Key encryption method and device, electronic equipment, storage medium and program product

Abstract

The invention relates to a key encryption method and device, electronic equipment, a storage medium and a program product, and the method comprises the steps: receiving a first request sent by a client, and the first request carries an account identifier and an account password; performing identity verification on the client based on the account identifier and the account password; under the condition that the client passes the identity verification, obtaining an initial picture and a target key corresponding to the account identifier; embedding the target secret key into the initial picture to obtain a secret carrying picture; and sending the secret carrying picture to the client. In the method, the target key is hidden in the picture and is not easy to discover, and an attacker is difficult to identify information contained in the picture, so that the risk that the target key is exposed is reduced, and the security of the protected data is improved.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and in particular to a key encryption method, device, electronic equipment, storage medium and program product. Background Art

[0002] In front-end development (for example, JavaScript in web development), encryption algorithms such as the Advanced Encryption Standard (AES) algorithm or the Data Encryption Standard (DES) algorithm are often used to protect sensitive data. Developers often hard-code the encryption key required in the JavaScript code. This hard-coding method has serious security vulnerabilities. Even if the JavaScript code is compressed and obfuscated, users can still easily view and analyze the front-end code through the browser's developer tools to obtain the hard-coded key. Once the key is found, the attacker can decrypt the protected data, resulting in serious security issues. Summary of the invention

[0003] The present invention is intended to provide a key encryption method, device, electronic device, storage medium and program product to solve the deficiencies in the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0004] According to a first aspect of the present disclosure, a key encryption method is provided, which is executed by a server, and the method includes: Receive a first request sent by a client, wherein the first request carries an account identifier and an account password; Authentication of the client based on the account identifier and the account password; When the client passes the identity authentication, obtaining an initial image and a target key corresponding to the account identifier; Embedding the target key into the initial picture to obtain a secret-carrying picture; The encrypted image is sent to the client.

[0005] Furthermore, embedding the target key into the initial picture to obtain a secret-carrying picture includes: Binary encoding each pixel in the initial image and the target key respectively; The binary code of the target key is embedded in the last bit of the binary code of each pixel in the initial picture to obtain a encrypted picture.

[0006] Furthermore, after sending the encrypted image to the client, the method further includes: receiving a second request sent by the client, where the second request carries the first data; The first data is decrypted using the target key to obtain second data.

[0007] According to a second aspect of the present disclosure, a key encryption method is provided, which is executed by a client, and the method includes: Sending a first request to the server, wherein the first request carries an account identifier and an account password; Receiving a secret image sent by the server based on the account identifier and the account password; The last bit of the binary code of each pixel in the encrypted image is concatenated to obtain a target binary code; The target binary code is converted to obtain a target key.

[0008] Furthermore, after converting the target binary code to obtain the target key, the method further includes: Encrypting the second data using the target key to obtain the first data; A second request is sent to the server, where the second request carries the first data.

[0009] According to a third aspect of the present disclosure, a key encryption device is provided, which is executed by a server, and includes: A first receiving module, configured to receive a first request sent by a client, wherein the first request carries an account identifier and an account password; A first verification module, used for performing identity authentication on the client based on the account identifier and the account password; A first acquisition module, configured to acquire an initial image and a target key corresponding to the account identifier when the client passes the identity authentication; A first processing module, configured to embed the target key into the initial image to obtain a secret-carrying image; The first sending module is used to send the encrypted image to the client.

[0010] According to a fourth aspect of the present disclosure, a key encryption device is provided, which is executed by a client, and includes: A second sending module, configured to send a first request to the server, wherein the first request carries an account identifier and an account password; A second receiving module, used for receiving a secret image sent by the server based on the account identifier and the account password; A first splicing module is used to splice the last bit of the binary code of each pixel in the encrypted image to obtain a target binary code; The first conversion module is used to convert the target binary code to obtain a target key.

[0011] According to a fifth aspect of the present disclosure, an electronic device is provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the method is implemented when the processor executes the computer program.

[0012] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program implements the method when executed by a processor.

[0013] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising computer instructions, which implement the method when executed by a processor.

[0014] The embodiments of the present invention include the following advantages: The key encryption method, device, electronic device, storage medium and program product provided by the embodiments of the present invention are as follows: the server receives a first request sent by a client, the first request carries an account ID and an account password; based on the account ID and the account password, the server authenticates the client; if the client passes the identity authentication, the server obtains an initial image and a target key corresponding to the account ID; the target key is embedded in the initial image to obtain a secret image; and the secret image is sent to the client. The target key is hidden in the image and is not easily discovered, and it is difficult for attackers to identify the information contained in the image, which reduces the risk of the target key being exposed, thereby improving the security of the protected data. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a flowchart of a key encryption method embodiment of the present invention executed by a server; Figure 2 is a flowchart of a key encryption method embodiment of the present invention executed by a client; Figure 3 It is a structural schematic diagram of an embodiment of a key encryption device applied to a server of the present invention; Figure 4 It is a structural schematic diagram of an embodiment of a key encryption device applied to a client of the present invention; Figure 5 It is a structural schematic diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0016] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0017] Figure 1 A flowchart of a key encryption method 100 according to an embodiment of the present disclosure is shown. The method 100 may be executed by a server, and includes: S101, receiving a first request sent by a client, where the first request carries an account identifier and an account password; In some embodiments, the user logs in on the client by filling in the account ID and account password, and the client sends a first request to the server based on the user's login operation, and the first request carries the account ID and account password filled in by the user. The first request can be understood as a verification request, and the server performs an authentication check on the client based on the verification request.

[0018] S102, performing identity authentication on the client based on the account identifier and the account password; In some embodiments, the server can search for the account identifier submitted by the client in the database. If the server finds an account record matching the account identifier mentioned by the client in the database, it will continue to search for the account password corresponding to the account record stored in the database. If the account password corresponding to the account record stored in the database is the same as the account password submitted by the client, it means that the client's identity authentication is successful.

[0019] If the server cannot find an account record in the database that matches the account ID mentioned by the client, or if the server can find an account record in the database that matches the account ID mentioned by the client, but the account password corresponding to the account record stored in the database is different from the account password submitted by the client, it means that the client's identity authentication has failed.

[0020] S103, when the client passes the identity authentication, obtaining an initial image and a target key corresponding to the account identifier; In some embodiments, when the client passes the identity authentication, the server can find the corresponding target key in the database according to the account identifier and obtain the initial image to perform image steganography operation on the target key using the initial image.

[0021] In some embodiments, when the client fails the identity authentication, a failure status code may be sent to the client to clearly indicate to the client that the verification request was unsuccessful.

[0022] S104, embedding the target key into the initial image to obtain a secret image; In some embodiments, embedding the target key into the initial picture to obtain a secret-carrying picture includes: Binary encoding each pixel in the initial image and the target key respectively; The binary code of the target key is embedded in the last bit of the binary code of each pixel in the initial picture to obtain a encrypted picture.

[0023] The original image is composed of many pixels, and the color of each pixel is obtained by mixing three colors: red, green, and blue. Each color (red, green, and blue) can be represented by a numerical value, which can range from 0 to 255. The higher the value, the stronger the color.

[0024] This value can be expressed in hexadecimal, such as "FF", which means that the color is the strongest in this pixel, and the hexadecimal "FF" is equivalent to the binary "11111111". If the last bit of this binary number (the rightmost 1) is changed to 0, it becomes "111111110". For the human eye, the change from "11111111" to "11111110" is extremely small and almost invisible, so this slight modification will not affect the overall display effect of the picture. Therefore, the binary code of the target key is embedded in the last bit of the binary code of each pixel in the initial picture to obtain the secret picture, so that the target key can be better hidden in the picture without affecting the display effect of the picture to the naked eye.

[0025] For example, the initial image contains 4×4 pixels, where the binary encoding of each pixel is as follows (for simplified explanation, each pixel is represented by one byte): [11001001,10101100,11110011,10000010, 10110101,11000111,10101010,11011001, 10010110,10001011,10111000,11101101, 11010011,10100010,11111100,10010101] The binary encoding of the target key is: 0101 0011 1010 0100 After embedding the binary code of the target key into the last bit of the binary code of each pixel in the initial image, the binary code of the encrypted image is as follows: [11001000,10101101,11110010,10000011, 10110100,11000110,10101011,11011001, 10010111,10001010,10111001,11101100, 11010010,10100011,11111100,10010100] S105: Send the secret-carrying picture to the client.

[0026] In some embodiments, the server can send the encrypted image to the client by directly returning it or sending it in real time through WebSocket.

[0027] In some embodiments, after sending the encrypted image to the client, the method further includes: receiving a second request sent by the client, where the second request carries the first data; The first data is decrypted using the target key to obtain second data.

[0028] The server can decrypt the first data using the AES algorithm according to the target key to obtain the second data. After obtaining the second data, the server can use the second data for subsequent business processing. It should be noted that the first data mentioned here is the encrypted second data, and there is no difference between the first data and the second data in terms of data content.

[0029] According to an embodiment of the present disclosure, the server receives a first request sent by a client, the first request carries an account ID and an account password; based on the account ID and the account password, the server authenticates the client; when the client passes the identity authentication, the server obtains an initial image and a target key corresponding to the account ID; the server embeds the target key into the initial image to obtain a secret image; and the server sends the secret image to the client. The target key is hidden in the image and is not easily discovered, and it is difficult for attackers to identify the information contained in the image, which reduces the risk of the target key being exposed, thereby improving the security of the protected data.

[0030] Figure 2 A flowchart of a key protection method 200 according to an embodiment of the present disclosure is shown. The method 200 may be executed by a client, and includes: S201, sending a first request to a server, wherein the first request carries an account identifier and an account password; In some embodiments, the user logs in on the client by filling in the account ID and account password, and the client sends a first request to the server based on the user's login operation, and the first request carries the account ID and account password filled in by the user. The first request can be understood as a verification request, and the server can authenticate the client based on the verification request.

[0031] S202, receiving a secret image sent by the server based on the account identifier and the account password; In some embodiments, if the server successfully authenticates the client, the client will receive a secret-carrying picture sent by the server, in which the target key is hidden.

[0032] In some embodiments, if the server fails to authenticate the client, the client will receive a failure verification code sent by the server, thereby knowing the result of the authentication failure.

[0033] S203, concatenating the last bit of the binary code of each pixel in the encrypted image to obtain a target binary code; In some embodiments, after receiving the secret image, the client draws the secret image on the canvas and reads the binary coded information of the secret image. Exemplarily, the binary coded information of the secret image may be as follows: [11001000,10101101,11110010,10000011, 10110100,11000110,10101011,11011001, 10010111,10001010,10111001,11101100, 11010010,10100011,11111100,10010100] Then, the client concatenates the last bit of the binary code of each pixel in the encrypted image to obtain the target binary code: 0101 0011 1010 0100.

[0034] S204: Convert the target binary code to obtain a target key.

[0035] In some embodiments, the client may convert the target binary code into a human-readable form, such as hexadecimal, ASCII characters, etc., to obtain the target key.

[0036] In some embodiments, after converting the target binary code to obtain the target key, the method further includes: Encrypting the second data using the target key to obtain the first data; A second request is sent to the server, where the second request carries the first data.

[0037] The client can use the target key and encrypt the second data to be transmitted based on the AES algorithm to obtain the first data (ie, the encrypted second data), and then send a second request to the server with the first data.

[0038] According to an embodiment of the present disclosure, the client sends a first request to the server, the first request carries an account ID and an account password; receives a secret picture sent by the server based on the account ID and the account password; concatenates the last bit of the binary code of each pixel in the secret picture to obtain a target binary code; and converts the target binary code to obtain a target key. The target key is hidden in the picture and is not easy to be found, and it is difficult for attackers to identify the information contained in the picture, which reduces the risk of the target key being exposed, thereby improving the security of the protected data.

[0039] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0040] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0041] Figure 3 A block diagram of a key encryption device 300 applied to a server according to an embodiment of the present disclosure is shown, and the device 300 includes: The first receiving module 301 is used to receive a first request sent by a client, where the first request carries an account identifier and an account password; A first verification module 302, configured to authenticate the client based on the account identifier and the account password; A first acquisition module 303 is used to acquire an initial image and a target key corresponding to the account identifier when the client passes the identity authentication; The first processing module 304 is used to embed the target key into the initial image to obtain a secret image; In some embodiments, the first processing module includes: A first encoding unit, configured to perform binary encoding on each pixel in the initial image and the target key respectively; The first processing unit is used to embed the binary code of the target key into the last bit of the binary code of each pixel in the initial picture to obtain a encrypted picture.

[0042] The first sending module 305 is used to send the encrypted image to the client.

[0043] In some embodiments, the apparatus further comprises: A third receiving module is used to receive a second request sent by the client, where the second request carries the first data; The first decryption module is used to decrypt the first data using the target key to obtain second data.

[0044] Figure 4 A block diagram of a key encryption device 400 applied to a client according to an embodiment of the present disclosure is shown, and the device 400 includes: The second sending module 401 is used to send a first request to the server, where the first request carries an account identifier and an account password; The second receiving module 402 is used to receive the encrypted image sent by the server based on the account identifier and the account password; The first splicing module 403 is used to splice the last bit of the binary code of each pixel in the encrypted image to obtain a target binary code; The first conversion module 404 is used to convert the target binary code to obtain a target key.

[0045] In some embodiments, the apparatus further comprises: A first encryption module, used to encrypt the second data using the target key to obtain the first data; The third sending module is used to send a second request to the server, where the second request carries the first data.

[0046] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0047] Figure 5 An example of a physical structure diagram of an electronic device is shown. The electronic device may be a smart terminal, and its internal structure diagram may be as follows: Figure 5As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned key encryption method is implemented.

[0048] On the other hand, the present invention also provides a computer storage medium storing a computer program, which implements the above-mentioned key encryption method when executed by a processor.

[0049] In another aspect, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, the above-mentioned key encryption method is implemented.

[0050] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory.

[0051] By way of illustration and not limitation, Random Access Memory (RAM) is available in many forms, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), Direct Rambus Dynamic RAM (DRDRAM), and Rambus Dynamic RAM (RDRAM).

[0052] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0053] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0054] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0055] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0056] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0057] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A key encryption method, characterized in that: Executed by the server, the method includes: Receive a first request sent by a client, wherein the first request carries an account identifier and an account password; Authentication of the client based on the account identifier and the account password; When the client passes the identity authentication, obtaining an initial image and a target key corresponding to the account identifier; Embedding the target key into the initial picture to obtain a secret-carrying picture; The encrypted image is sent to the client.

2. The key encryption method according to claim 1, characterized in that: The step of embedding the target key into the initial picture to obtain a secret-carrying picture includes: Binary encoding each pixel in the initial image and the target key respectively; The binary code of the target key is embedded in the last bit of the binary code of each pixel in the initial picture to obtain a encrypted picture.

3. The key encryption method according to claim 1 or 2, characterized in that: After sending the encrypted image to the client, the method further includes: receiving a second request sent by the client, where the second request carries the first data; The first data is decrypted using the target key to obtain second data.

4. A key encryption method, characterized in that: Executed by a client, the method includes: Sending a first request to the server, wherein the first request carries an account identifier and an account password; Receiving a secret image sent by the server based on the account identifier and the account password; The last bit of the binary code of each pixel in the encrypted image is concatenated to obtain a target binary code; The target binary code is converted to obtain a target key.

5. The key encryption method according to claim 4, characterized in that: After converting the target binary code to obtain the target key, the method further includes: Encrypting the second data using the target key to obtain the first data; A second request is sent to the server, where the second request carries the first data.

6. A key encryption device, characterized in that: Applied to the server, the device comprises: A first receiving module, configured to receive a first request sent by a client, wherein the first request carries an account identifier and an account password; A first verification module, used for performing identity authentication on the client based on the account identifier and the account password; A first acquisition module, configured to acquire an initial image and a target key corresponding to the account identifier when the client passes the identity authentication; A first processing module, configured to embed the target key into the initial image to obtain a secret-carrying image; The first sending module is used to send the encrypted image to the client.

7. A key encryption device, characterized in that: Applied to a client, the device comprises: A second sending module, configured to send a first request to the server, wherein the first request carries an account identifier and an account password; A second receiving module, used for receiving a secret image sent by the server based on the account identifier and the account password; A first splicing module is used to splice the last bit of the binary code of each pixel in the encrypted image to obtain a target binary code; The first conversion module is used to convert the target binary code to obtain a target key.

8. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the key encryption method according to any one of claims 1 to 3 when executed by the processor, or implements the steps of the key encryption method according to claim 4 or 5 when executed by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the key encryption method as described in any one of claims 1 to 3, or implements the steps of the key encryption method as described in claim 4 or 5 when executed by the processor.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the key encryption method according to any one of claims 1 to 3, or implement the steps of the key encryption method according to claim 4 or 5 when executed by a processor.

Images