Dynamic encryption transmission method for interface data based on symmetric and asymmetric modes

Abstract

The embodiment of the invention discloses an interface data dynamic encryption transmission method based on symmetric and asymmetric modes. The method comprises the steps of performing dual encryption transmission on interface data through an SM2 encryption algorithm and an SM4 encryption algorithm, performing secondary encryption on a symmetric key generated by SM4 symmetric encryption by using SM2 asymmetric encryption, meeting the requirements of high encryption efficiency and high security when a large amount of data is processed, and performing corresponding secondary decryption so as to improve the encryption efficiency and the security. And the transcoded data in the first transmission data is decrypted through the obtained symmetric key and the initialization vector, so that the fault bit error rate in the data transmission encryption and decryption process is avoided, and the success rate of interface data encryption transmission is improved. Meanwhile, legality verification is carried out on the interface data obtained through decryption based on the hash function, and the purpose of resisting interface replay attacks under the condition that the response speed of the front-end interface is not affected is achieved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the technical field of secure data transmission, and in particular, to a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods. Background Art

[0002] With the rapid development of communication technology, data transmission has become an indispensable part of daily life in the information age. Therefore, the security of interface data transmission is particularly important, and the demand for data encryption is growing. Traditional interface data encryption methods often use internationally accepted algorithms such as RSA and AES. However, in the RSA algorithm, since the encryption and decryption processes involve big data operations, the encryption time is relatively long, especially when processing large amounts of data, the problem of low efficiency is particularly prominent. Although the AES algorithm has a fast encryption speed, in the scenario where a fixed key is used, once the key is leaked, the security of the entire encryption system will be threatened. Therefore, although the existing encryption transmission algorithms guarantee the security of data to a certain extent, they cannot simultaneously overcome the shortcomings of the single encryption method, the long encryption time, and the fixed key content. Summary of the invention

[0003] The embodiment of this specification provides a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods, and its technical solution is as follows: In a first aspect, an embodiment of the present specification provides a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods, the method comprising: When the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, and transmits the asymmetric public key to the target front end, wherein the asymmetric key includes the asymmetric public key and the asymmetric private key, and the interface data includes the service parameter, the timestamp parameter and the nonce parameter; The target front end encrypts the interface data based on the SM4 encryption algorithm to obtain first transmission data, wherein the first transmission data includes a symmetric key generated by the SM4 encryption algorithm, an initialization vector, and transcoded data obtained by encrypting the interface data based on the SM4 encryption algorithm; The target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain second transmission data, where the second transmission data includes key-encrypted data corresponding to the symmetric key and the initialization vector and the transcoded data, and sends the second transmission data to the server; After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, and performs a second decryption on the first transmission data based on the symmetric key and initialization vector obtained by the first decryption to obtain the interface data; The timestamp parameter and the nonce parameter in the interface data are subjected to a validity check based on a hash function, and the service parameter is read after both the timestamp parameter and the nonce parameter pass the validity check.

[0004] Preferably, when the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: When the target front end obtains the interface data, the target front end sends a data encryption request to the server; After receiving the encryption request, the server randomly generates an asymmetric key based on the SM2 encryption algorithm.

[0005] Preferably, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: The server determines a target elliptic curve based on the SM2 encryption standard, and determines a parameter value corresponding to the target elliptic curve, wherein the parameter value includes an order and a base point number; Determine a target interval corresponding to the order, and determine a random target number in the target interval based on a random method to obtain an asymmetric private key; Performing a point multiplication operation on the asymmetric private key and the base point number to obtain an asymmetric public key; The asymmetric private key and the asymmetric public key are integrated to obtain an asymmetric key.

[0006] Preferably, the target front end encrypts the interface data based on the SM4 encryption algorithm to obtain the first transmission data, including: The target front end determines an encryption mode based on the SM4 encryption algorithm, and determines a symmetric key and an initialization vector corresponding to the encryption mode; Encrypting the interface data based on the symmetric key and the initialization vector to obtain transcoded data; The transcoded data, the symmetric key and the initialization vector are integrated to obtain first transmission data.

[0007] Preferably, the target front end performs SM2 algorithm encryption on the symmetric key and the initialization vector based on the asymmetric public key to obtain the second transmission data, including: The target front end performs format conversion on the symmetric key and the initialization vector to obtain a target byte sequence; Encrypting the target byte sequence based on the asymmetric public key to obtain key-encrypted data; The key-encrypted data and the transcoded data are integrated to obtain second transmission data.

[0008] Preferably, after the target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain the second transmission data, it also includes: Encapsulating the first transmission data and the second transmission data respectively to obtain request parameter data corresponding to the first transmission data and cipher parameter data corresponding to the second transmission data; Integrate the request parameter and cipher parameter data to obtain encapsulated data; The target front end transmits the encapsulated data to the service end; After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, including: After receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key.

[0009] Preferably, after receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key, including: After receiving the encapsulated data, the server decapsulates the encapsulated data to obtain decapsulated data, wherein the decapsulated data includes the second transmission data corresponding to the cipher parameter and the first transmission data corresponding to the request parameter data; Decrypting the key-encrypted data in the second transmission data for the first time based on the asymmetric private key to obtain the symmetric key and the initialization vector, the second transmission data being transmission data whose encapsulation parameter is the cipher parameter; The second decrypting of the transcoded data based on the symmetric key and the initialization vector to obtain the interface data includes: The transcoded data in the first transmission data is decrypted for a second time based on the symmetric key and the initialization vector to obtain the interface data, wherein the first transmission data is the transmission data whose encapsulation parameter is the request parameter.

[0010] Preferably, performing a legitimacy check on the timestamp parameter and the nonce parameter in the interface data based on a hash function, and reading the service parameter after both the timestamp parameter and the nonce parameter pass the legitimacy check, comprises: The server determines a receiving timestamp when the interface data is received, and performs a time check on the timestamp parameter based on the receiving timestamp to obtain a first check result; Performing a set check on the nonce parameters based on a hash function to obtain a second check result; When both the first verification result and the second verification result pass the legality verification, the service parameters are read.

[0011] Preferably, performing time verification on the timestamp parameter based on the received timestamp to obtain a first verification result includes: Calculate the difference between the receiving timestamp and the timestamp parameter to obtain the target duration; Comparing the target duration with the preset duration to obtain a comparison result; When the comparison result indicates that the target duration exceeds the preset duration, the first verification result indicates that the legality requirement is not met; When the comparison result indicates that the target duration does not exceed the preset duration, the first verification result indicates that the legality requirement is met.

[0012] Preferably, performing a set check on the nonce parameters based on a hash function to obtain a second check result includes: Determine a target hash value corresponding to the nonce parameter based on a hash function; Determine whether the target hash value exists in the historical hash set based on the Bloom filter, and obtain a determination result, wherein the historical hash set is a set consisting of all historical hash values ​​corresponding to the historical nonce parameter; When the judgment result indicates that the target hash value exists in the historical hash set, the second verification result indicates that the legality requirement is not met; When the judgment result is characterized as the target hash value not existing in the historical hash set, the second verification result is characterized as satisfying the legality requirement.

[0013] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least: In one or more embodiments of the present specification, the interface data is double encrypted and transmitted by using the SM2 encryption algorithm and the SM4 encryption algorithm, and the symmetric key generated by the SM4 symmetric encryption is twice encrypted by using the SM2 asymmetric encryption, which meets the requirements of high encryption efficiency and high security when processing large amounts of data, and when performing the corresponding secondary decryption, the transcoded data in the first transmission data is decrypted by using the obtained symmetric key and initialization vector, which avoids the error rate of the fault in the data transmission encryption and decryption process and improves the success rate of the interface data encryption transmission. At the same time, the legitimacy of the interface data obtained by decryption is verified based on the hash function, which achieves the goal of resisting the interface replay attack without affecting the response speed of the front-end interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 A schematic diagram of the system architecture of a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods provided in an embodiment of this specification; Figure 2 A flowchart of a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods is provided in an embodiment of this specification. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0017] The terms "first", "second", "third", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0018] The following description provides examples and does not limit the scope, applicability or examples set forth in the claims. Changes may be made to the functions and arrangements of the elements described without departing from the scope of the present specification. Various processes or components may be appropriately omitted, substituted or added to each example. For example, the described method may be performed in an order different from the order described, and various steps may be added, omitted or combined. In addition, features described with respect to some examples may be combined in other examples.

[0019] See also Figure 1 , Figure 1 A schematic diagram of the system architecture of a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods provided in an embodiment of this specification is shown.

[0020] like Figure 1 As shown, the system architecture of the random key-based data encryption transmission method may at least include a target front end 10, a service end 20 and a network.

[0021] The target front end 10 includes but is not limited to electronic devices such as smart phones, desktop computers, tablet computers, laptops, smart speakers, digital assistants, smart wearable devices, etc., and may also be software running on the above electronic devices, such as applications, etc. Optionally, the operating system running on the electronic device may include but is not limited to Android system, IOS system, Linux, Windows, etc. Optionally, the target front end 10 may send a data encryption request to the server 20, receive an asymmetric public key, encrypt the interface data, obtain the first transmission data, and then encrypt the symmetric key and the initialization vector based on the asymmetric public key to obtain the second transmission data, and send the second transmission data to the server 20.

[0022] The node network formed by the server 20 can provide background services for the target front end 10, randomly generate an asymmetric key according to the data encryption request sent by the target front end 10, perform a first decryption on the second transmission data based on the asymmetric private key, and perform a second decryption on the first transmission data based on the symmetric key and initialization vector obtained by the first decryption to obtain interface data, and then perform a legitimacy check on the timestamp parameter and nonce parameter in the interface data based on the hash function, and read the business parameters after the timestamp parameter and nonce parameter pass the legitimacy check. Specifically, the server 20 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0023] The network is a medium for providing a communication link between the target front end 10 and the server end 20. The network may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0024] In addition, it should be noted that Figure 1 What is shown is only one system provided by the present disclosure. In practical applications, other systems may also be included, for example, more target front ends may be included.

[0025] In the embodiments of the present specification, the target front end 10 and the server end 20 may be directly or indirectly connected via wired or wireless communication, and the present disclosure does not limit this.

[0026] See next Figure 2 , Figure 2 The overall flow chart of a method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric methods provided in an embodiment of the present specification is shown.

[0027] like Figure 2 As shown, the interface data dynamic encryption transmission method based on symmetric and asymmetric modes may at least include the following steps: Step 201: When the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm and transmits the asymmetric public key to the target front end.

[0028] The asymmetric key includes the asymmetric public key and the asymmetric private key, and the interface data includes a service parameter, a timestamp parameter and a nonce parameter.

[0029] In the embodiment of this specification, when the target front end obtains the interface data, it will send a data encryption request to the server. Among them, the obtained interface data may include the main transmission business parameters, as well as the timestamp parameter and nonce parameter corresponding to the interface data. Then, the server will randomly generate a pair of asymmetric keys through the SM2 encryption algorithm, and transmit the asymmetric public key in the asymmetric key to the target front end.

[0030] In one possible implementation, when the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: When the target front end obtains the interface data, the target front end sends a data encryption request to the server; After receiving the encryption request, the server randomly generates an asymmetric key based on the SM2 encryption algorithm.

[0031] In the embodiment of the present specification, when the target front end obtains the interface data, the target front end will send a data encryption request to the server. Further, after receiving the encryption request, the server will randomly generate a pair of asymmetric keys through the SM2 encryption algorithm. Among them, the asymmetric key includes an asymmetric public key and an asymmetric private key. The asymmetric public key can be used to encrypt the data later, and the asymmetric private key can be used to decrypt the encrypted data. And the server will randomly generate different asymmetric keys each time it receives an encryption request to improve the encryption strength of the interface data.

[0032] In one possible implementation, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: The server determines a target elliptic curve based on the SM2 encryption standard, and determines a parameter value corresponding to the target elliptic curve, wherein the parameter value includes an order and a base point number; Determine a target interval corresponding to the order, and determine a random target number in the target interval based on a random method to obtain an asymmetric private key; Performing a point multiplication operation on the asymmetric private key and the base point number to obtain an asymmetric public key; The asymmetric private key and the asymmetric public key are integrated to obtain an asymmetric key.

[0033] In the embodiments of this specification, after receiving each encryption request, the server will first determine a suitable target elliptic curve through the SM2 encryption standard, which is generally a fixed standard elliptic curve. Then, the base point number G corresponding to the target elliptic curve and the order n of its corresponding base point are determined, and the target interval is determined to be [1, n-2] through the order n. A random target integer is determined in the target interval through a random number generation method, and is used as an asymmetric private key. Among them, sufficient security and randomness can be guaranteed by the random number generation method. Furthermore, the asymmetric private key obtained is calculated with the base point number G using the point multiplication operation on the target elliptic curve to obtain an elliptical random point consisting of two coordinates, and it is used as an asymmetric public key. Finally, the asymmetric private key and the asymmetric public key are integrated to obtain an asymmetric key.

[0034] Step 202: The target front end encrypts the interface data based on the SM4 encryption algorithm to obtain first transmission data.

[0035] Among them, the first transmission data includes a symmetric key generated by an SM4 encryption algorithm, an initialization vector, and transcoded data obtained by encrypting the interface data based on the SM4 encryption algorithm.

[0036] In the embodiment of the present specification, when the target front end receives the interface data, since the amount of the received interface data is often large, the interface data can be encrypted using the high encryption efficiency of the SM4 encryption algorithm to obtain transcoded data. When the SM4 encryption algorithm is used for encryption, a set of symmetric keys and initialization vectors are automatically generated. Therefore, after the interface data is encrypted, the first transmission data can be obtained, and the first transmission data is sent to the server. The first transmission data may include the transcoded data, symmetric key, and initialization vector corresponding to the interface data.

[0037] In one possible implementation, the target front end encrypts the interface data based on the SM4 encryption algorithm to obtain the first transmission data, including: The target front end determines an encryption mode based on the SM4 encryption algorithm, and determines a symmetric key and an initialization vector corresponding to the encryption mode; Encrypting the interface data based on the symmetric key and the initialization vector to obtain transcoded data; The transcoded data, the symmetric key and the initialization vector are integrated to obtain first transmission data.

[0038] In the embodiment of the present specification, after receiving the interface data, the target front end will first determine the encryption mode corresponding to the SM4 encryption. Then, determine the symmetric key and initialization vector corresponding to the encryption mode. As an example, when using the SM4-128-CBC encryption mode, the symmetric key length is 128 bits, the initial vector length is 128 bits, and the padding method is PKCS5Padding. Further, the interface data is encrypted by the obtained symmetric key and initialization vector to obtain transcoded data. Finally, the transcoded data, the symmetric key and the initialization vector are integrated to obtain the first transmission data.

[0039] Step 203: The target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain second transmission data, and sends the second transmission data to the server.

[0040] The second transmission data includes key-encrypted data corresponding to the symmetric key and the initialization vector and the transcoded data.

[0041] In the embodiments of this specification, in order to ensure the encryption strength of data encryption, the asymmetric encryption method used by the SM2 encryption algorithm has high security, but the encryption time efficiency is relatively low, so only the symmetric key generated by the SM4 encryption algorithm needs to be re-encrypted by the SM2 algorithm. Therefore, the target front end first obtains the asymmetric public key sent by the server, and uses the symmetric key to re-encrypt the symmetric key and the initialization vector by the SM2 algorithm to obtain key-encrypted data. Finally, the key-encrypted data and the transcoded data are integrated to obtain the second transmission data.

[0042] In one possible implementation, the target front end performs SM2 algorithm encryption on the symmetric key and the initialization vector based on the asymmetric public key to obtain second transmission data, including: The target front end performs format conversion on the symmetric key and the initialization vector to obtain a target byte sequence; Encrypting the target byte sequence based on the asymmetric public key to obtain key-encrypted data; The key-encrypted data and the transcoded data are integrated to obtain second transmission data.

[0043] In the embodiment of this specification, after receiving the symmetric key and the initialization vector, the target front end first converts the format of the symmetric key and the initialization vector respectively to obtain the corresponding byte sequences respectively, and then concatenates the two byte sequences to obtain the target byte sequence. Then, the target byte sequence is SM2 encrypted by the asymmetric public key to obtain key-encrypted data. Finally, the key-encrypted data and the transcoded data are integrated to obtain the second transmission data.

[0044] Step 204: After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, and performs a second decryption on the first transmission data based on the symmetric key and initialization vector obtained by the first decryption to obtain the interface data.

[0045] In the embodiment of the present specification, after the server receives the first transmission data and the second transmission data sent by the target front end, the second transmission data can be first decrypted by the asymmetric private key to obtain the symmetric key and the initialization vector. Then, in order to ensure the originality of the original interface data after the secondary encryption process and prevent the abnormal bit error phenomenon of data transcoding transmission during the first encryption and the second encryption process, it is necessary to use the symmetric key and the initialization vector obtained by the first decryption to decrypt the transcoded data in the first transmission data for the second time, and keep the transcoded data in the second transmission data for archiving, and finally obtain the interface data.

[0046] In one possible implementation, after the target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain the second transmission data, it also includes: Encapsulating the first transmission data and the second transmission data respectively to obtain request parameter data corresponding to the first transmission data and cipher parameter data corresponding to the second transmission data; Integrate the request parameter and cipher parameter data to obtain encapsulated data; The target front end transmits the encapsulated data to the service end; After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, including: After receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key.

[0047] In the embodiment of the present specification, after the first transmission data and the second transmission data are obtained through double encryption, they are first encapsulated separately. Among them, the first transmission data is encapsulated to obtain the corresponding request parameter data, and the second transmission data is encapsulated to obtain the corresponding cipher parameter data. Then, the obtained request parameter and cipher parameter data are integrated to obtain encapsulated data, and the target front end transmits the encapsulated data to the server. After the server receives the encapsulated data, it can decrypt the encapsulated data for the first time through the asymmetric private key.

[0048] In one possible implementation, after receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key, including: After receiving the encapsulated data, the server decapsulates the encapsulated data to obtain decapsulated data, wherein the decapsulated data includes the second transmission data corresponding to the cipher parameter and the first transmission data corresponding to the request parameter data; Decrypting the key-encrypted data in the second transmission data for the first time based on the asymmetric private key to obtain the symmetric key and the initialization vector, the second transmission data being transmission data whose encapsulation parameter is the cipher parameter; The second decrypting of the transcoded data based on the symmetric key and the initialization vector to obtain the interface data includes: The transcoded data in the first transmission data is decrypted for a second time based on the symmetric key and the initialization vector to obtain the interface data, wherein the first transmission data is the transmission data whose encapsulation parameter is the request parameter.

[0049] In an embodiment of the present specification, after the server receives the encapsulated data, it can first decapsulate the encapsulated data to obtain the second transmission data corresponding to the cipher parameter and the first transmission data corresponding to the request parameter data, that is, the decapsulated data. Then, the data classification in the obtained decapsulated data is determined by different encapsulation parameters, and the data whose encapsulation parameter is the cipher parameter is determined to be the second transmission data, and the data whose encapsulation parameter is the request parameter is the first transmission data. Furthermore, the key-encrypted data in the second transmission data is decrypted for the first time by an asymmetric private key to obtain a symmetric key and an initialization vector. Then, the transcoded data in the first transmission data can be decrypted for a second time by the obtained symmetric key and initialization vector to obtain interface data.

[0050] Among them, both the first transmission data and the second transmission data obtained include transcoded data, but only the key encrypted data of the second transmission data needs to be decrypted, and then the decrypted symmetric key and initialization vector are used to decrypt the transcoded data in the first transmission data, which can ensure the original interface data's originality after the secondary encryption process and prevent abnormal bit errors in data transcoding transmission during the first and second encryption processes.

[0051] Step 205: Perform a validity check on the timestamp parameter and the nonce parameter in the interface data based on a hash function, and read the service parameter after both the timestamp parameter and the nonce parameter pass the validity check.

[0052] In the embodiments of this specification, after obtaining the interface data through secondary decryption, in order to verify the legitimacy of the interface data to resist replay attacks in scenarios with a large number of interface requests, the legitimacy of the time corresponding to the time taken from receiving the encryption request to decrypting the interface data can be determined based on the timestamp parameter corresponding to the encryption timestamp of the front-end interface request, and then the random string parameters such as the client's IP address, MAC address, etc. in the interface data corresponding to each encryption request, i.e., the nonce parameter, can be used to determine whether each request satisfies the target legal set. Finally, after both the timestamp parameter and the nonce parameter pass the legitimacy check, the business parameters in the decrypted interface data are read.

[0053] In one possible implementation, performing a validity check on the timestamp parameter and the nonce parameter in the interface data based on a hash function, and reading the service parameter after both the timestamp parameter and the nonce parameter pass the validity check, includes: The server determines a receiving timestamp when the interface data is received, and performs a time check on the timestamp parameter based on the receiving timestamp to obtain a first check result; Performing a set check on the nonce parameters based on a hash function to obtain a second check result; When both the first verification result and the second verification result pass the legality verification, the service parameters are read.

[0054] In the embodiment of the present specification, when performing a validity check on the timestamp parameter in the interface data, the server can first determine the receiving timestamp when the interface data is received, and then perform a time check on the timestamp parameter through the receiving timestamp to determine whether the time taken from receiving the encryption request to decrypting the interface data exceeds the preset legal time, and obtain a first verification result. Then, a hash function is used to determine whether the nonce parameter exists in the legal parameter set, and a second verification result is obtained. Finally, when both the first verification result and the second verification result pass the legality check, the service parameters in the decrypted interface data are read.

[0055] In one possible implementation, performing time verification on the timestamp parameter based on the received timestamp to obtain a first verification result includes: Calculate the difference between the receiving timestamp and the timestamp parameter to obtain the target duration; Comparing the target duration with the preset duration to obtain a comparison result; When the comparison result indicates that the target duration exceeds the preset duration, the first verification result indicates that the legality requirement is not met; When the comparison result indicates that the target duration does not exceed the preset duration, the first verification result indicates that the legality requirement is met.

[0056] In the embodiment of this specification, when the timestamp parameter is time-checked by receiving the timestamp, the difference between the received timestamp and the timestamp parameter can be calculated to obtain the target duration. Then, the obtained target time is compared with the legal preset duration to obtain the comparison result. When the target duration exceeds the legal preset duration, the first verification result is characterized as not meeting the legality requirement. When the target duration does not exceed the legal preset duration, the first verification result is characterized as meeting the legality requirement. In general, the preset duration is set to 60s.

[0057] In one possible implementation, performing a set check on the nonce parameter based on a hash function to obtain a second check result includes: Determine a target hash value corresponding to the nonce parameter based on a hash function; Determine whether the target hash value exists in the historical hash set based on the Bloom filter, and obtain a determination result, wherein the historical hash set is a set consisting of all historical hash values ​​corresponding to the historical nonce parameter; When the judgment result indicates that the target hash value exists in the historical hash set, the second verification result indicates that the legality requirement is not met; When the judgment result is characterized as the target hash value not existing in the historical hash set, the second verification result is characterized as satisfying the legality requirement.

[0058] In the embodiment of the present specification, when the nonce parameter is set-checked by a hash function, the target hash value corresponding to the nonce parameter can be first determined by the hash function, and then all the historical hash values ​​corresponding to the historical nonce parameter are determined, and a legal historical hash set is formed by all the historical hash values. Then, a Bloom filter is used to determine whether the target hash value exists in the historical hash set. When the judgment result is characterized as the target hash value existing in the historical hash set, the second verification result is characterized as not meeting the legality requirement. When the judgment result is characterized as the target hash value not existing in the historical hash set, the second verification result is characterized as meeting the legality requirement.

[0059] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0060] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0061] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0062] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable memory, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0063] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A method for dynamically encrypting and transmitting interface data based on symmetric and asymmetric modes, characterized in that: The method comprises: When the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, and transmits the asymmetric public key to the target front end, wherein the asymmetric key includes the asymmetric public key and the asymmetric private key, and the interface data includes the service parameter, the timestamp parameter and the nonce parameter; The target front end encrypts the interface data based on the SM4 encryption algorithm to obtain first transmission data, wherein the first transmission data includes a symmetric key generated by the SM4 encryption algorithm, an initialization vector, and transcoded data obtained by encrypting the interface data based on the SM4 encryption algorithm; The target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain second transmission data, and sends the second transmission data to the server, where the second transmission data includes the key-encrypted data corresponding to the symmetric key and the initialization vector and the transcoded data; After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, and performs a second decryption on the first transmission data based on the symmetric key and initialization vector obtained by the first decryption to obtain the interface data; The timestamp parameter and the nonce parameter in the interface data are subjected to a validity check based on a hash function, and the service parameter is read after both the timestamp parameter and the nonce parameter pass the validity check.

2. The method according to claim 1, characterized in that When the target front end obtains the interface data, the server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: When the target front end obtains the interface data, the target front end sends a data encryption request to the server; After receiving the encryption request, the server randomly generates an asymmetric key based on the SM2 encryption algorithm.

3. The method according to claim 1, characterized in that The server randomly generates an asymmetric key based on the SM2 encryption algorithm, including: The server determines a target elliptic curve based on the SM2 encryption standard, and determines a parameter value corresponding to the target elliptic curve, wherein the parameter value includes an order and a base point number; Determine a target interval corresponding to the order, and determine a random target number in the target interval based on a random method to obtain an asymmetric private key; Performing a point multiplication operation on the asymmetric private key and the base point number to obtain an asymmetric public key; The asymmetric private key and the asymmetric public key are integrated to obtain an asymmetric key.

4. The method according to claim 1, characterized in that The target front end encrypts the interface data based on the SM4 encryption algorithm to obtain first transmission data, including: The target front end determines an encryption mode based on the SM4 encryption algorithm, and determines a symmetric key and an initialization vector corresponding to the encryption mode; Encrypting the interface data based on the symmetric key and the initialization vector to obtain transcoded data; The transcoded data, the symmetric key and the initialization vector are integrated to obtain first transmission data.

5. The method according to claim 1, characterized in that The target front end performs SM2 algorithm encryption on the symmetric key and the initialization vector based on the asymmetric public key to obtain second transmission data, including: The target front end performs format conversion on the symmetric key and the initialization vector to obtain a target byte sequence; Encrypting the target byte sequence based on the asymmetric public key to obtain key-encrypted data; The key-encrypted data and the transcoded data are integrated to obtain second transmission data.

6. The method according to claim 1, characterized in that After the target front end encrypts the symmetric key and the initialization vector using the SM2 algorithm based on the asymmetric public key to obtain the second transmission data, the method further includes: Encapsulating the first transmission data and the second transmission data respectively to obtain request parameter data corresponding to the first transmission data and cipher parameter data corresponding to the second transmission data; Integrate the request parameter and cipher parameter data to obtain encapsulated data; The target front end transmits the encapsulated data to the service end; After receiving the second transmission data, the server performs a first decryption on the second transmission data based on the asymmetric private key, including: After receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key.

7. The method according to claim 6, characterized in that After receiving the encapsulated data, the server performs a first decryption on the encapsulated data based on the asymmetric private key, including: After receiving the encapsulated data, the server decapsulates the encapsulated data to obtain decapsulated data, wherein the decapsulated data includes the second transmission data corresponding to the cipher parameter and the first transmission data corresponding to the request parameter data; Decrypting the key-encrypted data in the second transmission data for the first time based on the asymmetric private key to obtain the symmetric key and the initialization vector, wherein the second transmission data is transmission data whose encapsulation parameter is the cipher parameter; The second decrypting of the transcoded data based on the symmetric key and the initialization vector to obtain the interface data includes: The transcoded data in the first transmission data is decrypted for a second time based on the symmetric key and the initialization vector to obtain the interface data, wherein the first transmission data is the transmission data whose encapsulation parameter is the request parameter.

8. The method according to claim 1, characterized in that The performing a validity check on the timestamp parameter and the nonce parameter in the interface data based on a hash function, and reading the service parameter after both the timestamp parameter and the nonce parameter pass the validity check, includes: The server determines a receiving timestamp when the interface data is received, and performs a time check on the timestamp parameter based on the receiving timestamp to obtain a first check result; Performing a set check on the nonce parameters based on a hash function to obtain a second check result; When both the first verification result and the second verification result pass the legality verification, the service parameters are read.

9. The method according to claim 8, characterized in that The performing time verification on the timestamp parameter based on the received timestamp to obtain a first verification result includes: Calculate the difference between the receiving timestamp and the timestamp parameter to obtain the target duration; Comparing the target duration with the preset duration to obtain a comparison result; When the comparison result indicates that the target duration exceeds the preset duration, the first verification result indicates that the legality requirement is not met; When the comparison result indicates that the target duration does not exceed the preset duration, the first verification result indicates that the legality requirement is met.

10. The method according to claim 8, characterized in that The performing a set check on the nonce parameter based on a hash function to obtain a second check result includes: Determine a target hash value corresponding to the nonce parameter based on a hash function; Determine whether the target hash value exists in the historical hash set based on the Bloom filter, and obtain a determination result, wherein the historical hash set is a set consisting of all historical hash values ​​corresponding to the historical nonce parameter; When the judgment result indicates that the target hash value exists in the historical hash set, the second verification result indicates that the legality requirement is not met; When the judgment result is characterized as the target hash value not existing in the historical hash set, the second verification result is characterized as satisfying the legality requirement.

Images