Data processing method and device based on secret key, equipment, medium and program product

Abstract

The embodiment of the invention provides a data processing method and device based on a secret key, equipment, a medium and a program product, relates to the technical field of data processing, is applied to a front end, and comprises the following steps: presetting an encryption algorithm at a server to encrypt and write the secret key into a secret key file, storing the secret key file into an H5 page, and sending the H5 page to the front end; and the key file generated at the server cannot be cracked. And the front end creates the second operation environment, and the first operation environment for loading and operating the H5 page and the second operation environment for operating the decryption container are isolated, so that the environmental security of operating the decryption container is improved. The decryption container is generated in a dynamic compiling mode, the decryption algorithm is operated through the decryption container to read the key file, the whole process of obtaining the key file through decryption is carried out in the container, the problem that a server interface is attacked due to the fact that the process of obtaining the key file processing data through H5 page decryption is reversely cracked is avoided, and the user experience is improved. And the security of the server interface is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a key-based data processing method, device, equipment, medium and program product. Background Art

[0002] Currently, most business functions on mobile terminals are implemented using H5 pages. When the H5 page interacts with the server, it will make an interface request to the server. In order to improve the security of the server interface, developers will obfuscate the source code of the H5 page and write encryption keys in the source code. However, after reverse logic analysis of the obfuscated code, the encryption key recorded in the source code can be obtained, and the logical processing mechanism of the interface can be inferred, resulting in reduced security of the server interface.

[0003] In the prior art, developers use symmetric encryption to encrypt the server's request interface message to generate a request message body ciphertext and a symmetric encryption key. The generated symmetric encryption key is then asymmetrically encrypted to generate an asymmetric encryption key. The asymmetric encryption key and the request message body ciphertext are transmitted to the server to achieve data interaction.

[0004] However, in the prior art, the asymmetric encryption key still needs to be stored in the source code of the H5 page. Since the source code of the H5 page is easy to be cracked after reverse logic analysis, the asymmetric encryption key stored in the source code is easy to be cracked, resulting in reduced security of the server interface. Summary of the invention

[0005] The embodiments of the present application provide a key-based data processing method, apparatus, device, medium and program product to solve the problem of reduced security of server interfaces in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a key-based data processing method, which is applied to a front end and includes:

[0007] Sending an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file;

[0008] Receive the H5 page sent by the server;

[0009] Loading in the first operating environment to run the H5 page;

[0010] During the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation;

[0011] Creating a second operating environment, wherein the second operating environment is isolated from the first operating environment;

[0012] In the second operating environment, running the decryption container;

[0013] Read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm;

[0014] Parsing the key file by using the decryption algorithm through the decryption container to obtain operation information corresponding to the original key;

[0015] Extracting the encrypted string and the concatenation constant from the operation information through the decryption container;

[0016] Generate a constant character string according to the concatenated constant by using the decryption container;

[0017] Performing an XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key;

[0018] Sending a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request;

[0019] Receiving the data to be processed sent by the server through the H5 page;

[0020] The data to be processed in the H5 page is processed according to the original key.

[0021] In a possible design, during the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation, including: during the loading of the H5 page, obtaining identification information and operation information of the front end; creating a container list according to the identification information and the operation information; dynamically obtaining status information of the decryption container according to the container list; compiling the container list and the status information to compile and generate a decryption container.

[0022] In one possible design, creating the second operating environment includes: obtaining the storage path of the decrypted container; reading the source code of the decrypted container according to the storage path of the decrypted container; generating a mount instruction according to the source code of the decrypted container; obtaining the environmental information of the first operating environment, and creating an operating isolation group according to the environmental information of the first operating environment; and deploying the source code of the decrypted container in the operating isolation group through the mount instruction to create the second operating environment.

[0023] In a possible design, the data to be processed in the H5 page is processed according to the original key, including: extracting a transmission message from the data to be processed in the H5 page according to the original key; encrypting the transmission message according to the original key to generate an encrypted transmission message.

[0024] In one possible design, after generating the encrypted transmission message, it also includes: sending the encrypted transmission message to the server so that the server decrypts the encrypted transmission message to obtain the transmission message, and verifies the transmission message. If the transmission message is verified, the interface function is called according to the transmission message.

[0025] In a possible design, before receiving the H5 page sent by the server, it also includes: receiving a running load request for the H5 page sent by the server, wherein the page data of the H5 page is recorded in the running load request for the H5 page; reading the page data of the H5 page, and determining the request type of the H5 page; if the request type of the H5 page is a dynamic request, encapsulating the H5 page, and storing the H5 page loading configuration information in the front-end cache pool; if the request type of the H5 page is a static request, obtaining the static file of the server, and loading the H5 page according to the static file.

[0026] In a possible design, after processing the data to be processed in the H5 page according to the original key, it also includes: generating a message data transmission request, and sending the message data transmission request to the server, so that the server obtains certificate information according to the message data request; receiving the certificate information sent by the server, and creating a session key pair according to the certificate information; wherein the session key pair includes a session public key and a session private key; encrypting the transmission protocol through the session public key, and sending the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information; receiving the decryption information sent by the server, and if the decryption information is decrypted successfully, sending the encrypted transmission message to the server.

[0027] In a second aspect, an embodiment of the present application provides a key-based data processing method, which is applied to a server, including:

[0028] Receive access requests sent by the front end;

[0029] Generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file;

[0030] Send the H5 page to the front end so that the front end is loaded in the first operating environment to run the H5 page. During the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation, and a second operating environment is created, wherein the second operating environment is isolated from the first operating environment. In the second operating environment, the decryption container is run, and the shared object file of the H5 page is read through the decryption container to obtain a decryption algorithm, and the key file is parsed using the decryption algorithm to obtain operation information corresponding to the original key, and an encrypted string and a splicing constant are extracted from the operation information through the decryption container, a constant string is generated according to the splicing constant, and an XOR operation is performed on the encrypted string and the constant string to obtain the original key;

[0031] Receive a data request sent by the H5 page, and obtain the data to be processed according to the data request;

[0032] The data to be processed is sent to the H5 page of the front end, so that the front end processes the data to be processed in the H5 page according to the original key.

[0033] In a possible design, generating an H5 page according to the access request includes: generating operation information according to the access request; generating a key file according to the operation information; and generating an H5 page according to the key file.

[0034] In one possible design, generating operation information according to the access request includes: generating an original key and a constant string according to the access request; performing an XOR operation on the original key and the constant string to generate an encrypted string; performing a superposition operation on the constant string to generate a concatenated constant; and generating operation information according to the encrypted string and the concatenated constant.

[0035] In one possible design, generating a key file based on the operation information includes: generating a user identifier based on the operation information; encrypting the user identifier and generating a key pair corresponding to the user identifier; creating a mapping list based on the user identifier; writing the key pair corresponding to the user identifier and the operation information into the mapping list to generate a key file.

[0036] In a possible design, after sending the data to be processed to the H5 page of the front end, it also includes: receiving the encrypted transmission message sent by the front end; decrypting the encrypted transmission message; verifying the transmission message, and if the transmission message verification passes, calling the corresponding service interface according to the transmission message; obtaining the address information of the service interface, and creating an access list according to the address information of the service interface; adding the address information of the service interface and the transmission message to the access list.

[0037] In a possible design, after adding the address information of the service interface and the transmission message to the access list, it also includes: serializing the access list to generate string data; obtaining the front-end identifier in the transmission message; encrypting and concatenating the front-end identifier and the string data to generate an access token; if a call request from the front-end to call the service interface corresponding to the access list is received, the access token is sent to the front-end so that the front-end calls the service interface corresponding to the access list.

[0038] In a third aspect, an embodiment of the present application provides a key-based data processing device, applied to a front end, including:

[0039] A first sending module, configured to send an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file;

[0040] The first receiving module is used to receive the H5 page sent by the server;

[0041] A first loading module, used for loading and running the H5 page in a first running environment;

[0042] A first generating module is used to generate a decryption container corresponding to the H5 page by dynamic compilation during the loading of the H5 page;

[0043] A creation module, used to create a second operating environment, wherein the second operating environment is isolated from the first operating environment;

[0044] An operating module, used for operating the decryption container in the second operating environment;

[0045] A first reading module, configured to read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm;

[0046] A parsing module, used to parse the key file using the decryption algorithm through the decryption container to obtain operation information corresponding to the original key;

[0047] An extraction module, used for extracting an encrypted string and a concatenation constant from the operation information through the decryption container;

[0048] A second generating module, used to generate a constant character string according to the concatenated constant through the decryption container;

[0049] A calculation module, used for performing an XOR operation on the encrypted string and the constant string through the decryption container to obtain an original key;

[0050] A second sending module is used to send a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request;

[0051] A second receiving module, used for receiving the to-be-processed data sent by the server through the H5 page;

[0052] The processing module is used to process the data to be processed in the H5 page according to the original key.

[0053] In a fourth aspect, an embodiment of the present application provides a key-based data processing device, including: a memory, a processor;

[0054] The memory stores computer-executable instructions;

[0055] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the key-based data processing method as described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0056] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the key-based data processing method described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0057] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the key-based data processing method as described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0058] The key-based data processing method, device, equipment, medium and program product provided in the embodiment of the present application encrypts and writes the key into a key file by presetting an encryption algorithm on the server side, stores the key file in the H5 page, and sends it to the front end. The key file generated on the server side cannot be cracked. The front end creates a second operating environment, isolates the first operating environment for loading and running the H5 page and the second operating environment for running the decryption container, and improves the environmental security of the running decryption container. The decryption container is generated by dynamic compilation, and the decryption algorithm is run through the decryption container to read the key file. The entire decryption process to obtain the key file is carried out in the container, avoiding the process of H5 page decryption to obtain key file processing data being reversely cracked, and then attacking the server interface, thereby improving the security of the server interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0060] Figure 1 A schematic diagram of a scenario of a key-based data processing method provided in this application;

[0061] Figure 2 A schematic diagram of a key-based data processing method provided in accordance with an embodiment of the present application;

[0062] Figure 3 A schematic diagram of a key-based data processing method provided in accordance with an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the structure of a key-based data processing device provided in this application;

[0064] Figure 5 A schematic diagram of the structure of a key-based data processing device provided in this application.

[0065] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0066] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0067] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0068] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0069] First, the terms involved in this application are explained:

[0070] H5 page: refers to a web page developed using HTML5 technology. HTML5 is the next-generation standard of the Internet and a language for building and presenting Internet content. Compared with traditional PC web pages, H5 pages are suitable for browsing on mobile devices and provide a better user experience;

[0071] Container: is an operating environment for managing and executing applications. It provides a standardized environment so that applications can run on different servers without modification.

[0072] Figure 1 A schematic diagram of a scenario of a key-based data processing method provided in this application, such as Figure 1 As shown, the scenario includes a front end 10 and a server 20.

[0073] The front end 10 includes: a receiving device 101, a processor 102 and a display device 103.

[0074] The server 20 includes a receiving device 201 , a processor 202 and a display device 203 .

[0075] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the object identification method. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0076] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, and can receive the H5 page sent by the server.

[0077] The processor 102 may execute a preset algorithm through the decryption container to obtain the original key, and process the data to be processed according to the original key.

[0078] The display device 103 can be used to display the above-mentioned data to be processed.

[0079] In the specific implementation process, the receiving device 201 can be an input / output interface or a communication interface, and can obtain an H5 page creation request.

[0080] Processor 202 can generate an H5 page.

[0081] The display device 203 can be used to display the above-mentioned H5 page, etc.

[0082] The display device may also be a touch display screen, which is used to receive user instructions while displaying the above-mentioned content, so as to realize operational interaction with the user.

[0083] It should be understood that the above-mentioned processor can be implemented by the processor reading instructions in the memory and executing the instructions, or it can be implemented by a chip circuit.

[0084] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0085] Combined with the above scenario, it can be seen that in the prior art, developers use symmetric encryption to encrypt the request interface message of the server to generate the request message body ciphertext and symmetric encryption key. The generated symmetric encryption key is then asymmetrically encrypted to generate an asymmetric encryption key. The asymmetric encryption key and the request message body ciphertext are transmitted to the server to achieve data interaction. However, in the prior art, the asymmetric encryption key still needs to be stored in the source code of the H5 page. Since the source code of the H5 page is easy to be cracked after reverse logic analysis, the asymmetric encryption key stored in the source code is easy to be cracked, resulting in reduced security of the server interface.

[0086] In order to solve the above technical problems, the embodiments of the present application propose the following technical concepts: the inventor considers pre-generating a key file on the server side and storing the key file in the H5 page; considers loading and running the H5 page in the first operating environment, creating a second operating environment, and running a decryption container in the second operating environment, isolating the operating environment of the H5 page and the operating environment of the decryption container, thereby improving the environmental security of running the decryption container; considers dynamically compiling and generating a decryption container on the front end, using the decryption container to read the H5 page, parsing the operation information in the key file, executing a preset algorithm on the operation information to obtain the original key, and using the original key to process the data. By executing the decryption process in the decryption container, the security of the decryption process is improved, and the original key is prevented from being cracked in the source code, thereby improving the security of the server interface.

[0087] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0088] Figure 2This is a flow chart of a key-based data processing method provided by an embodiment of the present application. The execution subject of this embodiment can be a front end, and this embodiment is not particularly limited here. Figure 2 As shown, the method includes:

[0089] S201: Send an access request to the server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0090] In this embodiment, the access request is a request to create an H5 page.

[0091] In this embodiment, the server is a device that creates H5 pages and provides user services.

[0092] The types of servers include but are not limited to web servers, user information servers and database servers.

[0093] Among them, the user services provided by the server include but are not limited to password retrieval, balance inquiry and business processing.

[0094] In this embodiment, the content recorded in the H5 page includes but is not limited to the page source code, page function code and key file.

[0095] In this embodiment, the front end is the device on which the user loads the H5 page, including but not limited to mobile phones, computers, and tablets.

[0096] Specifically, when the H5 page is sent to the front end, the H5 page requests the server's interface and sends a message to the server's interface to realize data interaction with the server, and realizes the corresponding function through data interaction with different functional interfaces of the server.

[0097] In this embodiment, the pre-generated key file is a key file written and generated by a developer according to a preset encryption algorithm.

[0098] S202: Receive the H5 page sent by the server.

[0099] Specifically, the front end receives the H5 page sent by the server through wireless communication.

[0100] S203: Loading in the first operating environment to run the H5 page.

[0101] In this embodiment, the first operating environment is the operating environment in which the front-end operating system runs the H5 page.

[0102] Among them, the type of the first operating environment includes but is not limited to a browser, a mini-program, and a WebView application.

[0103] S204: When the H5 page is loaded, a decryption container corresponding to the H5 page is generated by dynamic compilation.

[0104] In this embodiment, when the front end loads and runs the H5 page, a decryption container is dynamically compiled and generated according to the key file in the H5 page.

[0105] In this embodiment, the decryption container is created by the H5 page using JavaScript.

[0106] In this embodiment, the decryption container is a temporary storage object that stores the decryption algorithm of the shared object file.

[0107] In this embodiment, the decryption algorithm in the decryption container corresponds to the encryption algorithm in the key file.

[0108] S205: Create a second operating environment, wherein the second operating environment is isolated from the first operating environment.

[0109] In this embodiment, the second operating environment is a virtual environment for running the decrypted container.

[0110] The type of the second operating environment includes but is not limited to a virtual machine, a Docker environment, and a Python virtual environment.

[0111] Specifically, the front end obtains the storage path of the decrypted container, reads the source code of the decrypted container according to the storage path of the decrypted container, generates a mount instruction, obtains the environmental information of the first operating environment, and creates an operating isolation group according to the environmental information of the first operating environment, and deploys the source code of the decrypted container in the operating isolation group through the mount instruction to create a second operating environment.

[0112] S206: In the second operating environment, run the decryption container.

[0113] Specifically, the second operating environment pulls the container image of the second operating environment through a command line tool, and runs the decrypted container according to the running function.

[0114] Among them, the forms of pulling container images with command line tools include but are not limited to docker pull commands, docker libraries, and dockerfile commands.

[0115] S207: Read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm.

[0116] In this embodiment, the shared object file is a so file, and the so file is stored in a so library in the H5 page loading project.

[0117] In this embodiment, the decryption algorithm of the decryption key file is recorded in the shared object file.

[0118] Among them, the method of writing the decryption algorithm in the decryption key file includes but is not limited to C language, C++ language and JNI technology.

[0119] Specifically, the decryption container reads the so file of the so library of the H5 page loading project through I / O operations, and obtains the decryption algorithm recorded in the so file.

[0120] S208: The key file is parsed by using a decryption algorithm through the decryption container to obtain operation information corresponding to the original key.

[0121] In this embodiment, the operation information includes an encrypted string and a concatenation constant.

[0122] Specifically, the decryption container reads the shared object file in the shared object library in the H5 page loading project, and parses the key file according to the decryption algorithm in the shared object file to obtain the operation information corresponding to the original key.

[0123] S209: extracting the encryption string and the concatenation constant from the operation information by decrypting the container.

[0124] In this embodiment, the concatenated constant is binary data generated by superimposing redundant obfuscation of a fixed length at the front and back of a constant character string.

[0125] S210: Generate a constant string according to the concatenated constants by decrypting the container.

[0126] Specifically, the decryption container locates the position of the splicing constant in the operation information through the decryption algorithm, and restores the constant string according to the splicing rule of the splicing constant in the shared object file.

[0127] S211: Perform an XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key.

[0128] In this embodiment, the encrypted string is generated by performing an XOR operation on the original key and a constant string.

[0129] Exemplarily, if the original key is 1011 and the constant string is 0111, the original key and the constant string are XORed to obtain the encrypted string 1100, and the encrypted string 1100 and the constant string 0111 are XORed to obtain the original key 1011.

[0130] S212: Send a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request.

[0131] Specifically, after the decryption container decrypts and obtains the original key, the H5 page generates a data request, and sends the data request to the server via wireless communication. The server obtains the corresponding data to be processed according to the data request.

[0132] In this embodiment, the data to be processed is a data file corresponding to the H5 page calling the server interface.

[0133] The formats of data files include but are not limited to exe files, sys files and app files.

[0134] S213: Receive the data to be processed sent by the server through the H5 page.

[0135] Specifically, the data to be processed sent by the server is received by wireless communication.

[0136] The data to be processed is encrypted by the server and then sent to the front end.

[0137] Among them, encryption methods include but are not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0138] S214: Process the data to be processed in the H5 page according to the original key.

[0139] In this embodiment, the data to be processed is the message data of the H5 page requesting the interface from the server.

[0140] Specifically, the H5 page uses the original key to encrypt the message data of the request interface and sends it to the server. The server verifies the encrypted message data to implement the H5 page's call to the server interface.

[0141] It can be seen from the above embodiments that by presetting the encryption algorithm on the server side to encrypt the key and write it into the key file, the key file is stored in the H5 page, and sent to the front end, the key file generated on the server side cannot be cracked. The front end creates a second operating environment, isolates the first operating environment for loading and running the H5 page and the second operating environment for running the decryption container, and improves the environmental security of the running decryption container. The decryption container is generated by dynamic compilation, and the decryption algorithm is run through the decryption container to read the key file. The entire decryption process to obtain the key file is carried out in the container, avoiding the process of H5 page decryption to obtain key file processing data being reversely cracked, and then attacking the server interface, thereby improving the security of the server interface.

[0142] In one embodiment of the present application, step S204 includes:

[0143] S2041: While the H5 page is loading, obtain the identification information and operation information of the front end.

[0144] In this embodiment, the content of the running information record is that the page status is a running status and the page status is a stopped status.

[0145] In this embodiment, the content recorded in the identification information of the front end includes, but is not limited to, the name of the front end, the serial number of the front end, and the storage capacity of the front end.

[0146] S2042: Create a container list according to the identification information and the operation information.

[0147] In this embodiment, a container list is created according to identification information, operation information, and UI elements.

[0148] S2043: Dynamically obtain the status information of the decrypted container according to the container list.

[0149] Specifically, each time the status of the container list is updated, the H5 page synchronizes the latest status of the container list through a synchronization function.

[0150] S2044: Compile the container list and status information to generate a decrypted container.

[0151] Specifically, the container list and the status information of the container are updated through the compile function, and the UI is updated on the UI front end to generate a decrypted container.

[0152] The compilation function includes but is not limited to an add function, an update function, and a traversal function.

[0153] In this embodiment, the operating environment for generating the decryption container includes but is not limited to a JavaScript environment, a Web environment, and a Wasm environment.

[0154] It can be seen from the above embodiments that by obtaining the identification information and operation information of the front end to create a container list, obtaining the status information of the decrypted container, dynamically compiling the container list and status information, generating a decrypted container, and using the decrypted container to perform the decryption process, the security of the data is improved.

[0155] In one embodiment of the present application, step S205 includes:

[0156] S2051: Obtain the storage path of the decrypted container.

[0157] In this embodiment, the types of storage paths include but are not limited to relative paths, absolute paths, and database paths.

[0158] In this embodiment, the method for obtaining the storage path of the decrypted container includes but is not limited to accessing a function, obtaining an external storage directory of the decrypted container, and obtaining an internal storage directory of the decrypted container.

[0159] S2052: Read the source code of the decryption container according to the storage path of the decryption container.

[0160] Specifically, a method function for reading source code is created, and a storage path is set in the method to read the source code of the decryption container.

[0161] S2053: Generate a mount instruction according to the source code of the decrypted container.

[0162] Specifically, a mount instruction is generated according to different file systems where the source code is located.

[0163] The file system includes but is not limited to the proc file system, the dev file system, and the tmp file system.

[0164] S2054: Obtain environmental information of the first operating environment, and create an operating isolation group according to the environmental information of the first operating environment.

[0165] Specifically, environmental information of the first operating environment is obtained, the first operating environment information is added to a dynamic replacement plug-in, and an operating isolation group is created through the dynamic replacement plug-in.

[0166] S2055: Deploy the source code of the decrypted container to the running isolation group through a mount instruction to create a second running environment.

[0167] Specifically, a tool for compiling and decrypting the container source code is deployed in the operation isolation group, and a root directory of the tool for compiling and decrypting the container source code is configured to create a second operation environment.

[0168] It can be seen from the above embodiments that by obtaining the storage path of the decrypted container, reading the source code of the decrypted container according to the path, generating a mount instruction, obtaining the first operating environment information, creating an operating isolation group according to the first operating environment information, and deploying the source code of the decrypted container in the operating isolation group through the mount instruction to create a second operating environment, the security of the decrypted container operation is improved.

[0169] In one embodiment of the present application, step S214 includes:

[0170] S2141: Extract the transmission message from the data to be processed in the H5 page according to the original key.

[0171] In this embodiment, the transmission message is message data of an H5 page requesting a port service of a server, wherein the transmission message records the request protocol format of the H5 page and the server.

[0172] S2142: Encrypt the transmission message according to the original key to generate an encrypted transmission message.

[0173] In this embodiment, the transmission message is encrypted by the original key, and after the encryption process is completed, the original key is stored in the key file.

[0174] In this embodiment, the original key is an RSA encryption public key.

[0175] The RSA encryption public key is an asymmetric encryption key, and the original key includes but is not limited to an ECC key, a DSA key, and an ElGamal key.

[0176] In addition, it should be noted that another form of encrypted transmission message is: encrypt the transmission message by symmetric encryption, encrypt the symmetric encryption key by the original key, and save it in the code of the H5 page.

[0177] It can be seen from the above embodiments that the transmission message transmitted to the server is encrypted by the original key, and the original key obtained by the decryption container is not easy to be cracked and obtained. The transmission message is encrypted by the original key obtained by decrypting the decryption container, thereby improving the security of data transmission between the H5 page and the server.

[0178] In one embodiment of the present application, after step S2142, the following steps are further included:

[0179] S2143: Send the encrypted transmission message to the server, so that the server decrypts the encrypted transmission message, obtains the transmission message, and verifies the transmission message. If the transmission message verification passes, the interface function is called according to the transmission message.

[0180] Specifically, the server obtains the encrypted private key corresponding to the original key based on the encrypted message, uses the encrypted private key to decrypt the encrypted transmission message, and verifies the request protocol format in the transmission message. If the verification passes, the interface is called according to the interface function called by the H5 request in the transmission message to realize the H5 page calling the server interface.

[0181] It can be seen from the above embodiment that the server decrypts the transmission message and verifies the request protocol format in the transmission message. If the verification is successful, the H5 page is allowed to call the interface function of the server, thereby improving the security of the server interface.

[0182] In one embodiment of the present application, before step S202, the method further includes:

[0183] S401: receiving an H5 page running load request sent by a server, wherein the H5 page running load request records page data of the H5 page.

[0184] In this embodiment, the page data includes but is not limited to a request header, server information, and loading request information.

[0185] S402: Read the page data of the H5 page and determine the request type of the H5 page.

[0186] Specifically, the request type of the H5 page is determined according to the request header in the H5 page data.

[0187] The information recorded in the request header includes static information and dynamic information.

[0188] S403: If the request type of the H5 page is a dynamic request, the H5 page is encapsulated and the H5 page loading configuration information is stored in the front-end cache pool.

[0189] Specifically, if the information recorded in the request header is dynamic information, the H5 page is encapsulated according to a preset encapsulation protocol, and the loading configuration information of the H5 page is stored in the front-end cache pool.

[0190] The loading configuration information of the H5 page includes but is not limited to html files, css files, JavaScript files, and image and text files.

[0191] The dynamic information includes, but is not limited to, information identifying the client software, the URL of the request source, and authentication information.

[0192] S404: If the request type of the H5 page is a static request, obtain the static file of the server, and load the H5 page according to the static file.

[0193] Specifically, if the information recorded in the request header is static information, it is sent to the corresponding static Web server through the HTTPS transmission protocol, the static file sent by the static Web server in response to the request information is received, and the static file is sent to the H5 page to complete the data loading of the H5 page.

[0194] It can be seen from the above embodiments that by obtaining the request type of the H5 page, by distinguishing different request types, and confirming the loading method of the H5 page according to the different request types, the loading speed of the H5 page is improved.

[0195] In one embodiment of the present application, after step S214, the following steps are further included:

[0196] S215: Generate a message data transmission request, and send the message data transmission request to the server, so that the server obtains the certificate information according to the message data request.

[0197] In this embodiment, the message data transmission request records the data format, communication protocol and request URL of the message to be transmitted.

[0198] The request URL is the address of the server.

[0199] The communication protocols include but are not limited to HTTP, POP3, TCP and SSH.

[0200] In this embodiment, the content recorded in the certificate information includes but is not limited to the certificate CA, certificate validity period, certificate serial number and certificate extension information.

[0201] S216: Receive the certificate information sent by the server, and create a session key pair according to the certificate information; wherein the session key pair includes a session public key and a session private key.

[0202] In this embodiment, types of session key pairs include but are not limited to symmetric keys, asymmetric keys, and mixed keys.

[0203] S217: Encrypt the transmission protocol using the session public key, and send the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information.

[0204] In this embodiment, after decrypting the transmission protocol, the server traverses the server backend transmission protocol database to determine whether the frontend transmission protocol is recorded in the transmission protocol database.

[0205] S218: Receive the decryption information sent by the server. If the decryption information indicates that the decryption is successful, send the encrypted transmission message to the server.

[0206] In this embodiment, the keys used for encrypting the transmission message include but are not limited to symmetric keys, asymmetric keys and mixed keys.

[0207] Specifically, the encrypted transmission message is transmitted to the server via wireless communication.

[0208] From the above embodiments, it can be seen that by creating a session key pair based on the certificate information of the server, using the session public key in the session key pair to encrypt the transmission protocol, decrypting the transmission protocol through the server, verifying the transmission protocol to generate decryption information, if the server verification is successful, the front end transmits the encrypted transmission message through the transmission protocol, encrypts the transmission protocol between the front end and the server, and improves the security of the transmission process.

[0209] Figure 3 This is a flowchart of a key-based data processing method provided by an embodiment of the present application. The execution subject of this embodiment can be a server, and this embodiment is not particularly limited here. Figure 3 As shown, the method includes:

[0210] S301: Receive an access request sent by the front end.

[0211] Specifically, an access request sent by the front end is received by way of wireless communication.

[0212] In this embodiment, the access request is a request for the front-end to run an H5 page.

[0213] S302: Generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0214] Specifically, the H5 page generates the original key and constant string according to the creation request, performs an XOR operation on the constant string and the original key to generate an encrypted string, performs an overlay operation on the constant string to obtain a concatenated constant, records the concatenated constant and the encrypted string in a key file, and writes the key file to the H5 page.

[0215] S303: Send the H5 page to the front end so that the front end is loaded in the first operating environment to run the H5 page. During the loading process of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation, and a second operating environment is created, wherein the second operating environment is isolated from the first operating environment. In the second operating environment, the decryption container is run, and the shared object file of the H5 page is read through the decryption container to obtain the decryption algorithm, and the key file is parsed using the decryption algorithm to obtain the operation information corresponding to the original key, and the encryption string and the splicing constant are extracted from the operation information through the decryption container, a constant string is generated according to the splicing constant, and an XOR operation is performed on the encryption string and the constant string to obtain the original key.

[0216] Specifically, when the front-end loads and runs the H5 page in the first operating environment, a decryption container is generated by dynamic compilation, and a second operating environment is created to isolate the first operating environment from the second operating environment. The decryption container is run in the second operating environment, and the shared object file of the H5 page is read through the decryption container to obtain the decryption algorithm. The decryption container uses the decryption algorithm to parse the key file to obtain the operation information corresponding to the original key, extract the encrypted string and the splicing constant from the operation information, generate a constant string based on the splicing constant, and perform an XOR operation on the encrypted string and the constant string to obtain the original key.

[0217] S304: Receive a data request sent by the H5 page, and obtain the data to be processed according to the data request.

[0218] Specifically, after the decryption container decrypts and obtains the original key, the H5 page generates a data request, and the front end sends the data request to the server through wireless communication, and the server obtains the corresponding data to be processed according to the data request.

[0219] In this embodiment, the data to be processed is a data file corresponding to the H5 page calling the server interface.

[0220] S305: Send the data to be processed to the H5 page of the front end, so that the front end processes the data to be processed in the H5 page according to the original key.

[0221] Specifically, the outgoing data is sent to the H5 page of the front end by means of wireless communication.

[0222] The data to be processed is encrypted by the server and then sent to the front end.

[0223] Among them, encryption methods include but are not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0224] It can be seen from the above embodiments that by presetting the encryption algorithm on the server side to encrypt the key and write it into the key file, the key file is stored in the H5 page, and sent to the front end, the key file generated on the server side cannot be cracked. The front end creates a second operating environment, isolates the first operating environment for loading and running the H5 page and the second operating environment for running the decryption container, and improves the environmental security of the running decryption container. The decryption container is generated by dynamic compilation, and the decryption algorithm is run through the decryption container to read the key file. The entire decryption process to obtain the key file is carried out in the container, avoiding the process of H5 page decryption to obtain key file processing data being reversely cracked, and then attacking the server interface, thereby improving the security of the server interface.

[0225] In one embodiment of the present application, step S302 includes:

[0226] S3021: Generate operation information according to the access request.

[0227] Specifically, step S3021 includes:

[0228] Step a: Generate the original key and constant string according to the access request.

[0229] In this embodiment, the original key is an RSA encryption public key, and the constant character string is a constant of a fixed length.

[0230] Step b: Perform an XOR operation on the original key and the constant string to generate an encrypted string.

[0231] In this embodiment, the operation form of the original key and the constant character string includes but is not limited to an XOR operation, an XOR operation, and a combination of an XOR operation followed by an XOR operation.

[0232] Step c: Perform a superposition operation on the constant character string to generate a concatenated constant.

[0233] Specifically, a fixed-length redundancy is superimposed before and after the constant character string to generate a concatenated constant.

[0234] Step d: Generate operation information based on the encrypted string and the concatenation constant.

[0235] Specifically, the encrypted string and the concatenation constant are recorded as operation information and added to the key file.

[0236] S3022: Generate a key file based on the calculation information.

[0237] In this embodiment, the key file is a .s file, which is a binary file that records the encryption information of the RSA public key.

[0238] S3023: Generate an H5 page according to the key file.

[0239] In this embodiment, the content recorded in the H5 page includes but is not limited to key files, loading projects and function projects.

[0240] It can be seen from the above embodiments that an encrypted string is generated by performing an XOR operation on the original key and a constant string, and the constant string is superimposed to obtain a spliced ​​constant. The constant is hidden by splicing to prevent the constant from being easily discovered. The calculation information is written into the key file, and the key file is written into the H5 page, thereby increasing the difficulty of obtaining the original key and improving the security of the original key.

[0241] In one embodiment of the present application, step S3022 includes:

[0242] Step a: Generate a user ID based on the calculation information.

[0243] In this embodiment, the content recorded in the user identification includes but is not limited to the name, serial number and running status of the front end.

[0244] Step b: Encrypt the user ID and generate a key pair corresponding to the user ID.

[0245] In this embodiment, the method of encrypting the user identification includes but is not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0246] Step c: Create a mapping list based on the user ID.

[0247] In this embodiment, the mapping list is stored in the cache of the front-end page.

[0248] In this embodiment, the developer sets the effective time of the mapping list to set the length of time the mapping list is stored in the cache.

[0249] Step d: Write the key pair and operation information corresponding to the user identification into the mapping list to generate a key file.

[0250] In this embodiment, the content recorded in the mapping list includes, but is not limited to, the key pair corresponding to the user identifier, the calculation information, and the storage duration of the mapping list.

[0251] From the above embodiments, it can be seen that by generating a front-end user identifier for the operation information in the key file, encrypting the user identifier, generating a key pair, creating a mapping list, writing the key pair and the operation information into the mapping list, and recording the mapping list in the key file, it is convenient to query the corresponding front-end user according to the mapping list.

[0252] In one embodiment of the present application, after step S305, the following steps are further included:

[0253] S306: Receive the encrypted transmission message sent by the front end.

[0254] In this embodiment, the encryption transmission message includes, but is not limited to, symmetric encryption, asymmetric encryption, and hybrid encryption.

[0255] S307: Decrypt the encrypted transmission message.

[0256] Specifically, the server obtains the encrypted private key corresponding to the original key according to the encrypted message, and uses the encrypted private key to decrypt the encrypted transmission message.

[0257] S308: Verify the transmission message. If the transmission message is verified, call the corresponding service interface according to the transmission message.

[0258] Specifically, according to the interface function and interface address recorded in the transmission message, the service interface corresponding to the server is queried, and if the transmission message verification passes, the corresponding service interface is called.

[0259] S309: Acquire the address information of the service interface, and create an access list according to the address information of the service interface.

[0260] In this embodiment, the address information of the service interface includes but is not limited to a protocol, an identifier, and a domain name.

[0261] S310: Add the address information and transmission message of the service interface to the access list.

[0262] Specifically, the transmission identifier recorded in the transmission message is obtained, and the transmission identifier and the address information of the called service interface are added to the access list.

[0263] From the above embodiment, it can be seen that the encrypted transmission message is decrypted by the server, an access list is created according to the transmission message, and the address information of the transmission message and the service interface is recorded in the access list, so as to facilitate querying the transmission message and the corresponding service interface called.

[0264] In one embodiment of the present application, after S310, the method further includes:

[0265] S311: Serialize and convert the access list to generate character string data.

[0266] Specifically, a serialization method is selected, a corresponding serialization library is imported, and an access list is input into the serialization library to generate string data.

[0267] Among them, serialization methods include pickle method and json method.

[0268] S312: Obtain the front-end identifier in the transmission message.

[0269] In this embodiment, the front-end identifier is a corresponding identifier generated after the front-end initiates a port call request.

[0270] The content recorded in the identifier includes but is not limited to the time when the request is initiated, the file size of the transmitted message and the name of the called port.

[0271] S313: Encrypt and concatenate the front-end identifier and the string data to generate an access token.

[0272] In this embodiment, encryption methods include but are not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0273] Among them, the front-end identification code and the string data code are concatenated and encrypted through an encryption algorithm to obtain an access token.

[0274] S314: If a call request from the front end to call the service interface corresponding to the access list is received, an access token is sent to the front end so that the front end calls the service interface corresponding to the access list.

[0275] Specifically, the function of the service interface recorded in the access token is obtained. If the front end calls the service interface again, the corresponding access token is obtained according to the function of the service interface.

[0276] From the above embodiments, it can be seen that by serializing the access list, the generated string data and the front-end identifier are spliced ​​to generate an access token. When the front-end calls the same service interface, the access token is directly sent to the front-end to implement the call of the service interface, thereby improving the efficiency of calling the service interface.

[0277] Figure 4 A schematic diagram of the structure of a key-based data processing device provided in this application, such as Figure 4As shown, the key-based data processing device 40 provided in this embodiment includes: a first sending module 401, a first receiving module 402, a first loading module 403, a first generating module 404, a creating module 405, an operating module 406, a first reading module 407, a parsing module 408, an extracting module 409, a second generating module 410, an operating module 411, a second sending module 412, a second receiving module 413 and a processing module 414.

[0278] The first sending module 401 is used to send an access request to the server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0279] The first receiving module 402 is used to receive the H5 page sent by the server.

[0280] The first loading module 403 is used to load and run the H5 page in the first running environment.

[0281] The first generating module 404 is used to generate a decryption container corresponding to the H5 page by dynamic compilation when the H5 page is loaded.

[0282] The creation module 405 is used to create a second operating environment, wherein the second operating environment is isolated from the first operating environment.

[0283] The running module 406 is used to run the decryption container in the second running environment.

[0284] The first reading module 407 is used to read the shared object file of the H5 page through the decryption container to obtain the decryption algorithm.

[0285] The parsing module 408 is used to parse the key file by using a decryption algorithm through the decryption container to obtain the operation information corresponding to the original key.

[0286] The extraction module 409 is used to extract the encryption string and the concatenation constant from the operation information by decrypting the container.

[0287] The second generating module 410 is used to generate a constant string according to the concatenated constant by decrypting the container.

[0288] The operation module 411 is used to perform an XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key.

[0289] The second sending module 412 is used to send a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request.

[0290] The second receiving module 413 is used to receive the to-be-processed data sent by the server through the H5 page.

[0291] The processing module 414 is used to process the data to be processed in the H5 page according to the original key.

[0292] In one embodiment of the present application, the first generating module 404 includes:

[0293] The first acquisition unit 4041 is used to acquire the identification information and operation information of the front end during the loading process of the H5 page.

[0294] The creation unit 4042 is used to create a container list according to the identification information and the operation information.

[0295] The second obtaining unit 4043 is used to dynamically obtain the state information of the decrypted container according to the container list.

[0296] The compiling unit 4044 is used to compile the container list and the status information, and compile and generate a decrypted container.

[0297] In one embodiment of the present application, the creation module 405 includes:

[0298] The third obtaining unit 4051 is used to obtain the storage path of the decrypted container.

[0299] The reading unit 4052 is used to read the source code of the decryption container according to the storage path of the decryption container.

[0300] The first generating unit 4053 is used to generate a mount instruction according to the source code of the decrypted container.

[0301] The fourth acquisition unit 4054 is used to acquire the environment information of the first operating environment and create an operating isolation group according to the environment information of the first operating environment.

[0302] The deployment unit 4055 is used to deploy the source code of the decrypted container to the running isolation group through a mount instruction to create a second running environment.

[0303] In one embodiment of the present application, the processing module 414 includes:

[0304] The extraction unit 4141 is used to extract the transmission message from the data to be processed in the H5 page according to the original key.

[0305] The second generating unit 4142 is used to encrypt the transmission message according to the original key to generate an encrypted transmission message.

[0306] In one embodiment of the present application, the processing module 414 further includes:

[0307] The sending unit 4143 is used to send the encrypted transmission message to the server, so that the server decrypts the encrypted transmission message, obtains the transmission message, and verifies the transmission message. If the transmission message verification passes, the interface function is called according to the transmission message.

[0308] In one embodiment of the present application, the device 40 further includes:

[0309] The third receiving module 415 is used to receive an H5 page running load request sent by the server, wherein the H5 page running load request records the page data of the H5 page.

[0310] The second reading module 416 is used to read the page data of the H5 page and determine the request type of the H5 page.

[0311] The encapsulation module 417 is used to encapsulate the H5 page if the request type of the H5 page is a dynamic request, and store the H5 page loading configuration information in the front-end cache pool.

[0312] The second loading module 418 is used to obtain the static file from the server if the request type of the H5 page is a static request, and load the H5 page according to the static file.

[0313] In one embodiment of the present application, the device 40 further includes:

[0314] The third generating module 419 is used to generate a message data transmission request and send the message data transmission request to the server, so that the server obtains the certificate information according to the message data request.

[0315] The fourth receiving module 420 is used to receive the certificate information sent by the server and create a session key pair according to the certificate information; wherein the session key pair includes a session public key and a session private key.

[0316] The third sending module 421 is used to encrypt the transmission protocol by using the session public key, and send the encrypted transmission protocol and the session private key to the server, so that the server can decrypt the transmission protocol according to the session private key and generate decryption information.

[0317] The fifth receiving module 422 is used to receive the decryption information sent by the server, and if the decryption information indicates that the decryption is successful, send the encrypted transmission message to the server.

[0318] The key-based data processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0319] Figure 5 This is a schematic diagram of the structure of the key-based data processing device provided in this application. Figure 5As shown, the key-based data processing device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0320] In a specific implementation process, at least one processor 501 executes the computer execution instructions stored in the memory 502, so that at least one processor 501 executes the above-mentioned key-based data processing method.

[0321] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0322] An embodiment of the present application also provides a computer storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the above-mentioned key-based data processing method is implemented.

[0323] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the key-based data processing method as described above.

[0324] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0325] The modules described above as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0326] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0327] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the above-mentioned method in each embodiment of the present application.

[0328] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0329] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0330] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0331] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0332] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0333] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0334] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method based on a key, characterized in that: Applied to the front end, including: Sending an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file; Receive the H5 page sent by the server; Loading in the first operating environment to run the H5 page; During the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation; Creating a second operating environment, wherein the second operating environment is isolated from the first operating environment; In the second operating environment, running the decryption container; Read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm; Parsing the key file by using the decryption algorithm through the decryption container to obtain operation information corresponding to the original key; Extracting the encrypted string and the concatenation constant from the operation information through the decryption container; Generate a constant character string according to the concatenated constant by using the decryption container; Performing an XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key; Sending a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request; Receiving the data to be processed sent by the server through the H5 page; The data to be processed in the H5 page is processed according to the original key.

2. The method according to claim 1, characterized in that In the process of loading the H5 page, generating a decryption container corresponding to the H5 page by dynamic compilation, including: During the loading of the H5 page, obtaining identification information and operation information of the front end; Creating a container list according to the identification information and the operation information; Dynamically obtain the state information of the decrypted container according to the container list; The container list and the state information are compiled to generate a decrypted container.

3. The method according to claim 1, characterized in that The step of creating the second operating environment comprises: Obtaining a storage path of the decrypted container; Reading the source code of the decryption container according to the storage path of the decryption container; Generate a mount instruction according to the source code of the decrypted container; Obtaining environmental information of the first operating environment, and creating an operating isolation group according to the environmental information of the first operating environment; The source code of the decrypted container is deployed in the operation isolation group through the mount instruction to create the second operation environment.

4. The method according to claim 1, characterized in that: The processing of the data to be processed in the H5 page according to the original key includes: Extracting a transmission message from the data to be processed in the H5 page according to the original key; The transmission message is encrypted according to the original key to generate an encrypted transmission message.

5. The method according to claim 4, characterized in that After the encrypted transmission message is generated, the method further includes: The encrypted transmission message is sent to the server, so that the server decrypts the encrypted transmission message, obtains the transmission message, and verifies the transmission message. If the transmission message is verified, the interface function is called according to the transmission message.

6. The method according to claim 1, characterized in that Before receiving the H5 page sent by the server, it also includes: Receive a running and loading request for an H5 page sent by a server, wherein the running and loading request for the H5 page records page data of the H5 page; Read the page data of the H5 page and determine the request type of the H5 page; If the request type of the H5 page is a dynamic request, the H5 page is encapsulated and the H5 page loading configuration information is stored in the cache pool of the front end; If the request type of the H5 page is a static request, the static file of the server is obtained, and the H5 page is loaded according to the static file.

7. The method according to claim 1, characterized in that After the data to be processed in the H5 page is processed according to the original key, the method further includes: Generate a message data transmission request, and send the message data transmission request to the server, so that the server obtains the certificate information according to the message data request; Receive the certificate information sent by the server, and create a session key pair according to the certificate information; wherein the session key pair includes a session public key and a session private key; Encrypting the transmission protocol by using the session public key, and sending the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information; Receive the decryption information sent by the server, and if the decryption information is successfully decrypted, send the encrypted transmission message to the server.

8. A data processing method based on a key, characterized in that: Applied to the server, including: Receive access requests sent by the front end; Generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file; Send the H5 page to the front end so that the front end is loaded in the first operating environment to run the H5 page. During the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation, and a second operating environment is created, wherein the second operating environment is isolated from the first operating environment. In the second operating environment, the decryption container is run, and the shared object file of the H5 page is read through the decryption container to obtain a decryption algorithm, and the key file is parsed using the decryption algorithm to obtain operation information corresponding to the original key, and an encrypted string and a splicing constant are extracted from the operation information through the decryption container, a constant string is generated according to the splicing constant, and an XOR operation is performed on the encrypted string and the constant string to obtain the original key; Receive a data request sent by the H5 page, and obtain the data to be processed according to the data request; The data to be processed is sent to the H5 page of the front end, so that the front end processes the data to be processed in the H5 page according to the original key.

9. The method according to claim 8, characterized in that Generating an H5 page according to the access request includes: generating operation information according to the access request; Generate a key file according to the operation information; Generate an H5 page based on the key file.

10. The method according to claim 9, characterized in that The generating operation information according to the access request includes: Generate an original key and a constant character string according to the access request; Performing an XOR operation on the original key and the constant character string to generate an encrypted string; Performing a superposition operation on the constant character string to generate a concatenated constant; The operation information is generated according to the encrypted string and the concatenation constant.

11. The method according to claim 9, characterized in that The step of generating a key file according to the operation information includes: generating a user identifier according to the calculation information; Encrypting the user ID and generating a key pair corresponding to the user ID; Creating a mapping list according to the user identifier; The key pair corresponding to the user identification and the operation information are written into the mapping list to generate a key file.

12. The method according to claim 8, characterized in that After sending the data to be processed to the H5 page of the front end, it also includes: Receive the encrypted transmission message sent by the front end; Decrypting the encrypted transmission message; Verifying the transmission message, and if the transmission message passes the verification, calling the corresponding service interface according to the transmission message; Acquire the address information of the service interface, and create an access list according to the address information of the service interface; Add the address information of the service interface and the transmission message to the access list.

13. The method according to claim 12, characterized in that After adding the address information of the service interface and the transmission message to the access list, the method further includes: Performing serialization conversion on the access list to generate character string data; Obtaining a front-end identifier in the transmission message; Perform encryption and concatenation operations on the front-end identifier and the string data to generate an access token; If a call request is received from the front end to call the service interface corresponding to the access list, the access token is sent to the front end so that the front end calls the service interface corresponding to the access list.

14. A key-based data processing device, characterized in that: Applied to the front end, including: A first sending module, configured to send an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file; The first receiving module is used to receive the H5 page sent by the server; A first loading module, used for loading and running the H5 page in a first running environment; A first generating module is used to generate a decryption container corresponding to the H5 page by dynamic compilation during the loading of the H5 page; A creation module, used to create a second operating environment, wherein the second operating environment is isolated from the first operating environment; An operating module, used for operating the decryption container in the second operating environment; A first reading module, configured to read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm; A parsing module, used to parse the key file using the decryption algorithm through the decryption container to obtain operation information corresponding to the original key; An extraction module, used for extracting an encrypted string and a concatenation constant from the operation information through the decryption container; A second generating module, used to generate a constant character string according to the concatenated constant through the decryption container; A calculation module, used for performing an XOR operation on the encrypted string and the constant string through the decryption container to obtain an original key; A second sending module is used to send a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request; A second receiving module, used for receiving the to-be-processed data sent by the server through the H5 page; The processing module is used to process the data to be processed in the H5 page according to the original key.

15. A key-based data processing device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the key-based data processing method as described in any one of claims 1 to 7, or the key-based data processing method as described in any one of claims 8 to 13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the key-based data processing method as described in any one of claims 1 to 7, or the key-based data processing method as described in any one of claims 8 to 13.

17. A computer program product, characterized in that It comprises a computer program which, when executed by a processor, implements the key-based data processing method according to any one of claims 1 to 7, or the key-based data processing method according to any one of claims 8 to 13.

Images