Method, system and medium for realizing unified encryption, decryption and desensitization of data across terminals

Abstract

The invention provides a method, a system and a medium for realizing unified encryption, decryption and desensitization of data across terminals, request and response data are encrypted through a 32-bit random password generated by a front end, and the password is stored in a session. And the front end encrypts the random password by using the RSA public key provided by the rear end, and sends the random password to the rear end through the HTTP request header. And after receiving the request, the rear end decrypts the random password by using the RSA private key, and encrypts and decrypts request data by using an AESGCM algorithm. The data between the front end and the rear end is always kept in an encrypted state in a transmission process, and the front end performs desensitization processing on the returned sensitive data according to service requirements, so that the data security is ensured. According to the method provided by the invention, multiple terminals (such as Web, mobile terminals and the like) are supported to uniformly call encryption, decryption and desensitization functions, repeated development on different platforms is avoided, and the development efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of data transmission, and in particular, to a method, system and medium for realizing unified encryption, decryption and desensitization of data across terminals. Background Art

[0002] With the development of the information society, data has become the core asset of various application systems. How to effectively protect the privacy and security of data during the storage, transmission and processing of data has become an important issue in the field of information security. Traditional data protection technologies mainly include data encryption, data desensitization, data access control, etc. Although these technologies can protect data to some extent, they usually have some shortcomings, such as low encryption and decryption efficiency, single desensitization strategy, and insufficient security. Common encryption algorithms include symmetric encryption algorithms (such as AES, DES, etc.) and asymmetric encryption algorithms (such as RSA, ECC, etc.). The current mainstream technology is to use the existing encryption library, negotiate the encryption algorithm between the two parties, and perform encryption and decryption of a single algorithm through a fixed key.

[0003] However, the existing technology has the following disadvantages: 1. High development and maintenance costs and the need to adapt to different platform terminals; 2. Single algorithm mode and unable to dynamically support multiple algorithm modes; 3. Fixed key, all clients use the same key for encryption; 4. Single desensitization strategy. Summary of the invention

[0004] In view of the defects in the prior art, the purpose of the present invention is to provide a method for realizing unified encryption, decryption and desensitization of data across terminals, which supports cross-terminal so that multiple terminals can realize unified call of encryption, decryption and desensitization functions.

[0005] In order to achieve the above technical effects, the present invention adopts the following technical solutions:

[0006] According to a first aspect of the present invention, a method for implementing unified encryption, decryption and desensitization of data across terminals is provided, which specifically comprises the following steps:

[0007] Step S1: The front end generates a 32-bit random password for encrypting and decrypting request and response data, wherein the password consists of uppercase and lowercase letters and numbers; the password is stored in the session and is valid only in the current session;

[0008] Step S2: The front end uses the RSA public key provided by the back end to encrypt the 32-bit random password to obtain an encryption key;

[0009] Step S3: Put the encrypted key into the HTTP request header, the field name is x-jmc-secret, the front end calls the back end interface, and passes the request header to the back end; at the same time, the front end adds the x-jmc-timestamp field in the request header to record the timestamp of the request; in addition, the x-jmc-encrypted field is added to the request header to indicate whether encryption is enabled. If x-jmc-encrypted=1, it indicates encryption; if x-jmc-encrypted=0, it indicates no encryption;

[0010] Step S4: After receiving the request, the backend uses the RSA private key to decrypt the key in the x-jmc-secret field and recover the 32-bit random password generated by the frontend;

[0011] Step S5: The backend decrypts the request body data and recovers the plaintext data; the request body data refers to the sensitive information transmitted in the request; the request body is encrypted using the AES_GCM algorithm; the AES_GCM encryption mode provides an identity authentication function;

[0012] Step S6: After processing the request and generating response data, the backend uses a 32-bit random password to encrypt the response body again to ensure that the data returned to the frontend is still encrypted during transmission; after the returned data is encrypted, x-jmc-encrypted=1 is added to the response header to indicate that the response content is encrypted and needs to be decrypted;

[0013] Step S7: After receiving the encrypted response data, the front end uses the 32-bit random password saved in the session to decrypt the returned encrypted data and restore the original response content; after decryption, the data can be directly displayed on the page or further processed;

[0014] Step S8: For the returned sensitive data, the front end performs desensitization processing according to business requirements; when displaying, the sensitive information is replaced with a mask to ensure that the sensitive information is not directly leaked to the end user;

[0015] Step S9: The front end obtains the whitelist through the interface and determines the ports that need to encrypt uploaded data and perform desensitization processing.

[0016] Preferably, in step S8, the desensitization rules can be flexibly configured according to different business scenarios, and different desensitization strategies can be adopted for different sensitive information.

[0017] Preferably, the whitelist in step S9 can be adjusted at any time through the background.

[0018] According to a second aspect of the present invention, a system for implementing unified encryption, decryption and desensitization of data across terminals is provided, which is used to implement the above-mentioned method for implementing unified encryption, decryption and desensitization of data across terminals.

[0019] According to a third aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the above-mentioned method for unified cross-terminal data encryption, decryption and desensitization.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] 1. The method, system and medium for realizing unified encryption, decryption and desensitization of data across terminals provided by the present invention support unified calling of encryption, decryption and desensitization functions by multiple terminals (such as Web, mobile terminals, etc.), avoiding repeated development on different platforms and improving development efficiency.

[0022] 2. The method, system and medium for realizing unified encryption and decryption and desensitization of data across terminals provided by the present invention ensure the security of keys and data by combining symmetric encryption (AES_GCM) and asymmetric encryption (RSA). Randomly generated keys and the method of dynamically generating and transmitting keys effectively prevent key leakage.

[0023] 3. The method for implementing unified encryption and decryption and desensitization of data across terminals provided by the present invention provides a flexible desensitization strategy, and the desensitization rules can be dynamically adjusted according to different business scenarios to ensure the security of sensitive information during transmission and display. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0025] Figure 1 This is a flowchart of the steps of the method for implementing unified encryption, decryption and desensitization of data across terminals described in the first embodiment;

[0026] Figure 2 This is a flowchart of the method for implementing unified encryption, decryption and desensitization of data across terminals as described in the first embodiment. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0028] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0029] Embodiment 1:

[0030] like Figure 1 Figure 2 As shown, this embodiment provides a method for realizing unified encryption, decryption and desensitization of data across terminals. The solution supports multiple terminals (such as Web, mobile terminals, etc.) to uniformly call encryption, decryption and desensitization functions, avoids repeated development on different platforms, and improves development efficiency. Specifically, the following steps are included:

[0031] Step S1: The front end generates a 32-bit random key: The front end first generates a 32-bit random password consisting of uppercase and lowercase letters and numbers. The generated password is used to encrypt and decrypt request and response data, and this password is only valid in the current session.

[0032] Random keys not only improve security, but also avoid the security risks caused by using fixed keys. The keys are stored in the session to ensure that the data encryption and decryption process of each interaction is independent, reducing the risk of the key being intercepted or reused.

[0033] Step S2: Encrypt the 32-bit random password using RSA: The 32-bit random password generated by the front end will be encrypted using the RSA algorithm to ensure that the key itself is also encrypted during transmission to prevent it from being stolen by a middleman. The RSA public key is provided by the back end, and the front end obtains it through the interface and uses it for encryption.

[0034] The RSA algorithm is an asymmetric encryption algorithm, which ensures the security of key transmission. Even if the encryption key is intercepted, the original key cannot be easily decrypted, which enhances the security of the overall solution.

[0035] Step S3: Pass the encryption key through the request header: The encrypted key will be placed in the HTTP request header with the field name x-jmc-secret, and the key will be passed to the backend through the request header. At the same time, the frontend will also add the x-jmc-timestamp field in the request header to record the timestamp of the request to ensure the uniqueness of each request to prevent replay attacks. In addition, the x-jmc-encrypted field indicates whether encryption is enabled.

[0036] Step S4: Backend decryption key: After receiving the request, the backend uses the RSA private key to decrypt the key in the x-jmc-secret field and recover the 32-bit random password generated by the frontend. This password will be used to decrypt the request data later. The backend private key is stored in a secure environment to ensure that only the server can decrypt the key in transit.

[0037] Step S5: Request data decryption: Using the decrypted 32-bit random password, the backend decrypts the request body data (i.e., the sensitive information passed in the request) and restores the plaintext data. The request body is encrypted using the AES_GCM algorithm, which has high efficiency and security. The AES_GCM encryption mode provides an identity authentication function to ensure the integrity and tamper-proofness of the encryption and decryption process. By combining symmetric encryption (AES_GCM) and asymmetric encryption (RSA), the security of keys and data is ensured. Randomly generated keys and the dynamic generation and transmission of keys effectively prevent key leakage.

[0038] Step S6: The backend processes the business logic and encrypts the response data: After processing the request and generating the response data, the backend will encrypt the response body again using a 32-bit random password to ensure that the data returned to the frontend is still encrypted during transmission. After the returned data is encrypted, x-jmc-encrypted=1 will be added to the response header, indicating that the response content is encrypted and needs to be decrypted.

[0039] Step S7: The front-end decrypts the response data: After receiving the encrypted response data, the front-end uses the 32-bit random password saved in the session to decrypt the returned encrypted data and restore the original response content. After decryption, the data can be directly displayed on the page or further processed. This process ensures the security of the data interaction between the front-end and back-end. Even if the network transmission is intercepted, the data content cannot be directly read.

[0040] Step S8: The front end performs data desensitization processing: As shown in Table 1 below, for the returned sensitive data, the front end will perform desensitization processing according to business needs. When displaying, use a mask (such as "****") to replace some sensitive information to ensure that sensitive information is not directly leaked to end users. Desensitization rules can be flexibly configured according to different business scenarios, such as using different desensitization strategies for information such as name, ID number, and phone number.

[0041]

[0042] Table 1

[0043] Step S9: Dynamic encryption and desensitization list: In order to adapt to different business needs, this method supports dynamic configuration of interfaces that need to be encrypted and desensitized. The front end obtains the white list through the interface to determine which interfaces need to encrypt uploaded data and which need to be desensitized. The background can adjust these lists at any time to ensure that encryption and desensitization strategies can be dynamically updated according to business changes, with high flexibility while ensuring the security of sensitive information during transmission and display. The interfaces in the white list all require the front end to encrypt the request body for upload.

[0044] This method is encapsulated into middleware to facilitate direct integration of the front-end and back-end, reducing the workload of repeated development, while also improving the encryption, decryption and desensitization efficiency of the system.

[0045] Second Embodiment

[0046] This embodiment provides a system for realizing unified encryption, decryption and desensitization of data across terminals, which is used to implement the method for realizing unified encryption, decryption and desensitization of data across terminals described in the first embodiment.

[0047] Embodiment 3

[0048] This embodiment provides a computer-readable storage medium on which a computer program is stored. The program is executed by a processor to implement the method for unified cross-terminal data encryption, decryption and desensitization described in Embodiment 1.

[0049] The above describes the specific embodiments of the present invention. Based on the above description, relevant personnel can make various changes and modifications without departing from the technical concept of the present invention.

Claims

1. A method for realizing unified encryption, decryption and desensitization of data across terminals, characterized in that: The specific steps include: Step S1: The front end generates a 32-bit random password for encrypting and decrypting request and response data, wherein the password consists of uppercase and lowercase letters and numbers; the password is stored in the session and is valid only in the current session; Step S2: The front end uses the RSA public key provided by the back end to encrypt the 32-bit random password to obtain an encryption key; Step S3: Put the encrypted key into the HTTP request header, the field name is x-jmc-secret, the front end calls the back end interface, and passes the request header to the back end; at the same time, the front end adds the x-jmc-timestamp field in the request header to record the timestamp of the request; in addition, the x-jmc-encrypted field is added to the request header to indicate whether encryption is enabled. If x-jmc-encrypted=1, it indicates encryption; if x-jmc-encrypted=0, it indicates no encryption; Step S4: After receiving the request, the backend uses the RSA private key to decrypt the key in the x-jmc-secret field and recover the 32-bit random password generated by the frontend; Step S5: The backend decrypts the request body data and recovers the plaintext data; the request body data refers to the sensitive information transmitted in the request; the request body is encrypted using the AES_GCM algorithm; the AES_GCM encryption mode provides an identity authentication function; Step S6: After processing the request and generating response data, the backend uses a 32-bit random password to encrypt the response body again to ensure that the data returned to the frontend is still encrypted during transmission; after the returned data is encrypted, x-jmc-encrypted=1 is added to the response header to indicate that the response content is encrypted and needs to be decrypted; Step S7: After receiving the encrypted response data, the front end uses the 32-bit random password saved in the session to decrypt the returned encrypted data and restore the original response content; after decryption, the data can be directly displayed on the page or further processed; Step S8: For the returned sensitive data, the front end performs desensitization processing according to business requirements; when displaying, the sensitive information is replaced with a mask to ensure that the sensitive information is not directly leaked to the end user; Step S9: The front end obtains the whitelist through the interface and determines the ports that need to encrypt uploaded data and perform desensitization processing.

2. The method for realizing unified encryption, decryption and desensitization of data across terminals according to claim 1 is characterized in that: In step S8, the desensitization rules can be flexibly configured according to different business scenarios, and different desensitization strategies can be adopted for different sensitive information.

3. The method for realizing unified encryption, decryption and desensitization of data across terminals according to claim 1 is characterized in that: The whitelist in step S9 can be adjusted at any time through the background.

4. A system for implementing unified encryption, decryption and desensitization of data across terminals, characterized in that: Used to implement the method for unified cross-end data encryption, decryption and desensitization as described in any one of claims 1-3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method for unified cross-end data encryption, decryption and desensitization as described in any one of claims 1-3.

Images