Certificate-based data processing method and device, storage medium and electronic equipment

Abstract

The application discloses a kind of based on certificate data processing method, device, storage medium and electronic equipment.It relates to the field of financial technology or other related technical fields., Among them, the method comprises: obtaining the target certificate associated with target enterprise, wherein the target certificate includes: when the target enterprise is connected to the cloud interconnection service of financial institution through third-party platform, the certificate that the parameter generated by third-party platform is signed and encrypted;The target certificate is encrypted by encryption algorithm, and the first encrypted certificate is obtained, and the first encrypted certificate is uploaded to application server;After the first encrypted certificate is received by application server, the first encrypted certificate is stored to database server.The application solves the technical problem that the cloud interconnection service of financial institution is accessed by different saas platforms in the related art, and different saas platforms establish certificate hosting related services respectively to manage the certificate of enterprise, resulting in high resource waste rate.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology or other related technical fields, in particular, to a certificate-based data processing method and device, a storage medium and an electronic device. BACKGROUND

[0002] When an enterprise connects to cloud interconnection on a saas (Software as a Service, referred to as saas) platform, it needs to use the certificate issued by the financial institution enterprise bank to sign the business parameters, wherein each enterprise can correspond to a set of certificates.

[0003] In related technologies, different saas platforms need to sign a certificate hosting agreement for the enterprise and provide a whole hosting service. Since each saas platform needs to develop certificate hosting related services and needs to ensure the security of the certificate transmission and hosting process, there is a lot of repetitive labor and unnecessary cost in the certificate hosting process, resulting in resource waste.

[0004] At present, no effective solution has been proposed to solve the above problems. SUMMARY

[0005] The embodiments of the present application provide a certificate-based data processing method and device, a storage medium and an electronic device to at least solve the technical problem of high resource waste rate in related technologies when different saas platforms access cloud interconnection services of a financial institution, different saas platforms each establish certificate hosting related services to manage the certificates of enterprises.

[0006] According to an aspect of an embodiment of the present application, a certificate-based data processing method is provided, comprising: obtaining a target certificate associated with a target enterprise, wherein the target certificate includes a certificate used by the target enterprise to sign and encrypt parameters generated by a third-party platform when the target enterprise connects to cloud interconnection services of a financial institution through the third-party platform, and the third-party platform includes a platform that provides software operation services for the target enterprise when the target enterprise connects to the cloud interconnection services; encrypting the target certificate through an encryption algorithm to obtain a first encrypted certificate, and uploading the first encrypted certificate to an application server, wherein the application server is used to provide encryption services for parameters generated by different third-party platforms; after the application server receives the first encrypted certificate, storing the first encrypted certificate in a database server, wherein the database server is used to encrypt and store the target certificate used by different third-party platforms.

[0007] Further, the encryption algorithm comprises: a symmetric encryption algorithm, the target certificate is encrypted by the encryption algorithm to obtain a first encrypted certificate, comprising: obtaining a first identifier and a second identifier, wherein the first identifier is used to encrypt the target certificate, and the second identifier is used to prevent the target certificate from being tampered with; based on the first identifier and the second identifier, the target certificate is encrypted N times by the symmetric encryption algorithm to obtain the first encrypted certificate, wherein N is a positive integer greater than 1.

[0008] Further, based on the first identifier and the second identifier, the target certificate is encrypted N times by the symmetric encryption algorithm to obtain the first encrypted certificate, comprising: determining an original string composed of M parameters of the target certificate, wherein M is a positive integer; a first preset parameter is added to the original string to obtain a first string, and all parameters in the first string are sorted to obtain a second string, wherein the parameter value of the first preset parameter is the first identifier; the hash value of the second string is calculated, and based on the hash value and the second identifier, the second string is encrypted by the symmetric encryption algorithm to obtain a first encrypted string; the first encrypted string and the second identifier are spliced to obtain a second encrypted string; the second encrypted string is encrypted N-1 times to obtain a first encrypted result, and based on the first encrypted result, the first encrypted certificate is determined.

[0009] Further, based on the hash value and the second identifier, the second string is encrypted by the symmetric encryption algorithm to obtain a first encrypted string, comprising: the hash value is taken as the parameter value of a second preset parameter, and the second preset parameter is added to the second string to obtain a third string; the first preset parameter in the third string is removed to obtain a fourth string, and all parameters in the fourth string are sorted to obtain a fifth string; the fifth string is encrypted by the symmetric encryption algorithm to obtain the first encrypted string.

[0010] Further, the first encrypted certificate is stored in the database server, comprising: the first encrypted certificate is parsed to obtain a parsed first encrypted certificate; and the parsed first encrypted certificate is data-verified to obtain a verification result; in the case that the verification result indicates that the parsed first encrypted certificate passes the verification, the parsed first encrypted certificate is encrypted by the encryption algorithm to obtain a second encrypted certificate, and the second encrypted certificate is stored in the database server.

[0011] Further, after storing the second encryption certificate to the database server, the method further comprises: receiving a parameter encryption request sent by the third-party platform, reading the second encryption certificate stored in the database server, wherein the parameter encryption request is used to request to encrypt a business parameter generated by the third-party platform when the target enterprise connects the cloud interconnection service of the financial institution through different third-party platforms; decrypting the second encryption certificate to obtain the target certificate, and encrypting the business parameter based on the target certificate to obtain a second encryption result, and returning the second encryption result to the third-party platform.

[0012] Further, after returning the second encryption result to the third-party platform, the method further comprises: sending a service request to the cloud interconnection service based on the second encryption result, and receiving response information returned by the cloud interconnection service, wherein the type of the service request includes at least one of the following: an information query request, a financial service request.

[0013] According to another aspect of the embodiments of the present application, a certificate-based data processing platform is also provided, which is used to execute any one of the certificate-based data processing methods. The certificate-based data processing platform comprises: a front end configured to obtain a target certificate associated with a target enterprise, encrypt the target certificate through an encryption algorithm, and upload a first encryption certificate to an application server, wherein the target certificate includes a certificate used to sign and encrypt a parameter generated by a third-party platform when the target enterprise connects a cloud interconnection service of a financial institution through the third-party platform, the third-party platform includes a platform configured to provide software operation services for the target enterprise when the target enterprise connects the cloud interconnection service, a database server configured to encrypt and store the target certificate used by different third-party platforms, and an application server configured to store the first encryption certificate to the database server after receiving the first encryption certificate, and provide encryption services for parameters generated by different third-party platforms.

[0014] According to another aspect of the embodiments of the present application, a certificate-based data processing apparatus is further provided, comprising: an acquisition unit configured to acquire a target certificate associated with a target enterprise, wherein the target certificate comprises a certificate generated by the target enterprise when the target enterprise connects a cloud interconnection service of a financial institution through a third-party platform, and the target certificate is used to sign and encrypt a parameter generated by the third-party platform, and the third-party platform comprises a platform configured to provide software operation services for the target enterprise when the target enterprise connects the cloud interconnection service; a first processing unit configured to encrypt the target certificate through an encryption algorithm to obtain a first encrypted certificate, and upload the first encrypted certificate to an application server, wherein the application server is configured to provide encryption services for parameters generated by different third-party platforms; and a second processing unit configured to store the first encrypted certificate in a database server after the application server receives the first encrypted certificate, wherein the database server is configured to encrypt and store the target certificate required by different third-party platforms.

[0015] Further, the encryption algorithm comprises a symmetric encryption algorithm, and the first processing unit comprises: an acquisition subunit configured to acquire a first identifier and a second identifier, wherein the first identifier is used to encrypt the target certificate, and the second identifier is used to prevent the target certificate from being tampered with; and an encryption subunit configured to encrypt the target certificate N times through the symmetric encryption algorithm based on the first identifier and the second identifier to obtain the first encrypted certificate, wherein N is a positive integer greater than 1.

[0016] Further, the encryption subunit comprises: a determination module configured to determine an original string composed of M parameters of the target certificate, wherein M is a positive integer; a first processing module configured to add a first preset parameter to the string to obtain a first string, and sort all parameters in the first string to obtain a second string, wherein the parameter value of the first preset parameter is the first identifier; a second processing module configured to calculate a hash value of the second string, and encrypt the second string through the symmetric encryption algorithm based on the hash value and the second identifier to obtain a first encrypted string; a splicing module configured to splice the first encrypted string and the second identifier to obtain a second encrypted string; and a third processing module configured to encrypt the second encrypted string N-1 times to obtain a first encryption result, and determine the first encrypted certificate based on the first encryption result.

[0017] Further, the second processing module comprises: an adding submodule, configured to add the hash value as a parameter value of a second preset parameter, add the second preset parameter into the second string to obtain a third string; a processing submodule, configured to remove the first preset parameter in the third string to obtain a fourth string, and sort all parameters in the fourth string to obtain a fifth string; and an encryption submodule, configured to encrypt the fifth string by using the symmetric encryption algorithm to obtain the first encrypted string.

[0018] Further, the second processing unit comprises: an analyzing submodule, configured to analyze the first encrypted certificate to obtain an analyzed first encrypted certificate; a checking submodule, configured to check the analyzed first encrypted certificate to obtain a checking result; and a processing submodule, configured to, in a case where the checking result indicates that the analyzed first encrypted certificate passes the checking, encrypt the analyzed first encrypted certificate by using the encryption algorithm to obtain a second encrypted certificate, and store the second encrypted certificate into the database server.

[0019] Further, the certificate-based data processing apparatus further comprises: a receiving unit, configured to, after storing the second encrypted certificate into the database server, receive a parameter encryption request sent by the third-party platform, and read the second encrypted certificate stored in the database server, wherein the parameter encryption request is used to request to encrypt a business parameter generated by the third-party platform when the target enterprise connects the cloud interconnection service of the financial institution through different third-party platforms; and a third processing unit, configured to decrypt the second encrypted certificate to obtain the target certificate, and encrypt the business parameter based on the target certificate to obtain a second encryption result, and return the second encryption result to the third-party platform.

[0020] Further, the certificate-based data processing apparatus further comprises: a fourth processing unit, configured to, after returning the second encryption result to the third-party platform, send a service request to the cloud interconnection service based on the second encryption result, and receive response information returned by the cloud interconnection service, wherein the type of the service request comprises at least one of the following: an information query request, a financial service request.

[0021] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the certificate-based data processing method of any one of the above by executing the executable instructions.

[0022] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium storing a computer program, wherein the computer program controls a device where the computer-readable storage medium is located to perform any of the above certificate-based data processing methods when the computer program is run.

[0023] In the present application, a target certificate associated with a target enterprise is acquired, wherein the target certificate includes a certificate generated by a third-party platform when the target enterprise accesses a cloud interconnection service of a financial institution through the third-party platform, the third-party platform includes a platform providing software operation services for the target enterprise when the target enterprise accesses the cloud interconnection service, and the target certificate is used to sign and encrypt a parameter generated by the third-party platform; the target certificate is encrypted by using an encryption algorithm to obtain a first encrypted certificate, and the first encrypted certificate is uploaded to an application server, wherein the application server is used to provide encryption services for parameters generated by different third-party platforms; after the application server receives the first encrypted certificate, the first encrypted certificate is stored in a database server, wherein the database server is used to encrypt and store target certificates required by different third-party platforms.

[0024] In the present application, the certificates of the target enterprise accessing the cloud interconnection service of the financial institution through the third-party platform are uniformly encrypted and uploaded to the application server and stored in the database server, thereby avoiding the situation that each third-party saas service platform establishes a certificate hosting service in the related art, and the resource waste rate is high, thereby achieving the technical effect of reducing the resource waste rate of the certificate hosting service of the enterprise. BRIEF DESCRIPTION OF DRAWINGS

[0025] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0026] Figure 1 is a flowchart of an optional certificate-based data processing method according to an embodiment of the present application;

[0027] Figure 2 is a schematic diagram of an optional certificate-based data processing platform according to an embodiment of the present application;

[0028] Figure 3 is a processing flowchart of an optional certificate-based data processing platform according to an embodiment of the present application;

[0029] Figure 4is an optional certificate encryption flowchart according to an embodiment of the present application;

[0030] Figure 5 is an optional certificate-based data processing device schematic diagram according to an embodiment of the present application;

[0031] Figure 6 is an electronic device schematic diagram according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0034] It should be noted that the certificate-based data processing method, device, storage medium and electronic device in the present disclosure can be used in the case of managing the certificate of the cloud interconnection service connected by the enterprise through the third party platform in the field of financial technology, and can also be used in the case of managing the certificate of the parameter encryption in any field other than the field of financial technology. The application field of the certificate-based data processing method, device, storage medium and electronic device in the present disclosure is not limited.

[0035] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards in the relevant region, and provide corresponding operation portal for user to choose authorization or refusal.

[0036] For the convenience of describing the following part of the present application, some terms or names related to the embodiments of the present application are explained.

[0037] Cloud interconnection: refers to taking the digitalization of small and micro enterprise financial management as the goal, relying on the open bank channel of financial institutions, and meeting the needs of customers to complete information query, transfer payment, agent issuance and deduction, and supply chain finance through the direct connection of the third-party saas platform.

[0038] Certificate: refers to the public key, private key and identity certificate used for signing and identity verification of messages when the third-party saas platform is connected to the cloud interconnection.

[0039] Embodiment one

[0040] According to the embodiments of the present application, an optional certificate-based data processing method is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from here.

[0041] Figure 1 is a flowchart of an optional certificate-based data processing method according to the embodiments of the present application, as shown in Figure 1 The method comprises the following steps:

[0042] Step S101, obtaining a target certificate associated with a target enterprise, wherein the target certificate includes a certificate for signing and encrypting parameters generated by a third-party platform when the target enterprise connects to a cloud interconnection service of a financial institution through the third-party platform, and the third-party platform includes a platform that provides software operation services for the target enterprise when the target enterprise connects to the cloud interconnection service.

[0043] The above-mentioned third-party platform can include a third-party saas platform for providing services for enterprises to realize the connection between the enterprises and the cloud interconnection through the third-party platform, and complete information query, transfer payment, agent issuance and deduction, and supply chain finance. The above-mentioned target certificate can include a public key, a private key and an identity certificate used for signing and identity verification of messages when the third-party platform is connected to the cloud interconnection. In this embodiment, the target certificate can be issued to each enterprise through a designated system of a financial institution (for example, a financial institution enterprise online bank).

[0044] Step S102, encrypting the target certificate through an encryption algorithm to obtain a first encrypted certificate, and uploading the first encrypted certificate to an application server, wherein the application server is used to provide encryption services for parameters generated by different third-party platforms.

[0045] In order to avoid the situation that different third-party saas platforms establish hosting platforms to manage target certificates respectively, resulting in a high resource waste rate, in the present embodiment, the target certificates of all enterprises can be uniformly uploaded to the application server. When different third-party platforms need to call the target certificates to encrypt business parameters, different third-party platforms can send a request to the application server. In order to further improve the security of the certificate, the target certificate can also be encrypted by an encryption algorithm, and the first encrypted certificate obtained after encryption can be uploaded to the application server.

[0046] Step S103, after the application server receives the first encrypted certificate, the first encrypted certificate is stored in the database server, wherein the database server is used to encrypt and store the target certificates needed to be used by different third-party platforms.

[0047] After the application server receives the first encrypted certificate, the first encrypted certificate can be parsed to verify the first encrypted certificate. After verification, the parsed first encrypted certificate can also be encrypted, and the encrypted certificate can be stored in the database server to realize the storage of the target certificate.

[0048] Through the above steps, in the present embodiment, the certificates of the cloud interconnection service of the financial institution connected by the enterprise through the third-party platform are uniformly encrypted and uploaded to the application server and stored in the database server, avoiding the situation that each third-party saas service platform establishes a certificate hosting service in the related art, resulting in a high resource waste rate. Thus, the technical effect of reducing the resource waste rate of the certificate hosting service of the enterprise is achieved. Further, the technical problem of a high resource waste rate caused by the establishment of certificate hosting related services by different saas platforms to manage the certificates of the enterprise when accessing the cloud interconnection service of the financial institution through different saas platforms in the related art is solved.

[0049] Optionally, the encryption algorithm includes a symmetric encryption algorithm. The target certificate is encrypted by the encryption algorithm to obtain the first encrypted certificate, including: obtaining a first identifier and a second identifier, wherein the first identifier is used to encrypt the target certificate, and the second identifier is used to prevent the target certificate from being tampered with; based on the first identifier and the second identifier, the target certificate is encrypted N times by the symmetric encryption algorithm to obtain the first encrypted certificate, wherein N is a positive integer greater than 1.

[0050] The encryption algorithm includes a symmetric encryption algorithm, such as a block encryption algorithm sm4 algorithm, the first identifier can be a uuid (Universally Unique Identifier, for short, uuid, Universal Unique Identifier) used to encrypt the target certificate, and the second identifier can be a salt (salt value) used to prevent the target certificate from being tampered with.

[0051] In the embodiment, the uuid and the salt are stored in the distributed cache system, and a certain expiration time is set. The expiration needs to be regenerated and written into the distributed cache system. Each time the certificate is uploaded to the application server, the first identifier and the second identifier can be obtained from the application server by calling an interface, then the parameters (parameters of the target certificate) are preprocessed according to a certain rule (parameter sorting, md5 calculation, etc.), and the symmetric encryption algorithm is used to encrypt the json (a lightweight data exchange format) string obtained after preprocessing N times (preferably, N can be 2), to obtain the first encrypted certificate. The encryption key used in the encryption process can be a 128-bit uuid returned by the application server, which realizes the technical effect of improving the security of the target certificate upload.

[0052] Optionally, based on the first identifier and the second identifier, the target certificate is encrypted N times by using a symmetric encryption algorithm to obtain a first encrypted certificate, including: determining an original string composed of M parameters of the target certificate, wherein M is a positive integer; a first preset parameter is added to the original string to obtain a first string, and all parameters in the first string are sorted to obtain a second string, wherein the parameter value of the first preset parameter is the first identifier; a hash value of the second string is calculated, and based on the hash value and the second identifier, the second string is encrypted by using a symmetric encryption algorithm to obtain a first encrypted string; the first encrypted string and the second identifier are spliced to obtain a second encrypted string; the second encrypted string is encrypted N-1 times to obtain a first encryption result, and based on the first encryption result, the first encrypted certificate is determined.

[0053] Based on an optional certificate parameter, taking the encryption times as 2 times as an example, the encryption process of the target certificate is illustrated:

[0054] Step 1, the original parameters of the certificate (corresponding to the original string composed of M parameters of the target certificate) can be obtained as:

[0055] The expression `{“cer”:”xxx”,"pubKey":"640101200102250916","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","password”:”xxx”}` represents the key of each parameter, and the value of each parameter is after the colon.

[0056] Step 2: After adding "md5Key (corresponding to the first preset parameter)" to the original parameters, the first string is obtained. Then, the parameters in the first string can be sorted according to their keys (ascending order is used as an example) to obtain the second string. The value of "md5Key" is the "client secret key" (uuid) provided to the enterprise. The second string is:

[0057] {"cer":"xxx","md5Key":"xxx","password":"xxx","priKey":"2f59f7a02bc24e0a9bf3bd434a92 e7cb","pubKey":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb"}.

[0058] Step 3: Calculate the MD5 value (corresponding to the hash value) of the second string, process the second string based on the MD5 value to obtain the processed string, and encrypt the processed string using a symmetric encryption algorithm. The encryption key can be the "client key" (UUID) assigned to the enterprise to obtain the ciphertext encJsonStr (corresponding to the first encrypted string).

[0059] Step 4: Append the salt value (corresponding to the second identifier) ​​to the ciphertext encJsonStr to obtain the second encrypted string.

[0060] The second encrypted string is encrypted again using the same logic as steps 2 to 4 to obtain the final ciphertext string encStr (corresponding to the first encryption certificate). The first encryption result can be used as the first encryption certificate, thereby achieving the technical effect of improving the security of the certificate.

[0061] Optionally, based on the hash value and the second identifier, the second string is encrypted by using a symmetric encryption algorithm to obtain a first encrypted string, including: adding the hash value as a parameter value of a second preset parameter to the second string to obtain a third string; removing the first preset parameter in the third string to obtain a fourth string, and sorting all parameters in the fourth string to obtain a fifth string; and encrypting the fifth string by using the symmetric encryption algorithm to obtain the first encrypted string.

[0062] When the md5 value of the second string is calculated, it is placed after "sign" (corresponding to the second preset parameter) to obtain the following content (corresponding to the third string):

[0063] {“cer”:”xxx”,"md5Key":"xxx","password":"xxx","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","pubKey":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb","sign":"xxx"}.

[0064] After removing "md5Key" (corresponding to the first preset parameter) in the third string, a fourth string is obtained, and the parameters in the fourth string are sorted according to the key (for example, in ascending order) to obtain the following result (corresponding to the fifth string):

[0065] {“cer”:”xxx”,"password":"xxx","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","pubKey":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb","sign":"xxx"}.

[0066] The "client key" (uuid) assigned to the enterprise is used as an encryption key, and the fifth string is encrypted by using a symmetric encryption algorithm to obtain ciphertext encJsonStr (corresponding to the first encrypted string), thereby achieving the technical effect of improving the security of the certificate.

[0067] Optionally, the first encrypted certificate is stored to the database server, including: parsing the first encrypted certificate to obtain a parsed first encrypted certificate; and performing data verification on the parsed first encrypted certificate to obtain a verification result; in a case where the verification result indicates that the parsed first encrypted certificate passes the verification, using an encryption algorithm to encrypt the parsed first encrypted certificate to obtain a second encrypted certificate, and storing the second encrypted certificate to the database server.

[0068] In order to achieve unified management of the certificate and avoid resource waste, in the embodiment, the application server can parse the first encrypted certificate to obtain a certificate information field in the first encrypted certificate, and verify whether the uuid and salt transmitted by the front end are expired, and whether the corresponding salt value and parameter md5 are correct based on the certificate information field; after the data verification is correct, the parsed certificate information field is encrypted and stored in the backend database (corresponding to the database server). When encrypting, sm4 symmetric encryption algorithm can be used for encryption. The secret key can be saved in the database, and each enterprise can be allocated a secret key. When using, the secret key can be obtained from the database to decrypt the second encrypted certificate, which achieves the technical effect of reducing the resource occupancy rate of certificate management.

[0069] Optionally, after the second encrypted certificate is stored to the database server, including: receiving a parameter encryption request sent by a third-party platform, reading the second encrypted certificate stored in the database server, wherein the parameter encryption request is used to request to encrypt a business parameter generated by the third-party platform when the target enterprise connects the cloud interconnection service of the financial institution through different third-party platforms; decrypting the second encrypted certificate to obtain a target certificate, and encrypting the business parameter based on the target certificate to obtain a second encryption result, and returning the second encryption result to the third-party platform.

[0070] In order to avoid the situation that different third-party platforms each establish a certificate hosting service with a high resource waste rate, in the embodiment, when the enterprise connects the cloud interconnection service through different third-party platforms, the third-party platform can send an encryption request of the business parameter to the application server, the application server can read the second encrypted certificate stored in the database server, decrypt the second encrypted certificate to obtain a target certificate, and use the target certificate to encrypt the business parameter to obtain an encrypted business parameter (i.e. the second encryption result), and return the encrypted business parameter to the third-party platform to connect the cloud interconnection service of the financial institution, which achieves the technical effect of reducing the waste rate of certificate hosting resources.

[0071] Optionally, after returning the second encryption result to the third-party platform, further comprising: based on the second encryption result, sending a service request to the cloud interconnection service, and receiving response information returned by the cloud interconnection service, wherein the type of the service request includes at least one of the following: information query request, financial service request.

[0072] The service request described above can include but is not limited to: information query service, transfer payment service, agent service and supply chain finance service, etc. In the embodiment, the third-party platform can send a request to the cloud interconnection service based on the second encryption result, and receive response information returned by the cloud interconnection service.

[0073] Since the enterprise certificate is sensitive information, when the certificate is uploaded to the application server, an encryption algorithm is used to encrypt the certificate information. At the same time, when saved in the backend database, the certificate information is first encrypted and then saved. At the same time, https (Hypertext Transfer Protocol Secure) mechanism can be used in all data transmission processes, different third-party saas platforms calling the certificate hosting platform can be assigned tenant numbers for permission control and log auditing, preventing malicious attacks from the channel end, and can be used for data statistics and problem tracking of access volume of different channels.

[0074] In the embodiment, different third-party saas platforms are connected to the same application server, and the business parameters are encrypted, which effectively solves the problem of lack of unified standard for repeated development and data transmission security mechanism caused by certificate hosting and signature when different third-party saas platforms access the cloud interconnection platform. For subsequent access of other saas platforms to the cloud interconnection, by deploying and calling the unified certificate hosting platform, the purpose of reducing research and development cost, unified security standard and unified management is achieved, and the technical effect of reducing resource waste rate is achieved.

[0075] Embodiment two

[0076] The embodiment two of the application provides a kind of optional certificate-based data processing platform, which can be used to execute the certificate-based data processing method provided in the embodiment one of the application.

[0077] Figure 2 It is a schematic diagram of an optional certificate-based data processing platform according to the embodiment of the application, as Figure 2 As shown, the certificate-based data processing platform includes: front end, application server and database server.

[0078] In particular, the front end is configured to obtain a target certificate associated with a target enterprise, encrypt the target certificate by using an encryption algorithm, and upload a first encrypted certificate to an application server, wherein the target certificate comprises a certificate generated by the target enterprise when the target enterprise connects to a cloud interconnection service of a financial institution through a third-party platform, and the third-party platform comprises a platform configured to provide software operation services for the target enterprise when the target enterprise connects to the cloud interconnection service.

[0079] The database server is configured to store the target certificate in an encrypted manner.

[0080] The application server is configured to store the first encrypted certificate in the database server after receiving the first encrypted certificate, and provide an encryption service for parameters generated by different third-party platforms.

[0081] Figure 3 is a processing flow diagram of an optional certificate-based data processing platform according to an embodiment of the present application. The following describes the processing flow of the certificate-based data processing platform in combination with Figure 3 The processing flow of the certificate-based data processing platform is described.

[0082] 1.1, agreement signing, certificate uploading and hosting, configured to sign an agreement, generate a target certificate, and upload the target certificate to the application server for certificate hosting. In the uploading process, an encryption algorithm can be used to encrypt the target certificate to obtain a first encrypted certificate.

[0083] 1.2, certificate analysis and encrypted storage, the application server can analyze the first encrypted certificate, perform data verification, and after the verification is passed, the analyzed first encrypted certificate can be encrypted and stored in the database server.

[0084] 2.1, when a business is handled, a business parameter is input to apply for certificate encryption. When an enterprise requests to connect to a cloud interconnection service through a third-party saas service (corresponding to the third-party platform in the first embodiment), the third-party saas service platform can send a business parameter encryption request to the application server.

[0085] 2.2, read the certificate, decrypt and encrypt the business input parameter, the application server can read the certificate (corresponding to the second encrypted certificate in the first embodiment) from the database server, decrypt the encrypted certificate to obtain the target certificate, and encrypt the business input parameter based on the target certificate.

[0086] 2.3, return the certificate encryption result, the application server returns the encryption result of the business parameter to the third-party saas service.

[0087] 2.4, request the cloud interconnection service, the third-party saas service sends a service request to the cloud interconnection service.

[0088] 2.5, the cloud interconnection service returns the result.

[0089] It should be noted that the application server (i.e. the backend) in the embodiment can include but is not limited to an application framework + mysql + a distributed cache system framework, and can provide five main interfaces of a general encryption and decryption interface, a certificate signing and uploading interface, a certificate hosting condition query interface, a certificate deletion interface, and a certificate encryption interface for business parameters, through the addition, deletion, modification and query of the database, to realize the necessary related operations of the third party saas service platform accessing the cloud interconnection of the financial institution.

[0090] Figure 4 is an optional certificate encryption flowchart according to an embodiment of the application, as shown in Figure 4 For the data transmission security problem in the certificate uploading process, an encryption algorithm is used to encrypt the parameters of the certificate, as follows:

[0091] Step (1), obtain the original parameters:

[0092] {“cer”:”xxx”,"pubKey":"640101200102250916","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb",”password”:”xxx”,}(corresponding to the original string).

[0093] Step (2), after the original parameters are added to “md5Key (corresponding to the first preset parameter)”, a first string is obtained, the parameters in the first string are sorted in ascending order according to the key, and a second string is obtained, the value of “md5Key” can be a “client secret key” (uuid) provided to the enterprise, and the second string is as follows:

[0094] {“cer”:”xxx”,"md5Key":"xxx","password":"xxx”,"priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","pubKey":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb"}.

[0095] Step (3), calculate the md5 value of the second string, and place it in “sign” to obtain the following content (corresponding to the third string):

[0096] {“cer”:”xxx”,"md5Key":"xxx","password":"xxx","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","pubKey":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb","sign":"xxx"}.

[0097] Step (4), remove the "md5Key" (get the fourth string), and sort again in ascending order of the key to get the fifth string, as follows:

[0098] {“cer”:”xxx”,"password":"xxx","priKey":"2f59f7a02bc24e0a9bf3bd434a92e7cb","pub Key":"640101200102250916","serialNo":"2f59f7a02bc24e0a9bf3bd434a92e7cb","sign":"xxx"}.

[0099] Step (5), sm4 encrypt the content of the above fifth string, and the encryption key is the "client key" (uuid) assigned to the enterprise, to get the ciphertext encJsonStr (corresponding to the first encrypted string).

[0100] Step (6), concatenate the salt value (corresponding to the second identifier) to the ciphertext encJsonStr to get the second encrypted string, and encrypt again in the same way as steps (2) to (5) above, to get the final ciphertext string encStr (corresponding to the first encrypted certificate).

[0101] In this embodiment, a unified certificate hosting platform (i.e., a data processing platform based on certificates) is established for different third-party saas platforms, and business parameters are encrypted, effectively solving the problem of repeated development and lack of unified security standard for data transmission security mechanism caused by certificate hosting and signature when different third-party saas platforms are individually connected to the cloud interconnection platform. For subsequent access of other saas platforms to the cloud interconnection, by deploying and calling the unified certificate hosting platform, the purpose of reducing research and development costs, unified security standard and unified management can be achieved, and the technical effect of reducing resource waste rate is achieved.

[0102] Embodiment Three

[0103] The embodiment three of the present application provides a kind of optional certificate-based data processing device, each implementation unit in the certificate-based data processing device corresponds to each implementation step in the embodiment one.

[0104] Figure 5 It is the schematic diagram of an optional certificate-based data processing device according to the embodiment of the present application, as shown in Figure 5 The certificate-based data processing device includes: acquisition unit 51, first processing unit 52 and second processing unit 53.

[0105] Specifically, the acquisition unit 51 is used for acquiring a target certificate associated with a target enterprise, wherein the target certificate includes a certificate for signing and encrypting a parameter generated by a third-party platform when the target enterprise connects a cloud interconnection service of a financial institution through the third-party platform, and the third-party platform includes a platform for providing software operation services for the target enterprise when the target enterprise connects the cloud interconnection service.

[0106] The first processing unit 52 is used for encrypting the target certificate by an encryption algorithm to obtain a first encrypted certificate, and uploading the first encrypted certificate to an application server, wherein the application server is used for providing encryption services for parameters generated by different third-party platforms.

[0107] The second processing unit 53 is used for storing the first encrypted certificate to a database server after the application server receives the first encrypted certificate, wherein the database server is used for encrypting and storing the target certificate required to be used by different third-party platforms.

[0108] In the certificate-based data processing apparatus provided in Embodiment Three of the present application, the target certificate associated with the target enterprise can be acquired by the acquisition unit 51, wherein the target certificate includes a certificate for signing and encrypting the parameter generated by the third-party platform when the target enterprise connects the cloud interconnection service of the financial institution through the third-party platform, and the third-party platform includes a platform for providing software operation services for the target enterprise when the target enterprise connects the cloud interconnection service. The first processing unit 52 performs encryption processing on the target certificate by using an encryption algorithm to obtain a first encrypted certificate, and uploads the first encrypted certificate to an application server, wherein the application server is configured to provide encryption services for the parameters generated by different third-party platforms. After the application server receives the first encrypted certificate, the second processing unit 53 stores the first encrypted certificate in a database server, wherein the database server is configured to encrypt and store the target certificate required by different third-party platforms. Thus, the technical problem of high resource waste rate caused by the establishment of certificate hosting services by different saas platforms when accessing the cloud interconnection service of the financial institution is solved. In this embodiment, the certificates of the enterprise connecting the cloud interconnection service of the financial institution through the third-party platform are uniformly encrypted and uploaded to the application server and stored in the database server, thereby avoiding the establishment of certificate hosting services by each third-party saas service platform in the related art, and reducing the resource waste rate of the certificate hosting services of the enterprise, thereby achieving the technical effect of reducing the resource waste rate of the certificate hosting services of the enterprise.

[0109] Optionally, in the certificate-based data processing apparatus provided in Embodiment Three of the present application, the encryption algorithm includes a symmetric encryption algorithm, and the first processing unit includes an acquisition subunit configured to acquire a first identifier and a second identifier, wherein the first identifier is used for encrypting the target certificate, and the second identifier is used for preventing the target certificate from being tampered with; and an encryption subunit configured to perform N times of encryption processing on the target certificate by using the symmetric encryption algorithm based on the first identifier and the second identifier to obtain the first encrypted certificate, wherein N is a positive integer greater than 1.

[0110] Optionally, in the certificate-based data processing apparatus provided in Embodiment Three of the present application, the encryption subunit comprises: a determination module configured to determine an original string composed of M parameters of a target certificate, wherein M is a positive integer; a first processing module configured to add a first preset parameter to the original string to obtain a first string, and sort all parameters in the first string to obtain a second string, wherein the parameter value of the first preset parameter is a first identifier; a second processing module configured to calculate a hash value of the second string, and encrypt the second string based on the hash value and a second identifier by using a symmetric encryption algorithm to obtain a first encrypted string; a concatenation module configured to concatenate the first encrypted string and the second identifier to obtain a second encrypted string; and a third processing module configured to encrypt the second encrypted string for N-1 times to obtain a first encryption result, and determine a first encrypted certificate based on the first encryption result.

[0111] Optionally, in the certificate-based data processing apparatus provided in Embodiment Three of the present application, the second processing module comprises: an adding sub-module configured to add the hash value as a parameter value of a second preset parameter to the second string to obtain a third string; a processing sub-module configured to remove the first preset parameter from the third string to obtain a fourth string, and sort all parameters in the fourth string to obtain a fifth string; and an encryption sub-module configured to encrypt the fifth string by using a symmetric encryption algorithm to obtain the first encrypted string.

[0112] Optionally, in the certificate-based data processing apparatus provided in Embodiment Three of the present application, the second processing unit comprises: an analysis subunit configured to analyze the first encrypted certificate to obtain an analyzed first encrypted certificate; a verification subunit configured to perform data verification on the analyzed first encrypted certificate to obtain a verification result; and a processing subunit configured to, in a case where the verification result indicates that the analyzed first encrypted certificate passes the verification, encrypt the analyzed first encrypted certificate by using an encryption algorithm to obtain a second encrypted certificate, and store the second encrypted certificate to a database server.

[0113] Optionally, in the certificate-based data processing apparatus provided in Embodiment Three of the present application, the certificate-based data processing apparatus further comprises: a receiving unit configured to, after storing the second encrypted certificate to the database server, receive a parameter encryption request sent by a third-party platform, and read the second encrypted certificate stored in the database server, wherein the parameter encryption request is used to request to encrypt a business parameter generated by the third-party platform when a target enterprise connects the cloud interconnection service of a financial institution through different third-party platforms; and a third processing unit configured to decrypt the second encrypted certificate to obtain a target certificate, encrypt the business parameter based on the target certificate to obtain a second encryption result, and return the second encryption result to the third-party platform.

[0114] Optionally, in the certificate-based data processing apparatus provided by the third embodiment of the present application, the certificate-based data processing apparatus further comprises a fourth processing unit configured to, after returning the second encryption result to the third-party platform, send a service request to the cloud interconnection service based on the second encryption result, and receive response information returned by the cloud interconnection service, wherein the type of the service request comprises at least one of the following: an information query request, a financial service request.

[0115] The certificate-based data processing apparatus described above can further comprise a processor and a memory, and the acquisition unit 51, the first processing unit 52, the second processing unit 53, and the like are stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory.

[0116] The processor described above comprises a core, and the core retrieves the corresponding program units from the memory. The core can be one or more, and by adjusting the core parameters, the enterprise can upload the certificate unified encryption of the cloud interconnection service of the financial institution through the third-party platform to the application server and store it to the database server, thereby avoiding the situation that in the related art, each third-party saas service platform establishes a certificate hosting service, and the resource waste rate is high, thereby realizing the technical effect of reducing the resource waste rate of the certificate hosting service of the enterprise.

[0117] The memory described above can include a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory includes at least one memory chip.

[0118] According to another aspect of the embodiment of the present application, an electronic device is further provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the certificate-based data processing method of any one of the above via execution of the executable instructions.

[0119] According to another aspect of the embodiment of the present application, a computer readable storage medium is further provided, which stores a computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the certificate-based data processing method of any one of the above when the computer program runs.

[0120] Figure 6 is a schematic diagram of an electronic device according to an embodiment of the present application, as shown in Figure 6 The present application provides an electronic device 60, which comprises a processor, a memory, and a program stored on the memory and executable on the processor, and the processor realizes the certificate-based data processing method of any one of the above when executing the program.

[0121] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0122] In the above-mentioned embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0123] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other ways. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0124] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0125] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0126] The integrated unit, if realized in the form of software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the essential part or all or part of the technical solutions that make contributions to the prior art can be embodied in the form of software product, which is stored in a storage medium and includes a plurality of instructions for making a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The above-mentioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and various program code storage media.

[0127] The above merely describes the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as falling within the protection scope of the present application.

Claims

1. A certificate-based data processing method, characterized by, The method comprises the following steps: obtaining a target certificate associated with a target enterprise, wherein the target certificate comprises a certificate in which the target enterprise signs and encrypts a parameter generated by a third-party platform when the target enterprise connects a cloud interconnection service of a financial institution through the third-party platform, and the third-party platform comprises a platform that provides software operation services for the target enterprise when the target enterprise connects the cloud interconnection service; encrypting the target certificate by using an encryption algorithm to obtain a first encrypted certificate, and uploading the first encrypted certificate to an application server, wherein the application server is configured to provide encryption services for parameters generated by different third-party platforms; storing the first encrypted certificate to a database server after the application server receives the first encrypted certificate, wherein the database server is configured to encrypt and store the target certificate required to be used by different third-party platforms.

2. The data processing method according to claim 1, characterized in that, The encryption algorithm comprises a symmetric encryption algorithm, and the target certificate is encrypted by using the symmetric encryption algorithm to obtain the first encrypted certificate, which comprises the following steps: obtaining a first identifier and a second identifier, wherein the first identifier is used to encrypt the target certificate, and the second identifier is used to prevent the target certificate from being tampered with; based on the first identifier and the second identifier, the target certificate is encrypted N times by using the symmetric encryption algorithm to obtain the first encrypted certificate, wherein N is a positive integer greater than 1.

3. The data processing method according to claim 2, characterized in that, Based on the first identifier and the second identifier, the target certificate is encrypted N times by using the symmetric encryption algorithm to obtain the first encrypted certificate, which comprises the following steps: determining an original string composed of M parameters of the target certificate, wherein M is a positive integer; adding a first preset parameter to the original string to obtain a first string, and sorting all parameters in the first string to obtain a second string, wherein the parameter value of the first preset parameter is the first identifier; calculating the hash value of the second string, and encrypting the second string by using the symmetric encryption algorithm based on the hash value and the second identifier to obtain a first encrypted string; splicing the first encrypted string and the second identifier to obtain a second encrypted string; encrypting the second encrypted string N-1 times to obtain a first encryption result, and determining the first encrypted certificate based on the first encryption result.

4. The data processing method according to claim 3, characterized in that, Based on the hash value and the second identifier, the second string is encrypted by using the symmetric encryption algorithm to obtain a first encrypted string, which comprises the following steps: adding the hash value as the parameter value of a second preset parameter to the second string to obtain a third string; removing the first preset parameter in the third string to obtain a fourth string, and sorting all parameters in the fourth string to obtain a fifth string; encrypting the fifth string by using the symmetric encryption algorithm to obtain the first encrypted string.

5. The data processing method of claim 1, wherein, storing the first encrypted certificate to a database server, which comprises the following steps: The first encrypted certificate is parsed to obtain a parsed first encrypted certificate; The parsed first encrypted certificate is subjected to data verification to obtain a verification result; In a case where the verification result indicates that the parsed first encrypted certificate passes the verification, the parsed first encrypted certificate is encrypted by using the encryption algorithm to obtain a second encrypted certificate, and the second encrypted certificate is stored in the database server.

6. The data processing method according to claim 5, characterized in that, After the second encrypted certificate is stored in the database server, the following steps are included: A parameter encryption request sent by the third-party platform is received, and the second encrypted certificate stored in the database server is read, wherein the parameter encryption request is used to request encryption of a business parameter generated by the third-party platform when the target enterprise connects the cloud interconnection service of the financial institution through different third-party platforms; The second encrypted certificate is decrypted to obtain the target certificate, and the business parameter is encrypted based on the target certificate to obtain a second encryption result, and the second encryption result is returned to the third-party platform.

7. The data processing method according to claim 6, characterized in that, After the second encryption result is returned to the third-party platform, the following steps are further included: based on the second encryption result, a service request is sent to the cloud interconnection service, and response information returned by the cloud interconnection service is received, wherein the type of the service request includes at least one of the following: an information query request, a financial service request.

8. A certificate-based data processing platform, characterized by The certificate-based data processing platform is used to execute the certificate-based data processing method of any one of claims 1 to 7, and the certificate-based data processing platform includes: A front end is used to obtain a target certificate associated with a target enterprise, encrypt the target certificate by using an encryption algorithm, and upload a first encrypted certificate to an application server, wherein the target certificate includes a certificate used to sign and encrypt a parameter generated by a third-party platform when the target enterprise connects a cloud interconnection service of a financial institution through the third-party platform, and the third-party platform includes a platform used to provide software operation services for the target enterprise when the target enterprise connects the cloud interconnection service; A database server is used to encrypt and store the target certificate used by different third-party platforms; An application server is used to store the first encrypted certificate in the database server after receiving the first encrypted certificate, and provide encryption services for parameters generated by different third-party platforms.

9. A certificate-based data processing apparatus, characterized by comprising: The following steps are included: An obtaining unit is used to obtain a target certificate associated with a target enterprise, wherein the target certificate includes a certificate used to sign and encrypt a parameter generated by a third-party platform when the target enterprise connects a cloud interconnection service of a financial institution through the third-party platform, and the third-party platform includes a platform used to provide software operation services for the target enterprise when the target enterprise connects the cloud interconnection service; A first processing unit is configured to perform encryption processing on the target certificate by using an encryption algorithm to obtain a first encrypted certificate, and upload the first encrypted certificate to an application server, wherein the application server is configured to provide encryption services for parameters generated by different third-party platforms. A second processing unit is configured to store the first encrypted certificate to a database server after the application server receives the first encrypted certificate, wherein the database server is configured to store the target certificate used by different third-party platforms in an encrypted manner.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the certificate-based data processing method in any one of claims 1 to 7 when the computer program is running.

11. An electronic device, comprising: An apparatus includes one or more processors and memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the certificate-based data processing method in any one of claims 1 to 7.

Images