A method, device, electronic device and medium for secure data transmission

Abstract

The present application provides a data security transmission method, device, electronic device and medium, the method generates a target credit inquiry request for a target user of a target application; encrypts the target credit inquiry request based on the public key of a first encryption pair, signs the target credit inquiry request based on the private key of a second encryption pair, and sends the encrypted and signed target credit inquiry request to a credit platform; the credit platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair, determines the target credit data of the target user, and encrypts based on the public key of a third encryption pair, and sends the encrypted target credit data to the inquiry platform; the inquiry platform receives the encrypted target credit data decrypted based on the private key of the third encryption pair, and obtains the target credit data of the target user of the target application, thereby realizing automatic acquisition and secure transmission of user credit data.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and more specifically, to a data security transmission method, device, electronic device and medium. Background Art

[0002] Some companies can provide financial services (such as lending services and leasing services) to corporate users, but before providing financial services, the companies need to obtain the credit information of corporate users, and then provide financial services to corporate users based on the credit information.

[0003] That is to say, in the business of many enterprises (for example, automobile enterprises or financial institutions), there may be a demand involved, that is, obtaining the credit of enterprise users, and then providing loan services for enterprise users. In the existing technology, enterprise users are required to go to financial institutions to apply for relevant certificates, which takes a lot of time for enterprise users, and the relevant credit data obtained by enterprise users may not be consistent with what the enterprise needs. The whole process is complicated and inefficient, and cannot meet the needs of enterprises. Therefore, enterprises are in urgent need of a method that can safely and quickly obtain user credit data. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a data security transmission method, device, electronic device and medium, which can enable an enterprise to automatically obtain the credit data of a user when there is a user whose credit behavior needs to be checked, and the entire process is more secure by implementing double-layer encryption.

[0005] An embodiment of the present application provides a method for secure data transmission, the method comprising:

[0006] The query platform of the target enterprise responds to the query operation of the target user of the target application and generates a target credit query request for the target user of the target application;

[0007] Encrypting the target credit inquiry request based on the public key of the first encryption pair, signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, and sending the encrypted and signed target credit inquiry request to the credit inquiry platform;

[0008] After receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request;

[0009] Determine the target credit data of the target user based on the decrypted and designed target credit query request, encrypt the target credit data based on the public key of the third encryption pair to obtain the encrypted target credit data, and send the encrypted target credit data to the query platform;

[0010] The query platform receives the encrypted target credit data, and decrypts the encrypted target credit data based on the private key of the third encryption pair to obtain the target credit data of the target user of the target application.

[0011] In some embodiments, in the data security transmission method, the target credit inquiry request includes a message header, target user information, and a target character string for uniquely identifying the target credit inquiry request;

[0012] Encrypting the target credit inquiry request based on the public key of the first encryption pair, and signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, including:

[0013] Encrypting the target user information in the credit inquiry request based on the public key of the first encryption certificate to obtain encrypted target user information;

[0014] Signing the target character string in the credit inquiry request based on the private key of the second encryption pair to obtain a signature value;

[0015] The message header, the encrypted target user information and the signature value are combined to obtain an encrypted and signed target credit inquiry request.

[0016] In some embodiments, in the data security transmission method, the message header includes a target enterprise identifier, a target application identifier, a serial number of a first encryption pair, a serial number of a second encryption pair, and a serial number of a third encryption pair;

[0017] The target enterprise identifier is used to enable the credit reporting platform to determine the encrypted pair information corresponding to the target enterprise;

[0018] The target application identifier is used to enable the credit reporting platform to determine the encryption pair information corresponding to the target application identifier from the encryption pair information of the target enterprise;

[0019] The serial number of the first encryption pair, the serial number of the second encryption pair, and the serial number of the third encryption pair are used to enable the credit reporting platform to respectively determine the private key of the first encryption pair, the public key of the second encryption pair, and the public key of the third encryption pair from the encryption pair information corresponding to the target application identifier.

[0020] In some embodiments, in the data security transmission method, after receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request; including:

[0021] After receiving the encrypted and signed target credit inquiry request, the credit inquiry platform determines the private key of the first encryption pair and the public key of the second encryption pair based on the unencrypted message header in the credit inquiry request;

[0022] The encrypted target user information in the encrypted and signed target credit inquiry request is decrypted based on the private key of the first encryption pair, and the signature value in the encrypted and signed target credit inquiry request is decrypted based on the public key of the second encryption pair to obtain the decrypted and designed target credit inquiry request.

[0023] In some embodiments, in the data security transmission method, determining the target credit data of the target user based on the decrypted and designed target credit query request includes:

[0024] Based on the target credit inquiry request, determine the type of credit information data required by the target application of the target enterprise's inquiry platform;

[0025] The target credit data of the target user is determined based on the credit data type required by the target application of the target enterprise's query platform and the target user information in the decrypted and designed target credit query request.

[0026] In some embodiments, in the data security transmission method, based on the type of credit data required by the target application of the query platform of the target enterprise and the target user information in the decrypted and designed target credit query request, determining the target credit data of the target user includes:

[0027] Based on the credit data type required by the target application of the target enterprise's query platform, find the original credit data of each credit data type of the target user;

[0028] Based on pre-configured data mapping rules for different types of credit information data, the original credit information data is mapped to target credit information data.

[0029] In some embodiments, the data security transmission method further includes:

[0030] When the first encryption pair and / or the third encryption pair meets the preset update condition, the credit reporting platform issues a new first encryption pair and / or third encryption pair;

[0031] The preset update conditions include: receiving a query platform response from the target enterprise in response to the issuance request for the target application, and the remaining term of the first encryption pair and / or the third encryption pair is lower than a preset term threshold.

[0032] In some embodiments, a data security transmission device is also provided, the device comprising:

[0033] A generation module, used to enable the query platform of the target enterprise to respond to the query operation of the target user of the target application, and generate a target credit inquiry request for the target user of the target application;

[0034] a first encryption module, configured to encrypt the target credit inquiry request based on the public key of the first encryption pair, sign the target credit inquiry request based on the private key of the second encryption pair, obtain the encrypted and signed target credit inquiry request, and send the encrypted and signed target credit inquiry request to the credit inquiry platform;

[0035] A first decryption module is used to enable the credit investigation platform to decrypt and de-sign the encrypted and signed target credit investigation query request based on the private key of the first encryption pair and the public key of the second encryption pair after receiving the encrypted and signed target credit investigation query request, so as to obtain the decrypted and de-signed target credit investigation query request;

[0036] A second encryption module is used to determine the target credit data of the target user based on the decrypted and designed target credit inquiry request, encrypt the target credit data based on the public key of the third encryption pair, obtain the encrypted target credit data, and send the encrypted target credit data to the inquiry platform;

[0037] The second decryption module is used to decrypt the encrypted target credit data based on the private key of the third encryption pair after the query platform receives the encrypted target credit data, so as to obtain the target credit data of the target user of the target application.

[0038] In some embodiments, an electronic device is also provided, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the data security transmission method are performed.

[0039] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data security transmission method are executed.

[0040] In an embodiment of the present application, a data security transmission method, device, electronic device and medium are provided. The credit platform of the data security transmission method provides a first encryption pair and a third encryption pair for the enterprise, and the enterprise has its own second encryption pair. When the enterprise needs to check the credit data of the target user enterprise user of the target application, it generates a target credit query request for the target user of the target application, and encrypts the target credit query request based on the first encryption pair. At the same time, the enterprise signs the target credit query request based on its own second encryption pair, and then sends the encrypted and signed target credit query request to the credit platform. The credit platform completes decryption and business response processing based on the first encryption pair and the second encryption pair, obtains the target credit data of the target user of the target application through query, and returns the encrypted target credit data to the enterprise based on the third set of encryption pairs. The whole process realizes double-layer encryption and is safer, and the enterprise can automatically obtain the target credit data of the target user of the target application, so that the target credit data obtained by the enterprise is consistent with the credit data required by the target application of the enterprise. The credit acquisition process is simple and efficient, meeting the needs of enterprise customers. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A flow chart of the data security transmission method according to an embodiment of the present application is shown;

[0043] Figure 2 The interactive schematic diagram of the data security transmission method described in this embodiment is shown;

[0044] Figure 3 A flow chart of a method for obtaining an encrypted and signed target credit inquiry request according to an embodiment of the present application is shown;

[0045] Figure 4 A schematic diagram of the structure of the data security transmission device according to an embodiment of the present application is shown;

[0046] Figure 5 A schematic structural diagram of an electronic device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0047] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0048] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0049] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0050] Some companies can provide financial services (such as lending services and leasing services) to corporate users, but before providing financial services, the companies need to obtain the credit information of corporate users, and then provide financial services to corporate users based on the credit information.

[0051] That is to say, in the business of many enterprises (for example, automobile enterprises or financial institutions), there may be a demand involved, that is, obtaining the credit of enterprise users, and then providing loan services for enterprise users. In the existing technology, enterprise users are required to go to financial institutions to apply for relevant certificates, which takes a lot of time for enterprise users, and the relevant credit data obtained by enterprise users may not be consistent with what the enterprise needs. The whole process is complicated and inefficient, and cannot meet the needs of enterprises. Therefore, enterprises are in urgent need of a method that can safely and quickly obtain user credit data.

[0052] Based on this, in an embodiment of the present application, a data security transmission method, device, electronic device and medium are provided. The credit platform of the data security transmission method provides the enterprise with a first encryption pair and a third encryption pair, and the enterprise has its own second encryption pair. When the enterprise needs to check the credit data of the target user enterprise user of the target application, it generates a target credit query request for the target user of the target application, and encrypts the target credit query request based on the first encryption pair. At the same time, the enterprise signs the target credit query request based on its own second encryption pair, and then sends the encrypted and signed target credit query request to the credit platform. The credit platform completes decryption and business response processing based on the first encryption pair and the second encryption pair, obtains the target credit data of the target user of the target application by query, and returns the encrypted target credit data to the enterprise based on the third set of encryption pairs. The whole process realizes double-layer encryption and is safer, and the enterprise can automatically obtain the target credit data of the target user of the target application, so that the target credit data obtained by the enterprise is consistent with the credit data required by the target application of the enterprise. The credit acquisition process is simple and efficient, meeting the needs of enterprise customers.

[0053] For example, if the enterprise is a car company, then the enterprise users are car buyers; if the enterprise is a financial institution, then the enterprise users are lenders and mortgagors; if the enterprise is a leasing company, then the enterprise users are lessees, for example, those who rent cars or computers.

[0054] Please refer to Figure 1 , Figure 1 A flow chart of the data security transmission method described in the embodiment of the present application is shown; Figure 1 As shown, the method includes the following steps S101-S105:

[0055] S101, the query platform of the target enterprise responds to the query operation of the target user of the target application and generates a target credit query request for the target user of the target application;

[0056] S102, encrypting the target credit inquiry request based on the public key of the first encryption pair, signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, and sending the encrypted and signed target credit inquiry request to the credit inquiry platform;

[0057] S103, after receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request;

[0058] S104, determining the target credit data of the target user based on the decrypted and designed target credit inquiry request, encrypting the target credit data based on the public key of the third encryption pair to obtain the encrypted target credit data, and sending the encrypted target credit data to the inquiry platform;

[0059] S105. The query platform receives the encrypted target credit data, and decrypts the encrypted target credit data based on the private key of the third encryption pair to obtain the target credit data of the target user of the target application.

[0060] In the embodiment of the present application, the first encryption pair and the third encryption pair are generated by the credit reporting platform and sent to the query platform; the second encryption pair is generated by the query platform.

[0061] Here, the first encryption pair may also be referred to as a first encryption certificate, the third encryption pair may also be referred to as a third encryption certificate, and the second encryption pair may also be referred to as a second signature certificate.

[0062] The query platform may be an enterprise server of the target enterprise, and the credit reporting platform may be a credit reporting data server of a credit reporting agency for providing credit reporting data.

[0063] Please refer to Figure 2 , Figure 2 An interactive schematic diagram of the data security transmission method described in the embodiment is shown; Figure 2 Three sets of encryption pairs are shown in the figure, each set of encryption pairs is a pair of certificates, and each pair of certificates includes a public key and a private key. Specifically, it includes a first encryption certificate (public key and private key), a second signature certificate (public key and private key), and a third encryption certificate (public key and private key); wherein, the first encryption certificate and the third encryption certificate are generated by the credit reporting platform and then provided to the query platform (i.e., the enterprise side). Generally speaking, all query platforms that call the interface service of the credit reporting platform can use the same set of encryption certificates. The credit reporting platform side also pre-generates an institutional encryption certificate and provides it to the query agency. In the embodiment of the present application, the encryption certificates (first encryption pair and third encryption pair) provided by the credit reporting platform side to different query platforms are different. The purpose is to use different encryption pairs for encryption when feeding back credit data to each query platform to ensure the security of the data returned to each query agency. The query platform side pre-generates a second signature certificate.

[0064] Based on the above three sets of encryption certificates (encryption pairs), the entire credit data transmission involves multiple nodes, including key storage nodes, query platforms, and credit platforms. The key storage node is used to store the first encryption certificate (public key and private key) and the third encryption certificate (public key and private key) provided by the credit platform, as well as the second signature certificate (public key and private key) generated by the query platform.

[0065] In step S101, the query platform of the target enterprise responds to the query operation of the target user of the target application and generates a target credit query request for the target user.

[0066] Here, the target enterprise may be enterprise A, enterprise B, or enterprise C. The query platform of the target enterprise, namely the enterprise server, may provide the enterprise with a series of functions and services to meet the operation and management needs of the enterprise.

[0067] An application usually refers to a software program installed on a user's device (such as a smartphone, tablet, computer, etc.) to perform specific tasks or provide specific services. Applications usually have a user interface so that users can easily interact with them and complete the required operations.

[0068] In actual usage, application is usually abbreviated as App.

[0069] The target enterprise can have one application or multiple applications; different applications can be designed for different business scenarios and user needs. For example, a financial institution can have loan and mortgage apps.

[0070] In different business scenarios, target companies have different needs for user data. Therefore, in the loan business, banks or financial institutions will pay special attention to the user's repayment ability, credit history and debt situation. These credit data help them accurately assess the borrower's credit risk, thereby deciding whether to issue a loan and the loan amount, interest rate and other conditions. In the leasing business, leasing companies may focus more on understanding the user's credit history, overdue situation and payment habits. These credit data help them determine whether the tenant can pay the rent on time and reduce leasing risks.

[0071] Therefore, different applications require different types of user credit data.

[0072] Based on this, the target credit inquiry request of the present application can characterize the target application of the target enterprise for which the request is directed, so that the credit inquiry platform can determine the type of credit information data required by the target application of the query platform of the target enterprise based on the target credit inquiry request.

[0073] Specifically, in the data security transmission method described in the embodiment of the present application, the target credit inquiry request includes a message header, target user information, and a target character string for uniquely identifying the target credit inquiry request.

[0074] The target credit inquiry request, i.e., the input parameter, includes a message header rqstHead, and a data body rqstBody, which is a data body including target user information. The secure transmission method described in the embodiment of the present application does not encrypt the message header during transmission, implements plain text transmission, and encrypts the data body so that the data body is transmitted in cipher text, which simplifies the processing flow and can also ensure the security of data transmission.

[0075] Specifically, the rqstBody (message body) should organize the request message body object according to the description of the target application request parameters to represent the target user information; illustratively, the content of the request message body object is as follows: product identifier "prod_cd":"pdCreditScore"; query type "qry_rsn":"0", target enterprise code "occ_orgn":"9111****MA01YFE587"; target user ID number "cert_no":"110****2012250098"; "cert_type":"0"; target user name "cert_name":"Zhang San"; target user mobile phone number "mobile":"138****0000".

[0076] Then, the request message body object is serialized into a JSON string to obtain the original text of the request message body, thereby obtaining the target credit inquiry request.

[0077] In step S102, the target credit inquiry request is encrypted based on the public key of the first encryption pair, and the target credit inquiry request is signed based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, and the encrypted and signed target credit inquiry request is sent to the credit platform.

[0078] When a user needs to make a credit inquiry through the target application, the query platform generates a target credit inquiry request for the user and encrypts the target credit inquiry request using the public key of the first encryption pair; at the same time, the query platform also uses the private key of the second encryption pair (second signature certificate) to sign the "target string" in the query request to obtain a signature value.

[0079] Please refer to Figure 3 , Figure 3 The flowchart of the method for obtaining the encrypted and signed target credit inquiry request according to the embodiment of the present application is shown; specifically, the target credit inquiry request is encrypted based on the public key of the first encryption pair, and the target credit inquiry request is signed based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, including the following steps S301-S303:

[0080] S301, encrypting the target user information in the credit inquiry request based on the public key of the first encryption certificate to obtain the encrypted target user information;

[0081] S302: Sign the target character string in the credit inquiry request based on the private key of the second encryption pair to obtain a signature value;

[0082] S303: Combine the message header, the encrypted target user information and the signature value to obtain an encrypted and signed target credit inquiry request.

[0083] The target string in the credit inquiry request is signed based on the private key of the second encryption pair to obtain a signature value; the signature value generated by the query platform based on the private key signature is equivalent to the characteristic identifier of the machine, that is, the name can be the same, but this characteristic identifier must be able to distinguish the target application of the query platform. When signing specifically, an original text (target string) is required, and then the original text is signed to be effective.

[0084] Exemplarily, the target string may be: $rqst_id+$rqst_tm+$app key+$orgn sgn sn+$orgn encrp sn+$pd_encrp sn+$rqstBodyJSONStr.

[0085] That is, the target string can be: target enterprise identifier + target application identifier + encryption pair timestamp + serial number of the first encryption pair + serial number of the second encryption pair + serial number of the third encryption pair + target user identifier; $rqst_id is the target enterprise identifier; $rqst_tm is the encryption pair timestamp; $app key is the target application identifier; $orgn sgn sn is the first encryption pair serial number; $orgn encrp sn is the second encryption pair serial number; $pd_encrp sn is the serial number of the third encryption pair, and $rqstBodyJSONStr is the target user identifier.

[0086] In step S103, after receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request.

[0087] After receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts the private key (i.e., the Pudao encryption certificate private key), queries the private key of the first encryption pair, and decrypts the encrypted and signed target credit inquiry request based on the private key of the first encryption pair. At the same time, it obtains the public key of the second encryption pair and further decrypts the decrypted target credit inquiry request.

[0088] It can be seen that since the credit reporting platform is aimed at multiple enterprises and multiple apps, it is necessary to query the first encryption pair, the second encryption pair and the third encryption pair used by the target application of the target enterprise.

[0089] The unencrypted message header in the embodiment of the present application can simplify the query process.

[0090] Specifically, the message header includes a target enterprise identifier, a target application identifier, a serial number of a first encryption pair, a serial number of a second encryption pair, and a serial number of a third encryption pair;

[0091] The target enterprise identifier is used to enable the credit reporting platform to determine the encrypted pair information corresponding to the target enterprise;

[0092] The target application identifier is used to enable the credit reporting platform to determine the encryption pair information corresponding to the target application identifier from the encryption pair information of the target enterprise;

[0093] The serial number of the first encryption pair, the serial number of the second encryption pair, and the serial number of the third encryption pair are used to enable the credit reporting platform to respectively determine the private key of the first encryption pair, the public key of the second encryption pair, and the public key of the third encryption pair from the encryption pair information corresponding to the target application identifier.

[0094] That is, after receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request; including:

[0095] After receiving the encrypted and signed target credit inquiry request, the credit inquiry platform determines the private key of the first encryption pair and the public key of the second encryption pair based on the unencrypted message header in the credit inquiry request;

[0096] The encrypted target user information in the encrypted and signed target credit inquiry request is decrypted based on the private key of the first encryption pair, and the signature value in the encrypted and signed target credit inquiry request is decrypted based on the public key of the second encryption pair to obtain the decrypted and designed target credit inquiry request.

[0097] It should be noted that the message header also includes a timestamp, which represents the expiration date of the first encryption pair and the third encryption pair sent from the credit reporting platform to the query platform.

[0098] That is to say, the data security transmission method described in the embodiment of the present application also includes:

[0099] After receiving the encrypted and signed target credit inquiry request, the credit investigation platform determines whether the first encryption pair and the third encryption pair thereof are expired based on the message header;

[0100] If it is expired, the encrypted and signed target credit inquiry request will be returned to the inquiry platform.

[0101] That is to say, based on the unencrypted message header, it is possible to determine whether the first encryption pair and the third encryption pair are expired before decryption, thereby simplifying the processing flow.

[0102] The message header rqstHead specifically includes: id unified serial number (target enterprise identifier, that is, the unique identifier of the query platform given by the credit reporting platform to the target enterprise), tm timestamp, APPkey (the unique identifier given by the credit reporting platform to the target application, that is, the target application identifier), and three sns (the serial number of the first encryption pair, the serial number of the second encryption pair, and the serial number of the third encryption pair).

[0103] Exemplarily, the message header rqstHead includes:

[0104] ID unified serial number "rqst_id":"20211104000000000001"; TM timestamp "rqst_tm":"20211104200100"; target application identifier "app_key":"xkaf_012", serial number of the first encryption pair "orgn_sgn_sn":"6991623be9cc460886e9afc09f746e08"; serial number of the second encryption pair "orgn_encrp_sn":"7991623be9cc460886e9afc09f746e09"; serial number of the third encryption pair "pd_encrp_sn":"8991623be9cc460886e9afc09f746e0a".

[0105] The serial number is attached to the two public keys of the encryption certificates issued by the credit reporting platform (the private key has no serial number). The first one is the serial number of the public key of the second signature certificate when the query platform signs, the second one is the serial number of the public key of the third encryption certificate when the credit reporting platform encrypts, and the last one is the serial number of the public key of the first encryption certificate used for encryption by the query platform.

[0106] In step S104, the target credit data of the target user is determined based on the decrypted and designed target credit query request, and the target credit data is encrypted based on the public key of the third encryption pair to obtain the encrypted target credit data, and the encrypted target credit data is sent to the query platform.

[0107] That is to say, the input parameters after decryption and designature of the response target credit query request are processed, and the response result is constructed to obtain the output parameters. Then, the output parameters are encrypted using the public key of the third encryption pair to obtain the encrypted response data, and the encrypted response data is returned to the query platform.

[0108] Specifically, in the embodiment of the present application, in the data security transmission method, determining the target credit data of the target user based on the decrypted and designed target credit query request includes:

[0109] Based on the target credit inquiry request, determine the type of credit information data required by the target application of the target enterprise's inquiry platform;

[0110] The target credit data of the target user is determined based on the credit data type required by the target application of the target enterprise's query platform and the target user information in the decrypted and designed target credit query request.

[0111] Different applications require different types of credit data. Therefore, the data transmission method described in the embodiment of the present application can determine the credit data required for the target application of the query platform of the target enterprise according to the target credit query request, thereby preventing the situation where the credit information obtained by the enterprise user may not be consistent with the needs of the enterprise. The entire process is automated and efficient.

[0112] In an embodiment of the present application, based on the target credit inquiry request, the type of credit information data required for the target application of the query platform of the target enterprise is determined. Specifically, according to the message header including the target enterprise identifier and the target application identifier, the type of credit information data that matches the target enterprise identifier and the target application identifier is determined.

[0113] Exemplarily, a mapping relationship among a target enterprise identifier, a target application identifier, and a list of credit information data types is preconfigured to determine the credit information data type that matches the target enterprise identifier and the target application identifier.

[0114] Based on the type of credit data required by the target application of the target enterprise's query platform and the target user information in the target credit query request after decryption and designature, the target credit data of the target user is determined, that is, the credit data of the target user information is found from the credit data of this type.

[0115] Sometimes, the original credit data obtained by the credit reporting platform does not meet the requirements of the query platform. For example, some query platforms hope to add an APP logo or a credit reporting platform logo to the credit data. The data type of the original credit data obtained by the credit reporting platform is type A, but the query platform requires type B data.

[0116] Based on this, in the embodiment of the present application, based on the type of credit data required by the target application of the query platform of the target enterprise and the target user information in the target credit query request after decryption and designature, the target credit data of the target user is determined, including:

[0117] Based on the credit data type required by the target application of the target enterprise's query platform, find the original credit data of each credit data type of the target user;

[0118] Based on pre-configured data mapping rules for different types of credit information data, the original credit information data is mapped to target credit information data.

[0119] That is to say, in the data transmission method described in the embodiment of the present application, the data mapping rules between the input parameters and the output parameters are pre-defined to realize the automatic data conversion function, which can quickly adapt the data, improve the response speed, and meet user needs.

[0120] In step S105, the query platform receives the encrypted target credit data, and decrypts the encrypted target credit data based on the private key of the third encryption pair to obtain the target credit data of the target user of the target application.

[0121] That is to say, the query platform performs decryption based on the private key of the third encryption pair to obtain the target credit data of the target user of the target application, so that the query can conduct credit investigation on the enterprise user.

[0122] Since the first encryption pair and the third encryption pair of the present application are issued by the credit reporting platform and have a time limit, in order to prevent the expiration of the first encryption pair and the third encryption pair from affecting the credit reporting of enterprise-to-enterprise users, a certificate smooth upgrade strategy is implemented in the embodiment of the present application.

[0123] Specifically, the data security transmission method described in the embodiment of the present application also includes:

[0124] When the first encryption pair and / or the third encryption pair meets the preset update condition, the credit reporting platform issues a new first encryption pair and / or third encryption pair;

[0125] The preset update conditions include: receiving a query platform response from the target enterprise in response to the issuance request for the target application, and the remaining term of the first encryption pair and / or the third encryption pair is lower than a preset term threshold.

[0126] When the target enterprise's query platform sends a request to the credit reporting platform to issue a new encryption pair for a target application, the credit reporting platform will respond to the request and issue a new encryption pair. This mechanism allows enterprises to proactively update encryption pairs when needed to adapt to business changes or changes in security requirements.

[0127] Encryption pairs usually have a certain validity period, after which the encryption pair may no longer be safe or reliable. Therefore, the credit reporting platform will set a preset validity threshold. When the remaining validity period of the first or third encryption pair is lower than this threshold, the credit reporting platform will automatically issue a new encryption pair to ensure the secure transmission and storage of data.

[0128] The preset deadline threshold, for example, may be one month before the expiration of the encryption pair.

[0129] In other words, when issuing certificates, the credit reporting platform supports multiple sets of certificates for a certain application; before the certificate expires, the credit reporting platform will issue a new encryption certificate, and the customer can switch between multiple sets of certificates independently; at the same time, because the certificate serial number is passed in plain text in the input parameter of the credit query request, the customer can switch the certificate serial number independently.

[0130] Based on the same inventive concept, a data security transmission device corresponding to the data security transmission method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned data security transmission method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0131] Please refer to Figure 4 , Figure 4 The structure diagram of the data security transmission device according to the embodiment of the present application is shown; specifically, the device includes:

[0132] A generating module 401 is used to enable the query platform of the target enterprise to respond to the query operation of the target user of the target application, and generate a target credit query request for the target user of the target application;

[0133] The first encryption module 402 is used to encrypt the target credit inquiry request based on the public key of the first encryption pair, sign the target credit inquiry request based on the private key of the second encryption pair, obtain the encrypted and signed target credit inquiry request, and send the encrypted and signed target credit inquiry request to the credit inquiry platform;

[0134] The first decryption module 403 is used to enable the credit platform to decrypt and de-sign the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair after receiving the encrypted and signed target credit inquiry request, so as to obtain the decrypted and de-signed target credit inquiry request;

[0135] The second encryption module 404 is used to determine the target credit data of the target user based on the decrypted and designed target credit inquiry request, encrypt the target credit data based on the public key of the third encryption pair, obtain the encrypted target credit data, and send the encrypted target credit data to the inquiry platform;

[0136] The second decryption module 405 is used to decrypt the encrypted target credit data based on the private key of the third encryption pair after the query platform receives the encrypted target credit data, so as to obtain the target credit data of the target user of the target application.

[0137] In some embodiments, in the data security transmission device, the target credit inquiry request includes a message header, target user information, and a target character string for uniquely identifying the target credit inquiry request;

[0138] The first encryption module, when encrypting the target credit inquiry request based on the public key of the first encryption pair and signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, is specifically used to:

[0139] Encrypting the target user information in the credit inquiry request based on the public key of the first encryption certificate to obtain encrypted target user information;

[0140] Signing the target character string in the credit inquiry request based on the private key of the second encryption pair to obtain a signature value;

[0141] The message header, the encrypted target user information and the signature value are combined to obtain an encrypted and signed target credit inquiry request.

[0142] In some embodiments, in the data security transmission device, the message header includes a target enterprise identifier, a target application identifier, a serial number of a first encryption pair, a serial number of a second encryption pair, and a serial number of a third encryption pair;

[0143] The target enterprise identifier is used to enable the credit reporting platform to determine the encrypted pair information corresponding to the target enterprise;

[0144] The target application identifier is used to enable the credit reporting platform to determine the encryption pair information corresponding to the target application identifier from the encryption pair information of the target enterprise;

[0145] The serial number of the first encryption pair, the serial number of the second encryption pair, and the serial number of the third encryption pair are used to enable the credit reporting platform to respectively determine the private key of the first encryption pair, the public key of the second encryption pair, and the public key of the third encryption pair from the encryption pair information corresponding to the target application identifier.

[0146] In some embodiments, in the data security transmission device, the first decryption module, after the credit platform receives the encrypted and signed target credit inquiry request, decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request, is specifically used to:

[0147] After receiving the encrypted and signed target credit inquiry request, the credit inquiry platform determines the private key of the first encryption pair and the public key of the second encryption pair based on the unencrypted message header in the credit inquiry request;

[0148] The encrypted target user information in the encrypted and signed target credit inquiry request is decrypted based on the private key of the first encryption pair, and the signature value in the encrypted and signed target credit inquiry request is decrypted based on the public key of the second encryption pair to obtain the decrypted and designed target credit inquiry request.

[0149] In some embodiments, in the data security transmission device, the determination module, when determining the target credit data of the target user based on the decrypted and designed target credit inquiry request, is specifically used to:

[0150] Based on the target credit inquiry request, determine the type of credit information data required by the target application of the target enterprise's inquiry platform;

[0151] The target credit data of the target user is determined based on the credit data type required by the target application of the target enterprise's query platform and the target user information in the decrypted and designed target credit query request.

[0152] In some embodiments, in the data security transmission device, the determination module, when determining the target credit data of the target user based on the type of credit data required by the target application of the query platform of the target enterprise and the target user information in the decrypted and designed target credit query request, is specifically used to:

[0153] Based on the credit data type required by the target application of the target enterprise's query platform, find the original credit data of each credit data type of the target user;

[0154] Based on pre-configured data mapping rules for different types of credit information data, the original credit information data is mapped to target credit information data.

[0155] In some embodiments, the data security transmission device further includes:

[0156] An updating module, configured to cause the credit reporting platform to issue a new first encryption pair and / or third encryption pair when the first encryption pair and / or the third encryption pair meet a preset updating condition;

[0157] The preset update conditions include: receiving a query platform response from the target enterprise in response to the issuance request for the target application, and the remaining term of the first encryption pair and / or the third encryption pair is lower than a preset term threshold.

[0158] Based on the same inventive concept, an electronic device corresponding to the data security transmission method is also provided in the embodiment of the present application. Since the principle of solving the problem by the electronic device in the embodiment of the present application is similar to the above-mentioned data security transmission method in the embodiment of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0159] Please refer to Figure 5 , Figure 5 A schematic diagram of the structure of the electronic device described in an embodiment of the present application is shown; specifically, the electronic device 500 includes: a processor 502, a memory 501 and a bus, the memory 501 stores machine-readable instructions executable by the processor 502, when the electronic device 500 is running, the processor 502 communicates with the memory 501 through the bus, and when the machine-readable instructions are executed by the processor 502, the steps of the data security transmission method are executed.

[0160] Based on the same inventive concept, a computer-readable storage medium corresponding to the data security transmission method is also provided in the embodiment of the present application. Since the principle of solving the problem by the computer-readable storage medium in the embodiment of the present application is similar to the above-mentioned data security transmission method in the embodiment of the present application, the implementation of the computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0161] A computer-readable storage medium stores a computer program, which executes the steps of the data security transmission method when executed by a processor.

[0162] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0163] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0164] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0165] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0166] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data security transmission method, characterized in that: The method comprises: The query platform of the target enterprise responds to the query operation of the target user of the target application and generates a target credit query request for the target user of the target application; Encrypting the target credit inquiry request based on the public key of the first encryption pair, signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, and sending the encrypted and signed target credit inquiry request to the credit inquiry platform; After receiving the encrypted and signed target credit inquiry request, the credit investigation platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request; Determine the target credit data of the target user based on the decrypted and designed target credit query request, encrypt the target credit data based on the public key of the third encryption pair to obtain the encrypted target credit data, and send the encrypted target credit data to the query platform; The query platform receives the encrypted target credit data, and decrypts the encrypted target credit data based on the private key of the third encryption pair to obtain the target credit data of the target user of the target application; The step of determining the target credit data of the target user based on the decrypted and designed target credit inquiry request includes: Based on the target credit inquiry request, determine the type of credit information data required by the target application of the target enterprise's inquiry platform; Based on the credit data type required by the target application of the target enterprise's query platform, find the original credit data of each credit data type of the target user; Based on pre-configured data mapping rules for different types of credit information data, the original credit information data is mapped to target credit information data.

2. The data security transmission method according to claim 1, characterized in that: The target credit inquiry request includes a message header, target user information, and a target character string for uniquely identifying the target credit inquiry request; Encrypting the target credit inquiry request based on the public key of the first encryption pair, and signing the target credit inquiry request based on the private key of the second encryption pair to obtain the encrypted and signed target credit inquiry request, including: Encrypting the target user information in the credit inquiry request based on the public key of the first encryption certificate to obtain encrypted target user information; Signing the target character string in the credit inquiry request based on the private key of the second encryption pair to obtain a signature value; The message header, the encrypted target user information and the signature value are combined to obtain an encrypted and signed target credit inquiry request.

3. The data security transmission method according to claim 2, characterized in that: The message header includes a target enterprise identifier, a target application identifier, a serial number of a first encryption pair, a serial number of a second encryption pair, and a serial number of a third encryption pair; The target enterprise identifier is used to enable the credit reporting platform to determine the encrypted pair information corresponding to the target enterprise; The target application identifier is used to enable the credit reporting platform to determine the encryption pair information corresponding to the target application identifier from the encryption pair information of the target enterprise; The serial number of the first encryption pair, the serial number of the second encryption pair, and the serial number of the third encryption pair are used to enable the credit reporting platform to respectively determine the private key of the first encryption pair, the public key of the second encryption pair, and the public key of the third encryption pair from the encryption pair information corresponding to the target application identifier.

4. The data security transmission method according to claim 2 or 3, characterized in that: After receiving the encrypted and signed target credit inquiry request, the credit inquiry platform decrypts and de-signs the encrypted and signed target credit inquiry request based on the private key of the first encryption pair and the public key of the second encryption pair to obtain the decrypted and de-signed target credit inquiry request; including: After receiving the encrypted and signed target credit inquiry request, the credit inquiry platform determines the private key of the first encryption pair and the public key of the second encryption pair based on the unencrypted message header in the credit inquiry request; The encrypted target user information in the encrypted and signed target credit inquiry request is decrypted based on the private key of the first encryption pair, and the signature value in the encrypted and signed target credit inquiry request is decrypted based on the public key of the second encryption pair to obtain the decrypted and designed target credit inquiry request.

5. The data security transmission method according to claim 1, characterized in that: The method further comprises: When the first encryption pair and / or the third encryption pair meets the preset update condition, the credit reporting platform issues a new first encryption pair and / or third encryption pair; The preset update conditions include: receiving a query platform response from the target enterprise in response to the issuance request for the target application, and the remaining term of the first encryption pair and / or the third encryption pair is lower than a preset term threshold.

6. A data security transmission device, characterized in that: The device comprises: A generation module, used to enable the query platform of the target enterprise to respond to the query operation of the target user of the target application, and generate a target credit inquiry request for the target user of the target application; a first encryption module, configured to encrypt the target credit inquiry request based on the public key of the first encryption pair, sign the target credit inquiry request based on the private key of the second encryption pair, obtain the encrypted and signed target credit inquiry request, and send the encrypted and signed target credit inquiry request to the credit inquiry platform; A first decryption module is used to enable the credit investigation platform to decrypt and de-sign the encrypted and signed target credit investigation query request based on the private key of the first encryption pair and the public key of the second encryption pair after receiving the encrypted and signed target credit investigation query request, so as to obtain the decrypted and de-signed target credit investigation query request; A second encryption module is used to determine the target credit data of the target user based on the decrypted and designed target credit inquiry request, encrypt the target credit data based on the public key of the third encryption pair, obtain the encrypted target credit data, and send the encrypted target credit data to the inquiry platform; A second decryption module is used to decrypt the encrypted target credit data based on the private key of the third encryption pair after the query platform receives the encrypted target credit data, so as to obtain the target credit data of the target user of the target application; The step of determining the target credit data of the target user based on the decrypted and designed target credit inquiry request includes: Based on the target credit inquiry request, determine the type of credit information data required by the target application of the target enterprise's inquiry platform; Based on the credit data type required by the target application of the target enterprise's query platform, find the original credit data of each credit data type of the target user; Based on pre-configured data mapping rules for different types of credit information data, the original credit information data is mapped to target credit information data.

7. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the data security transmission method as described in any one of claims 1 to 5 are performed.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data security transmission method as described in any one of claims 1 to 5 are executed.

Images