algorithms, and key exchange algorithms.

[0124] The following illustrations illustrate the method for establishing the target data transmission channel in this application, including the initialization of TCP based on the OpenSSL software library package, certificate verification, key loading, and connection delivery to the national cryptographic channel. Please refer to... Figure 5B The figure is a flowchart of establishing a target data transmission channel according to an embodiment of this application. The specific process is as follows:

[0125] Firstly, the server calls the socket function to generate a detection object (TCPListener object, used to obtain incoming sockets) on the server, and binds the socket object (socket object) corresponding to the socket detection object to the server's network address; the server creates a thread queue to receive network requests in real time and execute multiple received network requests sequentially or concurrently.

[0126] Secondly, the server sends verification information, including a signing certificate, a signing key, an encryption certificate, and an encryption key, to the detection object on the terminal device (which is created by the terminal device). When the terminal device receives the request for the first time, it can set the signing certificate in the OpenSSL software library package, while the encryption certificate encrypts the request body each time a request is received.

[0127] Thirdly, the detection objects on the server can generate their own corresponding 256-bit private keys, pass the private key path to the target communication module through the memset function, check the correctness of the private key, and perform preloading processes such as memory space allocation.

[0128] After the above three processes are performed, the terminal device sends a request to the server to establish the target data transmission channel. Upon receiving the request, the server initializes the network environment using flags, performs DNS (Domain Name System) domain name resolution on the terminal device using the key pair (including the private key), obtains the terminal device's Internet Protocol (IP) address (i.e., the server's communication address), and sets the corresponding receiving port number (i.e., the server's communication port). This method enables a handshake between the terminal device and the server. Once the terminal device and server confirm their identities through the handshake, the target data transmission channel (TCP channel) is established, thus realizing the establishment of the national cryptographic channel described in this application.

[0129] Since the original software library package (network library) used in the application layer of the App does not have a TCP channel connection established in this application, this application will intercept, replace, and forward the requests executed by the original software library package (i.e., hooking), thereby enabling data transmission through the target data transmission channel via the created target communication module (i.e., the TXURLProtocol module). The hooking process will be described below; please refer to [link to relevant documentation]. Figure 5CThis diagram is a flowchart illustrating the setting of a target communication module according to an embodiment of this application. The terminal device first overrides the +load method of the target communication module; in this method, the class of the request class is obtained through the private API __NSCFURLSessionConfiguration, and the request is intercepted using the method call function MethodSwizzling. The specific process is as follows:

[0130] 1. The terminal device obtains the protocol method of the original class (the intercepted class) by calling the class_getInstanceMethod method (the first original method) and passing in the class of the request class and the protocol method selector. In the TXURLProtocol module, the protocolClasses instance method (the first target method built in this application, used to return the class name) is written and stored in the TXURLProtocol module.

[0131] 2. The terminal device exchanges the protocol method address of the original class by calling the method_exchangeImplementations method (the second original method), and replaces the original method with the stubMethod method (the second target method) generated by the TXURLProtocol module.

[0132] By using the above method, since the protocol method of the original class changes the method address, when the protocol method of the original class is called, it will be captured and enter the protocolClasses method implemented in this application, that is, the subsequent data transmission processing will be carried out through the target communication module constructed in this application.

[0133] In one embodiment, the terminal device needs to preload data such as communication parameters and encryption suites in order to send the data acquisition request to the server through the target data transmission channel. The specific implementation method of the preloading process is as follows:

[0134] (c1) Determine the server's communication parameters, including the server's communication address and the server's communication port.

[0135] (c2) Establish data encryption agreement rules with the server, and determine the second encryption kit corresponding to the target data transmission channel according to the data encryption agreement rules.

[0136] The server communication address and server communication port are used for data communication between the terminal device and the server. After establishing the target data transmission channel, the terminal device can construct a second encryption suite through TLS negotiation.

[0137] (c3) Set the communication parameters and the second encryption suite to the target communication module.

[0138] Since the terminal device pre-creates an initial target communication module, during subsequent interactions between the terminal device and the server, the terminal device will transmit relevant data (such as cipher suites, server communication parameters, etc.) to the initial target communication module, ultimately realizing the data transmission task through the target communication module.

[0139] In one embodiment, the terminal device can determine the data transmission method of a received request. Upon receiving the first request that requires data transmission through the target data transmission channel, it determines the communication parameters and second encryption suite information corresponding to the target data transmission channel and sets them in the target communication module. When other requests are subsequently received that also require data transmission through the target data transmission channel, corresponding operations are performed based on the previously set communication parameters and second encryption suite information, thereby improving processing efficiency.

[0140] The above method will be illustrated below. Please refer to the diagrams. Figure 5D This diagram is a flowchart illustrating another method for setting up the target communication module according to an embodiment of this application. When the NSURLSession of the system's original image module receives a request, it enters the startLoading method of the target communication module (TXURLProtocol module). The access layer can determine the data transmission method corresponding to the request based on the captured Uniform Resource Locator (URL) information, thereby determining whether it is necessary to use the national cryptographic channel. If the national cryptographic channel is not needed, no operation is performed. If the national cryptographic channel is needed, proxyHost, proxyPort, and proxyDict are set in the config class of the system's NSURLSession. These three parameters represent the proxy Host (indicating the server communication address, for example, 127.0.0.1), the proxy port (indicating the server communication port, for example, 8899), and the proxy dictionary, respectively. The set host and port are written into the proxy dictionary (e.g., the proxyDict dictionary), and the national cryptographic encryption suite for this request is set. Then, the configuration information (config) is sent back to the underlying software library package OpenSSL.

[0141] Please see Figure 5E This figure is a flowchart of a request processing embodiment provided in this application. The following will illustrate the interception and concatenation of requests in this application through specific examples:

[0142] Based on the configured information, when the OpenSSL software library package on the terminal device receives a request, it checks whether the host (server communication address) and port (server communication port) are correct. If the host and port are incorrect, the request is stopped, and OpenSSL continues to receive subsequent requests; if the host and port are correct, meaning the terminal device can enable the local proxy service, it listens for data stream input under that port. Due to the asynchronous execution of network requests, the TXURLProtocol module needs to be dynamically modified with attributes to mark the data streams of different requests and to enable the concatenation of request or response data.

[0143] Since data retrieval requests from each terminal device or business response data from the server are generally not sent all at once, a tag field (i.e., a marker field) is added to the custom TXURLProtocol. The tag field can be 8-digit binary data, with values ​​ranging from 0x00 to 0xff. The value of the tag field is incremented by 1 for each new request. The terminal device checks whether the currently acquired request has a reusable tag number (i.e., whether a tag number corresponding to the request has already been assigned). If not, a new tag is created for the request and associated with the target communication module; if a tag number exists, it is directly associated with the target communication module.

[0144] The aforementioned tag association processing can be achieved by the terminal device calling `objc_setAssociatedObject` to associate the retrieved tag with the target communication module and implementing the `set` method. The `set` method is only allowed to be called twice: once to set the tag value, and the second time to clear all tags after the request ends, ensuring that the 256 possible tag values ​​can be effectively reused. The terminal device uses `objc_getAssociatedObject` to allow the target communication module to read the tag; there are no restrictions on the reading process.

[0145] The terminal device determines whether a request carries a processing identifier. If it does not carry a processing identifier, the request is stored in the cache (i.e., a new category is added to the request, the tag value is incremented by 1, and it is stored in the allocated cache). If a request carries a processing identifier, the request is also stored in the cache (i.e., a new category is added to the request, the tag value is incremented by 1, and it is stored in the allocated cache). It is worth noting that the last request received by the terminal device carrying a processing identifier may not be re-categorized, its tag value incremented, or stored in the allocated cache, because after the batch encryption process is completed, the tag field and the allocated cache will be released for the next batch of encryption. This method ensures that tag values ​​can be effectively reused within a certain range, while also improving resource utilization.

[0146] When a terminal device receives a request that does not carry a processing identifier, it concatenates and encrypts all currently received unprocessed requests to obtain a complete request body. Finally, the terminal device executes the sending, that is, it sends the information to the server after encrypting it according to the second encryption suite through the target communication module.

[0147] In one embodiment, requests of the same type (e.g., both being data retrieval requests) can be grouped into the same category. The terminal device can assign the same tag value to requests of the same type and store them in the same buffer. When a request of another type is retrieved, the request is assigned a different tag value (e.g., the tag value corresponding to the previous type of request +1) and stored in the buffer corresponding to the new tag value. Based on this, the terminal device can use different categories as the dividing criteria to concatenate requests in the buffer of the same category (i.e., the same tag value) into a complete request body, and then use the established TCP sockets to pass through the national cryptographic channel.

[0148] In this embodiment, due to the differences in data format and network interface used between the original communication module and the target communication module, to ensure that the business layer remains unchanged, it is necessary to construct a callback mechanism at the lower level that the original communication module can recognize. This allows the implementation of the method using the national cryptographic channel described in this application without any modifications to the business layer. Therefore, when the target communication module (TXURLProtocol module) of the terminal device receives the response data returned by the server, since the App application layer still uses NSURLSession as the network entry and exit point, the network callback transmission method is implemented in the TXURLProtocol module. Specifically, the TXURLProtocol module can first convert the received binary response data into a C++ std::string string, then convert it into an Objective-C string using UTF8String (a character encoding method), and then objectify these strings to generate various parameters in the callback method, such as session, dataTask, NSData, and response. Finally, the TXURLProtocol module sends the generated parameters back to the NSURLSession interface of NSURLProtocol.

[0149] It should be noted that the aforementioned operations such as establishing the target data transmission channel and hooking can be performed automatically by the terminal device when running an APP through the APP loading the software development kit (SDK), achieving seamless operation of the target object and ensuring a good user experience.

[0150] Because many projects increasingly require the use of Chinese cryptographic algorithms for encrypted data transmission, while the underlying implementations of these projects do not support such encryption controls, this application addresses the issue. For example, when providing basic technical support to banks, securities firms, and insurance companies, these departments typically have multiple versions of their mobile apps, all using the NSURLSession network library. Therefore, this application utilizes related properties, NSURLProtocol, and MethodSwizzling to enable data transmission via the Chinese cryptographic channel for older projects. The proposed method can be effectively applied to various older app projects. By intercepting requests using TXURLProtocol, requests can be forwarded to OpenSSIL for further processing. Furthermore, the underlying implementation constructs parameters that the system's NSURLSession can recognize to execute callbacks, ensuring that the Chinese cryptographic channel is used without any modifications to the business layer.

[0151] Based on the above embodiments, the beneficial effects of this application are as follows: This application obtains the unified resource location information (URL) of the requested data based on the relevant information of the requested data included in the data acquisition request, then determines the security analysis result of the requested data based on the URL, and performs multi-dimensional judgment through the security analysis result to determine the data transmission method corresponding to the data acquisition request, which can improve the accuracy of the data transmission method judgment. Processing the determined data transmission method improves the matching degree between the data transmission method and business attributes, thereby increasing the flexibility of data processing and reducing the resource cost of data transmission.

[0152] This application also proposes that the data transmission method corresponding to the data acquisition request can be determined by the terminal device calling the target communication module, or by the terminal device through a judgment module independent of both the target and original communication modules, thus improving the flexibility of data transmission method determination. This application further proposes storing the acquired request in a cache, and performing batch encryption processing before sending it when processing conditions are met, which can improve data encryption efficiency, ensure the overall efficiency of request processing, and reduce resource consumption.

[0153] This application also proposes adding a tag field to the target communication module. The tag field is used to indicate the count of acquired requests during a batch encryption process. When performing the next batch encryption process, the tag field and its corresponding cache data are released, ensuring that the tag value can be effectively reused within a certain value range, thus improving resource utilization. This application also proposes to convert the response data into request data through the target communication module. By constructing parameters that the original communication module can recognize at the underlying level to execute callbacks, the method of using the national cryptographic channel described in this application can be implemented without any modifications to the business layer.

[0154] Please see Figure 6 This figure is a schematic block diagram of a data processing apparatus provided in an embodiment of this application. Specifically, the data processing apparatus may include:

[0155] Processing module 601 is used to respond to the data acquisition request of the business module by calling the original communication module, which is used to encrypt the information according to the first encryption suite and send it to the server.

[0156] The judgment module 602 is used to determine the data transmission method corresponding to the data acquisition request when the above-mentioned original communication module is detected to be called.

[0157] The aforementioned processing module 602 is further configured to send the aforementioned data acquisition request to the target communication module when the data transmission method corresponding to the aforementioned data acquisition request is the target data transmission method;

[0158] The communication module 603 is used to encrypt the data acquisition request using the second encryption suite through the target communication module, and send the encrypted data acquisition request to the server through the target data transmission channel; the second encryption suite corresponds to the target data transmission channel, the second encryption suite is generated by agreement between the target communication module and the server, and the target data transmission channel is a dedicated data transmission channel created between the target communication module and the server.

[0159] Optionally, the aforementioned data acquisition request includes information related to the requested data. The aforementioned judgment module 602, when determining the data transmission method corresponding to the aforementioned data acquisition request, is specifically used for:

[0160] Based on the above data, obtain the relevant information of the above request data included in the request, and obtain the Uniform Resource Locator (URL) information of the above request data;

[0161] Based on the aforementioned unified resource location information, the security analysis results of the above-mentioned request data are determined.

[0162] Based on the above security analysis results, the data transmission method corresponding to the above data acquisition request is determined.

[0163] Optionally, when the aforementioned judgment module 602 determines the data transmission method corresponding to the aforementioned data acquisition request based on the aforementioned security analysis results, it is specifically used for:

[0164] When the security analysis results indicate that the requested data needs to be transmitted through the target data transmission channel, the data transmission method corresponding to the data acquisition request is determined to be the target data transmission method.

[0165] Optionally, the communication module 603 described above is also used for:

[0166] The target communication module receives the response data returned by the server; the response data matches the request data requested in the data acquisition request; the response data is transmitted by the server to the target communication module through the target data transmission channel.

[0167] The above-mentioned target communication module performs data format conversion processing on the above-mentioned response data to obtain the above-mentioned request data. The data format of the above-mentioned request data is the standard data format corresponding to the above-mentioned original communication module.

[0168] The target communication module sends the request data to the original communication module, and the original communication module then sends the request data to the business module.

[0169] Optionally, the above-mentioned processing module 601 is also used for:

[0170] Create the target communication module described above using the OpenSSL software library package;

[0171] The target communication module initiates a Transmission Control Protocol (TCP) handshake with the server to establish the target data transmission channel between the target communication module and the server.

[0172] In the TCP handshake process described above, the target communication module verifies the verification information returned by the server. The target data transmission channel is established based on the verification results of the verification information, which includes one or more of the following: a signature certificate, a signature key, an encryption certificate, and an encryption key.

[0173] Optionally, the above-mentioned processing module 601 is also used for:

[0174] Determine the communication parameters of the server, including the server communication address and the server communication port;

[0175] Establish data encryption rules with the aforementioned server, and determine the second encryption suite corresponding to the aforementioned target data transmission channel based on the aforementioned data encryption rules;

[0176] Set the above communication parameters and the above second encryption suite to the above target communication module.

[0177] Optionally, the communication module 603 described above is also used for:

[0178] The aforementioned data acquisition request is stored in the cache area through the target communication module described above.

[0179] If the above data acquisition request does not carry a processing identifier, then when the pending request from the above business module is received, the pending request will be stored in the above cache area.

[0180] When the communication module 603 is used to encrypt the data acquisition request using the second encryption suite, it is specifically used for:

[0181] When the above pending request is detected to carry the above processing identifier, unprocessed requests are retrieved from the above cache area. The unprocessed requests include the above data retrieval requests and unprocessed pending requests.

[0182] The obtained unprocessed requests are concatenated to obtain concatenated data;

[0183] The concatenated data is then encrypted using a second encryption kit to obtain encrypted data.

[0184] It should be noted that the functions of each functional module of the data processing device in this application embodiment can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0185] Please see Figure 7 This figure is a schematic block diagram of a computer device provided in an embodiment of this application. As shown in the figure, the smart terminal in this embodiment may include: a processor 701, a storage device 702, and a communication interface 703. The processor 701, storage device 702, and communication interface 703 can interact with each other.

[0186] The aforementioned storage device 702 may include volatile memory, such as random-access memory (RAM); the storage device 702 may also include non-volatile memory, such as flash memory, solid-state drive (SSD), etc.; the aforementioned storage device 702 may also include a combination of the above types of memory.

[0187] The processor 701 described above may be a central processing unit (CPU). In one embodiment, the processor 701 may also be a graphics processing unit (GPU). Alternatively, the processor 701 may be a combination of a CPU and a GPU. In one embodiment, the storage device 702 is used to store program instructions, which the processor 701 can invoke to perform the following operations:

[0188] In response to the data acquisition request from the business module, the original communication module is invoked. The original communication module is used to encrypt the information according to the first encryption suite and send it to the server.

[0189] When the above-mentioned original communication module is detected to be invoked, the data transmission method corresponding to the above data acquisition request is determined;

[0190] When the data acquisition request corresponds to the target data transmission method, the data acquisition request is sent to the target communication module.

[0191] The target communication module uses a second encryption suite to encrypt the data acquisition request and sends the encrypted data acquisition request to the server through the target data transmission channel. The second encryption suite corresponds to the target data transmission channel. The second encryption suite is generated by agreement between the target communication module and the server. The target data transmission channel is a dedicated data transmission channel between the target communication module and the server.

[0192] Optionally, the aforementioned data acquisition request includes information related to the requested data. The processor 701, when determining the data transmission method corresponding to the aforementioned data acquisition request, is specifically used for:

[0193] Based on the above data, obtain the relevant information of the above request data included in the request, and obtain the Uniform Resource Locator (URL) information of the above request data;

[0194] The security analysis results of the above-mentioned request data are determined based on the aforementioned unified resource location information.

[0195] Based on the above security analysis results, the data transmission method corresponding to the above data acquisition request is determined.

[0196] Optionally, when the processor 701 determines the data transmission method corresponding to the data acquisition request based on the security analysis results, it is specifically used for:

[0197] When the security analysis results indicate that the requested data needs to be transmitted through the target data transmission channel, the data transmission method corresponding to the data acquisition request is determined to be the target data transmission method.

[0198] Optionally, the processor 701 described above is also used for:

[0199] The target communication module receives the response data returned by the server; the response data matches the request data requested in the data acquisition request; the response data is transmitted by the server to the target communication module through the target data transmission channel.

[0200] The above-mentioned target communication module performs data format conversion processing on the above-mentioned response data to obtain the above-mentioned request data. The data format of the above-mentioned request data is the standard data format corresponding to the above-mentioned original communication module.

[0201] The target communication module sends the request data to the original communication module, and the original communication module then sends the request data to the business module.

[0202] Optionally, the processor 701 described above is also used for:

[0203] Create the target communication module described above using the OpenSSL software library package;

[0204] The target communication module initiates a Transmission Control Protocol (TCP) handshake with the server to establish the target data transmission channel between the target communication module and the server.

[0205] In the TCP handshake process described above, the target communication module verifies the verification information returned by the server. The target data transmission channel is established based on the verification results of the verification information, which includes one or more of the following: a signature certificate, a signature key, an encryption certificate, and an encryption key.

[0206] Optionally, the processor 701 described above is also used for:

[0207] Determine the communication parameters of the server, including the server communication address and the server communication port;

[0208] Establish data encryption rules with the aforementioned server, and determine the second encryption suite corresponding to the aforementioned target data transmission channel based on the aforementioned data encryption rules;

[0209] Set the above communication parameters and the above second encryption suite to the above target communication module.

[0210] Optionally, the processor 701 described above is also used for:

[0211] The aforementioned data acquisition request is stored in the cache area through the target communication module described above.

[0212] If the above data acquisition request does not carry a processing identifier, then when the pending request from the above business module is received, the pending request will be stored in the above cache area.

[0213] When the processor 701 is used to encrypt the data acquisition request using the second encryption suite, it is specifically used for:

[0214] When the above pending request is detected to carry the above processing identifier, unprocessed requests are retrieved from the above cache area. The unprocessed requests include the above data retrieval requests and unprocessed pending requests.

[0215] The obtained unprocessed requests are concatenated to obtain concatenated data;

[0216] The concatenated data is then encrypted using a second encryption kit to obtain encrypted data.

[0217] In specific implementation, the processor 701, storage device 702, and communication interface 703 described in the embodiments of this application can execute the embodiments of this application. Figure 2 or Figure 4 The implementation methods described in the relevant embodiments of the provided data processing method can also be used to execute the embodiments of this application. Figure 6 The implementation methods described in the relevant embodiments of the provided data processing device will not be repeated here.

[0218] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, and systems can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the division of units is merely a logical functional division, and other division methods may exist in actual implementation; for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0219] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium storing a computer program executed by the aforementioned data processing device, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the aforementioned... Figure 2 , Figure 4 The methods described in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same methods will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application. As an example, program instructions can be deployed on a computer device, or executed on multiple computer devices located in one location, or executed on multiple computer devices distributed across multiple locations and interconnected via a communication network. These multiple computer devices distributed across multiple locations and interconnected via a communication network can constitute a blockchain system.

[0220] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned... Figure 2 , Figure 4 The methods described in the corresponding embodiments are therefore not repeated here.

[0221] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0222] The above-disclosed embodiments are merely some of the embodiments of this application, and should not be construed as limiting the scope of this application. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of this application still fall within the scope of the invention.

Claims

1. A data processing method, characterized in that, The method includes: In response to a data retrieval request from a business module, the original communication module is invoked; When the original communication module is detected to be invoked, the data transmission method corresponding to the data acquisition request is determined; When the data acquisition request corresponds to a data transmission method that is not the target data transmission method, the data acquisition request is encrypted using the first encryption suite through the original communication module, and the encrypted data acquisition request is sent to the server through the original data transmission channel; wherein, the first encryption suite corresponds to the original data transmission channel, the first encryption suite is generated by agreement between the original communication module and the server, and the original data transmission channel is a dedicated data transmission channel created between the original communication module and the server. When the data acquisition request corresponds to the target data transmission method, the data acquisition request is sent to the target communication module. The target communication module then uses a second encryption suite to encrypt the data acquisition request and sends the encrypted data acquisition request to the server through the target data transmission channel. The second encryption suite corresponds to the target data transmission channel, and the second encryption suite is generated by agreement between the target communication module and the server. The target data transmission channel is a dedicated data transmission channel created between the target communication module and the server.

2. The method according to claim 1, characterized in that, The data acquisition request includes information related to the requested data, and determining the data transmission method corresponding to the data acquisition request includes: Based on the data acquisition request, obtain the relevant information of the request data, and obtain the Uniform Resource Locator (URL) information of the request data; The security analysis results of the requested data are determined based on the unified resource location information. The data transmission method corresponding to the data acquisition request is determined based on the security analysis results.

3. The method according to claim 2, wherein determining the data transmission method corresponding to the data acquisition request based on the security analysis result includes: When the security analysis result indicates that the requested data needs to be transmitted through the target data transmission channel, the data transmission method corresponding to the data acquisition request is determined to be the target data transmission method.

4. The method according to claim 1, characterized in that, The method further includes: The target communication module receives response data returned by the server; the response data matches the request data requested in the data acquisition request, and the response data is transmitted by the server to the target communication module through the target data transmission channel; The target communication module performs data format conversion processing on the response data to obtain the request data, and the data format of the request data is the standard data format corresponding to the original communication module. The target communication module sends the request data to the original communication module, and the original communication module then sends the request data to the business module.

5. The method according to claim 1, characterized in that, The method further includes: Create the target communication module based on the OpenSSL software library package; The target communication module initiates a Transmission Control Protocol (TCP) handshake with the server to establish the target data transmission channel between the target communication module and the server. During the TCP handshake process, the target communication module verifies the verification information returned by the server. The target data transmission channel is established based on the verification result of the verification information, which includes one or more of a signature certificate, a signature key, an encryption certificate, and an encryption key.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: Determine the communication parameters of the server, including the server communication address and the server communication port; Establish a data encryption agreement with the server, and determine the second encryption suite corresponding to the target data transmission channel according to the data encryption agreement; Set the communication parameters and the second encryption suite to the target communication module.

7. The method according to any one of claims 1-5, characterized in that, The method further includes: The target communication module stores the data acquisition request in the cache area. If the data acquisition request does not carry a processing identifier, then when the pending request of the business module is received, the pending request is stored in the cache area; The encryption process for the data acquisition request using the second encryption suite includes: When the pending request is detected to carry the processing identifier, an unprocessed request is retrieved from the cache, the unprocessed request including the data acquisition request and the unprocessed pending request; The obtained unprocessed requests are concatenated to obtain concatenated data; The spliced ​​data is encrypted using a second encryption kit to obtain encrypted data.

8. A data processing apparatus, characterized in that, The device includes: The processing module is used to respond to data acquisition requests from business modules and call the original communication module; The judgment module is used to determine the data transmission method corresponding to the data acquisition request when the original communication module is detected to be invoked. A communication module is used to encrypt the data acquisition request using a first encryption suite through the original communication module when the data acquisition request does not correspond to the target data transmission mode, and then send the encrypted data acquisition request to the server through the original data transmission channel; wherein, the first encryption suite corresponds to the original data transmission channel, the first encryption suite is generated by agreement between the original communication module and the server, and the original data transmission channel is a dedicated data transmission channel created between the original communication module and the server. The processing module is further configured to send the data acquisition request to the target communication module when the data acquisition request corresponds to the target data transmission method; The communication module is further configured to encrypt the data acquisition request using a second encryption suite through the target communication module, and send the encrypted data acquisition request to the server through the target data transmission channel; wherein, the second encryption suite corresponds to the target data transmission channel, the second encryption suite is generated by agreement between the target communication module and the server, and the target data transmission channel is a dedicated data transmission channel created between the target communication module and the server.

9. A computer device, characterized in that, include: The processor, the communication interface, and the storage device are interconnected, wherein the storage device stores executable program code, and the processor is used to call the executable program code to implement the data processing method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that are executed by a processor to implement the data processing method as described in any one of claims 1-7.

11. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, are used to implement the data processing method as described in any one of claims 1-7.

Images