Request encryption method, request decryption method, device, medium and program product
By generating a dynamic encryption key based on historical requests and encrypting and decrypting twice during transmission, the problem of easy leakage of keys is solved, and the security of encrypted data is improved.
Patent Information
- Application Number
- CN202411547377.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-01
- Publication Date
- 2025-02-07
AI Technical Summary
In the prior art, keys are prone to leakage, resulting in low security of encrypted data during transmission.
By generating an encryption key and a decryption key based on the historical requests sent between services, the initial key is expanded using the preset key expansion function, a dynamic encryption key is generated, and two operations are performed during the transmission process. Encryption and decryption.
It improves the security of encrypted data during transmission, increases the difficulty of deciphering for attackers, and reduces the risk of key leakage.
Smart Images
Figure CN119402265A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information security technology, and in particular to a request encryption method, a request decryption method, a device, a medium and a program product. Background Art
[0002] In information security, keys are an important resource that is directly related to the security and integrity of data. If keys are leaked, data may be leaked, tampered with, or used maliciously. Therefore, ensuring the security of keys is the basis and prerequisite for maintaining information security.
[0003] In the prior art, keys are usually encrypted and stored in a database. With the emergence of new attack methods, it is very easy to cause key leakage. Once the key is leaked, the attacker can use the key to decrypt the ciphertext to obtain the plaintext, resulting in low security of encrypted data during transmission. Summary of the invention
[0004] The purpose of the embodiments of the present application is to provide a request encryption method, a request decryption method, a device, a medium and a program product, which are used to generate encryption keys and decryption keys based on historical requests that have been sent between services, thereby improving the security of encrypted data during transmission.
[0005] In the first aspect, an embodiment of the present application provides a request encryption method, which is applied to a request initiator, and the method includes: before sending a pending request, obtaining a historical request with the same request target address as the pending request; generating an initial key based on the historical request; using a preset key expansion function to expand the initial key to generate an encryption key; encrypting the pending request by using the encryption key to obtain a first encrypted pending request, and sending the first encrypted pending request to the request recipient.
[0006] In the embodiment of the present application, before sending the pending request, the initial key is generated in real time according to the historical request with the same request target address as the pending request. In this process, since the historical requests corresponding to different request target addresses are different, and the historical requests corresponding to the pending requests sent at different time points are also different, the generated initial keys are different for different pending requests, so that the encryption keys generated after expansion are also different. Therefore, since the initial key is dynamically changing, it increases the difficulty of deciphering by the attacker, thereby improving the security of the encrypted data during transmission.
[0007] In some embodiments, an initial key is generated based on historical requests, including: querying the corresponding request initiation record table according to the request target address; if the request initiation record table is empty, using the request target address as the initial key; if the request initiation record table is not empty, traversing the request initiation record table, obtaining the data size of each historical request, and using the data size of all historical requests as the initial key.
[0008] When generating an initial key based on a historical request, the embodiment of the present application first determines whether there is a corresponding historical request for the pending request, and then selects different objects as the initial key based on the determination result, thereby improving the flexibility of the initial key. Furthermore, it also reflects that for different pending requests, the corresponding initial keys are different. Different initial keys generate different encryption keys, thereby improving the security of encrypted data during transmission.
[0009] In some embodiments, an initial key is expanded using a preset key expansion function to generate an encryption key, including: hashing the initial key to obtain a hash value; expanding the hash value using a preset key expansion function to generate an encryption key; the key expansion function includes at least one of a sum function, a difference function, a product function, a quotient function, and a factorial function.
[0010] In the process of generating an encryption key based on an initial key, the embodiment of the present application first hashes the initial key. Since the hash has the characteristics of unidirectionality and anti-collision, the security of the initial key is improved to a certain extent. Then the hash value is expanded using a key expansion function to generate an encryption key, which increases the difficulty of deciphering the encryption key, thereby reducing the risk of key leakage and improving the security of encrypted data during transmission.
[0011] In some embodiments, the pending request includes a sending time; after obtaining the first encrypted pending request, the method also includes: obtaining a corresponding periodic key based on the sending time; the periodic key is generated by the request initiator according to a preset time period; the first encrypted pending request is re-encrypted using the periodic key to obtain a second encrypted pending request; accordingly, the first encrypted pending request is sent to the request recipient, including: sending the second encrypted pending request to the request recipient.
[0012] In order to further improve the security of encrypted data during transmission, the embodiment of the present application uses a periodic key to perform secondary encryption after obtaining the first encrypted data, thereby increasing the difficulty of decryption and further improving the security of the encrypted data during transmission.
[0013] In some embodiments, obtaining a corresponding period key according to a sending time includes: determining the time period to which the sending time belongs according to the sending time; if there is a period key corresponding to the time period, obtaining the period key; if there is no period key corresponding to the time period, obtaining the period key of the previous time period as the period key of the current time period.
[0014] The embodiment of the present application takes into account that the generation of the periodic key may fail. Therefore, if there is no corresponding periodic key for the current time period, the periodic key of the previous time period is obtained as the periodic key of the current time period, so that the secondary encryption process can be executed normally, thereby improving the security of the encrypted data during transmission.
[0015] In the second aspect, an embodiment of the present application provides a request decryption method, which is applied to a request processing party, and the method includes: receiving a first encrypted pending request sent by a request initiator; the first encrypted pending request is generated by the request initiator according to an encryption key generated by a historical request with the same request target address as the pending request to encrypt the request to be processed; the first encrypted pending request includes an initiation address; an initial key is generated according to the historical request corresponding to the initiation address; the initial key is expanded using a preset key expansion function to generate a decryption key; the first encrypted pending request is decrypted using the decryption key to obtain the decrypted pending request.
[0016] In the embodiment of the present application, the request initiator generates an encryption key in real time to encrypt the request to be processed. Therefore, the request processor also needs to generate a decryption key in real time to decrypt the first encrypted request to be processed. After receiving the first encrypted request to be processed, the request processor generates a decryption key in the same way as the request initiator generates the encryption key, so that the first encrypted request to be processed can be correctly decrypted.
[0017] In some embodiments, the method also includes: encrypting the pending request including the sending time; after receiving the first encrypted pending request sent by the request initiator, the method also includes: obtaining the corresponding periodic key based on the sending time; the periodic key is generated by the request initiator according to a preset time period, and the periodic key is sent to the request processor for storage; using the periodic key to decrypt the first encrypted pending request to obtain a second encrypted pending request; accordingly, decrypting the first encrypted pending request by the decryption key, including: decrypting the second encrypted pending request by the decryption key.
[0018] In the embodiment of the present application, the request initiator may encrypt the request to be processed twice to further improve the security of the encrypted data during transmission. Therefore, in order to obtain the correct request to be processed, the request processor also needs to decrypt the encrypted request to be processed twice. The first encrypted request to be processed is decrypted by obtaining the same periodic key as the request initiator, and then the decrypted first encrypted request to be processed is decrypted by using the decryption key to obtain the request to be processed, so that the request processor can correctly process the request of the request initiator.
[0019] In the third aspect, an embodiment of the present application provides a request encryption device, which includes: an acquisition module, which is used to acquire a historical request with the same request target address as the pending request before sending the pending request; a first generation module, which is used to generate an initial key based on the historical request; a second generation module, which is used to expand the initial key using a preset key expansion function to generate an encryption key; an encryption module, which is used to encrypt the pending request by using the encryption key, obtain a first encrypted pending request, and send the first encrypted pending request to the request recipient.
[0020] In a fourth aspect, an embodiment of the present application provides a request decryption device, which includes: a receiving module, used to receive a first encrypted pending request sent by a request initiator; the first encrypted pending request is generated by encrypting the pending request using an encryption key generated by the request initiator according to a historical request with the same request target address as the pending request; the first encrypted pending request includes an initiation address; a third generation module, used to generate an initial key according to the historical request corresponding to the initiation address; a fourth generation module, used to expand the initial key using a preset key expansion function to generate a decryption key; a decryption module, used to decrypt the first encrypted pending request using the decryption key to obtain the decrypted pending request.
[0021] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method steps of any one embodiment of the first aspect, the second aspect, or both aspects can be executed.
[0022] In a sixth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, comprising: computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, the method steps of any one of the embodiments of the first aspect, the second aspect, or both aspects are executed.
[0023] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising: computer program instructions, which, when executed by a processor, execute the method steps of the first aspect, the second aspect, or any one of the embodiments of these two aspects.
[0024] Other features and advantages of the present application will be described in the subsequent description, and in part will become apparent from the description, or will be understood by implementing the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0026] Figure 1 A flowchart of a method for requesting encryption provided in an embodiment of the present application;
[0027] Figure 2 A flowchart of a method for requesting decryption provided in an embodiment of the present application;
[0028] Figure 3 A schematic diagram of the structure of a request encryption device provided in an embodiment of the present application;
[0029] Figure 4 A schematic diagram of the structure of a decryption request device provided in an embodiment of the present application;
[0030] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0031] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.
[0032] It should be noted that all technical and scientific terms used in this document have the same meanings as those generally understood by technicians in the technical field to which this application belongs; the terms used in this document are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.
[0033] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.
[0034] Figure 1 A flowchart of a request encryption method provided in an embodiment of the present application, the method is applied to the request initiator. It can be understood that the request initiator can be a terminal device (also referred to as an electronic device) and a server; wherein the terminal device can specifically be a smart phone, a tablet computer, a computer, a personal digital assistant (PDA), etc.; the server can specifically be an application server or a Web server. To facilitate understanding of the technical solution provided in the embodiment of the present application, the application scenario of the request encryption method provided in the embodiment of the present application is introduced below, taking the server as the execution subject as an example.
[0035] like Figure 1 As shown, the method includes:
[0036] Step S101: before sending the request to be processed, the server obtains a historical request with the same request target address as the request to be processed.
[0037] For the request initiator and the request processor that are interacting, during the interaction, the number of requests sent by the request initiator to the request processor and the size of the plaintext data of each request can be recorded and traced.
[0038] Exemplarily, the request initiator may be a bank app, and the request processor may be a technical service provider.
[0039] The embodiment of the present application stores the request sent by the request initiator to the request processor through the request initiation record table.
[0040] The data structure of the request initiation record table is Map <String1,List1 <integer>>, where String1 represents the request target address IP, that is, the IP address of the request processor that processes the pending request, and List1 represents a list, each element in the list is used to store the plaintext message size of the historical request that has been sent to the request processor.
[0041] Exemplarily, the request target address is ip1, and the size of the plaintext message corresponding to the i-th historical request sent to the request processor that needs to be obtained is RequestRecord.get(ip1)[i].
[0042] Therefore, before sending the pending request, the server of the request initiator obtains all historical requests or a preset number of historical requests with the same request target address as the pending request through RequestRecord.get(ip).
[0043] Optionally, the request initiation record table may also store the sending time of each historical request.
[0044] Pending requests are requests that need to be sent to the request processor for processing.
[0045] The historical requests with the same request target address as the request to be processed reflect the interaction between the request processor and the request initiator corresponding to the request target address.
[0046] Since one request initiator may correspond to multiple request processors, and each request processor processes requests in different specific circumstances, one request initiator may store multiple request initiation record tables, and each request initiation record table corresponds one-to-one to each request processor.
[0047] Step S102: The server generates an initial key based on historical requests.
[0048] After obtaining the historical requests, the server generates an initial key based on the historical requests.
[0049] In the computer field, a "request" usually refers to a call or command issued by the request initiator to the request processor to obtain information or perform an operation. Generally speaking, a request includes information such as the request type, request target address, request header, request body, query parameters, and sending time.
[0050] Therefore, the server generates an initial key based on historical requests, including: querying the corresponding request initiation record table according to the request target address; if the request initiation record table is empty, using the request target address as the initial key; if the request initiation record table is not empty, traversing the request initiation record table, obtaining the data size of each historical request, and using the data size of all historical requests as the initial key.
[0051] The request record table is empty, which means that before sending the pending request, the request initiator has not sent a request to the request processor, so there is no historical request with the same request target address as the pending request. At this time, the request target address is used as the initial key.
[0052] If the request record table is not empty, it indicates that there is a historical request with the same request target address as the request to be processed. At this time, the request initiation record table is traversed to obtain the data size of each historical request, and the data size of all historical requests is used as the initial key.
[0053] Optionally, the server generates an initial key based on historical requests, including: querying a corresponding request initiation record table according to a request target address, obtaining the number of historical requests, and using the number of historical requests as the initial key.
[0054] Optionally, since the request initiation record table may also store the sending time of each historical request, the server generates an initial key based on the historical requests, including: summing up the sending time of each historical request to obtain a total time, and using the total time as the initial key.
[0055] Optionally, since the request initiation record table can also store the sending time of each historical request, the server generates an initial key based on the historical requests, including: determining the time period to which the pending request belongs based on the sending time of the pending request, and using the data size of the historical requests whose sending time does not belong to the time period or the number of historical requests as the initial key.
[0056] Step S103: The server expands the initial key using a preset key expansion function to generate an encryption key.
[0057] Step S104: the server encrypts the request to be processed by using an encryption key to obtain a first encrypted request to be processed, and sends the first encrypted request to be processed to a request recipient.
[0058] In order to increase the difficulty of deciphering the key and the encrypted data, after obtaining the initial key, the server uses a preset key expansion function to expand the initial key to generate an encryption key.
[0059] The initial key can be transformed into another value through the key expansion function. In this process, since the key expansion function is pre-set in the server's memory, the user does not know how the key expansion function expands the initial key, and it is difficult to crack the generated encryption key. Improve the security of the encryption key.
[0060] After generating the encryption key, the server encrypts the request to be processed by using the encryption key to obtain a first encrypted request to be processed.
[0061] The algorithm for encrypting the request to be processed using the encryption key may be a data encryption standard (DES), a triple data encryption algorithm (3DES), a stream cipher, etc. The specific setting may be made according to the actual situation.
[0062] In the embodiment of the present application, before sending the pending request, the initial key is generated in real time according to the historical request with the same request target address as the pending request. In this process, since the historical requests corresponding to different request target addresses are different, and the historical requests corresponding to the pending requests sent at different time points are also different, the generated initial keys are different for different pending requests, so that the encryption keys generated after expansion are also different. Therefore, since the initial key is dynamically changing, it increases the difficulty of deciphering by the attacker, thereby improving the security of the encrypted data during transmission.
[0063] In some embodiments, the server uses a preset key expansion function to expand the initial key to generate an encryption key, including: the server hashes the initial key to obtain a hash value; the server uses a preset key expansion function to expand the hash value to generate an encryption key; the key expansion function includes at least one of a sum function, a difference function, a product function, a quotient function, and a factorial function.
[0064] During the execution process, the server first hashes the initial key to obtain the corresponding hash value. The irreversible and anti-collision characteristics of the hash ensure the uniqueness of the encryption key to a certain extent.
[0065] The hash value is then expanded using a preset key expansion function to generate an encryption key.
[0066] The key expansion function includes at least one of a sum function, a difference function, a product function, a quotient function, and a factorial function. That is, the key expansion function can be a single function or a combination of multiple functions.
[0067] The sum function performs an addition operation on a series of values to obtain the sum of a series of data. If the key expansion function is a sum function, the hash value of the initial key is added to a series of preset values to obtain the encryption key. Alternatively, each value in the initial key is added in sequence to obtain the encryption key. The series of values can be positive, negative, decimal, or integer, and are set according to actual conditions.
[0068] The difference function is to perform a subtraction operation on a series of values to obtain the difference of a series of data. If the key expansion function is a difference function, the hash value of the initial key is subtracted from a preset series of values to obtain the encryption key. Alternatively, each value in the initial key is subtracted in turn to obtain the encryption key. Among them, the series of values can be positive, negative, decimal, or integer, which is set according to the actual situation.
[0069] The product function is to multiply a series of values to obtain the product of a series of data. If the key expansion function is a product function, the hash value of the initial key is multiplied by a preset series of values to obtain the encryption key. Alternatively, each value in the initial key is multiplied in sequence to obtain the encryption key. Among them, the series of values can be positive, negative, decimal, or integer, which is set according to the actual situation.
[0070] The quotient function is to divide a series of values to obtain the quotient of a series of data. If the key expansion function is a quotient function, the hash value of the initial key is divided by a preset series of values to obtain the encryption key. Alternatively, each value in the initial key is divided in turn to obtain the encryption key. Among them, the series of values can be positive, negative, decimal, or integer, which is set according to the actual situation.
[0071] The factorial function performs a factorial operation on the hash value of the initial key to obtain a factorial result.
[0072] For example, assuming that the initial key is password123, the hash value calculated using the SHA-256 hash algorithm is: H=SHA-256(password123), and the product function is selected as the key expansion function. The product function multiplies each value in the initial key in sequence to obtain the encryption key.
[0073] Assume that the hash value H is a 256-bit binary string, divide it into four 64-bit substrings, and apply the product function to each substring: K = H1*H2*H3*H4, where H1, H2, H3, H4 are four substrings of the hash value. Finally, the encryption key is obtained by calculating the product function.
[0074] In the process of generating an encryption key based on an initial key, the embodiment of the present application first hashes the initial key. Since the hash has the characteristics of unidirectionality and anti-collision, the security of the initial key is improved to a certain extent. Then the hash value is expanded using a key expansion function to generate an encryption key, which increases the difficulty of deciphering the encryption key, thereby reducing the risk of key leakage and improving the security of encrypted data during transmission.
[0075] In some embodiments, the pending request includes a sending time; after the server obtains the first encrypted pending request, the method also includes: the server obtains the corresponding periodic key according to the sending time; the periodic key is generated by the request initiator according to a preset time period; the server uses the periodic key to re-encrypt the first encrypted pending request to obtain a second encrypted pending request; accordingly, the server sends the first encrypted pending request to the request recipient, including: the server sends the second encrypted pending request to the request recipient.
[0076] To further improve the security of encrypted data, a second encryption is performed using the periodic key based on the first encryption to confuse the first encryption operation.
[0077] The period key is generated by the request initiator according to the preset time period and stored in the memory in the form of a key-value pair. Among them, the key is the start time of the current time period plus the length of a time period. Therefore, the period key generated in the current time period is used in the next time period.
[0078] For example, if the key generation starts at 14:20 and is completed at 14:21, the periodic key will take effect at 14:30.
[0079] When the service is started, it will begin to generate periodic keys according to the preset time period. When the periodic key is needed for secondary encryption, the corresponding periodic key is obtained according to the sending time.
[0080] When obtaining the period key, the sending time of the pending request is rounded up according to the period. For example, assuming that ten minutes is a time period, the sending time is 14:35 and the start time point of the time period is 14:30, then the period key corresponding to the time point 14:30 is obtained.
[0081] The preset time period can be set to: one minute as a time period, one hour as a time period, or half an hour as a time period. The specific length of the time period is set according to actual conditions.
[0082] In addition, the length of the time period can be dynamically set according to the service performance and network conditions. For example, the initial time period is 10 minutes. If the service performance of the request initiator and the request processor is good and the network conditions are good during the interaction, the length of the time period can be adjusted to 1 minute.
[0083] The request initiator generates a periodic key using a preset algorithm, and sends the generated periodic key to the request processor interacting with it.
[0084] If there are multiple request processors interacting with the request initiator, the request initiator sends the periodic key to each request processor respectively. At this time, the request processors obtain the same periodic key, which reduces the key generation time of the request initiator and improves the resource utilization of the request initiator.
[0085] Optionally, if there are multiple request processors, differentiated configurations can be performed. That is, for different request processors, the request initiator generates different period keys using different preset algorithms according to different time periods, thereby personalizing the period keys and further improving the security of encrypted data transmission.
[0086] Exemplarily, request initiator A is connected with request processor B and request processor C. For request processor B, request initiator A generates a periodic key every one minute and sends it to request processor B; for request processor C, request initiator A generates a periodic key every ten minutes and sends it to request processor C. Differentiated configuration is performed.
[0087] In order to further improve the security of encrypted data during transmission, the embodiment of the present application uses a periodic key to perform secondary encryption after obtaining the first encrypted data, thereby increasing the difficulty of decryption and further improving the security of the encrypted data during transmission.
[0088] In some embodiments, the server obtains the corresponding period key according to the sending time, including: the server determines the time period to which the sending time belongs according to the sending time; if there is a period key corresponding to the time period, the period key is obtained; if there is no period key corresponding to the time period, the period key of the previous time period is obtained as the period key of the current time period.
[0089] Considering that the period key may fail to be generated, if there is no corresponding period key for the current time period, the period key of the previous time period is obtained as the period key of the current time period.
[0090] For example, if the key generation starts at 14:20 and is completed at 14:31, it is considered that the generation of the periodic key has failed. At this time, 14:30 continues to use the periodic key corresponding to 14:20, and the periodic keys corresponding to the time points 14:30 and 14:20 are stored in the memory.
[0091] To improve resource utilization, only the periodic keys of several historical time periods close to the current time may be retained, for example, the periodic keys of the previous 10 historical time periods or the previous 15 historical time periods may be retained.
[0092] Taking into account that the request processor successfully generates the key but fails to send it, in order to solve the problem that the periodic key is not synchronized and thus cannot be decrypted successfully, after the request initiator sends the periodic key to the request processor, the request processor immediately sends an identification of successful receipt of the periodic key to the request initiator. If the request initiator receives the identification, it uses the latest generated periodic key for encryption. If it fails to receive the identification, it obtains the periodic key of the previous time period as the periodic key of the current time period for encryption.
[0093] The embodiment of the present application takes into account that the generation of the periodic key may fail. Therefore, if there is no corresponding periodic key for the current time period, the periodic key of the previous time period is obtained as the periodic key of the current time period, so that the secondary encryption process can be executed normally, thereby improving the security of the encrypted data during transmission.
[0094] Figure 2 A flowchart of a request decryption method provided in an embodiment of the present application, which method is applied to a request processor. It is understandable that the request processor can be a terminal device (also referred to as an electronic device) and a server; wherein the terminal device can specifically be a smart phone, a tablet computer, a computer, a personal digital assistant (PDA), etc.; the server can specifically be an application server or a Web server. To facilitate understanding of the technical solution provided in an embodiment of the present application, the application scenario of the request decryption method provided in an embodiment of the present application is introduced below, taking the server as an execution subject as an example.
[0095] like Figure 2 As shown, the method includes:
[0096] Step S201, the server receives a first encrypted pending request sent by a request initiator; the first encrypted pending request is generated by the request initiator using an encryption key generated by the request initiator according to a historical request with the same request target address as the pending request; the first encrypted pending request includes an initiating address.
[0097] Step S202, the server generates an initial key according to the historical request corresponding to the initiating address;
[0098] Step S203, the server uses a preset key expansion function to expand the initial key to generate a decryption key;
[0099] Step S204: the server decrypts the first encrypted request to be processed by using a decryption key to obtain a decrypted request to be processed.
[0100] For the generation process of the first encrypted pending request, please refer to the above embodiment and will not be repeated here.
[0101] The initiating address refers to the IP address that initiates the first encrypted request to be processed, that is, the IP address of the request initiator.
[0102] Based on the above embodiments, it can be known that the number of requests sent by the request initiator to the request processor and the plaintext data size of each request can be recorded and traced. Similarly, the number of requests received by the request processor and the plaintext data size of each request can also be recorded and traced.
[0103] The embodiment of the present application stores the request sent by the request initiator and received by the request processor through the request processing record table.
[0104] The data structure of the request processing record table is also Map <String2,List2 <integer>>, where String2 represents the initiating address IP of the request to be processed, that is, the IP address of the request initiator that sends the request to be processed, and List2 represents a list, each element in the list is used to store the plaintext message size of the received historical request.
[0105] Exemplarily, the initiating address is ip2, and the size of the plaintext message corresponding to the i-th historical request received needs to be obtained as RequestRecord.get(ip2)[i].
[0106] Therefore, the server obtains all historical requests or a preset number of historical requests with the same initiation address as the request to be processed through RequestRecord.get(ip).
[0107] Similarly, the request processing record table may also store the receiving time of each historical request. Also, since one request processor may correspond to multiple request initiators, one request processor may store multiple request processing record tables, each request record table corresponding to each request initiator.
[0108] For the process of generating the initial key based on the historical requests corresponding to the initiating address, please refer to the process of generating the initial key based on the historical requests by the server of the request initiator mentioned above.
[0109] It should be noted that the request initiation record table is replaced by the request processing record table. And the process of generating the initial key according to the historical request corresponding to the initiation address corresponds to the process of generating the initial key based on the historical request by the server of the request initiator. So that the initial key generated by the request initiator and the request processor is the same.
[0110] For the process of expanding the initial key by using the preset key expansion function to generate the decryption key, please refer to the process of expanding the initial key by using the preset key expansion function to generate the encryption key.
[0111] And the process of generating the decryption key is the same as the process of generating the encryption key, thereby ensuring that the generated decryption key is the same as the encryption key and can correctly decrypt the first encrypted pending request.
[0112] Finally, the first encrypted request to be processed is decrypted by using the decryption key to obtain the decrypted request to be processed. The decryption algorithm is the inverse operation of the encryption algorithm.
[0113] In the embodiment of the present application, the request initiator generates an encryption key in real time to encrypt the request to be processed. Therefore, the request processor also needs to generate a decryption key in real time to decrypt the first encrypted request to be processed. After receiving the first encrypted request to be processed, the request processor generates a decryption key in the same way as the request initiator generates the encryption key, so that the first encrypted request to be processed can be correctly decrypted.
[0114] In some embodiments, the method also includes: the encrypted pending request includes a sending time; after the server receives the first encrypted pending request sent by the request initiator, the method also includes: the server obtains the corresponding periodic key based on the sending time; the periodic key is generated by the request initiator according to a preset time period, and the periodic key is sent to the request processor for storage; the server uses the periodic key to decrypt the first encrypted pending request to obtain a second encrypted pending request; accordingly, the server decrypts the first encrypted pending request through the decryption key, including: the server decrypts the second encrypted pending request through the decryption key.
[0115] Based on the above embodiments, it can be known that the request initiator can encrypt the pending request twice, so the request processor needs to decrypt the first encrypted pending request twice. And the order of decryption is opposite to the order of encryption, that is: the request initiator first uses the encryption key to encrypt the pending request for the first time to obtain the first encrypted pending request, and then uses the periodic key to encrypt the first encrypted pending request for the second time to obtain the second encrypted pending request. At this time, the request processor first uses the periodic key to decrypt the received encrypted pending request for the first time, and then uses the decryption key to decrypt it for the second time to obtain the plaintext pending request.
[0116] Therefore, the request processor needs to use the same period key as the request initiator to correctly perform the first decryption process.
[0117] The periodic key of the request processor is generated by the request initiator according to a preset time period, and the periodic key is sent to the request processor for storage. At this time, in order to improve the security of the periodic key during transmission, a secure channel (such as Transport Layer Security Protocol, TLS) is required for transmission.
[0118] Optionally, the request initiator generates a periodic key but does not send it. Instead, the request processor generates the periodic key in the same way as the request initiator generates the periodic key. However, in this case, the request processor and the request initiator need to synchronously generate the periodic key of the same period using the same generation algorithm to ensure that the periodic keys generated by the two parties are the same.
[0119] When the first decryption fails or the second decryption fails, it means that an attacker attempts to reversely deduce the key based on the message. At this time, an alarm can be issued according to the pre-configured alarm method.
[0120] In the embodiment of the present application, the request initiator may encrypt the request to be processed twice to further improve the security of the encrypted data during transmission. Therefore, in order to obtain the correct request to be processed, the request processor also needs to decrypt the encrypted request to be processed twice. The first encrypted request to be processed is decrypted by obtaining the same periodic key as the request initiator, and then the decrypted first encrypted request to be processed is decrypted by using the decryption key to obtain the request to be processed, so that the request processor can correctly process the request of the request initiator.
[0121] In this application, even the developers who maintain the service do not know the key used to encrypt the message each time. The encryption key used for the first encryption is generated based on the historical requests sent, and the relevant data of the historical requests is only stored in the memory. Even the service developer itself cannot disclose the encryption key used for a certain encryption. The periodic key used for the second encryption also has its cycle counting and iteration completed in the memory, so the developer itself cannot disclose the key used for a certain cycle. At the same time, even by monitoring the request messages interacting between services, it is impossible to obtain the relevant characteristics of the key used for each encryption. Therefore, this application improves the security of encrypted data during transmission.
[0122] Figure 3 A schematic diagram of a structure of a request encryption device provided in an embodiment of the present application, such as Figure 3 As shown, the device includes: an acquisition module 301, a first generation module 302, a second generation module 303 and an encryption module 304; wherein,
[0123] The acquisition module 301 is used to obtain historical requests with the same request target address as the pending request before sending the pending request; the first generation module 302 is used to generate an initial key based on the historical request; the second generation module 303 is used to expand the initial key using a preset key expansion function to generate an encryption key; the encryption module 304 is used to encrypt the pending request using the encryption key, obtain a first encrypted pending request, and send the first encrypted pending request to the request recipient.
[0124] Based on the above embodiment, the first generation module 302 is specifically used to: query the corresponding request initiation record table according to the request target address; if the request initiation record table is empty, use the request target address as the initial key; if the request initiation record table is not empty, traverse the request initiation record table, obtain the data size of each historical request, and use the data size of all historical requests as the initial key.
[0125] Based on the above embodiment, the second generation module 303 is specifically used to: hash the initial key to obtain a hash value; expand the hash value using a preset key expansion function to generate an encryption key; the key expansion function includes at least one of a sum function, a difference function, a product function, a quotient function, and a factorial function.
[0126] Based on the above embodiment, the pending request includes a sending time; the device also includes a periodic key encryption module, which is used to obtain the corresponding periodic key according to the sending time; the periodic key is generated by the request initiator according to a preset time period; the first encrypted pending request is re-encrypted using the periodic key to obtain a second encrypted pending request; accordingly, the first encrypted pending request is sent to the request recipient, including: sending the second encrypted pending request to the request recipient.
[0127] Based on the above embodiment, the period key encryption module is specifically used to: determine the time period to which the sending time belongs according to the sending time; if there is a period key corresponding to the time period, obtain the period key; if there is no period key corresponding to the time period, obtain the period key of the previous time period as the period key of the current time period.
[0128] It should be understood that the device corresponds to the above-mentioned request encryption method embodiment and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.
[0129] Figure 4 A schematic diagram of a decryption request device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the device includes: a receiving module 401, a third generating module 402, a fourth generating module 403 and a decryption module 404; wherein,
[0130] A receiving module 401 is used to receive a first encrypted pending request sent by a request initiator; the first encrypted pending request is generated by encrypting the pending request using an encryption key generated by the request initiator according to a historical request with the same request target address as the pending request; the first encrypted pending request includes an initiating address; a third generating module 402 is used to generate an initial key according to the historical request corresponding to the initiating address; a fourth generating module 403 is used to expand the initial key using a preset key expansion function to generate a decryption key; a decryption module 404 is used to decrypt the first encrypted pending request using the decryption key to obtain the decrypted pending request.
[0131] Based on the above embodiment, the encrypted pending request includes a sending time; the device also includes a periodic key decryption module, which is used to: obtain a corresponding periodic key based on the sending time; the periodic key is generated by the request initiator according to a preset time period, and the periodic key is sent to the request processor for storage; the first encrypted pending request is decrypted using the periodic key to obtain a second encrypted pending request; accordingly, the first encrypted pending request is decrypted using the decryption key, including: decrypting the second encrypted pending request using the decryption key.
[0132] It should be understood that the device corresponds to the above-mentioned request decryption method embodiment and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.
[0133] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 5 As shown, the electronic device includes a processor 501 (processor), a memory 502 (memory) and a bus 503; wherein the processor 501 and the memory 502 communicate with each other through the bus 503. The processor 501 is used to call the program instructions in the memory 502 to execute the methods provided by the above-mentioned method embodiments.
[0134] The processor 501 can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 501 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. It can implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.
[0135] The memory 502 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.
[0136] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments.
[0137] This embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments.
[0138] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.
[0139] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0140] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0141] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.< / integer> < / integer>
Claims
1. A request encryption method, characterized in that: The method is applied to a request initiator, and the method comprises: Before sending the pending request, obtaining a historical request having the same request target address as the pending request; generating an initial key based on the historical request; Using a preset key expansion function to expand the initial key to generate an encryption key; The pending request is encrypted by using the encryption key to obtain a first encrypted pending request, and the first encrypted pending request is sent to a request recipient.
2. The method according to claim 1, characterized in that The generating an initial key based on the historical request comprises: Query the corresponding request initiation record table according to the request target address; If the request initiation record table is empty, the request target address is used as the initial key; If the request initiation record table is not empty, the request initiation record table is traversed to obtain the data size of each historical request, and the data size of all historical requests is used as the initial key.
3. The method according to claim 1, characterized in that The method of using a preset key expansion function to expand the initial key to generate an encryption key includes: Hash the initial key to obtain a hash value; The Hash value is expanded using a preset key expansion function to generate an encryption key; the key expansion function includes at least one of a sum function, a difference function, a product function, a quotient function, and a factorial function.
4. The method according to any one of claims 1 to 3, characterized in that: The pending request includes a sending time; after obtaining the first encrypted pending request, the method further includes: Acquire a corresponding periodic key according to the sending time; the periodic key is generated by the request initiator according to a preset time period; Re-encrypting the first encrypted request to be processed by using the periodic key to obtain a second encrypted request to be processed; Correspondingly, sending the first encrypted request to be processed to the request recipient includes: The second encrypted pending request is sent to the request recipient.
5. The method according to claim 4, characterized in that The acquiring the corresponding periodic key according to the sending time includes: Determine the time period to which the sending time belongs according to the sending time; If there is a period key corresponding to the time period, obtaining the period key; If there is no period key corresponding to the time period, the period key of the previous time period is obtained as the period key of the current time period.
6. A method for requesting decryption, characterized in that: The method is applied to a request processing party, and the method comprises: Receive a first encrypted pending request sent by a request initiator; the first encrypted pending request is generated by encrypting the pending request by the request initiator according to an encryption key generated by a historical request having the same request target address as the pending request; the first encrypted pending request includes an initiating address; Generate an initial key according to the historical request corresponding to the initiating address; Using a preset key expansion function to expand the initial key to generate a decryption key; The first encrypted request to be processed is decrypted using the decryption key to obtain a decrypted request to be processed.
7. The method according to claim 6, characterized in that The method further includes: the encrypted pending request includes a sending time; after receiving the first encrypted pending request sent by the request initiator, the method further includes: Acquire a corresponding periodic key based on the sending time; the periodic key is generated by the request initiator according to a preset time period, and the periodic key is sent to the request processor for storage; Decrypting the first encrypted request to be processed by using the periodic key to obtain a second encrypted request to be processed; Correspondingly, decrypting the first encrypted pending request by using the decryption key includes: The second encrypted pending request is decrypted using the decryption key.
8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is executed.
10. A computer program product, characterized in that include: Computer program instructions, when executed by a processor, perform the method according to any one of claims 1 to 7.