Data transmission method and device and computer equipment

Abstract

The invention relates to a data transmission method and apparatus, and a computer device. The method comprises the steps of obtaining user identity information, a current timestamp and to-be-transmitted target data; determining secret key data according to the current timestamp and the user identity information; performing confusion processing, splicing processing and encryption processing on the target data according to the secret key data to obtain encrypted data; and sending the encrypted data and the secret key data to a back end, so that the back end decrypts the encrypted data according to the secret key data to obtain target data. According to the method and the device, the key data is dynamically determined in combination with the current timestamp and the user identity information, so that the keys for each data transmission are different, and the difficulty of cracking the keys is greatly increased. And code obfuscation processing is performed on the target data, so that the data tampering difficulty of an attacker is increased.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data transmission method, apparatus and computer equipment. Background Art

[0002] In the modern Web development architecture model with front-end and back-end separation, the front-end is responsible for the user interface and interaction logic, while the back-end handles business logic, data management, and port services. The front-end and back-end interact with each other through HTTP (HyperText Transfer Protocol) requests. However, during this interaction, if the request parameters are transmitted directly in plain text without encryption, there will be many security risks.

[0003] The common encryption method at present is to provide the public key to the interface caller, and the private key interface provider retains it. The interface caller first sorts the call parameter name according to the exchange standard code, adds the timestamp and performs md5 encryption as the signature value, and then uses the public key to encrypt the parameter string to obtain the ciphertext and transmit it. After receiving the call request, the backend uses the private key to decrypt the ciphertext. If the decryption is successful, the signature value is verified, and the business logic is executed after passing.

[0004] However, the encryption key needs to be saved in a file, which poses a risk of leakage. In addition, the cost of regularly replacing the key is high and the update is inconvenient. Summary of the invention

[0005] Based on this, it is necessary to provide a data transmission method, device and computer equipment that can solve the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a data transmission method, the method comprising:

[0007] Obtain user identity information, current timestamp, and target data to be transmitted;

[0008] Determine the key data based on the current timestamp and user identity information;

[0009] Obfuscation, concatenation and encryption are performed on the target data according to the secret key data to obtain encrypted data;

[0010] The encrypted data and secret key data are sent to the back-end, so that the back-end decrypts the encrypted data according to the secret key data to obtain the target data.

[0011] In one embodiment, the target data is obfuscated, concatenated and encrypted according to the secret key data to obtain the encrypted data, including:

[0012] Perform code obfuscation processing on the target data to obtain obfuscated code;

[0013] The obfuscated codes are spliced ​​to obtain spliced ​​data;

[0014] The spliced ​​data is encrypted based on a symmetric encryption algorithm to obtain encrypted data.

[0015] In one embodiment, the above-mentioned code obfuscation processing is performed on the target data to obtain the obfuscated code, including:

[0016] Acquire data information of target data; the data information includes at least one of a variable name, a function name, a control flow structure, a target string, and a target code;

[0017] Code obfuscation processing is performed on the data information to obtain obfuscated code; the code obfuscation processing includes at least one of variable name obfuscation, function name obfuscation, control flow flattening, string encryption and code compression.

[0018] In one embodiment, the above-mentioned splicing processing of the obfuscated code to obtain the spliced ​​data includes:

[0019] Acquire spare data in the obfuscated code; the spare data includes at least one of a function to be spliced, a variable declaration, and a logic fragment;

[0020] According to a predetermined splicing rule, the spare data is spliced ​​to obtain spliced ​​data; the splicing process includes sequential connection and merge connection.

[0021] In one embodiment, determining the key data according to the current timestamp and the user identity information includes:

[0022] Perform hash encryption on the user identity information according to the current timestamp to obtain a hash value;

[0023] Perform digital extraction processing on the hash value to obtain digital information;

[0024] The secret key data is determined based on the digital information and the user identity information.

[0025] In one embodiment, the digital information includes a digital cumulative value, a number of digits, a number of odd numbers, and a preset value; the key data includes an encryption key and an initialization vector, and the key data is determined according to the digital information and the user identity information, including:

[0026] Perform data interception and processing on the user identity information according to the digital accumulated value to obtain an encryption key;

[0027] The encryption key is processed by data interception according to the number of digits, the number of odd numbers and the preset value to obtain an initialization vector.

[0028] In a second aspect, the present application also provides a data transmission method, the method comprising:

[0029] Get the encrypted data and secret key data sent by the front end; the secret key data is determined by the front end based on the user identity information and the current timestamp, and the encrypted data is determined by the front end based on the secret key data and the target data to be transmitted;

[0030] The encrypted data is decrypted according to the secret key data to obtain the target data.

[0031] In a third aspect, the present application further provides a data transmission device, the device comprising:

[0032] A data acquisition module is used to obtain user identity information, current timestamp and target data to be transmitted;

[0033] A secret key determination module, used to determine secret key data according to the current timestamp and user identity information;

[0034] The encryption processing module is used to perform obfuscation processing, splicing processing and encryption processing on the target data according to the secret key data to obtain encrypted data;

[0035] The data sending module is used to send the encrypted data and the secret key data to the back end, so that the back end can decrypt the encrypted data according to the secret key data to obtain the target data.

[0036] In a fourth aspect, the present application further provides a data transmission device, the device comprising:

[0037] The key acquisition module is used to obtain the encrypted data and key data sent by the front end; the key data is determined by the front end based on the user identity information and the current timestamp, and the encrypted data is determined by the front end based on the key data and the target data to be transmitted;

[0038] The decryption module is used to decrypt the encrypted data according to the secret key data to obtain the target data.

[0039] In a fifth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0040] Obtain user identity information, current timestamp, and target data to be transmitted;

[0041] Determine the key data based on the current timestamp and user identity information;

[0042] Obfuscation, concatenation and encryption are performed on the target data according to the secret key data to obtain encrypted data;

[0043] The encrypted data and secret key data are sent to the back-end, so that the back-end decrypts the encrypted data according to the secret key data to obtain the target data.

[0044] In a sixth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0045] Obtain user identity information, current timestamp, and target data to be transmitted;

[0046] Determine the key data based on the current timestamp and user identity information;

[0047] Obfuscation, concatenation and encryption are performed on the target data according to the secret key data to obtain encrypted data;

[0048] The encrypted data and secret key data are sent to the back-end, so that the back-end decrypts the encrypted data according to the secret key data to obtain the target data.

[0049] In a seventh aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0050] Obtain user identity information, current timestamp, and target data to be transmitted;

[0051] Determine the key data based on the current timestamp and user identity information;

[0052] Obfuscation, concatenation and encryption are performed on the target data according to the secret key data to obtain encrypted data;

[0053] The encrypted data and secret key data are sent to the back-end, so that the back-end decrypts the encrypted data according to the secret key data to obtain the target data.

[0054] The above-mentioned data transmission method, device and computer equipment obtain user identity information, current timestamp and target data to be transmitted; determine the secret key data according to the current timestamp and user identity information; perform obfuscation, splicing and encryption on the target data according to the secret key data to obtain encrypted data; send the encrypted data and secret key data to the back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data. The present application dynamically determines the key data in combination with the current timestamp and user identity information, so that the key for each data transmission is different, which greatly increases the difficulty of the key being cracked. Code obfuscation of the target data increases the difficulty for attackers to tamper with the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is an application environment diagram of a data transmission method in an embodiment;

[0056] Figure 2A schematic diagram of a flow chart of a data transmission method in an embodiment;

[0057] Figure 3 A schematic diagram of a process of obtaining encrypted data in one embodiment;

[0058] Figure 4 A schematic diagram of a process of obtaining obfuscated code in one embodiment;

[0059] Figure 5 A schematic diagram of a process of obtaining spliced ​​data in one embodiment;

[0060] Figure 6 A schematic diagram of a flow chart of hash encryption processing in one embodiment;

[0061] Figure 7 A schematic diagram of a process for determining key data in one embodiment;

[0062] Figure 8 A schematic diagram of a flow chart of a data transmission method in another embodiment;

[0063] Fig. 9 is a structural block diagram of a data transmission device in one embodiment;

[0064] Fig.10 is a structural block diagram of a data transmission device in another embodiment;

[0065] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0067] First of all, before specifically introducing the technical solution of the embodiments of the present application, the technical background based on the embodiments of the present application is introduced.

[0068] Front-end and back-end separation is a modern Web development architecture model, in which the front-end is responsible for the user interface and interaction logic, and the back-end handles business logic, data management, and API services. In this architecture, the front-end interacts with the back-end through HTTP requests. These requests usually carry parameters for specifying query conditions, submitting form data, etc. If these parameters are not encrypted, there are certain security risks.

[0069] During the data exchange between the front-end and back-end through HTTP requests, if the request parameters are transmitted directly in plain text without encryption, they will be exposed to multiple security risks:

[0070] Data leakage: Since the HTTP protocol itself does not have the ability to encrypt data, unencrypted parameters can be easily captured by network monitoring tools, resulting in the leakage of sensitive information such as user credentials and private data. Especially in scenarios where HTTPS encrypted communication is not used, the risk of man-in-the-middle attacks (MitM) is greatly increased.

[0071] Parameter tampering: Attackers can modify parameter values ​​during request transmission, such as adjusting product prices and tampering with user permission levels, which may lead to fraudulent transactions, illegal access, and other operations, damaging business logic.

[0072] Among the current encryption methods, the first method is to use RSA encryption, where the public key is provided to the interface caller and the private key interface provider retains it. The interface caller uses the public key to encrypt the transmission parameters of the call. Before encryption, the call parameter names are sorted according to ASCII code, timestamps are added, and then encrypt them using md5 as the signature value to prevent parameter loss or tampering. The public key is then used to encrypt the parameter string to obtain the ciphertext, which is encoded using base64 during the transmission process. Upon receiving the call request from the caller, the private key is first used to decrypt the ciphertext. If the decryption is successful, it means that the caller is trustworthy. If the decryption fails, it means that the caller is untrustworthy, and the caller is returned directly and added to the blacklist. The decryption is successful to obtain the plaintext. The decrypted plaintext is first signed with md5 to obtain the signature value and compared with the sign sent by the caller. If they do not match, the data may have been tampered with. After the signature is verified, the business logic can be executed.

[0073] The second method is to agree on secret keys and encryption rules between the front-end and back-end. The front-end puts the request parameters into a map and converts them into a JSON string, sorts them by characters, and converts the sorted results into a base64 string. The front-end uses the AES encryption algorithm to generate a digital signature for the base64 string and puts the signature value into the request header. The back-end creates an interceptor to determine if the request header in the request has a digital signature, then verifies the digital signature of the request. The verification logic is consistent with the encryption rules and order of the front-end. After the verification passes, normal business is carried out.

[0074] The first method is RSA encryption. The public key is provided to the interface caller, and the private key interface provider retains it. The secret key needs to be saved in a file, which has the risk of leakage. The cost of regular key replacement is high, and updating is inconvenient.

[0075] The second method is AES encryption. The front-end and back-end are encrypted using fixed keys and agreed encryption rules. The code is not obfuscated. In addition, the key is not stored safely and there is a risk of leakage. The cost of replacing the key is high and the cycle is long, and the probability of network security is extremely high.

[0076] Based on this, the present application provides a data transmission method, apparatus and computer equipment, aiming to solve the above technical problems.

[0077] The data transmission method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The front end of the terminal 102 obtains the user identity information, the current timestamp and the target data to be transmitted; determines the secret key data according to the current timestamp and the user identity information; performs obfuscation processing, splicing processing and encryption processing on the target data according to the secret key data to obtain encrypted data; sends the encrypted data and the secret key data to the back end, so that the back end of the terminal 102 decrypts the encrypted data according to the secret key data to obtain the target data. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones and tablets. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0078] In one embodiment, Figure 2 As shown, a data transmission method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps:

[0079] S201, obtaining user identity information, current timestamp and target data to be transmitted.

[0080] Among them, user identity information is used to uniquely identify the user, such as the session token after the user logs in. The current timestamp represents the current time, usually in seconds or milliseconds, and is dynamic and unique. The target data refers to the specific data content to be transmitted, which can be data in various forms such as text, numbers, files, etc.

[0081] In the embodiment of the present application, when the user operates on the front-end page, the front-end system obtains the user's identity information through interaction with the server, such as the session token returned from the server. At the same time, the timestamp of the current system time can be obtained using the time function provided by the programming language. The target data can be the form data entered by the user, the data uploaded by the file, etc.

[0082] Another implementation method: After the user successfully logs in, the user identity information is stored in the local cache. When data needs to be transmitted, the user identity information and the current timestamp are directly read from the cache. The target data can be obtained in real time through the front-end sensor or other data sources.

[0083] S202, determining key data according to the current timestamp and user identity information.

[0084] Among them, the key data is the key information used to encrypt and decrypt the target data, which may include keys and initialization vectors, etc.

[0085] In the embodiment of the present application, the user identity information is encrypted by MD5 using the current timestamp as the salt. Specific digital information, such as digits from 0 to 9, is extracted from the encrypted result, and the cumulative value of these digits and the value of the number of digits plus the number of odd numbers plus 1 are calculated. According to the AES encryption requirements, the key value is determined to be the cumulative value of the digits at the beginning position of the intercepted user identity information characters, and the end position is 16 bits backward; the initialization vector IV value is the number of digits at the beginning position of the user identity information characters + the number of odd numbers + 1, and 16 bits backward.

[0086] Another implementation method: Use a more complex encryption algorithm to encrypt the timestamp and user identity information to generate key data. For example, the timestamp can be hashed first, and then the hash result and the user identity information are XORed, and then the key and initialization vector are extracted through a specific algorithm.

[0087] S203, performing obfuscation processing, concatenation processing and encryption processing on the target data according to the secret key data to obtain encrypted data.

[0088] In the embodiment of the present application, for obfuscation processing, the variable names and function names in the code related to the target data are replaced with meaningless identifiers, the execution order of the code is disrupted using the control flow flattening technology, and the sensitive strings are encrypted. Then, the obfuscated code is spliced, and the code fragments can be connected together according to specific rules. Finally, the spliced ​​code is encrypted by AES using the key and initialization vector in the secret key data to obtain encrypted data.

[0089] S204, sending the encrypted data and the secret key data to the back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data.

[0090] In the embodiment of the present application, the encrypted data is sent as a request parameter to the backend server via an HTTP request, and the secret key data is placed in a specific format in the request header. After receiving the request, the backend server extracts the encrypted data and secret key data, generates a key and initialization vector in the same way as the front end, and decrypts the encrypted data.

[0091] The above-mentioned data transmission method, device and computer equipment obtain user identity information, current timestamp and target data to be transmitted; determine the secret key data according to the current timestamp and user identity information; perform obfuscation, splicing and encryption on the target data according to the secret key data to obtain encrypted data; send the encrypted data and secret key data to the back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data. The present application dynamically determines the key data in combination with the current timestamp and user identity information, so that the key for each data transmission is different, which greatly increases the difficulty of the key being cracked. Code obfuscation of the target data increases the difficulty for attackers to tamper with the data.

[0092] In an exemplary embodiment, based on the above embodiment, see Figure 3 The embodiment of the present application relates to a process of performing obfuscation processing, splicing processing and encryption processing on target data according to secret key data to obtain encrypted data, including the following steps:

[0093] S301, performing code obfuscation processing on target data to obtain obfuscated code.

[0094] Among them, obfuscated code refers to the target data code that has been processed by code obfuscation, making it difficult to understand and modify, thereby increasing security.

[0095] In the embodiment of the present application, the target data is subjected to code obfuscation processing to obtain obfuscated code. Code obfuscation techniques such as code self-modification and virtual machine protection are used. When obfuscating variable names and function names, randomly generated identifiers with longer and more complex string lengths can be used. For control flow flattening, more complex logic and nested structures can be introduced to increase the difficulty of cracking.

[0096] S302, splicing the obfuscated codes to obtain spliced ​​data.

[0097] The spliced ​​data is the data obtained after splicing the obfuscated code, in preparation for encryption processing.

[0098] In an embodiment of the present application, the terminal can splice according to the logical structure of the code, a specific identifier or a pre-set order. For example, all function definitions are spliced ​​in the order of appearance, and variable declarations are put together for splicing. The code after code obfuscation is traversed to identify the parts that need to be spliced. Finally, according to the determined splicing rules, the identified code parts are spliced ​​in sequence. It can be a simple string concatenation or a more complex logical combination.

[0099] Another implementation method: Use a more complex splicing algorithm, such as hash-based splicing, dynamic splicing, etc. When determining the splicing rules, you can consider the security and efficiency of the code and choose the best splicing method. For traversing the obfuscated code, you can use a more efficient algorithm to reduce the time complexity. When performing the splicing operation, you can add some redundant code or random data to increase the difficulty of cracking.

[0100] S303, encrypting the spliced ​​data based on a symmetric encryption algorithm to obtain encrypted data.

[0101] Among them, the encrypted data is the data obtained after the spliced ​​data is encrypted by a symmetric encryption algorithm, and exists in the form of ciphertext during the transmission process to ensure security.

[0102] The embodiment of the present application selects a symmetric encryption algorithm: such as AES (Advanced Encryption Standard). Determine the key length, such as 128 bits, 192 bits, or 256 bits. The same method as in the previous steps can be used to dynamically generate a key and an initialization vector based on the current timestamp and user identity information. Use the generated key and initialization vector to encrypt the spliced ​​data. According to the requirements of the symmetric encryption algorithm, the key and initialization vector are applied to the encryption process to gradually encrypt the data.

[0103] The embodiment of the present application uses code obfuscation processing to make it difficult for attackers to understand and modify the code of the target data, thereby increasing the difficulty of cracking. Splicing and encryption processing further ensure the security of data during transmission and prevent data from being stolen and tampered with. Splicing processing can integrate the target data into a continuous data block, reducing the situation where partial data loss or confusion occurs during transmission. Encryption processing can ensure the integrity of the data, and even if the data is intercepted, it is difficult to be tampered with.

[0104] In an exemplary embodiment, based on the above embodiment, see Figure 4 The embodiment of the present application relates to a process of performing code obfuscation processing on target data to obtain an obfuscated code, including the following steps:

[0105] S401, obtaining data information of target data.

[0106] The data information includes at least one of a variable name, a function name, a control flow structure, a target character string and a target code.

[0107] In the embodiment of the present application, the terminal can analyze the code structure of the target data and extract information such as variable names, function names, control flow structures, etc. This can be achieved using a code analysis tool or a reflection mechanism provided by a programming language. For example, for JavaScript code, an AST (Abstract Syntax Tree) analysis tool can be used to obtain various information in the code.

[0108] For target strings, such as API keys, passwords and other sensitive information, they can be identified by regular expressions or specific string matching algorithms. The target code can be obtained by reading files or getting the running code from memory.

[0109] S402, performing code obfuscation processing on the data information to obtain an obfuscated code.

[0110] The code obfuscation process includes at least one of variable name obfuscation, function name obfuscation, control flow flattening, string encryption and code compression.

[0111] Variable name obfuscation: The terminal can replace the extracted variable names with meaningless, incomprehensible identifiers. New variable names can be generated using randomly generated strings or specific naming rules. For example, replace "userData" with "a1b2c3".

[0112] Function name obfuscation: The terminal can perform similar obfuscation operations on function names. Change the function name that clearly expresses the function to an irregular name. For example, change "encryptData" to "f4g5h6".

[0113] The control flow is flattened. The terminal can change the control flow structure to make the execution path of the code more complicated. A large number of conditional judgments and jump statements can be used to disrupt the execution order of the code. For example, the original linear code execution flow is changed to branch execution based on random conditions.

[0114] String encryption: The terminal can encrypt the target string. When the code is running, the encrypted string is decrypted for use. The string can be encrypted using a symmetric encryption algorithm or a hash algorithm.

[0115] Code compression: The terminal can remove comments, blank characters, and unnecessary line breaks from the code to make the code more compact. This can be achieved using code compression tools or the compression function provided by the programming language.

[0116] In the embodiment of the present application, by performing multiple code obfuscation processes on the data information of the target data, it is difficult for attackers to understand and modify the code, which increases the difficulty of cracking and improves the security of data transmission.

[0117] In an exemplary embodiment, based on the above embodiment, see Figure 5 The embodiment of the present application relates to a process of splicing obfuscated codes to obtain spliced ​​data, including the following steps:

[0118] S501, obtaining spare data in the obfuscated code.

[0119] The backup data includes at least one of a function to be spliced, a variable declaration, and a logic fragment.

[0120] In the embodiment of the present application, the terminal can analyze the structure of the obfuscated code and identify the spare data such as the functions to be spliced, variable declarations and logic fragments therein. This can be achieved using the parsing function provided by the code analysis tool or programming language. For example, for JavaScript code, an AST analysis tool can be used to extract information such as function definitions and variable declarations.

[0121] For functions to be spliced, the terminal can filter them according to their functions and calling relationships. Only functions related to target data transmission are selected for splicing. Variable declarations can be filtered according to the scope and frequency of use of variables. Only variables needed in the data transmission process are selected for splicing. Logic fragments can be filtered according to the execution flow and logic relationship of the code. Only logic fragments related to data processing and encryption are selected for splicing.

[0122] S502: splicing the spare data according to a predetermined splicing rule to obtain spliced ​​data.

[0123] The splicing process includes sequential connection and merge connection.

[0124] In the embodiment of the present application, sequential connection can be used to connect the spare data in the order in which they appear in the obfuscated code. For example, all variable declarations are connected first, then all functions to be spliced ​​are connected, and finally the logic fragments are connected.

[0125] You can also merge and connect alternate data with the same function or logical relationship. For example, you can merge multiple related function definitions into one function, or merge multiple variable declarations of the same type into one declaration.

[0126] During the splicing process, some special marks or comments can be added so that the spliced ​​data can be correctly identified and processed during the subsequent encryption and data transmission process. For example, a specific mark string can be added at the beginning and end of the spliced ​​data, or a comment can be added at the splicing point.

[0127] The embodiment of the present application can integrate scattered code fragments into a continuous data block by splicing the obfuscated code, which increases the difficulty for attackers to analyze and crack the code and improves the security of data transmission. Splicing can make the code more compact and orderly, reduce the redundancy and confusion of the code, and improve the readability and maintainability of the code.

[0128] In an exemplary embodiment, based on the above embodiment, see Figure 6 The embodiment of the present application relates to a process of determining key data according to a current timestamp and user identity information, comprising the following steps:

[0129] S601, performing hash encryption processing on the user identity information according to the current timestamp to obtain a hash value.

[0130] In the embodiment of the present application, a suitable hash algorithm can be selected, such as MD5 (Message Digest Algorithm 5), SHA-256 (Secure Hash Algorithm 256-bit), etc. The current timestamp is used as a salt value and combined with the user identity information for hash encryption processing. For example, the timestamp and the user identity information can be concatenated together and then hashed. The resulting hash value is a fixed-length value with high randomness and security.

[0131] S602, performing digital extraction processing on the hash value to obtain digital information.

[0132] In an embodiment of the present application, the terminal can extract specific digital content from the hash value, such as extracting the numbers 0-9 therein. A regular expression or a specific digital extraction algorithm can be used to implement digital extraction. For example, a regular expression is used to match the digital characters in the hash value, and then the extracted numbers are further processed. The extracted numbers are statistically analyzed, such as calculating the cumulative value of the numbers, the number of digits, the number of odd numbers, etc.

[0133] S603, determining key data according to the digital information and the user identity information.

[0134] In an embodiment of the present application, the generation rules of the key and the initialization vector are determined according to the digital information. For example, the digital cumulative value is used as part of the key, and the value of the number of digits plus the number of odd numbers plus 1 is used as part of the initialization vector. Characters of a specific length are intercepted from the user identity information as the other parts of the key and the initialization vector. For example, the starting position and length of the interception are determined according to the digital information, and the corresponding characters are extracted from the user identity information. The intercepted characters are combined with the digital information to generate the final secret key data.

[0135] In another embodiment, the terminal may use a more complex key generation algorithm to generate keys by combining multiple features of digital information and user identity information. For example, a more secure key and initialization vector may be generated by using technologies such as chaotic systems and elliptic curve encryption.

[0136] The generated key data is further encrypted to improve its security. For example, the key data can be hashed again using another hash algorithm or encrypted using a symmetric encryption algorithm.

[0137] In the embodiment of the present application, the dynamic key generation is realized by combining the current timestamp and the user identity information. Each time the data is transmitted, the generated key is different due to the change of the timestamp, which improves the security and anti-attack of the key. The hash value is digitally extracted and processed, which increases the complexity of key generation. It is difficult for attackers to predict and crack the key generation process, which improves the security of data transmission.

[0138] In an exemplary embodiment, based on the above embodiment, see Figure 7 The digital information of the embodiment of the present application includes a digital accumulated value, a number of digits, a number of odd numbers, and a preset value; the key data includes an encryption key and an initialization vector, and the key data is determined according to the digital information and the user identity information, including the following steps:

[0139] S701, performing data interception processing on the user identity information according to the digital accumulated value to obtain an encryption key.

[0140] In an embodiment of the present application, the terminal can determine the starting position of the interception. The digital accumulated value can be used as the offset of the starting position, and interception can be started from a specific position of the user identity information. For example, if the user identity information is a string, the digital accumulated value is used as the character index, and a certain length of characters are intercepted from this position as the encryption key. Determine the length of the interception. The interception length can be calculated according to a preset key length requirement or according to a specific algorithm. For example, the interception length can be set to a fixed 16 bits, 32 bits, etc., or the interception length can be calculated based on certain characteristics of the digital accumulated value.

[0141] Perform data interception operation. Intercept the user's identity information according to the determined starting position and length to obtain the encryption key.

[0142] S702, performing data interception processing on the encryption key according to the number of digits, the number of odd numbers and the preset value to obtain an initialization vector.

[0143] In the embodiment of the present application, the terminal can calculate the auxiliary value. Perform a specific operation on the number of digits, the number of odd numbers and the preset value to obtain an auxiliary value. For example, the number of digits plus the number of odd numbers plus the preset value can be added to obtain a new value.

[0144] To determine the starting position of the interception, the auxiliary value can be used as the offset of the starting position to start intercepting from a specific position of the encryption key. For example, the auxiliary value is used as a character index, and a certain length of characters are intercepted from the position of the encryption key as the initialization vector.

[0145] The intercepted length may be determined based on a preset initialization vector length requirement or calculated based on a specific algorithm. For example, the intercepted length may be set to a fixed 16 bits, 32 bits, etc., or the intercepted length may be calculated based on certain characteristics of the auxiliary value.

[0146] The embodiment of the present application intercepts the user identity information through digital information, generates encryption keys and initialization vectors, and realizes the generation of dynamic keys. Each time data is transmitted, the generated key is different due to the change of digital information, which improves the security and anti-attack ability of the key.

[0147] In another embodiment, see Figure 8 The present application also provides a data transmission method, which is applied to Figure 1 In the back end of the terminal shown, the method of the embodiment of the present application further includes the following steps:

[0148] S801, obtain the encrypted data and key data sent by the front end.

[0149] Among them, the secret key data is determined by the front end based on the user identity information and the current timestamp, and the encrypted data is determined by the front end based on the secret key data and the target data to be transmitted.

[0150] In an embodiment of the present application, the back end receives a request sent by the front end through a network interface, and the request includes encrypted data and key data. Common network protocols such as HTTP, HTTPS, etc. can be used for data transmission. The received request is parsed to extract the encrypted data and key data. The corresponding programming language and library can be used to process the request and extract data. For example, in Python, Flask or Django frameworks can be used to receive requests, and built-in functions and modules can be used to parse the request data.

[0151] S802, decrypt the encrypted data according to the secret key data to obtain the target data.

[0152] In the embodiment of the present application, the backend uses the same method as the frontend to redetermine the key data based on the received user identity information and the current timestamp. The specific steps include hash encryption processing of the user identity information, digital extraction processing, etc., which is consistent with the process of generating key data in the frontend.

[0153] Decrypt the encrypted data using the determined key data. You can use the same decryption algorithm as the front-end encryption algorithm, such as the decryption algorithm of the AES encryption algorithm. According to the requirements of the encryption algorithm, the key and initialization vector are applied to the decryption process to gradually restore the original target data.

[0154] The embodiments of the present application ensure that data maintains confidentiality and integrity during transmission between the front-end and back-end through encryption and decryption processing, thereby preventing data from being stolen and tampered with.

[0155] In an exemplary embodiment, based on the above embodiment, the method of the embodiment of the present application further includes the following steps:

[0156] Step 1: The front end obtains the user identity information, current timestamp and target data to be transmitted;

[0157] Step 2: The front end performs hash encryption processing on the user identity information according to the current timestamp to obtain a hash value; performs digital extraction processing on the hash value to obtain digital information;

[0158] Step 3: The front end performs data interception processing on the user identity information according to the digital accumulated value in the digital information to obtain the encryption key in the key data; the encryption key is intercepted and processed according to the number of digits, the number of odd numbers and the preset value in the digital information to obtain the initialization vector in the key data;

[0159] Step 4: The front end obtains data information of the target data; performs code obfuscation processing on the data information to obtain an obfuscated code; obtains spare data in the obfuscated code; performs splicing processing on the spare data according to a predetermined splicing rule to obtain spliced ​​data; performs encryption processing on the spliced ​​data based on a symmetric encryption algorithm to obtain encrypted data; the front end sends the encrypted data and secret key data to the back end;

[0160] Step 5: The backend receives the encrypted data and secret key data, and decrypts the encrypted data according to the secret key data to obtain the target data.

[0161] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0162] Based on the same inventive concept, the embodiment of the present application also provides a data transmission device for implementing the data transmission method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data transmission device embodiments provided below can refer to the limitations on the data transmission method above, and will not be repeated here.

[0163] In one embodiment, Fig. 9 As shown, a data transmission device 900 is provided, comprising:

[0164] Data acquisition module 901, used to acquire user identity information, current timestamp and target data to be transmitted;

[0165] A key determination module 902, configured to determine key data according to a current timestamp and user identity information;

[0166] The encryption processing module 903 is used to perform obfuscation processing, concatenation processing and encryption processing on the target data according to the secret key data to obtain encrypted data;

[0167] The data sending module 904 is used to send the encrypted data and the secret key data to the back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data.

[0168] In one embodiment, the encryption processing module 903 includes:

[0169] The obfuscation unit is used to perform code obfuscation processing on the target data to obtain an obfuscated code;

[0170] A splicing unit, used for splicing the obfuscated codes to obtain spliced ​​data;

[0171] The encryption unit is used to encrypt the spliced ​​data based on a symmetric encryption algorithm to obtain encrypted data.

[0172] In one embodiment, the obfuscation unit comprises:

[0173] An information acquisition subunit, used to acquire data information of target data; the data information includes at least one of a variable name, a function name, a control flow structure, a target character string and a target code;

[0174] The obfuscation subunit is used to perform code obfuscation processing on data information to obtain obfuscated code; the code obfuscation processing includes at least one of variable name obfuscation, function name obfuscation, control flow flattening, string encryption and code compression.

[0175] In one embodiment, the splicing unit comprises:

[0176] A spare data acquisition subunit is used to acquire spare data in the obfuscated code; the spare data includes at least one of a function to be spliced, a variable declaration, and a logic fragment;

[0177] The splicing subunit is used to perform splicing processing on the spare data according to a predetermined splicing rule to obtain spliced ​​data; the splicing processing includes sequential connection and merge connection.

[0178] In one embodiment, the key determination module 902 includes:

[0179] A hash encryption unit, used to perform hash encryption processing on the user identity information according to the current timestamp to obtain a hash value;

[0180] A digital extraction unit, used for performing digital extraction processing on the hash value to obtain digital information;

[0181] The data determination unit is used to determine the secret key data according to the digital information and the user identity information.

[0182] In one embodiment, the digital information includes a digital cumulative value, a number of digits, a number of odd numbers, and a preset value; the key data includes an encryption key and an initialization vector, and the data determination unit includes:

[0183] The encryption subunit is used to perform data interception processing on the user identity information according to the digital accumulated value to obtain an encryption key;

[0184] The vector determination subunit is used to perform data interception processing on the encryption key according to the number of digits, the number of odd numbers and the preset value to obtain an initialization vector.

[0185] In one embodiment, the present application also provides a data transmission module 1000, see Fig.10 , the device comprises:

[0186] The key acquisition module 1001 is used to acquire the encrypted data and key data sent by the front end; the key data is determined by the front end according to the user identity information and the current timestamp, and the encrypted data is determined by the front end according to the key data and the target data to be transmitted;

[0187] The decryption module 1002 is used to decrypt the encrypted data according to the secret key data to obtain the target data.

[0188] Each module in the above data transmission device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0189] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data transmission method is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0190] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0191] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0192] Obtain user identity information, current timestamp, and target data to be transmitted;

[0193] Determine the key data based on the current timestamp and user identity information;

[0194] Obfuscation, concatenation and encryption are performed on the target data according to the secret key data to obtain encrypted data;

[0195] The encrypted data and secret key data are sent to the back-end, so that the back-end decrypts the encrypted data according to the secret key data to obtain the target data.

[0196] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0197] Perform code obfuscation processing on the target data to obtain obfuscated code;

[0198] The obfuscated codes are spliced ​​to obtain spliced ​​data;

[0199] The spliced ​​data is encrypted based on a symmetric encryption algorithm to obtain encrypted data.

[0200] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0201] Acquire data information of target data; the data information includes at least one of a variable name, a function name, a control flow structure, a target string, and a target code;

[0202] Code obfuscation processing is performed on the data information to obtain obfuscated code; the code obfuscation processing includes at least one of variable name obfuscation, function name obfuscation, control flow flattening, string encryption and code compression.

[0203] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0204] Acquire spare data in the obfuscated code; the spare data includes at least one of a function to be spliced, a variable declaration, and a logic fragment;

[0205] According to a predetermined splicing rule, the spare data is spliced ​​to obtain spliced ​​data; the splicing process includes sequential connection and merge connection.

[0206] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0207] Perform hash encryption on the user identity information according to the current timestamp to obtain a hash value;

[0208] Perform digital extraction processing on the hash value to obtain digital information;

[0209] The secret key data is determined based on the digital information and the user identity information.

[0210] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0211] Perform data interception and processing on the user identity information according to the digital accumulated value to obtain an encryption key;

[0212] The encryption key is processed by data interception according to the number of digits, the number of odd numbers and the preset value to obtain an initialization vector.

[0213] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0214] Get the encrypted data and secret key data sent by the front end; the secret key data is determined by the front end based on the user identity information and the current timestamp, and the encrypted data is determined by the front end based on the secret key data and the target data to be transmitted;

[0215] The encrypted data is decrypted according to the secret key data to obtain the target data.

[0216] According to some embodiments of the present application, there is also provided a non-transitory computer-readable storage medium including instructions, such as a memory including instructions, and the above instructions can be executed by a processor of an electronic device to complete the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0217] According to some embodiments of the present application, a computer program product is also provided, and when the computer program is executed by a processor, the above method can be implemented. The computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, part or all of the above method can be implemented in whole or in part according to the process or function described in the embodiment of the present application.

[0218] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0219] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0220] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0221] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data transmission method, characterized in that: The method comprises: Obtain user identity information, current timestamp, and target data to be transmitted; Determine key data according to the current timestamp and the user identity information; Obfuscating, concatenating and encrypting the target data according to the secret key data to obtain encrypted data; The encrypted data and the secret key data are sent to a back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data.

2. The method according to claim 1, characterized in that The obfuscating, concatenating and encrypting the target data according to the secret key data to obtain encrypted data includes: Performing code obfuscation processing on the target data to obtain an obfuscated code; Performing splicing processing on the obfuscated codes to obtain spliced ​​data; The spliced ​​data is encrypted based on a symmetric encryption algorithm to obtain the encrypted data.

3. The method according to claim 2, characterized in that The performing code obfuscation processing on the target data to obtain an obfuscated code includes: Acquire data information of the target data; the data information includes at least one of a variable name, a function name, a control flow structure, a target character string and a target code; The data information is subjected to code obfuscation processing to obtain obfuscated code; the code obfuscation processing includes at least one of variable name obfuscation, function name obfuscation, control flow flattening, string encryption and code compression.

4. The method according to claim 2, characterized in that: The step of splicing the obfuscated codes to obtain spliced ​​data includes: Acquire spare data in the obfuscated code; the spare data includes at least one of a function to be spliced, a variable declaration, and a logic fragment; The standby data is spliced ​​according to a predetermined splicing rule to obtain the spliced ​​data; the splicing includes sequential connection and merge connection.

5. The method according to claim 1, characterized in that The determining the key data according to the current timestamp and the user identity information includes: Performing hash encryption processing on the user identity information according to the current timestamp to obtain a hash value; Performing digital extraction processing on the hash value to obtain digital information; The secret key data is determined according to the digital information and the user identity information.

6. The method according to claim 5, characterized in that The digital information includes a digital cumulative value, a number of digits, a number of odd numbers, and a preset value; the key data includes an encryption key and an initialization vector, and determining the key data according to the digital information and the user identity information includes: Performing data interception processing on the user identity information according to the digital accumulated value to obtain the encryption key; The encryption key is subjected to data interception processing according to the number of digits, the number of odd numbers and a preset value to obtain the initialization vector.

7. A data transmission method, characterized in that: The method comprises: Obtaining the encrypted data and secret key data sent by the front end; the secret key data is determined by the front end according to the user identity information and the current timestamp, and the encrypted data is determined by the front end according to the secret key data and the target data to be transmitted; The encrypted data is decrypted according to the secret key data to obtain the target data.

8. A data transmission device, characterized in that: The device comprises: A data acquisition module is used to obtain user identity information, current timestamp and target data to be transmitted; A key determination module, configured to determine key data according to the current timestamp and the user identity information; An encryption processing module, used for performing obfuscation processing, concatenation processing and encryption processing on the target data according to the secret key data to obtain encrypted data; The encrypted data and the secret key data are sent to a back end, so that the back end decrypts the encrypted data according to the secret key data to obtain the target data.

9. A data transmission device, characterized in that: The device comprises: A key acquisition module, used to acquire the encrypted data and key data sent by the front end; the key data is determined by the front end according to the user identity information and the current timestamp, and the encrypted data is determined by the front end according to the key data and the target data to be transmitted; The decryption module is used to decrypt the encrypted data according to the secret key data to obtain the target data.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images