Secure dynamic network data encryption and decryption method, system and device

Abstract

The invention provides a secure dynamic network data encryption and decryption method, system and device, and the method comprises the steps: enabling a terminal to dynamically and randomly generate an AES (Advanced Encryption Standard) key when the terminal initiates a request to a server; performing RSA encryption on the AES key and the current timestamp by using an RSA public key to obtain first data, and performing AES encryption on the request data by using the AES key to obtain second data; through an http or https communication protocol, the first data is transmitted to a background service in a request header mode, and the second data is transmitted to a background service in a POST mode request body mode; after receiving the request data, the background service decrypts the first data by using the RSA private key to obtain an AES key, then decrypts the second data by using the AES key, processes the request, performs AES encryption on response data by using the AES key to obtain third data, and responds the third data to the terminal; and after receiving the response data, the terminal decrypts the third data by using the AES key to obtain plaintext data. According to the invention, the network data security under the http and https communication protocols can be effectively improved, and the transmission efficiency is high.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and device for secure dynamic network data encryption and decryption. Background Art

[0002] With the rapid development of the Internet and the Internet of Things, data security has become extremely important. At present, the HTTP-based communication protocol uses plain text when submitting and obtaining data, and also uses plain text during network transmission, lacking encryption protection during the entire network transmission process. Although the HTTPS communication protocol adds SSL encryption on the basis of HTTP, which makes the data ciphertext during network transmission and improves security, it is still easy to capture plain text data at the terminal level, such as through browser developer tools or network packet capture tools, which makes data security not fully guaranteed. Therefore, it is necessary to study a more effective data encryption technology to protect the security of data at the terminal and prevent data from being easily captured and cracked. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a method, system and device for secure dynamic network data encryption and decryption, so as to improve the security of network data under http and https communication protocols.

[0004] In a first aspect, the present invention provides a method for secure dynamic network data encryption and decryption, the method comprising: Step S1: When the terminal initiates a request to the server, the terminal dynamically and randomly generates an AES key corresponding to the current request and caches it in the terminal; Step S2: using the RSA public key to perform RSA encryption on the current AES key and the current timestamp to obtain the first data, and using the AES key to perform AES encryption on the request data to obtain the second data; Step S3: passing the first data to the backend service in the form of a request header and the second data to the backend service in the form of a POST request body via the http or https communication protocol; Step S4: After receiving the request data, the background service uses the RSA private key to decrypt the first data to obtain the decrypted AES key, and then uses the decrypted AES key to decrypt the second data. After processing the request, the plaintext response data is AES encrypted using the decrypted AES key to obtain the third data, and the third data is responded to the terminal; Step S5: After receiving the response data, the terminal uses the current AES key to decrypt the third data to obtain the plaintext data.

[0005] Furthermore, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0006] Furthermore, the request in step S1 includes a login request or an access request, and each time an API access is performed, a new AES key is randomly generated by the terminal and cached in the terminal.

[0007] Furthermore, in the login request stage, the request data includes at least the login user account and password. After processing the request, the server generates an authorization TOKEN and dynamically generates a private RSA public key and RSA private key associated with the user. The plaintext response data includes the TOKEN and the private RSA public key.

[0008] Furthermore, for the anonymous API or login request stage, the RSA public key used in step S2 is a public RSA public key. For the API that requires authorization or the stage after successful login, the RSA public key used in step S2 is the private RSA public key responded by the server after successful login.

[0009] Furthermore, the step S3 is specifically as follows: the first data is encoded by BASE64 and then passed to the backend service in a request header, and the second data is encoded by BASE64URL security mode and then passed to the backend service in a POST request body; Then, before decrypting the second data, BASE64 decoding is performed first, and before decrypting the second data, BASE64 URL security mode decoding is performed first.

[0010] Furthermore, in step S4, "responding the third data to the terminal" specifically includes encoding the third data in BASE64URL security mode and responding to the terminal in the form of a response body; In the step S5, before "decrypting the third data using the current AES key", the step also includes performing BASE64URL security mode decoding. In a second aspect, the present invention provides a secure dynamic network data encryption and decryption system, comprising: The terminal is used to generate a random 16 bytes each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal, encrypt the current AES key with an RSA public key, perform BASE64 encoding, and then add it to the request header, encrypt the request data with the AES key and obtain the request body after encoding it in BASE64URL security mode, and send the request header and request body to the server through the http or https communication protocol; and after receiving the server response data, perform BASE64URL security mode decoding on the response data, and decrypt the response data with the current AES key to obtain the plaintext response data; The server is used to receive a request from a terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with an RSA private key to obtain an AES key, perform BASE64URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt the original request data, perform corresponding business processing based on the original request data, obtain response data, encrypt the response data with the AES key, and then send it to the terminal through the http or https communication protocol after encoding it with the BASE64URL security mode.

[0011] Furthermore, the “encrypting the current AES key with the RSA public key and performing BASE64 encoding before adding it to the request header” specifically includes: determining whether the accessed API is anonymous; if so, encrypting the current AES key with a timestamp using the public RSA public key, performing BASE64 encoding before adding it to the request header; otherwise, encrypting the current AES key with a timestamp using the private RSA public key after login, performing BASE64 encoding before adding it to the request header.

[0012] Furthermore, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0013] In a third aspect, the present invention provides a secure dynamic network data encryption and decryption device, the device being a terminal, comprising: AES key generation module, used to generate a random 16-byte key each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal; AES key encryption module, used to determine whether the accessed API is anonymous. If so, the current AES key is encrypted with the public RSA public key, and then BASE64-encoded and added to the request header. Otherwise, the current AES key is encrypted with the private RSA public key after login, and then BASE64-encoded and added to the request header. A plaintext data encryption module is used to encrypt the request data using the AES key and obtain the request body after encoding it in BASE64URL security mode; Data submission module, used to send request header and request body to the server via http or https communication protocol; The data acquisition module is used to obtain the server response data through the http or https communication protocol, and after receiving the response body, it is decoded through the BASE64URL security mode to obtain the ciphertext response body, and then decoded through the AES key to obtain the plaintext response data.

[0014] Furthermore, the “encrypting the current AES key using the public RSA public key” in the AES key encryption module specifically refers to encrypting the current AES key plus the current timestamp using the public RSA public key; The "using the private RSA public key after login to encrypt the current AES key" in the AES key encryption module specifically means encrypting the current AES key plus the current timestamp using the private RSA public key.

[0015] Furthermore, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0016] In a fourth aspect, the present invention provides a secure dynamic network data encryption and decryption device, the device being a server, comprising: The data receiving module is used to receive the request from the terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with the RSA private key to obtain the AES key, perform BASE64 URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt the original request data; The data response module is used to perform corresponding business processing according to the original request data, obtain response data, encrypt the response data with an AES key, and then encode it in BASE64URL security mode and send it to the terminal through the http or https communication protocol.

[0017] One or more technical solutions provided by the present invention have at least the following technical effects or advantages: the secure dynamic network encryption and decryption method of the present invention adopts a combination of RSA and AES, and the RSA and AES keys are dynamically and randomly generated. According to the encryption and decryption characteristics of RSA and AES, RSA is used to encrypt and decrypt 16 characters of the AES key, and AES is used to encrypt and decrypt request data and response data. The data is dynamically encrypted and decrypted, the speed and efficiency of encryption and decryption are greatly improved, and the difficulty of data cracking is greatly increased. Even if the data is cracked once, it cannot be used for the next data cracking, which greatly improves the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0019] Figure 1 The present invention is a flowchart of a method for encrypting and decrypting secure dynamic network data in a first embodiment of the present invention.

[0020] Figure 2 This is a system structure block diagram of a secure dynamic network data encryption and decryption method in Embodiment 2 of the present invention.

[0021] Figure 3The figure is a schematic diagram of the device structure of a secure dynamic network data encryption and decryption method in Embodiment 3 of the present invention.

[0022] Figure 4 The figure is a schematic diagram of the device structure of a secure dynamic network data encryption and decryption method in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0023] The embodiments of the present application provide a secure dynamic network data encryption and decryption method, system and device to solve the problem that data under the existing http and https communication protocols are all in plain text when submitted and obtained by the terminal, thereby improving the security of the data.

[0024] The technical solution in the embodiment of the present application has the following general idea: the present invention is based on the application of the front-end and back-end separation system architecture of http and https. The terminal can be APP, WEB terminal, PC terminal software, etc. The request header, request body, and response header are used for data interaction in POST mode. The request parameter data and response data are dynamically encrypted. The combination of RSA, AES, and BASE64 is used. The RSA and AES keys are dynamically generated. In view of the encryption and decryption characteristics of RSA and AES, the encryption and decryption performance of AES for big data is much higher than that of RAS. In order to improve the efficiency of encryption and decryption, RSA is used to encrypt small amounts of data, encrypt and decrypt AES keys, AES encryption and decryption of big data, and encryption and decryption requests and response data. For APIs that can be accessed anonymously, a public RSA public key is used. For APIs that require authorized access, the user's private RSA public key is used. A new private RSA public key is dynamically generated after each successful login by the user. A new random AES key is dynamically generated for each request. The AES key plus the current timestamp is encrypted using the RSA public key to ensure that the data encrypted by the AES key is different each time. The encrypted data is encoded into a string using BASE64, and the decrypted data is first decoded by BASE64. The encrypted AES key data is passed to the backend service using the request header of the http communication protocol, the encrypted request data is passed to the backend service using the request body of the http communication protocol, and the encrypted response data is responded to the terminal using the response body of the http communication protocol.

[0025] In order to better understand the above technical solution, the technical solution of the present invention will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0026] Embodiment 1 See also Figure 1 As shown, the present invention provides a secure dynamic network data encryption and decryption method, the method comprising: Step S1: When the terminal initiates a request to the server, the terminal dynamically and randomly generates an AES key corresponding to the current request and caches it in the terminal; Step S2, using the RSA public key to perform RSA encryption on the current AES key plus the current timestamp to obtain the first data, and using the AES key to perform AES encryption on the request data to obtain the second data; the specific format of the current AES key plus the current timestamp is "current AES key & timestamp number (milliseconds)", ensuring that the encrypted data will not be the same, ensuring the uniqueness of the encrypted data, and no regularity, increasing the difficulty of cracking, and the timestamp can be used to verify the time point when the AES key was generated, and the illegal access can be filtered out for a long time.

[0027] Step S3: passing the first data to the backend service in the form of a request header and the second data to the backend service in the form of a POST request body via the http or https communication protocol; Step S4: After receiving the request data, the background service uses the RSA private key to decrypt the first data to obtain the decrypted AES key, and then uses the decrypted AES key to decrypt the second data. After processing the request, the plaintext response data is AES encrypted using the decrypted AES key to obtain the third data, and the third data is responded to the terminal; Step S5: After receiving the response data, the terminal uses the current AES key to decrypt the third data to obtain the plaintext data.

[0028] Preferably, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0029] Preferably, the request in step S1 includes a login request or an access request, and each time an API access is performed, a new AES key is randomly generated by the terminal and cached in the terminal.

[0030] Preferably, at the login request stage, the request data includes at least the login user account and password. After processing the request, the server generates an authorization TOKEN and dynamically generates a private RSA public key and RSA private key associated with the user. The plaintext response data includes the TOKEN and the private RSA public key.

[0031] Preferably, for the anonymous API or login request stage, the RSA public key used in step S2 is a public RSA public key, and for the API requiring authorization or the stage after successful login, the RSA public key used in step S2 is a private RSA public key responded by the server after successful login.

[0032] Preferably, the step S3 specifically includes: performing BASE64 encoding on the first data and passing it to the backend service in a request header, and performing BASE64URL security mode encoding on the second data and passing it to the backend service in a POST request body; Then, before decrypting the second data, BASE64 decoding is performed first, and before decrypting the second data, BASE64 URL security mode decoding is performed first.

[0033] Preferably, in step S4, "responding the third data to the terminal" specifically includes encoding the third data in BASE64URL security mode and responding to the terminal in the form of a response body; In the step S5, before "decrypting the third data using the current AES key", the step also includes performing BASE64URL security mode decoding. For example, in a specific implementation, in an application of an Internet of Things or Internet front-end and back-end separation system architecture based on http and https: During the user request login stage, the terminal dynamically and randomly generates an AES key corresponding to the login request and caches it in the terminal; the public RSA public key is used to perform RSA encryption on the string formed by adding the AES key to the current timestamp to obtain the first data, and the AES key is used to perform AES encryption on the login request data to obtain the second data; the login request data at least includes the login user account and password; through the http or https communication protocol, one data is passed to the background service in the request header and the second data is passed to the background service in the POST request body; then after the background service receives the login request data, it uses the public RSA private key to decrypt the first data to obtain the decrypted AES key, and then uses the decrypted AES key to decrypt the second data, the background service verifies that the user has logged in, generates an authorization TOKEN and dynamically generates a private RSA public key and RSA private key associated with the user, uses the decrypted AES key to perform AES encryption on the TOKEN and the private RSA public key data to obtain the third data, and responds to the third data to the terminal. After the terminal receives the response data, it uses the current AES key to decrypt the third data, extracts the TOKEN and the private RSA public key and caches them in the terminal; During the access phase after the user successfully logs in, for access to other APIs, each time an access request is initiated, the terminal dynamically and randomly generates a new AES key and caches it in the terminal; The terminal uses a private RSA public key to perform RSA encryption on the string formed by adding the current AES key to the current timestamp to obtain the fourth data, uses the current AES key to perform AES encryption on the plaintext request data to obtain the fifth data, and passes the fourth data to the background service in the request header and the fifth data in the POST request body through the http or https communication protocol. The background service uses the private RSA private key associated with the user to decrypt the fourth data to obtain the decrypted AES key, and then uses the decrypted AES key to decrypt the fifth data. After processing the request, the plaintext response data uses the decrypted AES key to perform AES encryption to obtain the sixth data, which is responded to the terminal. The terminal uses the current new AES key to decrypt the response data to obtain the plaintext data. Each login request or access request in each of the above stages will generate a new AES key, and the timestamp is introduced in the process of encrypting the AES key using the RSA public key before encryption.

[0034] Among them, a parameter datetime is set in the JOSN format data of the request data and the response data respectively, which is used to add the current timestamp number (milliseconds) to the request data / response data to ensure that the encrypted data of each request and response data is different. When other parameter values ​​of the request or response are the same, if there is no timestamp, the encrypted content will be the same. After adding the timestamp, the encrypted data will not be the same, and the encrypted data will be unique and irregular, which increases the difficulty of cracking.

[0035] Embodiment 2 like Figure 2 As shown, the present invention provides a secure dynamic network data encryption and decryption system, comprising: The terminal is used to generate a random 16 bytes each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal, encrypt the current AES key with an RSA public key, perform BASE64 encoding, and then add it to the request header, encrypt the request data with the AES key and obtain the request body after encoding it in BASE64URL security mode, and send the request header and request body to the server through the http or https communication protocol; and after receiving the server response data, perform BASE64URL security mode decoding on the response data, and decrypt the response data with the current AES key to obtain the plaintext response data; The server is used to receive a request from a terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with an RSA private key to obtain an AES key, perform BASE64URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt the original request data, perform corresponding business processing based on the original request data, obtain response data, encrypt the response data with the AES key, and then send it to the terminal through the http or https communication protocol after encoding it with the BASE64URL security mode.

[0036] Among them, a parameter datetime is set in the JOSN format data of the request data and the response data respectively, which is used to add the current timestamp number (milliseconds) to the request data / response data to ensure that the encrypted data of each request and response data is different. When other parameter values ​​of the request or response are the same, if there is no timestamp, the encrypted content will be the same. After adding the timestamp, the encrypted data will not be the same, and the encrypted data will be unique and irregular, which increases the difficulty of cracking.

[0037] Preferably, the "encrypting the current AES key with RSA public key and performing BASE64 encoding before adding it to the request header" is specifically as follows: determine whether the accessed API is anonymous, if so, encrypt the current AES key with a timestamp using the public RSA public key, perform BASE64 encoding before adding it to the request header, otherwise, encrypt the current AES key with a timestamp using the private RSA public key after login, perform BASE64 encoding before adding it to the request header, and before encrypting the current AES key with the RSA public key, add the current timestamp to the AES key, with the specific format of "current AES key & timestamp number (milliseconds)" to ensure that the encrypted data will not be the same, ensure the uniqueness of the encrypted data, and increase the difficulty of cracking. At the same time, the timestamp can be used to verify the time point when the AES key was generated, and illegal access that is a long time ago can be filtered out.

[0038] Preferably, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0039] Embodiment 3 like Figure 3 As shown, the present invention provides a secure dynamic network data encryption and decryption device, the device is a terminal, including: AES key generation module, used to generate a random 16-byte key each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal; The AES key encryption module is used to determine whether the accessed API is anonymous. If so, the public RSA public key is used to encrypt the current AES key, and the key is added to the request header after BASE64 encoding. Otherwise, the private RSA public key after login is used to encrypt the current AES key, and the key is added to the request header after BASE64 encoding. Preferably, before the current AES key is encrypted with the RSA public key, the current timestamp is added to the AES key. The specific format is "current AES key & timestamp number (milliseconds)" to ensure that the encrypted data will not be the same, and the encrypted data is unique and irregular, which increases the difficulty of cracking. At the same time, the timestamp can be used to verify the time point when the AES key was generated. Illegal access can be filtered out if the time is too long.

[0040] The plaintext data encryption module is used to encrypt the request data with the AES key and obtain the request body after encoding with the BASE64URL security mode; a parameter datetime is set in the JOSN format data of the request data to add the current timestamp number (milliseconds) to the request data to ensure that the encrypted data is different for each request. When the other parameter values ​​of the request are the same, if there is no timestamp, the encrypted content will be the same. After adding the timestamp, the encrypted data will not be the same. The encrypted data is unique and irregular, which increases the difficulty of cracking, so that the illegal data can be filtered out by the timestamp during subsequent verification.

[0041] Data submission module, used to send request header and request body to the server via http or https communication protocol; The data acquisition module is used to obtain the server response data through the http or https communication protocol, and after receiving the response body, it is decoded through the BASE64URL security mode to obtain the ciphertext response body, and then decoded through the AES key to obtain the plaintext response data.

[0042] Preferably, the "using a public RSA public key to encrypt the current AES key" in the AES key encryption module specifically includes encrypting the current AES key plus the current timestamp using a public RSA public key; The "using the private RSA public key after login to encrypt the current AES key" in the AES key encryption module specifically means encrypting the current AES key plus the current timestamp using the private RSA public key.

[0043] Preferably, the terminal includes an APP terminal, a WEB terminal or a PC terminal.

[0044] Embodiment 4 like Figure 4As shown, the present invention provides a secure dynamic network data encryption and decryption device, the device is a server, including: The data receiving module is used to receive the request from the terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with the RSA private key to obtain the AES key, perform BASE64 URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt the original request data; The data response module is used to perform corresponding business processing according to the original request data, obtain response data, and encrypt the response data through the AES key, and then send it to the terminal through the http or https communication protocol after encoding in BASE64URL security mode. Preferably, a parameter datetime is set in the JOSN format data of the response data to add the current timestamp number (milliseconds) to the response data to ensure that the encrypted data of each response data is different. When the other parameter values ​​of the response are the same, if there is no timestamp, the encrypted content will be the same. After adding the timestamp, the encrypted data will not be the same. The encrypted data is unique and irregular, which increases the difficulty of cracking.

[0045] The technical solution provided in the embodiment of the present application has at least the following technical effects or advantages: solve the problem that the data is plain text data at the terminal, and the data needs to be encrypted and decrypted. A secure dynamic network encryption and decryption method is adopted, and RSA and AES are combined. RSA and AES keys are dynamically and randomly generated. According to the encryption and decryption characteristics of RSA and AES, the speed and efficiency of AES encryption and decryption of large data are much higher than RAS. In order to improve the speed and efficiency of encryption and decryption, RSA is used to encrypt a small amount of data, and is only used to encrypt and decrypt 16 characters of AES keys. AES encryption and decryption of large data is used to encrypt and decrypt request data and response data. AES is used to encrypt and decrypt request and response data, and the current timestamp is added to the request and response data to ensure that the data encrypted by each request and response data is different, so as to realize the dynamic encryption and decryption of data, and the speed and efficiency of encryption and decryption are greatly improved. The difficulty of data cracking is greatly improved. Even if one of the data is cracked, it cannot be used for the next data cracking, which greatly enhances the security of data.

[0046] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A secure dynamic network data encryption and decryption method, characterized in that: The method comprises: Step S1: When the terminal initiates a request to the server, the terminal dynamically and randomly generates an AES key corresponding to the current request and caches it in the terminal; Step S2: using the RSA public key to perform RSA encryption on the current AES key and the current timestamp to obtain the first data, and using the AES key to perform AES encryption on the request data to obtain the second data; Step S3: passing the first data to the backend service in the form of a request header and the second data to the backend service in the form of a POST request body via the http or https communication protocol; Step S4: After receiving the request data, the background service uses the RSA private key to decrypt the first data to obtain the decrypted AES key, and then uses the decrypted AES key to decrypt the second data. After processing the request, the plaintext response data is AES encrypted using the decrypted AES key to obtain the third data, and the third data is responded to the terminal; Step S5: After receiving the response data, the terminal uses the current AES key to decrypt the third data to obtain the plaintext data.

2. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: The terminal includes an APP terminal, a WEB terminal or a PC terminal.

3. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: The request in step S1 includes a login request or an access request. Each time an API access is performed, a new AES key is randomly generated by the terminal and cached in the terminal.

4. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: In the login request stage, the request data includes at least the login user account and password. After processing the request, the server generates an authorization TOKEN and dynamically generates a private RSA public key and RSA private key associated with the user. The plaintext response data includes the TOKEN and the private RSA public key.

5. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: For the anonymous API or login request stage, the RSA public key used in step S2 is the public RSA public key. For the API that requires authorization or the stage after successful login, the RSA public key used in step S2 is the private RSA public key responded by the server after successful login.

6. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: The step S3 specifically includes: performing BASE64 encoding on the first data and passing it to the backend service in a request header, and performing BASE64URL security mode encoding on the second data and passing it to the backend service in a POST request body; Then, before decrypting the second data, BASE64 decoding is performed first, and before decrypting the second data, BASE64 URL security mode decoding is performed first.

7. A secure dynamic network data encryption and decryption method according to claim 1, characterized in that: In the step S4, "responding the third data to the terminal" specifically includes encoding the third data in BASE64URL security mode and responding to the terminal in the form of a response body; In the step S5, before "decrypting the third data using the current AES key", the step also includes performing BASE64 URL security mode decoding.

8. A secure dynamic network data encryption and decryption system, characterized by: include: The terminal is used to generate a random 16 bytes each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal, encrypt the current AES key with an RSA public key, perform BASE64 encoding, and then add it to the request header, encrypt the request data with the AES key and obtain the request body after encoding it in BASE64URL security mode, and send the request header and request body to the server through the http or https communication protocol; After receiving the server response data, the response data is decoded in BASE64URL security mode, and the response data is decrypted using the current AES key to obtain the plaintext response data; The server is used to receive a request from a terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with an RSA private key to obtain an AES key, perform BASE64URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt the original request data, perform corresponding business processing based on the original request data, obtain response data, encrypt the response data with the AES key, and then send it to the terminal through the http or https communication protocol after encoding it with the BASE64URL security mode.

9. A secure dynamic network data encryption and decryption device, characterized in that: The device is a terminal, comprising: AES key generation module, used to generate a random 16-byte key each time a request is initiated, and convert it into 16 US-ASCII characters as the current AES key and temporarily cache it in the terminal; AES key encryption module, used to determine whether the accessed API is anonymous. If so, the current AES key is encrypted with the public RSA public key, and then BASE64-encoded and added to the request header. Otherwise, the current AES key is encrypted with the private RSA public key after login, and then BASE64-encoded and added to the request header. A plaintext data encryption module is used to encrypt the request data using the AES key and obtain the request body after encoding it in BASE64URL security mode; Data submission module, used to send request header and request body to the server via http or https communication protocol; The data acquisition module is used to obtain the server response data through the http or https communication protocol, and after receiving the response body, it is decoded through the BASE64URL security mode to obtain the ciphertext response body, and then decoded through the AES key to obtain the plaintext response data.

10. A secure dynamic network data encryption and decryption device, characterized in that: The device is a server, comprising: The data receiving module is used to receive the request from the terminal through the http or https communication protocol, perform BASE64 decoding on the request header, decrypt it with the RSA private key to obtain the AES key, perform BASE64 URL security mode decoding on the request body, and then use the AES key obtained by decrypting the request header to decrypt it to obtain the original request data; The data response module is used to perform corresponding business processing according to the original request data, obtain response data, encrypt the response data with an AES key, and then send it to the terminal through the http or https communication protocol after encoding it in BASE64URL security mode.

Images