Key-based data processing method, apparatus, device, medium, and program product

Abstract

The embodiment of the application provides a kind of data processing method, device, equipment, medium and program product based on key, it is applied to front end in data processing technical field, the method is by in service side, key is encrypted and written to key file by pre-setting encryption algorithm, key file is stored in H5 page, and it is sent to front end, the key file generated in service side cannot be cracked.The second running environment is created in front end, and the first running environment of loading and running H5 page and the second running environment of running decryption container are isolated, and the environment security of running decryption container is improved.The decryption container is generated by dynamic compilation, and the key file is read by decryption algorithm through decryption container, the whole decryption process of obtaining key file is carried out in container, avoid the process of H5 page decryption to obtain key file processing data is reversed and cracked, and then attack server interface problem, improve the security of server interface.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data processing method and device based on a key, equipment, a medium and a program product. BACKGROUND

[0002] Currently, the business functions of a mobile terminal are often implemented using an H5 page. When the H5 page interacts with a server, it will make an interface request to the server. In order to improve the security of the server interface, a developer will obfuscate the source code of the H5 page and write an encryption key in the source code. However, the encryption key recorded in the obfuscated code can be obtained after reverse logic analysis, and the logic processing mechanism of the interface can be inferred, resulting in reduced security of the server interface.

[0003] In the prior art, a developer uses a symmetric encryption method to encrypt the request interface message of a server to generate a request message body ciphertext and a symmetric encryption key. The generated symmetric encryption key is then encrypted asymmetrically to generate an asymmetric encryption key. The asymmetric encryption key and the request message body ciphertext are transmitted to the server side to realize data interaction.

[0004] However, in the prior art, the key of asymmetric encryption still needs to be stored in the source code of the H5 page. Since the source code of the H5 page is easy to be cracked after reverse logic analysis, the asymmetric encryption key stored in the source code is easy to be cracked, resulting in reduced security of the server interface. SUMMARY

[0005] The embodiments of the present application provide a data processing method and device based on a key, equipment, a medium and a program product to solve the problem of reduced security of the server interface in the prior art.

[0006] In a first aspect, the embodiments of the present application provide a data processing method based on a key, applied to a front end, comprising:

[0007] sending an access request to a server to make the server generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file;

[0008] receiving an H5 page sent by the server;

[0009] loading the H5 page in a first running environment to run the H5 page;

[0010] generating a decryption container corresponding to the H5 page by dynamic compilation during loading of the H5 page;

[0011] creating a second running environment, wherein the second running environment and the first running environment are isolated from each other;

[0012] running the decryption container in the second running environment;

[0013] reading, by the decryption container, a shared object file of the H5 page to obtain a decryption algorithm;

[0014] parsing, by the decryption container, the key file by using the decryption algorithm to obtain operation information corresponding to the original key;

[0015] extracting, by the decryption container, an encrypted string and a splicing constant from the operation information;

[0016] generating, by the decryption container, a constant string according to the splicing constant;

[0017] performing, by the decryption container, an exclusive or operation on the encrypted string and the constant string to obtain the original key;

[0018] sending, by the H5 page, a data request to the server to enable the server to obtain to-be-processed data according to the data request;

[0019] receiving, by the H5 page, to-be-processed data sent by the server;

[0020] processing, according to the original key, to-be-processed data in the H5 page.

[0021] In a possible design, the decryption container corresponding to the H5 page is generated by dynamic compilation during loading of the H5 page, including: obtaining identification information and running information of the front end during loading of the H5 page; creating a container list according to the identification information and the running information; dynamically obtaining state information of the decryption container according to the container list; and compiling the container list and the state information to generate the decryption container.

[0022] In a possible design, the second running environment is created, including: obtaining a storage path of the decryption container; reading source code of the decryption container according to the storage path of the decryption container; generating a mounting instruction according to the source code of the decryption container; obtaining environment information of the first running environment and creating a running isolation group according to the environment information of the first running environment; and deploying the source code of the decryption container to the running isolation group by using the mounting instruction to create the second running environment.

[0023] In a possible design, the processing of the to-be-processed data in the H5 page according to the original key includes: extracting a transmission message from the to-be-processed data in the H5 page according to the original key; and encrypting the transmission message according to the original key to generate an encrypted transmission message.

[0024] In a possible design, after the encrypted transmission message is generated, the method further includes: sending the encrypted transmission message to the server, so that the server decrypts the encrypted transmission message to obtain a transmission message, and verifies the transmission message; and if the transmission message passes the verification, invoking an interface function according to the transmission message.

[0025] In a possible design, before the H5 page sent by the server is received, the method further includes: receiving a running loading request of the H5 page sent by the server, where the running loading request of the H5 page records page data of the H5 page; reading the page data of the H5 page, judging a request type of the H5 page; if the request type of the H5 page is a dynamic request, performing encapsulation processing on the H5 page, and storing H5 page loading configuration information of the H5 page into a cache pool of the front end; and if the request type of the H5 page is a static request, obtaining a static file of the server, and loading the H5 page according to the static file.

[0026] In a possible design, after the to-be-processed data in the H5 page is processed according to the original key, the method further includes: generating a message data transmission request, and sending the message data transmission request to the server, so that the server obtains certificate information according to the message data transmission request; receiving the certificate information sent by the server, and creating a session key pair according to the certificate information, where the session key pair includes a session public key and a session private key; encrypting a transmission protocol through the session public key, and sending the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information; receiving the decryption information sent by the server, and if the decryption information is decrypted successfully, sending the encrypted transmission message to the server.

[0027] In a second aspect, an embodiment of the present application provides a data processing method based on a key, applied to a server, and including the following steps.

[0028] receiving an access request sent by the front end;

[0029] generating an H5 page according to the access request, where the H5 page includes a pre-generated key file;

[0030] send the H5 page to the front end, so that the front end loads the H5 page in a first running environment to run the H5 page, in the process of loading the H5 page, the H5 page corresponding decryption container is generated by dynamic compilation, and a second running environment is created, wherein the second running environment is isolated from the first running environment, in the second running environment, the decryption container is run, the shared object file of the H5 page is read through the decryption container to obtain a decryption algorithm, and the key file is parsed by using the decryption algorithm to obtain operation information corresponding to the original key, the encryption string and the splicing constant are extracted from the operation information through the decryption container, the constant string is generated according to the splicing constant, and the encryption string and the constant string are subjected to exclusive or operation to obtain the original key.

[0031] receive the data request sent by the H5 page, and obtain the to-be-processed data according to the data request;

[0032] send the to-be-processed data to the H5 page of the front end, so that the front end processes the to-be-processed data in the H5 page according to the original key.

[0033] In a possible design, the generating the H5 page according to the access request comprises: generating operation information according to the access request; generating a key file according to the operation information; and generating the H5 page according to the key file.

[0034] In a possible design, the generating the operation information according to the access request comprises: generating an original key and a constant string according to the access request; performing exclusive or operation on the original key and the constant string to generate an encryption string; performing superposition operation on the constant string to generate a splicing constant; and generating operation information according to the encryption string and the splicing constant.

[0035] In a possible design, the generating the key file according to the operation information comprises: generating a user identifier according to the operation information; encrypting the user identifier, and generating a key pair corresponding to the user identifier; creating a mapping list according to the user identifier; and writing the key pair corresponding to the user identifier and the operation information into the mapping list to generate a key file.

[0036] In a possible design, after the sending the to-be-processed data to the H5 page of the front end, the method further comprises: receiving an encrypted transmission message sent by the front end; decrypting the encrypted transmission message; verifying the transmission message, if the transmission message is verified, calling a corresponding service interface according to the transmission message; obtaining address information of the service interface, and creating an access list according to the address information of the service interface; and adding the address information of the service interface and the transmission message to the access list.

[0037] In a possible design, after the address information of the service interface and the transmission packet are added to the access list, the method further includes: performing serialization conversion on the access list to generate string data; obtaining a front-end identifier in the transmission packet; performing encryption splicing operation on the front-end identifier and the string data to generate an access token; and if a front end calls a calling request of the service interface corresponding to the access list, sending the access token to the front end to enable the front end to call the service interface corresponding to the access list.

[0038] In a third aspect, an embodiment of the present application provides a data processing apparatus based on a key, applied to a front end, and including:

[0039] A first sending module is configured to send an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0040] A first receiving module is configured to receive an H5 page sent by the server.

[0041] A first loading module is configured to load the H5 page in a first running environment to run the H5 page.

[0042] A first generating module is configured to generate a decryption container corresponding to the H5 page by dynamic compilation during loading of the H5 page.

[0043] A creating module is configured to create a second running environment, wherein the second running environment and the first running environment are isolated from each other.

[0044] A running module is configured to run the decryption container in the second running environment.

[0045] A first reading module is configured to read a shared object file of the H5 page through the decryption container to obtain a decryption algorithm.

[0046] An analyzing module is configured to analyze the key file by using the decryption algorithm through the decryption container to obtain operation information corresponding to an original key.

[0047] An extracting module is configured to extract an encrypted string and a splicing constant from the operation information through the decryption container.

[0048] A second generating module is configured to generate a constant string according to the splicing constant through the decryption container.

[0049] An operation module is configured to perform XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key.

[0050] The second sending module is configured to send a data request to the server through the H5 page, so that the server obtains to-be-processed data according to the data request.

[0051] The second receiving module is configured to receive the to-be-processed data sent by the server through the H5 page.

[0052] The processing module is configured to process the to-be-processed data in the H5 page according to the original key.

[0053] In a fourth aspect, an embodiment of the present application provides a key-based data processing device, including a memory and a processor.

[0054] The memory stores computer execution instructions.

[0055] The processor executes the computer execution instructions stored in the memory, so that the processor executes the key-based data processing method as described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0056] In a fifth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer execution instructions. The computer execution instructions are executed by a processor to implement the key-based data processing method as described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0057] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. The computer program is executed by a processor to implement the key-based data processing method as described in the first aspect and / or the second aspect and various possible designs of the first aspect and / or the second aspect.

[0058] The key-based data processing method, device, equipment, medium and program product provided by the embodiments of the present application can encrypt the key into a key file by pre-setting an encryption algorithm on the server side, store the key file into an H5 page, and send it to the front end. The key file generated on the server side cannot be cracked. The front end creates a second running environment to isolate the first running environment of the H5 page and the second running environment of the decryption container, thereby improving the environmental security of the decryption container. The decryption container is generated by using dynamic compilation, the decryption algorithm reads the key file through the decryption container, the whole process of decrypting the key file is performed in the container, the process of decrypting the key file to obtain the processing data of the H5 page is avoided to be reversed and cracked, and the server interface is further attacked. The security of the server interface is improved. BRIEF DESCRIPTION OF DRAWINGS

[0059] The accompanying drawings, which are incorporated herein and constitute part of this specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0060] Figure 1 A scenario diagram of a key-based data processing method provided in the application is shown in the following figure.

[0061] Figure 2 A flowchart of a key-based data processing method provided in an embodiment of the application is shown in the following figure.

[0062] Figure 3 A flowchart of a key-based data processing method provided in an embodiment of the application is shown in the following figure.

[0063] Figure 4 A structure diagram of a key-based data processing apparatus provided in the application is shown in the following figure.

[0064] Figure 5 A structure diagram of a key-based data processing device provided in the application is shown in the following figure.

[0065] The specific embodiments of the application have been shown in the above figures, and will be described in more detail hereinafter. These figures and the written description are not intended to constrain the scope of the concept of the application in any way, but to illustrate the concept of the application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0066] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements in the several figures. The following exemplary embodiments described herein describe implementations consistent with the present application, but do not represent all implementations consistent with the present application. Rather, they are merely examples in accordance with some aspects of the present application as detailed in the appended claims.

[0067] In the technical solution of the present application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data comply with relevant laws and regulations and do not violate public order and good customs.

[0068] It should be noted that in the embodiments of the present application, some existing industry solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but does not mean that the applicant has or will necessarily use the solution.

[0069] First, the terms involved in the present application are explained:

[0070] H5 page: refers to a webpage developed using HTML5 technology, HTML5 is the next generation standard of the Internet, which is a language way to build and present Internet content. Compared with traditional PC webpages, H5 pages are suitable for browsing on mobile devices and provide better user experience;

[0071] Container: a runtime environment for managing and executing applications. It provides a standardized environment so that applications can run on different servers without modification.

[0072] Figure 1 The scene diagram of the key-based data processing method provided in the application is shown in FIG. 1, which includes a front end 10 and a server 20. Figure 1

[0073] The front end 10 includes a receiving device 101, a processor 102, and a display device 103.

[0074] The server 20 includes a receiving device 201, a processor 202, and a display device 203.

[0075] It can be understood that the structure illustrated in the embodiments of the application does not constitute a specific limitation on the article identification method. In other feasible embodiments of the application, the above architecture can include more or fewer components than the illustration, or combine certain components, or split certain components, or different component arrangement, which can be determined according to the actual application scenario, and is not limited herein. Figure 1 The components shown can be realized in hardware, software, or a combination of software and hardware.

[0076] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, which can receive the H5 page sent by the server.

[0077] The processor 102 can execute a preset algorithm to obtain an original key by decrypting the container, and process the to-be-processed data according to the original key.

[0078] The display device 103 can be used to display the to-be-processed data and the like.

[0079] In the specific implementation process, the receiving device 201 can be an input / output interface or a communication interface, which can obtain an H5 page creation request.

[0080] The processor 202 can generate an H5 page.

[0081] The display device 203 can be used to display the H5 page and the like.

[0082] ​The display device can also be a touch display screen for receiving user instructions while displaying the aforementioned content to achieve interactive operation with the user.

[0083] It should be understood that the above processor can be implemented by the processor reading the instructions in the memory and executing the instructions, or by a chip circuit.

[0084] In addition, the network architecture and service scenarios described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of network architecture and the appearance of new service scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0085] In combination with the above scenarios, it can be known that in the prior art, the developer uses symmetric encryption to encrypt the request interface message of the server to generate a request message body ciphertext and a symmetric encryption key. The generated symmetric encryption key is further encrypted by asymmetric encryption to generate an asymmetric encryption key. The asymmetric encryption key and the request message body ciphertext are transmitted to the server side to realize data interaction. However, in the prior art, the key of asymmetric encryption still needs to be stored in the source code of the H5 page. Since the source code of the H5 page is easy to be cracked by reverse logic analysis, the key of asymmetric encryption stored in the source code is easy to be cracked, which reduces the security of the server interface.

[0086] To solve the above technical problems, the embodiments of the present application propose the following technical ideas: the inventor considers pre-generating a key file on the server side and storing the key file in the H5 page; considers loading and running the H5 page in a first running environment and creating a second running environment, and running a decryption container in the second running environment to isolate the running environment of the H5 page from the running environment of the decryption container, thereby improving the security of the environment of the decryption container; considers dynamically compiling a decryption container on the front end to read the H5 page using the decryption container, parse the operation information in the key file, execute a preset algorithm on the operation information to obtain an original key, process data using the original key, and execute a decryption process in the decryption container to improve the security of the decryption process, avoid the original key being cracked in the source code, and thereby improve the security of the server interface.

[0087] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0088] Figure 2A flowchart of a key-based data processing method provided for an embodiment of the present application. The execution subject of the embodiment can be a front end, which is not particularly limited here. As shown in Figure 2 The method includes the following steps.

[0089] S201: Send an access request to a server to enable the server to generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0090] In this embodiment, the access request is a creation request for the H5 page.

[0091] In this embodiment, the server is a device that provides user services for creating the H5 page.

[0092] The type of the server includes but is not limited to a web server, a user information server, and a database server.

[0093] The user services provided by the server include but are not limited to password retrieval, balance inquiry, and business handling.

[0094] In this embodiment, the content recorded in the H5 page includes but is not limited to page source code, page function code, and a key file.

[0095] In this embodiment, the front end is a device that loads the H5 page for the user, including but not limited to a mobile phone, a computer, and a tablet.

[0096] Specifically, when the H5 page is sent to the front end, the H5 page sends a message to the interface of the server through a request to the interface of the server to realize data interaction with the server, and realizes the corresponding function through data interaction with different function interfaces of the server.

[0097] In this embodiment, the pre-generated key file is a key file generated by a developer according to a pre-set encryption algorithm.

[0098] S202: Receive the H5 page sent by the server.

[0099] Specifically, the front end receives the H5 page sent by the server through wireless communication.

[0100] S203: Load and run the H5 page in a first running environment.

[0101] In this embodiment, the first running environment is a running environment for the front end operating system to run the H5 page.

[0102] The type of the first running environment includes but is not limited to a browser, a small program, and a WebView application.

[0103] S204: During the loading of the H5 page, a decryption container corresponding to the H5 page is generated by dynamic compilation.

[0104] In this embodiment, when the current front-end loads and runs the H5 page, the decryption container is dynamically compiled and generated according to the key file in the H5 page.

[0105] In this embodiment, the decryption container is created by the H5 page using JavaScript.

[0106] In this embodiment, the decryption container is a temporary storage object that stores the decryption algorithm of the shared object file.

[0107] In this embodiment, the decryption algorithm in the decryption container corresponds to the encryption algorithm in the key file.

[0108] S205: Create a second running environment, wherein the second running environment is isolated from the first running environment.

[0109] In this embodiment, the second running environment is a virtual environment that runs the decryption container.

[0110] The type of the second running environment includes but is not limited to a virtual machine, a Docker environment, and a Python virtual environment.

[0111] Specifically, the front-end obtains the storage path of the decryption container, reads the source code of the decryption container according to the storage path of the decryption container, generates a mounting instruction, obtains the environment information of the first running environment, and creates a running isolation group according to the environment information of the first running environment. The source code of the decryption container is deployed in the running isolation group through the mounting instruction to create the second running environment.

[0112] S206: Run the decryption container in the second running environment.

[0113] Specifically, the second running environment pulls the container image of the second running environment through a command line tool, and runs the decryption container according to a running function.

[0114] The form of the command line tool pulling the container image includes but is not limited to a docker pull command, a docker library, and a dockerfile command.

[0115] S207: Read the shared object file of the H5 page through the decryption container to obtain the decryption algorithm.

[0116] In this embodiment, the shared object file is an so file, and the so file is stored in the so library in the H5 page loading project.

[0117] In this embodiment, the decryption algorithm of the decryption key file is recorded in the shared object file.

[0118] The method for writing the decryption algorithm in the decryption key file includes, but is not limited to, C language, C++ language and JNI technology.

[0119] Specifically, the decryption container reads the so file of the so library of the H5 page loading project through an I / O operation, and obtains the decryption algorithm recorded in the so file.

[0120] S208: The decryption container parses the key file by using the decryption algorithm to obtain the operation information corresponding to the original key.

[0121] In this embodiment, the operation information includes an encryption string and a splicing constant.

[0122] Specifically, the decryption container reads the shared object file in the shared object library in the H5 page loading project, and parses the key file by using the decryption algorithm in the shared object file to obtain the operation information corresponding to the original key.

[0123] S209: The decryption container extracts the encryption string and the splicing constant from the operation information.

[0124] In this embodiment, the splicing constant is binary data generated by superimposing a fixed length of redundancy on a constant string.

[0125] S210: The decryption container generates a constant string according to the splicing constant.

[0126] Specifically, the decryption container locates the position of the splicing constant in the operation information by using the decryption algorithm, and restores the constant string according to the splicing rule of the splicing constant in the shared object file.

[0127] S211: The decryption container performs an exclusive or operation on the encryption string and the constant string to obtain the original key.

[0128] In this embodiment, the encryption string is generated by performing an exclusive or operation on the original key and the constant string.

[0129] For example, if the original key is 1011 and the constant string is 0111, the exclusive or operation of the original key and the constant string is 1100, and the exclusive or operation of the encryption string 1100 and the constant string 0111 can obtain the original key 1011.

[0130] S212: The H5 page sends a data request to the server, so that the server obtains the to-be-processed data according to the data request.

[0131] Specifically, when the original key is decrypted by the decryption container, the H5 page generates a data request, and sends the data request to the server through wireless communication. The server obtains the corresponding to-be-processed data according to the data request.

[0132] In this embodiment, the to-be-processed data is a data file corresponding to the H5 page calling the server interface.

[0133] The format of the data file includes but is not limited to an exe file, a sys file and an app file.

[0134] S213: receiving the to-be-processed data sent by the server through the H5 page.

[0135] Specifically, the to-be-processed data sent by the server is received through wireless communication.

[0136] The to-be-processed data is sent to the front end after being encrypted by the server.

[0137] The encryption method includes but is not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0138] S214: processing the to-be-processed data in the H5 page according to the original key.

[0139] In this embodiment, the to-be-processed data is message data of the H5 page requesting the interface of the server.

[0140] Specifically, the H5 page encrypts the message data of the interface request by using the original key, and sends the encrypted message data to the server. The server verifies the encrypted message data, so as to realize the calling of the interface of the server by the H5 page.

[0141] From the above embodiment, it can be known that the key is encrypted and written into the key file by pre-setting the encryption algorithm on the server, the key file is stored in the H5 page and sent to the front end, and the key file generated on the server cannot be cracked. The front end creates a second running environment to isolate the first running environment of the H5 page and the second running environment of the decryption container, thereby improving the environmental security of the decryption container. The decryption container is generated by using dynamic compilation, the decryption algorithm reads the key file through the decryption container, the whole process of decrypting the key file is performed in the container, the process of the H5 page decrypting the key file to obtain the processing data is avoided to be reversed and cracked, and the server interface is further attacked, thereby improving the security of the server interface.

[0142] In an embodiment of the present application, step S204 includes:

[0143] S2041: obtaining the identification information and running information of the front end during the loading process of the H5 page.

[0144] In the embodiment, the content recorded in the running information includes a page state being a running state and a page state being a stop state.

[0145] In the embodiment, the content recorded in the identification information of the front end includes but is not limited to a name of the front end, a serial number of the front end, and a storage capacity of the front end.

[0146] S2042: creating a container list according to the identification information and the running information.

[0147] In the embodiment, the container list is created according to the identification information, the running information, and a UI element.

[0148] S2043: dynamically obtaining state information of a decryption container according to the container list.

[0149] Specifically, each time the container list is updated, the H5 page synchronizes the latest state of the container list through a synchronization function.

[0150] S2044: compiling the container list and the state information to generate the decryption container.

[0151] Specifically, the container list and the state information of the container are updated through a compilation function, and the UI is updated in the front end to generate the decryption container.

[0152] The compilation function includes but is not limited to an adding function, an updating function, and a traversal function.

[0153] In the embodiment, the running environment of the decryption container includes but is not limited to a JavaScript environment, a Web environment, and a Wasm environment.

[0154] From the above embodiments, it can be seen that the container list is created by obtaining the identification information and the running information of the front end, the state information of the decryption container is obtained, the container list and the state information are dynamically compiled, the decryption container is generated, and the decryption process is executed by using the decryption container, thereby improving the security of data.

[0155] In an embodiment of the present application, step S205 includes:

[0156] S2051: obtaining a storage path of the decryption container.

[0157] In the embodiment, the type of the storage path includes but is not limited to a relative path, an absolute path, and a database path.

[0158] In the embodiment, the method of obtaining the storage path of the decryption container includes but is not limited to an access function, an external storage directory of the decryption container, and an internal storage directory of the decryption container.

[0159] S2052: Read the source code of the decrypted container according to the storage path of the decrypted container.

[0160] Specifically, by creating a method function for reading the source code, the storage path is set in the method to read the source code of the decrypted container.

[0161] S2053: Generate a mounting instruction according to the source code of the decrypted container.

[0162] Specifically, the mounting instruction is generated according to different file systems in which the source code is located.

[0163] The file system includes but is not limited to the proc file system, the dev file system and the tmp file system.

[0164] S2054: Obtain environment information of the first running environment, and create a running isolation group according to the environment information of the first running environment.

[0165] Specifically, the environment information of the first running environment is obtained, the first running environment information is added to the dynamic replacement plug-in, and the running isolation group is created through the dynamic replacement plug-in.

[0166] S2055: Deploy the source code of the decrypted container in the running isolation group through the mounting instruction to create a second running environment.

[0167] Specifically, the tool for compiling the source code of the decrypted container is deployed in the running isolation group, and the root directory of the tool for compiling the source code of the decrypted container is configured to create the second running environment.

[0168] From the above embodiment, by obtaining the storage path of the decrypted container, reading the source code of the decrypted container according to the path, generating a mounting instruction, obtaining the first running environment information, creating a running isolation group according to the first running environment information, and deploying the source code of the decrypted container in the running isolation group through the mounting instruction, a second running environment is created to improve the security of the decrypted container running.

[0169] In an embodiment of the present application, step S214 includes:

[0170] S2141: Extract a transmission message from the to-be-processed data in the H5 page according to the original key.

[0171] In this embodiment, the transmission message is a message data that the H5 page requests a port service of the server, wherein the transmission message records the request protocol format of the H5 page and the server.

[0172] S2142: Encrypt the transmission message according to the original key to generate an encrypted transmission message.

[0173] In the embodiment, the original key is used to encrypt the transmission message, and after the encryption process is completed, the original key is stored in the key file.

[0174] In the embodiment, the original key is an RSA encryption public key.

[0175] The RSA encryption public key is an asymmetric encryption key, and the form of the original key includes but is not limited to an ECC key, a DSA key, and an EIGamal key.

[0176] In addition, it should be noted that another form of encrypted transmission message is that the transmission message is encrypted by a symmetric encryption method, and the symmetric encryption key is encrypted by the original key and saved in the code of the H5 page.

[0177] As can be seen from the above embodiment, the transmission message transmitted to the server is encrypted by the original key, the original key obtained by the decryption container is not easy to be cracked and obtained, and the transmission message is encrypted by the original key obtained by the decryption container, thereby improving the security of data transmission between the H5 page and the server.

[0178] In an embodiment of the present application, after step S2142, the method further comprises:

[0179] S2143: sending the encrypted transmission message to the server, so that the server decrypts the encrypted transmission message to obtain the transmission message, and verifies the transmission message, and if the transmission message is verified, the interface function is called according to the transmission message.

[0180] Specifically, the server obtains the encrypted private key corresponding to the original key according to the encrypted message, decrypts the encrypted transmission message by using the encrypted private key, verifies the request protocol format in the transmission message, and if the verification is passed, the interface is called according to the interface function called by the H5 request in the transmission message, so as to realize the calling of the interface of the server by the H5 page.

[0181] As can be seen from the above embodiment, the transmission message is decrypted by the server, and the request protocol format in the transmission message is verified, and if the verification is passed, the interface function of the server is allowed to be called by the H5 page, thereby improving the security of the server interface.

[0182] In an embodiment of the present application, before step S202, the method further comprises:

[0183] S401: receiving a running loading request of an H5 page sent by a server, wherein the running loading request of the H5 page records page data of the H5 page.

[0184] In the embodiment, the page data includes but is not limited to a request header, server information, and loading request information.

[0185] S402: Read the page data of the H5 page, and determine the request type of the H5 page.

[0186] Specifically, the request type of the H5 page is determined according to the request header in the H5 page data.

[0187] The information recorded in the request header includes static information and dynamic information.

[0188] S403: If the request type of the H5 page is dynamic request, the H5 page is encapsulated, and the H5 page loading configuration information is stored in the cache pool of the front end.

[0189] Specifically, if the information recorded in the request header is dynamic information, the H5 page is encapsulated according to the preset encapsulation protocol, and the H5 page loading configuration information is stored in the front cache pool.

[0190] The H5 page loading configuration information includes but is not limited to html file, css file, JavaScript file and picture text file.

[0191] The dynamic information includes but is not limited to information identifying the client software, the URL of the request source and the authentication information.

[0192] S404: If the request type of the H5 page is static request, the static file of the server is obtained, and the H5 page is loaded according to the static file.

[0193] Specifically, if the information recorded in the request header is static information, the static Web server is sent through the HTTPS transmission protocol, the static file sent by the static Web server in response to the request information is received, and the static file is sent to the H5 page for completing the data loading of the H5 page.

[0194] From the above embodiment, it can be seen that by obtaining the request type of the H5 page, different request types are distinguished, and the loading mode of the H5 page is confirmed according to different request types, so that the loading speed of the H5 page is improved.

[0195] In an embodiment of the present application, after step S214, the following steps are further included:

[0196] S215: Generate a message data transmission request, and send the message data transmission request to the server, so that the server obtains the certificate information according to the message data request.

[0197] In this embodiment, the message data transmission request records the data format, communication protocol and request URL of the to-be-transmitted message.

[0198] The request URL is the address of the server.

[0199] The communication protocol includes, but is not limited to, HTTP, POP3, TCP and SSH.

[0200] In the embodiment, the content recorded in the certificate information includes, but is not limited to, certificate CA, certificate validity period, certificate serial number and certificate extension information.

[0201] S216: receiving the certificate information sent by the server and creating a session key pair according to the certificate information; wherein the session key pair includes a session public key and a session private key.

[0202] In the embodiment, the type of the session key pair includes, but is not limited to, symmetric key, asymmetric key and hybrid key.

[0203] S217: encrypting the transmission protocol by the session public key, and sending the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information.

[0204] In the embodiment, after the server decrypts the transmission protocol, the server traverses the server backend transmission protocol database to determine whether the transmission protocol of the front end is recorded in the transmission protocol database.

[0205] S218: receiving the decryption information sent by the server, and if the decryption information is decryption success, sending the encrypted transmission message to the server.

[0206] In the embodiment, the key used for encrypting the transmission message includes, but is not limited to, symmetric key, asymmetric key and hybrid key.

[0207] Specifically, the encrypted transmission message is transmitted to the server by a wireless communication mode.

[0208] From the above embodiment, it can be known that by creating a session key pair according to the certificate information of the server, encrypting the transmission protocol by the session public key in the session key pair, decrypting the transmission protocol by the server, verifying the transmission protocol to generate decryption information, if the server verifies successfully, the front end transmits the encrypted transmission message by the transmission protocol, and the transmission protocol of the front end and the server is encrypted, thereby improving the security of the transmission process.

[0209] Figure 3 A flowchart of a data processing method based on a key provided by an embodiment of the application is shown. The execution subject of the embodiment can be a server, which is not particularly limited here. As shown in the figure, the method includes: Figure 3

[0210] S301: receiving an access request sent by a front end.

[0211] Specifically, the access request sent by the front end is received by a wireless communication mode.​

[0212] In this embodiment, the access request is a request for running an H5 page in the front end.

[0213] S302: generating an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0214] Specifically, the H5 page generates a primary key and a constant string according to the creation request, performs an XOR operation on the constant string and the primary key to generate an encrypted string, performs an overlay operation on the constant string to obtain a spliced constant, records the spliced constant and the encrypted string in the key file, and writes the key file into the H5 page.

[0215] S303: sending the H5 page to the front end to load and run the H5 page in a first running environment, generating a decryption container corresponding to the H5 page by dynamic compilation during the loading of the H5 page, and creating a second running environment, wherein the second running environment is isolated from the first running environment, in the second running environment, running the decryption container, reading a shared object file of the H5 page through the decryption container to obtain a decryption algorithm, and using the decryption algorithm to parse the key file to obtain operation information corresponding to the primary key, extracting the encrypted string and the spliced constant from the operation information through the decryption container, generating a constant string according to the spliced constant, performing an XOR operation on the encrypted string and the constant string to obtain the primary key.

[0216] Specifically, when the front end loads and runs the H5 page in the first running environment, the decryption container is generated by dynamic compilation, and the second running environment is created, the first running environment is isolated from the second running environment, the decryption container is run in the second running environment, the shared object file of the H5 page is read through the decryption container to obtain a decryption algorithm, the key file is parsed by the decryption algorithm through the decryption container to obtain operation information corresponding to the primary key, the encrypted string and the spliced constant are extracted from the operation information, the constant string is generated according to the spliced constant, the XOR operation is performed on the encrypted string and the constant string to obtain the primary key.

[0217] S304: receiving a data request sent by the H5 page, and obtaining to-be-processed data according to the data request.

[0218] Specifically, after the decryption container decrypts the primary key, the H5 page generates a data request, the front end sends the data request to the server through wireless communication, and the server obtains the corresponding to-be-processed data according to the data request.

[0219] In this embodiment, the to-be-processed data is a data file corresponding to the service interface called by the H5 page.

[0220] S305: send the to-be-processed data to the H5 page of the front end, so that the front end processes the to-be-processed data in the H5 page according to the original key.

[0221] Specifically, the to-be-out data is sent to the H5 page of the front end in a wireless communication manner.

[0222] The to-be-processed data is sent to the front end after the server-side encryption operation.

[0223] The encryption manner includes, but is not limited to, symmetric encryption, asymmetric encryption, and hybrid encryption.

[0224] From the above embodiment, it can be seen that the key is encrypted and written to the key file by pre-setting the encryption algorithm on the server side, the key file is stored in the H5 page and sent to the front end, and the key file generated on the server side cannot be cracked. The front end creates a second running environment to isolate the first running environment of the H5 page and the second running environment of the decryption container, thereby improving the environment security of the decryption container. The decryption container is generated by dynamic compilation, the decryption algorithm reads the key file through the decryption container, the entire process of decrypting the key file is performed in the container, thereby avoiding the process of decrypting the key file to obtain the data of the H5 page being reverse cracked, and further attacking the server interface, thereby improving the security of the server interface.

[0225] In an embodiment of the present application, step S302 comprises:

[0226] S3021: generating operation information according to the access request.

[0227] Specifically, step S3021 comprises:

[0228] Step a: generating an original key and a constant string according to the access request.

[0229] In this embodiment, the original key is an RSA encryption public key, and the constant string is a constant of fixed length.

[0230] Step b: performing XOR operation on the original key and the constant string to generate an encrypted string.

[0231] In this embodiment, the operation form of the original key and the constant string includes, but is not limited to, XOR operation, XNOR operation, and combination of XOR operation and XNOR operation.

[0232] Step c: performing superposition operation on the constant string to generate a spliced constant.

[0233] Specifically, a constant of fixed length is added in front of and behind the constant string to generate a spliced constant.

[0234] Step d: generating operation information according to the encrypted string and the splicing constant.

[0235] Specifically, the encrypted string and the splicing constant are recorded as operation information and added to the key file.

[0236] S3022: generating the key file according to the operation information.

[0237] In this embodiment, the key file is an.s file, the.s file is a binary file, and the encrypted information of the RSA public key is recorded.

[0238] S3023: generating the H5 page according to the key file.

[0239] In this embodiment, the content recorded in the H5 page includes but is not limited to the key file, the loading project, and the function project.

[0240] As can be seen from the above embodiment, by performing XOR operation on the original key and the constant string to generate an encrypted string, and performing superposition operation on the constant string to obtain a splicing constant, the constant is hidden by splicing, avoiding the constant being easily discovered, the operation information is written into the key file, the key file is written into the H5 page, and then the difficulty of obtaining the original key is improved, and the security of the original key is improved.

[0241] In an embodiment of the present application, step S3022 comprises:

[0242] Step a: generating a user identifier according to the operation information.

[0243] In this embodiment, the content recorded in the user identifier includes but is not limited to the name, serial number and running state of the front end.

[0244] Step b: encrypting the user identifier and generating a key pair corresponding to the user identifier.

[0245] In this embodiment, the encryption method of the user identifier includes but is not limited to symmetric encryption, asymmetric encryption and hybrid encryption.

[0246] Step c: creating a mapping list according to the user identifier.

[0247] In this embodiment, the mapping list is saved in the cache of the front end page.

[0248] In this embodiment, the developer sets the validity time of the mapping list to set the storage time of the mapping list in the cache.

[0249] Step d: writing the key pair corresponding to the user identifier and the operation information into the mapping list to generate the key file.

[0250] In the embodiment, the content recorded in the mapping list includes but is not limited to the key pair corresponding to the user identifier, the operation information, and the storage duration of the mapping list.

[0251] From the above embodiment, it can be seen that by generating the front-end user identifier for the operation information in the key file, the user identifier is encrypted, the key pair is generated, the mapping list is created, the key pair and the operation information are written into the mapping list, and the mapping list is recorded in the key file, so that the corresponding front-end user can be queried according to the mapping list.

[0252] In an embodiment of the present application, after step S305, the method further comprises:

[0253] S306: receiving the encrypted transmission message sent by the front end.

[0254] In the embodiment, the encryption manner of the transmission message includes but is not limited to symmetric encryption, asymmetric encryption, and hybrid encryption.

[0255] S307: decrypting the encrypted transmission message.

[0256] Specifically, the server obtains the encrypted private key corresponding to the original key according to the encrypted message, and decrypts the encrypted transmission message by using the encrypted private key.

[0257] S308: verifying the transmission message, and if the transmission message is verified, calling the corresponding service interface according to the transmission message.

[0258] Specifically, the corresponding service interface of the server is queried according to the interface function and the interface address recorded in the transmission message, and if the transmission message is verified, the corresponding service interface is called.

[0259] S309: obtaining the address information of the service interface, and creating an access list according to the address information of the service interface.

[0260] In the embodiment, the address information of the service interface includes but is not limited to a protocol, an identifier, and a domain name.

[0261] S310: adding the address information of the service interface and the transmission message to the access list.

[0262] Specifically, the transmission identifier recorded in the transmission message is obtained, and the transmission identifier and the address information of the called service interface are added to the access list.

[0263] From the above embodiment, it can be seen that by decrypting the encrypted transmission message by the server, creating the access list according to the transmission message, and recording the transmission message and the address information of the service interface in the access list, the transmission message and the corresponding service interface called can be queried.

[0264] In an embodiment of the present application, after S310, further comprising:

[0265] S311: serializing the access list to generate string data.

[0266] Specifically, a serialization method is selected, a corresponding serialization library is imported, and the access list is input into the serialization library to generate string data.

[0267] The serialization method includes a pickle method and a json method.

[0268] S312: obtaining a front-end identifier in the transmission message.

[0269] In the embodiment, the front-end identifier is an identifier generated after the front end initiates a port call request.

[0270] The content recorded in the identifier includes but is not limited to the time of initiating the request, the file size of the transmission message, and the port name of the call.

[0271] S313: encrypting and splicing the front-end identifier and the string data to generate an access token.

[0272] In the embodiment, the encryption method includes but is not limited to symmetric encryption, asymmetric encryption, and hybrid encryption.

[0273] The code of the front-end identifier and the code of the string data are spliced and then encrypted by an encryption algorithm to obtain the access token.

[0274] S314: if a call request for a service interface corresponding to the access list is received, the access token is sent to the front end to call the service interface corresponding to the access list.

[0275] Specifically, the function of the service interface recorded in the access token is obtained, and if the front end calls the service interface again, the corresponding access token is obtained according to the function of the service interface.

[0276] As can be seen from the above embodiment, by serializing the access list to generate string data and splicing the string data and the front-end identifier to generate an access token, when the front end calls the same service interface, the access token is directly sent to the front end, and the service interface can be called, thereby improving the efficiency of calling the service interface.

[0277] Figure 4 The structure diagram of the key-based data processing device provided in the present application is as follows: Figure 4As shown, the key-based data processing device 40 provided in this embodiment includes: a first sending module 401, a first receiving module 402, a first loading module 403, a first generating module 404, a creating module 405, an operating module 406, a first reading module 407, a parsing module 408, an extraction module 409, a second generating module 410, an operation module 411, a second sending module 412, a second receiving module 413 and a processing module 414.

[0278] The first sending module 401 is used to send an access request to the server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file.

[0279] The first receiving module 402 is used to receive the H5 page sent by the server.

[0280] The first loading module 403 is used to load and run the H5 page in the first running environment.

[0281] The first generating module 404 is used to generate a decryption container corresponding to the H5 page by dynamic compilation when the H5 page is loaded.

[0282] The creation module 405 is configured to create a second operating environment, wherein the second operating environment is isolated from the first operating environment.

[0283] The running module 406 is used to run the decryption container in the second running environment.

[0284] The first reading module 407 is configured to read the shared object file of the H5 page through the decryption container to obtain a decryption algorithm.

[0285] The parsing module 408 is used to parse the key file using a decryption algorithm through the decryption container to obtain operation information corresponding to the original key.

[0286] The extraction module 409 is used to extract the encrypted string and the concatenation constant from the operation information by decrypting the container.

[0287] The second generating module 410 is configured to generate a constant string according to the concatenated constant by decrypting the container.

[0288] The operation module 411 is used to perform an XOR operation on the encrypted string and the constant string through the decryption container to obtain the original key.

[0289] The second sending module 412 is used to send a data request to the server through the H5 page, so that the server obtains the data to be processed according to the data request.

[0290] The second receiving module 413 is used to receive the data to be processed sent by the server through the H5 page.

[0291] The processing module 414 is configured to process the to-be-processed data in the H5 page according to the original key.

[0292] In an embodiment of the present application, the first generation module 404 comprises:

[0293] The first acquisition unit 4041 is configured to acquire the identification information and the running information of the front end during loading of the H5 page.

[0294] The creation unit 4042 is configured to create a container list according to the identification information and the running information.

[0295] The second acquisition unit 4043 is configured to dynamically acquire state information of the decryption container according to the container list.

[0296] The compiling unit 4044 is configured to compile the container list and the state information to generate the decryption container.

[0297] In an embodiment of the present application, the creation module 405 comprises:

[0298] The third acquisition unit 4051 is configured to acquire a storage path of the decryption container.

[0299] The reading unit 4052 is configured to read source code of the decryption container according to the storage path of the decryption container.

[0300] The first generation unit 4053 is configured to generate a mounting instruction according to the source code of the decryption container.

[0301] The fourth acquisition unit 4054 is configured to acquire environment information of the first running environment, and create a running isolation group according to the environment information of the first running environment.

[0302] The deployment unit 4055 is configured to deploy the source code of the decryption container to the running isolation group through the mounting instruction to create a second running environment.

[0303] In an embodiment of the present application, the processing module 414 comprises:

[0304] The extraction unit 4141 is configured to extract a transmission packet from the to-be-processed data in the H5 page according to the original key.

[0305] The second generation unit 4142 is configured to encrypt the transmission packet according to the original key to generate an encrypted transmission packet.

[0306] In an embodiment of the present application, the processing module 414 further comprises:

[0307] The sending unit 4143 is configured to send the encrypted transmission message to the server, so that the server decrypts the encrypted transmission message to obtain the transmission message, and verifies the transmission message; if the transmission message passes the verification, the interface function is called according to the transmission message.

[0308] In an embodiment of the present application, the device 40 further comprises:

[0309] The third receiving module 415 is configured to receive a running loading request of the H5 page sent by the server, wherein the running loading request of the H5 page records the page data of the H5 page.

[0310] The second reading module 416 is configured to read the page data of the H5 page and determine the request type of the H5 page.

[0311] The packaging module 417 is configured to, if the request type of the H5 page is a dynamic request, package the H5 page, and store the H5 page loading configuration information into the cache pool of the front end.

[0312] The second loading module 418 is configured to, if the request type of the H5 page is a static request, obtain the static file of the server, and load the H5 page according to the static file.

[0313] In an embodiment of the present application, the device 40 further comprises:

[0314] The third generating module 419 is configured to generate a message data transmission request, and send the message data transmission request to the server, so that the server obtains the certificate information according to the message data transmission request.

[0315] The fourth receiving module 420 is configured to receive the certificate information sent by the server, and create a session key pair according to the certificate information; wherein the session key pair comprises a session public key and a session private key.

[0316] The third sending module 421 is configured to encrypt the transmission protocol by using the session public key, and send the encrypted transmission protocol and the session private key to the server, so that the server decrypts the transmission protocol according to the session private key and generates decryption information.

[0317] The fifth receiving module 422 is configured to receive the decryption information sent by the server, and if the decryption information is decrypted successfully, send the encrypted transmission message to the server.

[0318] The data processing device based on the key provided in the embodiment can execute the method provided in the method embodiment, and has similar implementation principles and technical effects, which will not be described here.

[0319] Figure 5 The structure diagram of the data processing device based on the key provided in the present application is shown in FIG. 5. Figure 5As shown, the key-based data processing device 50 provided by the embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected through a bus 504.

[0320] In the implementation process, the at least one processor 501 executes the computer execution instructions stored in the memory 502, so that the at least one processor 501 executes the key-based data processing method described above.

[0321] The specific implementation process of the processor 501 can refer to the method embodiments described above, which have similar implementation principles and technical effects, and will not be described here in detail.

[0322] The embodiment of the application further provides a computer storage medium, and the computer storage medium stores computer execution instructions. When the processor executes the computer execution instructions, the key-based data processing method described above is implemented.

[0323] The embodiment of the application further provides a computer program product, which includes a computer program. When the computer program is executed by the processor, the key-based data processing method described above is implemented.

[0324] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the above modules is only a logical function division, and actual implementation can have another division manner, for example, a plurality of modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0325] The modules described above as separate components can or can not be physically separated, and the components shown as modules can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the modules can be selected according to actual needs to realize the embodiment scheme.

[0326] In addition, each functional module in each embodiment of the application can be integrated in one processing unit, or each module can be physically present alone, or two or more modules can be integrated in one unit. The unit formed by the above modules can be realized in the form of hardware, or in the form of hardware plus software function unit.

[0327] The integrated modules realized in the form of software function modules can be stored in a computer readable storage medium. The software function modules are stored in a storage medium and include a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of steps of the method according to the embodiments of the present application.

[0328] It should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in combination with the application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0329] The memory can include a high-speed RAM memory, and can also include a non-volatile storage NVM, for example, at least one disk memory, and can also be a U disk, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0330] The bus can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0331] The storage medium can be realized by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0332] An example storage medium is coupled to the processor such that the processor can read information from, and can write information to, the storage medium. Of course, the storage medium can be a part of the processor. Consistent with the teachings provided herein, the processor (acting in response to a plurality of instructions executed by the processor) can be capable of implementing any of the features, steps, or functions disclosed herein, including the methods and techniques described above. The storage medium can be realized as a collection of programming instructions that, when executed by the processor, implement the features, steps, or functions disclosed herein. The storage medium can be realized as a volatile memory, a non-volatile memory, or a combination of volatile and non-volatile memory. The storage medium can include, but is not limited to, RAM, ROM, EEPROM, flash memory, or a combination of different memory storage mediums. For example, a non-transitory computer readable storage medium can be realized as RAM containing programming instructions that, when executed by the processor, implement the features, steps, or functions disclosed herein. Of course, the storage medium can be a part of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Alternatively, the processor and the storage medium can be located in a remote terminal or a host computer.

[0333] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. The program executes the steps of the above-mentioned method embodiments when executed; and the foregoing storage medium includes ROM, RAM, magnetic disc or optical disc and various storage medium capable of storing program codes.

[0334] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A key-based data processing method, characterized by, The application is applied to a front end, and includes: sending an access request to a server to enable the server to generate an H5 page according to the access request, wherein the H5 page includes a pre-generated key file; receiving the H5 page sent by the server; loading the H5 page in a first running environment to run the H5 page; generating a decryption container corresponding to the H5 page by dynamic compilation during loading of the H5 page; creating a second running environment, wherein the second running environment is isolated from the first running environment; running the decryption container in the second running environment; reading a shared object file of the H5 page by the decryption container to obtain a decryption algorithm; analyzing the key file by the decryption container to obtain operation information corresponding to an original key by using the decryption algorithm; extracting an encrypted string and a splicing constant from the operation information by the decryption container; generating a constant string according to the splicing constant by the decryption container; performing exclusive or operation on the encrypted string and the constant string by the decryption container to obtain the original key; sending a data request to the server by the H5 page to enable the server to obtain to-be-processed data according to the data request; receiving the to-be-processed data sent by the server by the H5 page; processing the to-be-processed data in the H5 page according to the original key.

2. The method of claim 1, wherein, The method for generating the decryption container corresponding to the H5 page by dynamic compilation during loading of the H5 page includes: obtaining identification information and running information of the front end during loading of the H5 page; creating a container list according to the identification information and the running information; dynamically obtaining state information of the decryption container according to the container list; compiling the container list and the state information to generate the decryption container.

3. The method of claim 1, wherein, The method for creating the second running environment includes: obtaining a storage path of the decryption container; reading source code of the decryption container according to the storage path of the decryption container; generating a mounting instruction according to the source code of the decryption container; obtaining environment information of the first running environment and creating a running isolation group according to the environment information of the first running environment; deploying the source code of the decryption container in the running isolation group by the mounting instruction to create the second running environment.

4. The method of claim 1, wherein, The method for processing the to-be-processed data in the H5 page according to the original key includes: extracting a transmission message from the to-be-processed data in the H5 page according to the original key; encrypting the transmission message according to the original key to generate an encrypted transmission message.

5. The method of claim 4, wherein, After the encrypted transmission message is generated, the method further includes: sending the encrypted transmission message to the server to enable the server to decrypt the encrypted transmission message to obtain a transmission message and verify the transmission message, and if the transmission message passes the verification, calling an interface function according to the transmission message.

6. The method of claim 1, wherein, Before the H5 page sent by the server is received, the method further includes: receiving a running loading request of the H5 page sent by the server, wherein the running loading request of the H5 page records page data of the H5 page. reading page data of the H5 page, judging a request type of the H5 page; if the request type of the H5 page is a dynamic request, performing encapsulation processing on the H5 page, and storing H5 page loading configuration information into a cache pool of a front end; if the request type of the H5 page is a static request, obtaining a static file of the service end, and loading the H5 page according to the static file.

7. The method of claim 1, wherein, After the processing of the to-be-processed data in the H5 page according to the original key, the method further comprises: generating a message data transmission request, and sending the message data transmission request to the service end, so that the service end obtains certificate information according to the message data request; receiving the certificate information sent by the service end, and creating a session key pair according to the certificate information; the session key pair comprises a session public key and a session private key; encrypting a transmission protocol through the session public key, and sending the encrypted transmission protocol and the session private key to the service end, so that the service end decrypts the transmission protocol according to the session private key and generates decryption information; receiving the decryption information sent by the service end, and if the decryption information is decrypted successfully, sending an encrypted transmission message to the service end.

8. A key-based data processing method characterized by, The application is applied to a service end, and comprises: receiving an access request sent by a front end; generating an H5 page according to the access request; the H5 page comprises a pre-generated key file; sending the H5 page to the front end, so that the front end loads and runs the H5 page in a first running environment; in the process of loading the H5 page, a decryption container corresponding to the H5 page is generated through dynamic compilation, and a second running environment is created; the second running environment is isolated from the first running environment; in the second running environment, the decryption container is run, a shared object file of the H5 page is read through the decryption container to obtain a decryption algorithm, the key file is parsed by using the decryption algorithm to obtain operation information corresponding to an original key, an encryption string and a splicing constant are extracted from the operation information through the decryption container, a constant string is generated according to the splicing constant, the encryption string and the constant string are subjected to exclusive or operation to obtain the original key; receiving a data request sent by the H5 page, and obtaining to-be-processed data according to the data request; sending the to-be-processed data to the H5 page of the front end, so that the front end processes the to-be-processed data in the H5 page according to the original key.

9. The method of claim 8, wherein, The generation of the H5 page according to the access request comprises: generating operation information according to the access request; generating a key file according to the operation information; generating an H5 page according to the key file.

10. The method of claim 9, wherein, The generation of the operation information according to the access request comprises: generating an original key and a constant string according to the access request; subjecting the original key and the constant string to exclusive or operation to generate an encryption string; subjecting the constant string to superposition operation to generate a splicing constant; generating operation information according to the encryption string and the splicing constant.

11. The method of claim 9, wherein, The generation of the key file according to the operation information comprises: According to the operation information, a user identifier is generated; The user identifier is encrypted, and a key pair corresponding to the user identifier is generated; A mapping list is created according to the user identifier; The key pair corresponding to the user identifier and the operation information are written into the mapping list to generate a key file.

12. The method of claim 8, wherein, After the H5 page is sent to the front end, the method further includes: Receiving an encrypted transmission message sent by the front end; Decrypting the encrypted transmission message; Verifying the transmission message, and if the transmission message is verified, calling a corresponding service interface according to the transmission message; Obtaining address information of the service interface, and creating an access list according to the address information of the service interface; Adding the address information of the service interface and the transmission message to the access list.

13. The method of claim 12, wherein, After the address information of the service interface and the transmission message are added to the access list, the method further includes: Serializing the access list to generate string data; Obtaining a front-end identifier in the transmission message; Encrypting and splicing the front-end identifier and the string data to generate an access token; If the front end calls a calling request of the service interface corresponding to the access list, the access token is sent to the front end, so that the front end calls the service interface corresponding to the access list.

14. A key-based data processing apparatus, characterized by comprising: Applied to the front end, the method includes: A first sending module is configured to send an access request to a server, so that the server generates an H5 page according to the access request, wherein the H5 page includes a pre-generated key file; A first receiving module is configured to receive an H5 page sent by the server; A first loading module is configured to load the H5 page in a first running environment to run the H5 page; A first generating module is configured to generate a decryption container corresponding to the H5 page by dynamic compilation during loading of the H5 page; A creating module is configured to create a second running environment, wherein the second running environment is isolated from the first running environment; A running module is configured to run the decryption container in the second running environment; A first reading module is configured to read a shared object file of the H5 page through the decryption container to obtain a decryption algorithm; An analyzing module is configured to analyze the key file by the decryption container using the decryption algorithm to obtain operation information corresponding to an original key; An extracting module is configured to extract an encrypted string and a splicing constant from the operation information by the decryption container; A second generating module is configured to generate a constant string according to the splicing constant by the decryption container; An operation module is configured to perform an exclusive or operation on the encrypted string and the constant string by the decryption container to obtain the original key; A second sending module is configured to send a data request to the server through the H5 page, so that the server obtains to-be-processed data according to the data request; A second receiving module is configured to receive to-be-processed data sent by the server through the H5 page; A processing module is configured to process to-be-processed data in the H5 page according to the original key.

15. A key-based data processing device, characterized by The method includes: A memory and a processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the key-based data processing method according to any one of claims 1 to 7, or the key-based data processing method according to any one of claims 8 to 13.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by the processor to implement the key-based data processing method according to any one of claims 1 to 7, or the key-based data processing method according to any one of claims 8 to 13.

17. A computer program product, characterised in that, The computer program is executed by the processor to implement the key-based data processing method according to any one of claims 1 to 7, or the key-based data processing method according to any one of claims 8 to 13.

Images