Data encryption method, device and equipment applied to front-end interface and medium

Abstract

The present disclosure provides a data encryption method and device applied to a front-end interface, equipment, a medium and a program product, relating to the technical field of information security. The method comprises: receiving a calling request sent by a first front-end application; obtaining a first key corresponding to the first front-end application; the front-end interface communicates with a plurality of front-end applications including the first front-end application, wherein the keys corresponding to different front-end applications in the plurality of front-end applications are different; encrypting target data requested by the calling request by using the first key to obtain first encrypted data; and sending the first encrypted data to the first front-end application.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of information security and communication technology, which can be applied to the financial field or other fields, and in particular to a data encryption method applied to a front-end interface, a device, equipment and a medium. BACKGROUND

[0002] The front-end interface serves as a bridge for data transmission between different systems and carries a large amount of sensitive information. However, the traditional plaintext data transmission method has certain risks and is vulnerable to various network attacks such as man-in-the-middle attacks, data tampering, etc. and has high costs. Some tools in the related art can encrypt data in the front-end interface to avoid the risk of plaintext data transmission, in which the data is encrypted according to a preset encryption method (for example, Base64 encryption, MD5 encryption or SHA-1 encryption) and then transmitted.

[0003] The inventors found that the existing scheme of encrypting data in the front-end interface before transmission has certain vulnerabilities in the process of implementing the present scheme concept. The main manifestation is that the encryption method is pre-set, so the ciphertext obtained for the same data is consistent regardless of who requests data from the front-end interface. The potential risk brought by this is that when a front-end interface can be called by multiple front-end applications, a front-end application can infer the data received by another front-end application through the ciphertext received by itself, for example, when the ciphertext received by the A front-end application is consistent with the ciphertext received by the B front-end application as monitored by the A front-end application, the A front-end application can know the data received by the B front-end application. This means that the logic of the front-end application communicating with the front-end interface is at risk of being leaked or cracked. SUMMARY

[0004] Therefore, the present disclosure provides a data encryption method applied to a front-end interface, a device, equipment, a medium and a program product, which can at least partially solve the above problems.

[0005] In a first aspect, the present disclosure provides a data encryption method applied to a front-end interface. The method comprises: receiving a calling request sent by a first front-end application; obtaining a first key corresponding to the first front-end application; wherein the front-end interface communicates with a plurality of front-end applications including the first front-end application, wherein the keys corresponding to different front-end applications in the plurality of front-end applications are different; encrypting target data requested by the calling request using the first key to obtain first encrypted data; and sending the first encrypted data to the first front-end application.

[0006] According to an embodiment of the present disclosure, the first key is a shared key generated by the first front-end application and the front-end interface through a key exchange protocol.

[0007] According to an embodiment of the present disclosure, when the first key comprises a new key and an old key, the encrypting the target data requested by the calling request by using the first key to obtain first encrypted data comprises: encrypting the target data by using the new key to obtain new encrypted data; and encrypting the target data by using the old key to obtain old encrypted data; wherein the first encrypted data comprises the new encrypted data and the old encrypted data; and the new key is generated later than the old key.

[0008] According to an embodiment of the present disclosure, after the sending, to the first front-end application, of the first encrypted data, the method further comprises: receiving decryption feedback information of the new encrypted data from the first front-end application; and deleting the old key when the decryption feedback information indicates that the first front-end application successfully decrypts the new encrypted data.

[0009] According to an embodiment of the present disclosure, the data structure and the encryption configuration information are pre-encapsulated in a calling method of the front-end interface; and the encrypting the target data requested by the calling request by using the first key to obtain first encrypted data comprises: inputting the first key and the target data into the calling method of the front-end interface; assembling the target data according to the data structure to generate target structured data; and encrypting the target structured data according to the encryption configuration information, with the first key as an encryption key in the encryption configuration information, to obtain the first encrypted data.

[0010] According to an embodiment of the present disclosure, the encryption configuration information comprises at least one encryption field in the data structure and an encryption algorithm applicable to each encryption field.

[0011] According to an embodiment of the present disclosure, the data structure and the encryption configuration information encapsulated in the calling method of the front-end interface are updated through version control.

[0012] A second aspect of an embodiment of the present disclosure provides a data encryption apparatus applied to a front-end interface. The apparatus comprises: a receiving module, a key obtaining module, an encryption module, and a transmission module.

[0013] The receiving module is configured to receive a calling request sent by a first front-end application.

[0014] The key obtaining module is configured to obtain a first key corresponding to the first front-end application, wherein the front-end interface communicates with a plurality of front-end applications including the first front-end application, and different front-end applications in the plurality of front-end applications correspond to different keys.

[0015] The encryption module is configured to encrypt target data requested by the calling request by using the first key to obtain first encrypted data.

[0016] The transmission module is configured to transmit the first encrypted data to the first front-end application.

[0017] According to an embodiment of the present disclosure, the apparatus further includes a key generation module. The key generation module is configured to generate a shared key with the first front-end application through a key exchange protocol to obtain the first key.

[0018] According to an embodiment of the present disclosure, the key generation module is further configured to periodically or aperiodically generate a shared key with the first front-end application through the key exchange protocol. The encryption module is further configured to, when the first key includes a new key and an old key, encrypt the target data by using the new key to obtain new encrypted data, and encrypt the target data by using the old key to obtain old encrypted data, wherein the first encrypted data includes the new encrypted data and the old encrypted data, and wherein the time of the new key is later than that of the old key.

[0019] According to an embodiment of the present disclosure, the apparatus further includes a key update module. The key update module is configured to, after the transmission of the first encrypted data to the first front-end application, receive decryption feedback information of the new encrypted data from the first front-end application, and delete the old key from the first key when the decryption feedback information indicates that the first front-end application successfully decrypts the new encrypted data.

[0020] According to an embodiment of the present disclosure, the encryption module is further configured to: pass the first key and the target data into a calling method of the front-end interface, wherein the calling method of the front-end interface is pre-encapsulated with a data structure and encryption configuration information; assemble the target data according to the data structure to generate target structured data; and encrypt the target structured data according to the encryption configuration information with the first key as an encryption key in the encryption configuration information to obtain the first encrypted data.

[0021] According to an embodiment of the present disclosure, the encryption configuration information includes at least one encryption field in the data structure and an encryption algorithm applicable to each encryption field.

[0022] According to an embodiment of the present disclosure, the apparatus further includes a version update module. The version update module is configured to update the data structure and the encryption configuration information encapsulated in the calling method of the front-end interface in a version control manner.

[0023] In a third aspect, an electronic device is provided. The electronic device includes one or more processors and memory. The memory is configured to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the above method.

[0024] In a fourth aspect, the present disclosure provides a computer-readable storage medium having stored thereon computer programs or instructions, wherein the computer programs or instructions, when executed by a processor, implement the steps of the above method.

[0025] In a fifth aspect, the present disclosure provides a computer program product comprising computer programs or instructions, wherein the computer programs or instructions, when executed by a processor, implement the steps of the above method.

[0026] The one or more embodiments described above can have the following advantages or benefits: When different front-end applications call the front-end interface to obtain data, the data will be encrypted using the key corresponding to each front-end application, and then transmitted to the front-end application. In this way, the front-end interface will use different keys for data encryption according to different front-end applications, thereby greatly reducing or even avoiding the risk that the transmitted data will be leaked when the front-end application transmits data in plaintext or uses a unified encryption coding method for data encryption. BRIEF DESCRIPTION OF DRAWINGS

[0027] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0028] Figure 1 The application scenario of the data encryption method, device, equipment, medium and program product of the present disclosure applied to the front-end interface is schematically shown;

[0029] Figure 2 The flowchart of the data encryption method of the present disclosure applied to the front-end interface is schematically shown;

[0030] Figure 3 The flowchart of the management of the key corresponding to the front-end application in the present disclosure is schematically shown;

[0031] Figure 4 The flowchart of the data encryption method of the present disclosure applied to the front-end interface is schematically shown;

[0032] Figure 5 The flowchart of the encryption of the target data in the data encryption method of the present disclosure applied to the front-end interface is schematically shown;

[0033] Figure 6 The block diagram of the data encryption device of the present disclosure applied to the front-end interface is schematically shown; and

[0034] Figure 7A structural block diagram of an electronic device to which a data encryption method applied to a front-end interface according to an embodiment of the disclosure is schematically illustrated. DETAILED DESCRIPTION

[0035] Hereinafter, embodiments of the disclosure will be described with reference to the accompanying drawings. However, it is to be understood that these descriptions are merely exemplary and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. However, it will be apparent to one skilled in the art that the embodiments can be practiced without these specific details. In other instances, well-known structures and techniques have been omitted in order to avoid obscuring the concepts of the disclosure.

[0036] The terms used herein are merely used to describe specific embodiments and are not intended to limit the disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0037] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the specification, and should not be interpreted in an idealized or overly formal manner.

[0038] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should be generally interpreted as including one or more of the items enumerated in the list (e.g., "a system having at least one of A, B, and C" should include, but not be limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.).

[0039] Figure 1 A scenario in which the data encryption method, apparatus, device, medium, and program product applied to a front-end interface according to an embodiment of the disclosure are applied is schematically illustrated.

[0040] As Figure 1 shown, the scenario 100 according to the embodiment can include at least one terminal device (three are shown in the figure, terminal devices 101, 102, and 103), a network 104, and a server 105. The network 104 is a medium to provide a communication link between the terminal devices 101, 102, and 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0041] A user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. A browser application can be installed on the terminal devices 101, 102, 103. The user can open a front-end application, such as an online shopping website, a bank website, a news information website, a social media platform, etc. through the browser application in the terminal devices 101, 102, 103.

[0042] The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0043] The server 105 can be a server providing various services, for example, a background management server supporting a website browsed by a user using the terminal devices 101, 102, 103 (only as an example). The background management server can analyze and process received user requests, etc. and feed back the processing results (for example, a webpage, information, or data, etc. obtained or generated according to the user request) to the terminal device. One or more front-end interfaces can be deployed in the server 105. The front-end interface refers to a back-end service API interacting with a front-end application. One front-end interface can be called by one or more front-end applications to obtain data or submit data.

[0044] It should be noted that the data encryption method applied to the front-end interface provided by the embodiments of the present disclosure can generally be executed by the server 105. Correspondingly, the data encryption apparatus, device, medium and program product applied to the front-end interface provided by the embodiments of the present disclosure can generally be arranged in the server 105. The data encryption method applied to the front-end interface provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal devices 101, 102, 103 and / or the server 105. Correspondingly, the data encryption apparatus, device, medium and program product applied to the front-end interface provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the terminal devices 101, 102, 103 and / or the server 105.

[0045] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above description is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks and servers.

[0046] Figure 2 The flowchart of the data encryption method applied to the front-end interface of an embodiment of the present disclosure is schematically shown.

[0047] As Figure 2As shown, the data encryption method applied to the front-end interface can include operation S201 to operation S204.

[0048] In operation S201, a call request sent by a first front-end application is received.

[0049] In operation S202, a first key corresponding to the first front-end application is obtained. The front-end interface communicates with a plurality of front-end applications including the first front-end application, wherein the keys corresponding to different front-end applications in the plurality of front-end applications are different. The first front-end application is any one of the plurality of front-end applications that communicate with the front-end interface.

[0050] In operation S203, the target data requested by the call request is encrypted using the first key to obtain first encrypted data.

[0051] In operation S204, the first encrypted data is sent to the first front-end application.

[0052] In the embodiments of the present disclosure, when different front-end applications call the front-end interface to obtain data, the keys corresponding to each front-end application are used to encrypt the data, and then the data is transmitted to the front-end application. In this way, the front-end interface uses different keys for data encryption according to different front-end applications, thereby greatly reducing or even avoiding the risk of data leakage caused by transmitting data in plaintext or using a unified encryption coding method for data encryption.

[0053] Figure 3 The flowchart of managing the keys corresponding to the front-end applications in an embodiment of the present disclosure is schematically shown.

[0054] In the embodiments of the present disclosure, since different front-end applications use different keys for encrypted communication with the front-end interface, key management is crucial. As shown, Figure 3 As shown, the management of the keys involves key generation, key distribution, key use, and updating of the keys, etc. A good key management scheme can effectively improve the security and robustness of the system, and can prevent data leakage when different front-end applications call the front-end interface.

[0055] In one embodiment, each front-end application can generate a corresponding shared key with the front-end interface through a key exchange protocol. The first key is a shared key generated by the first front-end application and the front-end interface through a key exchange protocol.

[0056] The steps of a key exchange protocol can vary depending on the different protocols, and a general key exchange protocol includes the following steps. 1) Initialization phase: both parties select or agree on a set of public parameters, such as a prime number pp and a base gg in the Diffie-Hellman protocol, or elliptic curve parameters in ECDH. 2) Key generation phase: each communication party independently generates its own private key. The private key is usually a large random number and must be kept secret. 3) Public key exchange phase: each communication party uses its private key and public parameters to calculate the corresponding public key, and then the communication parties exchange public keys, but these public keys can be seen by a third party. 4) Shared key calculation phase: each communication party uses the other party's public key and its own private key to calculate the shared key through some mathematical operation. This process is designed so that even if a third party knows the public key and the public parameters, it cannot derive the shared key. 5) Key verification phase: to ensure that the key exchange has not been tampered with, the communication parties can send additional messages to verify the consistency and correctness of the shared key. 6) Use of shared key: once the shared key is calculated and verified (if necessary), it can be used to encrypt and decrypt subsequent communications.

[0057] The Diffie-Hellman key exchange protocol can be used in the embodiments of the present disclosure to negotiate and distribute the shared key. The Diffie-Hellman key exchange protocol is a method of establishing a key, which needs to be combined with other encryption algorithms, and the purpose is to allow both parties to negotiate a key without revealing the key to facilitate subsequent data encryption and decryption.

[0058] In one embodiment, the Diffie-Hellman key exchange protocol can be combined with the Elliptic Curve Cryptography (ECC) asymmetric encryption algorithm, where the front-end application and the front-end interface can generate their own public keys and private keys according to the ECC asymmetric encryption algorithm in the above key generation phase, where the private key is kept by itself, and the public key is disclosed in the above 3) public key exchange phase. The transmission or disclosure of the public key is an important step. If the public key is tampered with or forged, it may compromise the security of encrypted data. A secure communication channel can be used to deliver the public key, such as a TLS / SSL encrypted network communication or physical medium transmission

[0059] The ECC asymmetric encryption algorithm uses different encryption keys and decryption keys, and it is computationally infeasible to derive the decryption key from the known encryption key. Its mathematical basis is the computational difficulty of elliptic discrete logarithm on the Abel additive group formed by rational points on an elliptic curve. Its main advantage is that it uses smaller keys and can provide the same or higher level of security compared to other methods such as the RSA encryption algorithm. At the same time, it is superior to many algorithms such as the RSA algorithm and the DSA algorithm in terms of encryption and decryption speed, and has smaller storage space and lower bandwidth requirements.

[0060] As can be seen, the front-end interface and the front-end application communicating therewith can negotiate a shared key known only to the communication parties through the key interaction protocol, so that one front-end interface can use the public key provided by different front-end applications to obtain different keys for different front-end applications, so that the encrypted data obtained by the front-end interface based on the same target data when communicating with different front-end applications is not the same, and a third party cannot infer the actual meaning from the intercepted or intercepted encrypted data, thereby reducing the risk of data leakage during data transmission of the front-end interface.

[0061] According to embodiments of the present disclosure, the key corresponding to each front-end application can be updated periodically or triggered by an event (such as triggered by a request from a front-end application). The update of the key is also a key to improve data security. When updating the key, the smooth transition of the new key and the old key should be ensured to ensure the continuity and stability of the system. For this, please refer to the embodiment shown in Figure 4 .

[0062] Figure 4 A flowchart of a data encryption method applied to a front-end interface according to another embodiment of the present disclosure is schematically shown.

[0063] As Figure 4 shown, according to this embodiment, the data encryption method applied to the front-end interface can include operation S201, operation S202, operation S301~operation S304, operation S204, and operation S305~operation S306.

[0064] In operation S201, a call request sent by a first front-end application is received.

[0065] In operation S202, a first key corresponding to the first front-end application is obtained.

[0066] Next, in operation S301, it is detected that the obtained first key includes a new key and an old key, wherein the generation time of the new key is later than that of the old key.

[0067] In one embodiment, both the new key and the old key are generated by the first front-end application and the front-end interface through the key interaction protocol. For example, after the old key is used for a period of time, the first front-end application can generate a new key with the front-end interface through the key interaction protocol.

[0068] Then, in operation S302, the target data is encrypted with the new key to obtain new encrypted data.

[0069] And in operation S303, the target data is encrypted with the old key to obtain old encrypted data.

[0070] Then, in operation S304, the new encrypted data and the old encrypted data are combined to obtain first encrypted data. For example, the new encrypted data and the old encrypted data are respectively labeled and then packaged together.

[0071] Next, in operation S204, the first encrypted data is sent to the first front-end application.

[0072] In this way, when the key is updated, in order to ensure the smooth transition of the new key and the old key, there can be a period of dual-key operation during which the data is encrypted and then transmitted using the new key and the old key respectively. In this way, the problem that the first front-end application cannot decrypt data if the first front-end application has not yet synchronized to generate a new key is avoided.

[0073] Next, in operation S305, decryption feedback information of the first front-end application on the new encrypted data is received. For example, when the first encrypted data is sent to the first front-end application, an instruction requiring feedback of decryption or the above decryption feedback information can be sent to the first front-end application at the same time. In this way, the first front-end application can feed back the decryption of the first encrypted data (or the above decryption feedback information) to the front-end interface.

[0074] In operation S306, when the decryption feedback information indicates that the first front-end application successfully decrypts the new encrypted data, the old key is deleted from the first key. When the first front-end application successfully decrypts the new encrypted data, it means that the new key in the first front-end application has taken effect, and at this time the old key can be deleted. In this way, in the next period of time, the first front-end application and the front-end interface can only use the above new key for encrypted communication.

[0075] In this way, the embodiments of the present disclosure can ensure the smooth transition of the new key and the old key and the continuity and stability of communication through a transition period of dual-key operation when each front-end application corresponds to key update.

[0076] According to some other embodiments of the present disclosure, before the first encrypted data is sent to the first front-end application in operation S204, a Hash-based Message Authentication Code (HMAC) algorithm can also be used to generate a digital signature based on the public key of the first front-end application, and then sent to the first front-end application together to ensure the integrity and authenticity of the data. The first front-end application can use a private key to verify the validity of the signature to ensure that the data is not tampered with during transmission. The HMAC algorithm is a hash function-based message authentication code algorithm that uses a key and a hash function to generate a fixed-length authentication code for a message to ensure data integrity and accuracy.

[0077] Figure 5 A flowchart of operation S203 in the data encryption method applied to the front-end interface according to an embodiment of the present disclosure is schematically shown.

[0078] As shown in Figure 5 According to this embodiment, operation S203 can include operations S51-S53.

[0079] In operation S51, the first key and the target data are passed into the calling method of the front-end interface. The calling method of the front-end interface is pre-encapsulated with data structure and encryption configuration information.

[0080] Next, in operation S52, the target data is assembled according to the data structure to generate target structured data.

[0081] In operation S53, the target structured data is encrypted according to the encryption configuration information with the first key as the encryption key in the encryption configuration information to obtain the first encrypted data.

[0082] By pre-encapsulating the data structure and the encryption configuration information in the calling method of the front-end interface, the target data requested by the front-end application can be processed into structured data, which can help better understand the data meaning and support cross-language data exchange and communication. When encapsulating, the structured file defining the data structure should be determined before compilation, and combined with the encryption process at compile time, which can reduce the time cost of encryption and transmission when calling the front-end interface. Moreover, by encapsulating the encryption process in the calling interface method, the coding cost, compilation cost, and running time can be avoided. Moreover, by selecting the data structure in the calling method code of the front-end interface and encrypting the specific data passed in, the coding cost of the developer can be reduced while achieving encryption without feeling.

[0083] An example of the encryption configuration information is as follows:

[0084] user:{

[0085] username:{

[0086] rule: ‘required’, / / whether it is required

[0087] type: ‘string’, / / data type

[0088] encrypted: true / / whether it is encrypted

[0089] }

[0090] password:{

[0091] rule: ‘required’,

[0092] type: ‘string’,

[0093] encrypted: true

[0094] }

[0095] age: {

[0096] rule: ‘required’,

[0097] type: ‘number’,

[0098] encrypted: false

[0099] }

[0100] }

[0101] As can be seen from the example, the encryption configuration information can include at least one encryption field in the data structure and an encryption algorithm applicable to each encryption field, wherein the fields with encrypted as true in the above example are encryption fields. In some embodiments, an encryption encode method or a decryption decode method for each encryption field can also be created to facilitate calling in code writing for encryption and decryption.

[0102] In this way, when the target structured data is encrypted according to the encryption configuration information using the first key, the data fields to be encrypted and the encryption algorithms of different fields can be flexibly controlled, the flexible selection of whether to encrypt and the encryption manner of the data in different fields of the requested data can be realized, compared with the manner of encrypting all data in the target data, the amount of encrypted data can be reduced, and the transmission cost will be reduced. Moreover, the first encrypted data after decryption of the target structured data can maintain the same data structure, so that the encrypted data can be very concise and compact.

[0103] Further, the data structure and the encryption configuration information can be defined in a structured file and can be updated through version control of a version control system, so that the overall update efficiency of data encryption can be effectively improved. Moreover, after the data structure and the encryption configuration information encapsulated in the calling method of the front-end interface are updated through version control, the front-end application can be conveniently notified to update synchronously according to the content of the version update, so as to facilitate the update and synchronization of the encryption or decryption mode between the front-end interface and the front-end application. It can be seen that the structured file supports version control, which facilitates modification of the data format in different versions, and at the same time, it can reduce the additional consumption caused by encryption and can serve as a document of the front-end and back-end data and interfaces, thereby improving the transmission and communication efficiency.

[0104] Figure 6 A block diagram of a data encryption apparatus applied to a front-end interface according to an embodiment of the present disclosure is schematically shown.

[0105] As shown in Figure 6 According to the data encryption apparatus 700 of the embodiment, the data encryption apparatus 700 can include a receiving module 710, a key obtaining module 720, an encryption module 730, a transmission module 740, a key generating module 750, a key updating module 760, and a version updating module 770.

[0106] The receiving module 710 is configured to receive a calling request sent by a first front-end application.

[0107] The key obtaining module 720 is configured to obtain a first key corresponding to the first front-end application, wherein the front-end interface communicates with a plurality of front-end applications including the first front-end application, and different front-end applications in the plurality of front-end applications correspond to different keys.

[0108] The encryption module 730 is configured to encrypt target data requested by the calling request by using the first key to obtain first encrypted data.

[0109] The transmission module 740 is configured to send the first encrypted data to the first front-end application.

[0110] The key generating module 750 is configured to generate a shared key with the first front-end application through a key exchange protocol to obtain the first key.

[0111] In one embodiment, the key generating module 750 is further configured to periodically or aperiodically generate a shared key with the first front-end application through a key exchange protocol. Correspondingly, the encryption module 730 is further configured to, when the first key includes a new key and an old key, encrypt the target data by using the new key to obtain new encrypted data, and encrypt the target data by using the old key to obtain old encrypted data, wherein the first encrypted data includes the new encrypted data and the old encrypted data, and the time of the new key is later than that of the old key.

[0112] The key update module 760 is configured to: after sending the first encrypted data to the first front-end application, receive decryption feedback information of the new encrypted data from the first front-end application, and delete the old key from the first key when the decryption feedback information indicates that the first front-end application successfully decrypts the new encrypted data.

[0113] In some embodiments, the encryption module 730 is further configured to: pass the first key and the target data into a calling method of the front-end interface, wherein the calling method of the front-end interface is pre-encapsulated with a data structure and encryption configuration information; assemble the target data according to the data structure to generate target structured data; and encrypt the target structured data according to the encryption configuration information with the first key as the encryption key in the encryption configuration information to obtain the first encrypted data. The encryption configuration information can include at least one encryption field in the data structure and an encryption algorithm applicable to each encryption field.

[0114] The version update module 770 is configured to update the data structure and the encryption configuration information encapsulated in the calling method of the front-end interface in a version-controlled manner.

[0115] The apparatus 700 can perform the method for encrypting data applied to a front-end interface as described above with reference to the accompanying drawings. Figures 2-5 The method for encrypting data applied to a front-end interface as described above can be referred to the foregoing description, which will not be repeated here.

[0116] According to embodiments of this disclosure, any multiple modules among the receiving module 710, key acquisition module 720, encryption module 730, transmission module 740, key generation module 750, key update module 760, and version update module 770 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the receiving module 710, key acquisition module 720, encryption module 730, transmission module 740, key generation module 750, key update module 760, and version update module 770 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), programmable logic array (PLA), system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the receiving module 710, key acquisition module 720, encryption module 730, transmission module 740, key generation module 750, key update module 760, and version update module 770 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0117] Figure 7 The diagram schematically illustrates a structural block diagram of an electronic device suitable for implementing the data encryption method applied to a front-end interface according to embodiments of the present disclosure.

[0118] like Figure 7 As shown, an electronic device 800 according to an embodiment of this disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0119] In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other via the bus 804. The processor 801 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 802 and / or the RAM 803. It should be noted that the programs can also be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0120] According to an embodiment of the present disclosure, the electronic device 800 can further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 can further include one or more of the following components connected to the I / O interface 805: an input part 806 including a keyboard, a mouse, etc.; an output part 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 808 including a hard disk, etc.; and a communication part 809 including a network interface card such as a LAN card, a modem, etc. The communication part 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as necessary. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 810 as necessary, so that a computer program read out therefrom is installed in the storage part 808 as necessary.

[0121] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0122] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In this disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include the ROM 802 and / or the RAM 803 described above and / or one or more memory other than the ROM 802 and the RAM 803.

[0123] Embodiments of the present disclosure also include a computer program product that includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the methods provided by the embodiments of the present disclosure.

[0124] The above-described functions defined in the system / device / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. According to an embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0125] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal on a network medium and installed and executed through the communication part 809 and / or installed from the detachable medium 811. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0126] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809 and / or installed from the detachable medium 811. When the computer program is executed by the processor 801, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0127] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0128] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0129] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0130] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A data encryption method applied to a front-end interface, wherein, The method comprises: receiving a call request sent by a first front-end application; obtaining a first key corresponding to the first front-end application; wherein the front-end interface communicates with a plurality of front-end applications including the first front-end application, wherein the keys corresponding to different front-end applications in the plurality of front-end applications are different; encrypting target data requested by the call request by using the first key to obtain first encrypted data, comprising: when the first key comprises a new key and an old key, encrypting the target data by using the new key to obtain new encrypted data, and encrypting the target data by using the old key to obtain old encrypted data, wherein the first encrypted data comprises the new encrypted data and the old encrypted data, and the generation time of the new key is later than that of the old key; and sending the first encrypted data to the first front-end application.

2. The method of claim 1, wherein, The first key is a shared key generated by the first front-end application and the front-end interface through a key exchange protocol.

3. The method of claim 1, wherein, After the first encrypted data is sent to the first front-end application, the method further comprises: receiving decryption feedback information of the new encrypted data by the first front-end application; when the decryption feedback information represents that the first front-end application successfully decrypts the new encrypted data, deleting the old key from the first key.

4. The method of claim 1, wherein, The data structure and encryption configuration information are pre-encapsulated in the call method of the front-end interface; the encryption of the target data requested by the call request by using the first key to obtain the first encrypted data comprises: passing the first key and the target data into the call method of the front-end interface; assembling the target data according to the data structure to generate target structured data; using the first key as the encryption key in the encryption configuration information, and encrypting the target structured data according to the encryption configuration information to obtain the first encrypted data.

5. The method of claim 4, wherein, The encryption configuration information comprises at least one encryption field in the data structure and an encryption algorithm applicable to each encryption field.

6. The method of claim 4, wherein, The data structure and encryption configuration information encapsulated in the call method of the front-end interface are updated through version control.

7. A data encryption device applied to a front-end interface, wherein, The apparatus comprises: a receiving module configured to receive a call request sent by a first front-end application; a key obtaining module configured to obtain a first key corresponding to the first front-end application; wherein the front-end interface communicates with a plurality of front-end applications including the first front-end application, wherein the keys corresponding to different front-end applications in the plurality of front-end applications are different; an encryption module configured to encrypt target data requested by the call request by using the first key to obtain first encrypted data; wherein the encryption module is specifically configured to: when the first key comprises a new key and an old key, encrypt the target data by using the new key to obtain new encrypted data, and encrypt the target data by using the old key to obtain old encrypted data, wherein the first encrypted data comprises the new encrypted data and the old encrypted data, and the generation time of the new key is later than that of the old key; a transmission module configured to send the first encrypted data to the first front-end application.

8. An electronic device comprising: one or more processors; memory storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method of any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program or instructions, wherein, The computer program or instructions, when executed by a processor, implement the steps of the method of any one of claims 1-6.

10. A computer program product comprising computer programs or instructions, wherein, The computer program or instructions, when executed by a processor, implement the steps of the method of any one of claims 1-6.

Images