Data encryption and decryption method and system based on HTTP (Hyper Text Transport Protocol)

Abstract

The invention relates to the technical field of communication, in particular to a data encryption and decryption method and system based on an HTTP (Hyper Text Transport Protocol). The method comprises the following steps: generating a public key of a sending end and a private key of the sending end; sending a public key exchange request to a receiving end, and obtaining a public key of the receiving end; generating a first secret key, and encrypting to-be-sent data according to the first secret key to obtain ciphertext data; encrypting the first secret key according to the public key of the receiving end, and signing the encrypted first secret key according to the private key of the sending end to obtain a second secret key; and splicing and synthesizing the ciphertext data and the second secret key, and sending the ciphertext data and the second secret key to the receiving end. According to the method provided by the invention, the security of communication based on the HTTP protocol can be improved.

Description

Technical Field

[0001] The present invention generally relates to the field of communication technology, and more specifically, to a method and system for data encryption and decryption based on HTTP protocol. Background Art

[0002] HTTP is one of the most important network protocols in the Internet era. It is the basis for data exchange on the Internet and is used to transmit various resources such as text, pictures, and videos between Web servers and client browsers. HTTP has the advantages of simplicity, scalability, and connectionlessness. Its emergence has greatly promoted information sharing and the popularization of the Internet.

[0003] Since the HTTP protocol was originally designed for convenient information exchange, it has some inherent shortcomings in terms of security. For example, the HTTP protocol does not encrypt data when transmitting, and the data is transmitted in plain text, which is easy to be read by a third party. In addition, HTTP does not provide a data integrity verification mechanism, so during the transmission process, the data may be tampered with by an unauthorized third party, and the receiver cannot easily detect such tampering. In this regard, the prior art generally adds the SSL / TLS protocol to HTTP, that is, uses the HTTPS protocol instead, to encrypt and verify the integrity of the data. However, this method requires the purchase of an SSL certificate from a third-party certificate authority; or establishes a secure VPN private network between the two communicating parties, and accesses data within the VPN. However, this method requires an additional VPN server and the use of a dedicated terminal to assist in connecting to the VPN, which is inconvenient. Summary of the invention

[0004] In order to solve the technical problem of poor security of the HTTP protocol, the present invention provides solutions in the following aspects.

[0005] In the first aspect, the present invention provides a data encryption method based on the HTTP protocol, including: generating a public key and a private key of a sender; sending a request for exchanging public keys to a receiver to obtain the public key of the receiver; generating a first secret key, encrypting data to be sent according to the first secret key, and obtaining ciphertext data; encrypting the first secret key according to the public key of the receiver, and signing the encrypted first secret key according to the private key of the sender to obtain a second secret key; concatenating the ciphertext data and the second secret key, and sending them to the receiver.

[0006] Further, generating a first secret key includes: generating the first secret key according to a symmetric encryption algorithm.

[0007] Furthermore, generating a public key of the sender and a private key of the sender includes: generating the public key of the sender and the private key of the sender according to an RSA encryption algorithm.

[0008] Furthermore, the method further includes: regularly sending a request for exchanging public keys to the receiving end.

[0009] Furthermore, the ciphertext data and the second secret key are concatenated and synthesized, including: connecting the ciphertext data and the second secret key according to a preset delimiter, and performing Huffman coding compression on the connected data body.

[0010] Furthermore, sending a request for exchanging public keys to the receiving end includes: sending a request for exchanging public keys to the receiving end based on the HTTP protocol.

[0011] In the second aspect, the present invention provides a data decryption method based on the HTTP protocol, including: generating a public key and a private key of a receiving end, and obtaining the public key of the sending end in response to a request for exchanging public keys from a sending end; receiving and decomposing a data body sent by the sending end, and obtaining ciphertext data encrypted by a first key and a second key; decrypting and verifying the second key according to the public key of the sending end; decrypting the verified second key according to the private key of the receiving end to obtain the first key; and decrypting the ciphertext data according to the first key.

[0012] Furthermore, it also includes: in response to the request of the sending end, generating a new data key, encrypting the data to be sent according to the data key to obtain ciphertext data; encrypting the data key according to the public key of the sending end, signing the encrypted data key according to the private key of the receiving end to obtain a signature key; splicing the ciphertext data and the signature key, and sending them to the sending end.

[0013] In a third aspect, the present invention further provides a communication encryption system based on the HTTP protocol, characterized in that it comprises a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, a data encryption method based on the HTTP protocol described in any one of the first aspects is implemented.

[0014] In a fourth aspect, the present invention provides a communication decryption system based on the HTTP protocol, characterized in that it includes a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, a data decryption method based on the HTTP protocol described in the second aspect is implemented.

[0015] The beneficial effects of the present invention are as follows: the present invention ensures data security and encryption efficiency by encrypting plaintext data using a symmetric encryption algorithm, ensures the security of data key transmission by encrypting data keys using an asymmetric encryption algorithm, ensures the integrity of transmitted data and the identification of the identities of both communicating parties by signing the keys, and further improves the security of HTTP protocol-based communication by setting the same splicing rules and decomposition rules on both communicating parties, and does not require the introduction of additional third-party protocols such as HTTPS and VPN, nor does it require hardware support, and is easy to implement with low cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By reading the following detailed description with reference to the accompanying drawings, the above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0017] Figure 1 is a flow chart schematically illustrating a data encryption method based on the HTTP protocol according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram schematically illustrating public key exchange according to an embodiment of the present invention;

[0019] Figure 3 is a flowchart schematically illustrating HTTP communication request processing according to an embodiment of the present invention, wherein the encryption and decryption process between the receiving end and the sending end is shown;

[0020] Figure 4 Schematically illustrates a flow chart of HTTP communication response processing according to an embodiment of the present invention, wherein the encryption and decryption process between the receiving end and the sending end is shown. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0022] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] Figure 1 FIG. 4 is a flow chart schematically illustrating a data encryption method based on the HTTP protocol according to an embodiment of the present invention.

[0024] In a first aspect, the present invention provides a data encryption method based on HTTP protocol, such as Figure 1 As shown, the method of the present invention comprises:

[0025] S101. Generate a public key and a private key of a sender.

[0026] In one embodiment, the public key and private key of the sender can be generated by the RSA (Rivest-Shamir-Adleman) encryption algorithm. It is understandable that the RSA encryption algorithm is an asymmetric encryption algorithm with high security. The generated public key can be disclosed to the outside world for encrypting data, while the private key is kept secret from the outside world for decrypting data. By adopting the RSA encryption algorithm, the security of key transmission is improved, thereby improving the security of HTTP protocol-based communication. In other optional embodiments, an asymmetric encryption algorithm such as the Diffie-Hellman key exchange algorithm can also be used to generate the public key of the sender and the private key of the sender.

[0027] S102: Send a request for exchanging public keys to a receiving end to obtain the public key of the receiving end.

[0028] Specifically, Figure 2 As shown in Figure 1, before data communication, the sender (i.e., business system A) sends a request to exchange public keys to the receiver (i.e., business system B). The sender sends its own public key (i.e., Figure 2 The receiving end responds to the sender's request to exchange public keys and sends its own public key (i.e. Figure 2 The public key of system B in the network is sent to the sender. Finally, through the exchange of public keys between the two parties, the sender stores its own private key and the public key of the receiver, while the receiver stores its own private key and the public key of the sender.

[0029] In one embodiment, the above process can be executed only once in the life cycle of the system. In other optional embodiments, the above process can also be repeated periodically, that is, public keys and private keys are generated periodically, and public keys are exchanged periodically, so as to achieve regular updating of secret keys, making the communication between the sender and the receiver more secure.

[0030] By exchanging public keys before data communication, excessive transmission of secret keys on the network is avoided, thereby reducing the risk of secret key theft and improving the security of HTTP protocol-based communication.

[0031] S103: Generate a first secret key, and encrypt the data to be sent according to the first secret key to obtain ciphertext data.

[0032] Specifically, Figure 3This is a flow chart of the communication between the sender (i.e., business system A) and the receiver (i.e., business system B) based on the HTTP protocol. Figure 3 It can be seen that when processing a request, the sender generates a first secret key (i.e. Figure 3 The data to be sent (i.e., plaintext communication data) is encrypted according to the first secret key to obtain ciphertext data.

[0033] In one embodiment, the first key can be generated by a symmetric encryption algorithm. When the symmetric encryption algorithm generates the first key, the key is generally generated randomly, thereby avoiding the problem of low security caused by using a fixed key or a key with a certain pattern, thereby improving the security of data communication. Furthermore, both the sending end and the receiving end use a "one-time one-key" method to encrypt data, further improving the security of HTTP protocol-based communication.

[0034] It should be noted that when encrypting the data to be sent, a symmetric encryption algorithm is also used. It is understandable that the symmetric encryption algorithm uses the same secret key in the process of encrypting and decrypting data. Therefore, compared with the asymmetric encryption algorithm, the symmetric encryption algorithm has higher encryption efficiency and is simple to use. Therefore, by using a symmetric encryption algorithm to encrypt the data to be sent, the efficiency of data encryption can be improved. In one embodiment, the symmetric encryption algorithm can be DES (Data Encryption Standard), AES (Advanced Encryption Standard), CAST5, etc.

[0035] S104: Encrypt and sign the first secret key to obtain a second secret key.

[0036] Specifically, combined Figure 3 It can be seen that in order to further improve the security of communication, the first secret key is encrypted with the public key of the receiving end to obtain the ciphertext key. By encrypting the first secret key with the public key of the receiving end, the ciphertext key can only be decrypted by the private key of the receiving end. Therefore, even if the data is intercepted by a third party, the ciphertext key cannot be decrypted due to the lack of the private key of the receiving end, and the data cannot be obtained or tampered with, thereby improving the security of communication based on the HTTP protocol.

[0037] Furthermore, in one embodiment, data integrity verification can be added. Specifically, the second key (i.e. Figure 3By signing the ciphertext key, the reliability of the key source is ensured, which can effectively prevent the third party from tampering with or destroying the key, indirectly verify the integrity and security of the ciphertext data, and avoid the need to perform separate signature calculation and verification on each ciphertext when signing the ciphertext data, saving computing resources and time.

[0038] In this embodiment, the asymmetric encryption algorithm used when signing is the RSA encryption algorithm. In other optional embodiments, the DSA (Digital Signature Algorithm) or ElGamal algorithm may also be used.

[0039] S105: Concatenate the ciphertext data and the second secret key, and send the result to the receiving end.

[0040] Specifically, the encrypted ciphertext data and the second key and other data are concatenated to form a unified data body (i.e. Figure 3 In this case, the data body can be securely sent to the receiving end through the HTTP protocol. Specifically, before communicating, both the sending end and the receiving end preset a specified delimiter, and the sending end connects the ciphertext data and the second secret key through the delimiter, and finally compresses the entire spliced ​​data body through Huffman coding, thereby obtaining a data body that can be securely transmitted in the HTTP protocol. In one embodiment, the delimiter can be three consecutive colons, namely ":::". Huffman coding is a lossless coding method for data compression, which can perform lossless compression. By compressing the connected data body, transmission time is saved.

[0041] It is understandable that the receiving end and the sending end both preset the same data splicing and decomposition rules. By using the specified separator to splice the ciphertext data and the second key and then transmit them, it is difficult for the attacker to confirm which is data and which is the key, which increases the difficulty of data cracking. In addition, the ciphertext data and the second key only need to be transmitted once after splicing, which reduces the number of network transmissions and reduces the risk of being intercepted or eavesdropped during the transmission process, thereby improving the efficiency of transmission. Further, since the ciphertext data and the second key are of unequal length, in this embodiment, the ciphertext data is the longer side and the second key is the shorter side. During decryption, even if the sequence is wrong during splicing or the decomposition is wrong, the ciphertext data and the second key can be accurately located according to the different lengths of the data, and then the corresponding decryption is performed (for example, during the decryption process, the length of the data at both ends of the separator is distinguished, the longer side is decrypted according to the ciphertext data, and the shorter side is decrypted according to the second key). Therefore, the problem that the ciphertext data and the key of the same length are difficult to identify after decomposition is avoided.

[0042] In other optional embodiments, the ciphertext data and the second key may not be concatenated. For example, the ciphertext data and the second key may be sent to the receiving end through different channels.

[0043] In a second aspect, the present invention provides a data decryption method based on HTTP protocol, specifically, as follows Figure 3 As shown, the receiving end receives the unified data body sent by the sending end through HTTP protocol communication, and then decomposes the data body to obtain the ciphertext data encrypted by the first key, the second key and other data after decomposition. It can be understood that since the receiving end and the sending end set the same rule for decomposing the data body, after obtaining the data body, the data body is first Huffman decoded according to the rule for decomposing the data body, and then the ciphertext data and the second key are split according to the preset separator, thereby obtaining the ciphertext data and the second key.

[0044] By presetting the same splicing rule and decomposition rule at the sending end and the receiving end, the security of the communication between the sending end and the receiving end based on the HTTP protocol is improved.

[0045] Furthermore, the receiving end performs signature authentication on the obtained second secret key. Specifically, the second secret key is decrypted and verified by using the public key of the sending end. If the decryption is correct, it indicates that the signature verification is successful, that is, the data is sent by the sending end (i.e., system A); if the decryption fails, it indicates that the data body is not sent by system A or the data sent by system A has been tampered with or replaced by a third party, and the data is discarded. By verifying the second secret key, the identities of the two communicating parties are identified, that is, it is ensured that the data comes from the sending end rather than other impersonating sending ends or third parties, avoiding illegal deception attacks in the network, and verifying the integrity of the data, thereby improving the security of communication based on the HTTP protocol.

[0046] Furthermore, the private key of the receiving end is used to decrypt the ciphertext key obtained after verification to obtain the first key (i.e. Figure 3 Finally, the ciphertext data is decrypted according to the first key to obtain the plaintext communication data, and the receiving end can perform business processing according to the plaintext communication data.

[0047] It should be noted that if the RSA encryption algorithm is used when signing, the corresponding RSA decryption algorithm must be used when verifying the signature.

[0048] Furthermore, if Figure 4 As shown, the receiving end (i.e., system B) generates a new data key (with Figure 3The data key used in the request is different), the data to be sent is encrypted according to the data key to obtain the ciphertext data; the data key is encrypted according to the public key of the sending end, the encrypted data key is signed according to the private key of the receiving end to obtain the signature key; the ciphertext data and the signature key are concatenated and sent to the sending end.

[0049] Furthermore, after receiving the data body, the sender decomposes and decrypts it to obtain the plaintext response data, and then performs business processing according to the plaintext response data. Figure 3 and Figure 4 It can be seen that the steps in the request and response process between the receiving end and the sending end are similar, and the difference is that the data keys used in the two links of request and response are not the same. The "one-time one-key" in the two links of request and response avoids the problem that the keyless exchange or one-way transmission of public keys can only use the same key in the two links of request and response. In addition, the security of HTTP protocol-based communication is further improved by using different data keys in the two links of request and response. In addition, keyless exchange and one-way transmission of public keys need to rely on specific business processing, so identity identification cannot be achieved in the secure transport layer. The present invention, by signing the key, enables the communication parties to perform identity identification, further improving the security of HTTP protocol-based communication.

[0050] Combination Figure 3 and Figure 4 It is understandable that system A can be used as both a receiving end and a transmitting end, and similarly, system B can be used as both a receiving end and a transmitting end. Figure 3 and Figure 4 The implementation in can be modularized into a communication interface layer, in which the communication encryption, sending, receiving and decryption processes are completed.

[0051] In summary, the present invention ensures data security and encryption efficiency by encrypting plaintext data using a symmetric encryption algorithm, ensures the security of data key transmission by encrypting data keys using an asymmetric decryption algorithm, and ensures data integrity and identification of the identities of both communicating parties by signing the keys. In addition, by setting the same splicing rules and decomposition rules on both communicating parties, the security of HTTP protocol-based communication is further improved, and there is no need to introduce additional third-party protocols such as HTTPS and VPN, nor is there any need to provide hardware support, so it is easy to implement.

[0052] In a third aspect, the present invention also provides a communication encryption system based on the HTTP protocol, the system comprising a processor and a memory, the memory storing computer program instructions, and when the computer program instructions are executed by the processor, a data encryption method based on the HTTP protocol described in any one of the first aspects is implemented.

[0053] In a fourth aspect, the present invention provides a communication decryption system based on the HTTP protocol, the system comprising a processor and a memory, the memory storing computer program instructions, and when the computer program instructions are executed by the processor, a data decryption method based on the HTTP protocol described in the second aspect is implemented.

[0054] In the present invention, the aforementioned memory may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus or device. For example, a computer-readable storage medium may be any suitable magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc., or any other medium that may be used to store the required information and may be accessed by an application, a module, or both. Any such computer storage medium may be part of a device or accessible or connectable to a device. Any application or module described in the present invention may be implemented using computer-readable / executable instructions that may be stored or otherwise maintained by such a computer-readable medium.

[0055] Although this specification has shown and described a number of embodiments of the present invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Those skilled in the art will conceive of many modifications, changes and alternatives without departing from the ideas and spirit of the present invention. It should be understood that in the practice of the present invention, various alternatives to the embodiments of the present invention described herein may be employed.

Claims

1. A data encryption method based on HTTP protocol, characterized in that: include: Generate the sender's public key and the sender's private key; Sending a request to exchange public keys to a receiving end to obtain the public key of the receiving end; Generate a first secret key, and encrypt the data to be sent according to the first secret key to obtain ciphertext data; Encrypting the first secret key according to the public key of the receiving end, and signing the encrypted first secret key according to the private key of the sending end to obtain a second secret key; The ciphertext data and the second secret key are concatenated and sent to the receiving end.

2. The data encryption method based on HTTP protocol according to claim 1, characterized in that: Generating a first secret key includes: generating the first secret key according to a symmetric encryption algorithm.

3. The data encryption method based on HTTP protocol according to claim 1, characterized in that: Generating a public key of a sender and a private key of a sender, including: generating the public key of the sender and the private key of the sender according to an RSA encryption algorithm.

4. The data encryption method based on HTTP protocol according to claim 1, characterized in that: Also includes: Periodically sending a request for exchanging public keys to the receiving end.

5. The data encryption method based on HTTP protocol according to claim 1, characterized in that: The ciphertext data and the second secret key are concatenated and synthesized, including: connecting the ciphertext data and the second secret key according to a preset delimiter, and performing Huffman coding compression on the connected data body.

6. The data encryption method based on HTTP protocol according to claim 1, characterized in that: Sending a request for exchanging public keys to a receiving end includes: sending a request for exchanging public keys to the receiving end based on the HTTP protocol.

7. A data decryption method based on HTTP protocol, characterized in that: include: Generate a public key and a private key of the receiving end, and in response to a request for exchanging public keys from the sending end, obtain the public key of the sending end; Receive and decompose the data body sent by the sender to obtain the ciphertext data encrypted by the first secret key and the second secret key; Decrypting and verifying the second secret key according to the public key of the sender; Decrypting the verified second secret key according to the private key of the receiving end to obtain the first secret key; The ciphertext data is decrypted according to the first secret key.

8. The data decryption method based on HTTP protocol according to claim 7, characterized in that: Also includes: In response to the request of the sending end, a new data key is generated, and the data to be sent is encrypted according to the data key to obtain ciphertext data; Encrypt the data key according to the public key of the sending end, and sign the encrypted data key according to the private key of the receiving end to obtain a signature key; The ciphertext data and the signature key are concatenated and sent to the sending end.

9. A communication encryption system based on HTTP protocol, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, a data encryption method based on the HTTP protocol according to any one of claims 1 to 6 is implemented.

10. A communication decryption system based on HTTP protocol, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, a data decryption method based on the HTTP protocol according to claim 7 or 8 is implemented.

Images