Data encryption processing method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a data encryption processing method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps that a request is sent to a server, the request is used for the server to determine a digital certificate, a signature private key and an encryption private key on the basis of a protocol corresponding to the request under the condition that encryption processing is determined to be carried out, if validity verification is determined to be passed on the basis of the digital certificate, encryption processing is carried out through a public key and a target national cryptographic algorithm, and encryption processing is carried out; according to the method, a symmetric encryption key is obtained, the symmetric encryption key is sent to a server, and symmetric encryption communication with the server is carried out, so that the security of a Web application can be improved, encrypted transmission of data can be realized through a national cryptographic algorithm, the risk of data leakage and hostile attack are further reduced, and the performance of a Tongsuo password library and the performance of the Web server are fully utilized.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data encryption processing method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] With the rapid development of the Internet, the scope of use of Web applications is becoming wider and wider, and the security issues of Web applications are becoming increasingly prominent. Since personal data may be involved when users use Web applications or transmit data through the Web, there is a risk of personal data leakage, resulting in a low level of data security. Summary of the invention

[0003] Based on this, it is necessary to provide a data encryption processing method, device, computer equipment, computer-readable storage medium and computer program product that can improve data security in response to the above technical problems.

[0004] In a first aspect, the present application provides a data encryption processing method, which is applied to a browser client, and the method includes:

[0005] Sending a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required;

[0006] Receiving the public key and the digital certificate sent by the server;

[0007] If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, which is then sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0008] In one embodiment, the method further comprises:

[0009] When establishing a connection with the server, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and it is determined to use the national encryption suite and the target national encryption algorithm to perform encrypted communication with the server.

[0010] In one embodiment, the digital certificate includes a signature certificate; if it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, including:

[0011] The legitimacy of the signature certificate is verified. If it is determined that the signature certificate passes the legitimacy verification, a random code is generated using the public key, and the random code is encrypted based on the target national encryption algorithm and the public key to obtain the encrypted random code, and the encrypted random code is determined to be a symmetric encryption key.

[0012] In one embodiment, the method further comprises:

[0013] Receiving symmetrically encrypted content sent by the server, where the symmetrically encrypted content is obtained after the server encrypts communication data based on the symmetrical encryption key;

[0014] Based on the random code and the target national encryption algorithm, the symmetrically encrypted content is decrypted to obtain communication data.

[0015] In a second aspect, the present application further provides a data encryption processing method, which is applied to a server, and the method comprises:

[0016] Receive requests sent by browser clients;

[0017] If it is determined based on the protocol corresponding to the request that encryption processing is required, a digital certificate, a signature private key, and an encryption private key are determined, and the digital certificate and the public key are sent to the client, so that the client performs encryption processing based on the digital certificate and the public key to obtain a symmetric encryption key;

[0018] The symmetric encryption key sent by the client is received, and symmetric encryption communication is performed with the client based on the symmetric encryption key.

[0019] In one embodiment, the method further comprises:

[0020] When establishing a connection with the client, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and it is determined to use the national encryption suite and the target national encryption algorithm to perform encrypted communication with the client. The national encryption suite includes a digital certificate, a public key, a signature private key, and an encryption private key.

[0021] In one embodiment, the receiving the symmetric encryption key sent by the client, and performing symmetric encryption communication with the client based on the symmetric encryption key, includes:

[0022] Decrypting the symmetric encryption key based on the encryption private key and the target national encryption algorithm to obtain a random code;

[0023] The communication data is symmetrically encrypted based on the random code and the target national encryption algorithm to obtain symmetrically encrypted content, and the symmetrically encrypted content is sent to the client.

[0024] In a third aspect, the present application further provides a data encryption processing device, the device comprising:

[0025] A first sending module, configured to send a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required;

[0026] A first receiving module, used for receiving the public key and the digital certificate sent by the server;

[0027] The first encryption module is used to, if it is determined that the digital certificate has passed the legitimacy verification based on the digital certificate, perform encryption processing using the public key and the target national encryption algorithm to obtain a symmetric encryption key, and send the symmetric encryption key to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0028] In a fourth aspect, the present application further provides a data encryption processing device, the device comprising:

[0029] A second receiving module is used to receive a request sent by a browser client;

[0030] A first determination module is used to determine a digital certificate, a signature private key, and an encryption private key if encryption processing is required based on the protocol corresponding to the request, and send the digital certificate and the public key to the client, so that the client performs encryption processing based on the digital certificate and the public key to obtain a symmetric encryption key;

[0031] The third receiving module is used to receive the symmetric encryption key sent by the client, and perform symmetric encryption communication with the client based on the symmetric encryption key.

[0032] In a fifth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] Sending a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required;

[0034] Receiving the public key and the digital certificate sent by the server;

[0035] If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, which is then sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0036] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0037] Sending a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required;

[0038] Receiving the public key and the digital certificate sent by the server;

[0039] If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, which is then sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0040] In a seventh aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Sending a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required;

[0042] Receiving the public key and the digital certificate sent by the server;

[0043] If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, which is then sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0044] The encryption processing method, device, computer equipment, computer-readable storage medium and computer program product of the above data, wherein the method includes: sending a request to a server, the request is used for the server to determine the digital certificate, signature private key and encryption private key based on the protocol corresponding to the request, when it is determined that encryption processing is required; receiving the public key and digital certificate sent by the server; if it is determined to pass the legality verification based on the digital certificate, encryption processing is performed through the public key and the target national secret algorithm to obtain a symmetric encryption key, and the symmetric encryption key is sent to the server, and the symmetric encryption key is used for symmetric encryption communication between the browser client and the server. By adopting this method, the browsing of the OpenResty national secret Web server can be realized through the Tongsuo cryptographic library and the browser client, which improves the security of the Web application. The encrypted transmission of data can be realized through the national secret algorithm, further reducing the risk of data leakage and malicious attacks, and making full use of the performance of the Tongsuo cryptographic library and the Web server. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0046] FIG1 is an application environment diagram of a data encryption processing method according to an embodiment;

[0047] FIG2 is a schematic diagram of a flow chart of a method for encrypting data in one embodiment;

[0048] FIG3 is a schematic diagram of a flow chart of a method for encrypting data in one embodiment;

[0049] FIG4 is a schematic flow chart of a data encryption processing method in another embodiment;

[0050] FIG5 is a structural block diagram of a data encryption processing device in one embodiment;

[0051] FIG6 is a block diagram of a data encryption processing device according to an embodiment;

[0052] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] With the rapid development of the Internet, the security issues of Web applications have become increasingly prominent. The national secret algorithm has high security and reliability. As a powerful Web application server, OpenResty has superior performance. Tongsuo (formerly BabaSSL) is an open source basic cryptographic library that provides modern cryptographic algorithms and secure communication protocols, and provides protection for the privacy, integrity and authenticity of data during transmission, use, storage, etc. Therefore, the data provided in this embodiment can be combined with Tongsuo and OpenResty to achieve national secret access, that is, by integrating the Tongsuo cryptographic library and the OpenResty Web server, national secret access in Web applications is achieved.

[0055] The data encryption processing method provided in the embodiment of the present application can be applied in the application environment as shown in FIG1 . It includes a browser client 100 and a server 200. The browser client 100 can be a national secret browser client, and the server can be an Openresty Web server. The browser client 100 can communicate with the server 200 through a network, and the browser client can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc. The server 200 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0056] In an exemplary embodiment, as shown in FIG2 , a data encryption processing method is provided, which is described by taking the method applied to the browser client 100 in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0057] Step 202: Send a request to the server.

[0058] Among them, the request is used for the server to determine the digital certificate, signature private key and encryption private key based on the protocol corresponding to the request, when it is determined that encryption processing is required; the digital certificate can be a national secret certificate, which can include one or more of a signature certificate and an encryption certificate; the signature certificate corresponds to the signature private key, and the encryption certificate corresponds to the encryption private key. The protocol corresponding to the request can be the protocol used by the browser client to send a request to the server, or the protocol corresponding to the connection established when the browser client and the server send a request. Optionally, it can be an SSL connection, and the corresponding protocol can be the SSL protocol, or it can be a TLS connection, and the corresponding protocol can be the TLS protocol, etc. The request can be an HTTP request, specifically, it can be an access request for the server's website address, and the request can be determined based on the web address of the server. The browser client can be a national secret browser client, and the server can be a national secret WEB server.

[0059] Specifically, when the browser client determines that it needs to access a national secret WEB server based on the actual application scenario, it can obtain the address of the national secret WEB server and generate an HTTP request based on the address, so that the browser client can send the request to the server. After receiving the request, the server can determine the protocol corresponding to the request and determine whether the request needs to be encrypted based on the protocol. In one example, the server can pre-configure one or more protocol types that need to be encrypted in the local storage space. In this way, after determining the protocol corresponding to the request, the server can query in the server's local storage space. If the protocol corresponding to the request is queried, the server can determine that the request currently needs to be encrypted. In this way, the server can determine the digital certificate, signature private key, and encryption private key.

[0060] In one example, the browser client can pre-handshake and negotiate with the server to determine the national encryption suite and the specified national encryption algorithm, that is, the target national encryption algorithm. The national encryption suite can be a signature certificate, a signature private key, an encryption certificate, and an encryption private key. After the server determines that it is necessary to encrypt the received request, the server can determine the signature certificate, signature private key, encryption certificate, and encryption private key corresponding to the current request based on the pre-negotiated national encryption suite, and determine the public key. In this way, the server can generate a response message corresponding to the request based on the signature certificate, encryption certificate, and public key. That is, the server can send a response message to the browser client, and the response message carries at least a signature certificate, an encryption certificate, and a public key.

[0061] Step 204: Receive the public key and digital certificate sent by the server.

[0062] Specifically, after receiving the response message sent by the server, the browser client can parse the response message to obtain the public key, signature certificate and encryption certificate carried by the response message. In this way, the browser client can perform legitimacy verification based on the signature certificate. If the browser client determines that the current signature certificate has not passed the legitimacy verification, the browser client can generate an abnormal prompt information or an alarm prompt information, and the abnormal prompt information can be an HTTP alarm.

[0063] Step 206: If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, and the symmetric encryption key is sent to the server.

[0064] The symmetric encryption key is used for symmetric encryption communication between the browser client and the server. The target national encryption algorithm can be a national encryption algorithm pre-negotiated by the browser client and the server.

[0065] Specifically, the browser client performs legitimacy verification based on the signature certificate in the digital certificate. If the browser client determines that the legitimacy verification has been passed based on the signature certificate, the browser client can determine the target national encryption algorithm pre-negotiated with the server, and perform encryption processing using the public key and the target national encryption algorithm to obtain a symmetric encryption key. The browser client can send the obtained symmetric encryption key to the server, and the server can receive the symmetric encryption key and perform symmetric encryption communication with the browser client based on the symmetric encryption key, thereby achieving secure transmission of data between the browser client and the server and avoiding the risk of data leakage.

[0066] In the encryption processing method of the above data, a request is sent to the server, and the request is used for the server to determine the digital certificate, signature private key and encryption private key based on the protocol corresponding to the request, when it is determined that encryption processing is required. Receive the public key and digital certificate sent by the server. If it is determined that the legitimacy verification has passed based on the digital certificate, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, and the symmetric encryption key is sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server. By adopting this method, the browsing of the OpenResty national encryption Web server can be realized through the Tongsuo cryptographic library and the browser client, which improves the security of the Web application. The encrypted transmission of data can be realized through the national encryption algorithm, which further reduces the risk of data leakage and malicious attacks, and makes full use of the performance of the Tongsuo cryptographic library and the Web server.

[0067] In an exemplary embodiment, the data encryption processing method further includes:

[0068] When establishing a connection with the server, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and the use of the national encryption suite and the target national encryption algorithm are determined to conduct encrypted communication with the server.

[0069] Among them, the national secret encryption suite can include a signature certificate, a signature private key, an encryption certificate, and an encryption private key.

[0070] Specifically, the user device can access the Openresty Web server through the browser client, so that when the browser client establishes a connection with the server, it can use the national encryption suite and the national encryption algorithm for encrypted communication through handshake negotiation, and negotiate the specific content of the national encryption suite to be used and the type of national encryption algorithm to be used, that is, determine the national encryption suite and the target national encryption algorithm. An SSL / TLS connection can be established between the browser client and the server, so that the browser client and the server can determine the national encryption suite and the target national encryption algorithm through SSL / TLS handshake negotiation.

[0071] Optionally, the Tongsuo cryptographic library and the national cryptographic algorithm module can be integrated into OpenResty by modifying the Nginx encryption processing, certificate loading, encryption suite loading and other module codes in Openresty to adapt to the Tongsuo cryptographic library, so that it supports the national cryptographic suite. When using it, configure the national cryptographic dual certificate in Openresty, and use the national cryptographic browser to access the Web service when establishing an SSL / TLS connection, so that the national cryptographic algorithm can be used for communication. The specific implementation process is as follows:

[0072] Step 1: Modify the Nginx encryption and decryption module code in Openresty to support the Tongsuo cryptographic library.

[0073] Step 2: Modify the Nginx certificate loading module code in Openresty to support dual national encryption certificates.

[0074] Step 3: Specify Openssl as the Tongsuo cryptographic library path and compile Openresty.

[0075] Step 4: Configure the signature certificate and encryption certificate in Openresty and enable the national encryption communication module.

[0076] Step 5: Start the Openresty web server.

[0077] Step 6: Use the national encryption client browser to access the Openresty web server.

[0078] Step 7: When the national encryption browser client establishes an SSL / TLS connection with the server, the national encryption suite and target national encryption algorithm are used for encrypted communication through SSL / TLS handshake negotiation.

[0079] In this embodiment, the browser client determines in advance the encrypted communication through handshake negotiation with the server, as well as the national encryption suite and national encryption algorithm used for the encrypted communication. The tongsuo encryption module and the national encryption web server are integrated to realize the encryption of web data and improve the efficiency of encryption processing.

[0080] In an exemplary embodiment, the digital certificate includes a signature certificate. The specific implementation process of the step "if it is determined that the digital certificate has passed the legitimacy verification, then encrypting the digital certificate using the public key and the target national encryption algorithm to obtain a symmetric encryption key" may include:

[0081] The legitimacy is verified through the signature certificate. If it is determined that the signature certificate passes the legitimacy verification, the public key is used to generate a random code, and the random code is encrypted based on the target national encryption algorithm and the public key to obtain the encrypted random code, and the encrypted random code is determined to be a symmetric encryption key.

[0082] Specifically, the browser client can perform legitimacy verification / legitimacy check based on the parsed signature certificate. In this way, if it is determined that the signature certificate passes the legitimacy verification, the browser client can generate a random code based on the public key carried in the response message, and encrypt the random code based on the pre-negotiated target national encryption algorithm to obtain an encrypted random code. In this way, the browser client can determine the encrypted random code as a symmetric encryption key and send the symmetric encryption key to the server. The random code can be a KEY, and the browser client can determine the encrypted key as a symmetric encryption key and send the encrypted key to the server.

[0083] In this embodiment, the browser client sends a symmetric encryption key to the server, and the web data transmission between the two ends can be protected by the symmetric encryption key, thereby further improving the security of the web data and avoiding data leakage.

[0084] In an exemplary embodiment, the data encryption processing method further includes:

[0085] Receive the symmetric encrypted content sent by the server. The symmetric encrypted content is obtained by the server encrypting the communication data based on the symmetric encryption key. Decrypt the symmetric encrypted content based on the random code and the target national secret algorithm to obtain the communication data.

[0086] Among them, the target national encryption algorithm is the national encryption algorithm negotiated by handshake when the browser client and the server establish a connection, for example, it can be one or more of SM1, SM2, SM3 and SM4.

[0087] Specifically, when the server needs to transmit web application data or other data that needs to be improved in security between the browser client and the server, the communication data can be web application data, and the communication data can also be other data that is transmitted between the browser client and the server and needs to ensure security; in this way, the server can perform symmetrical encryption processing on the communication data based on the received symmetric encryption key to obtain symmetrically encrypted content, and transmit the symmetrically encrypted content to the browser client. After receiving the encrypted content (symmetrically encrypted content) sent by the server, the browser client can decrypt the encrypted content based on the random code determined in the above embodiment and the target national secret algorithm to obtain the decrypted data, that is, the communication data originally transmitted by the server. In this way, symmetrical encryption communication can be completed between the browser client and the server.

[0088] Optionally, an encryption processing module may be integrated in the server, and the tongsuo encryption module may be called through the encryption processing module to perform encryption and decryption processing of the data. That is, after the server determines the target national encryption algorithm during the handshake negotiation, it may call the target national encryption algorithm in the tongsuo encryption module through the internally integrated encryption processing module, and implement decryption processing or encryption processing of the data based on the target national encryption algorithm.

[0089] In this embodiment, based on the symmetric encryption key synchronized between the browser client and the server, symmetric encryption transmission of data is achieved, as well as high-speed encryption and decryption processing of data, thereby ensuring data security while ensuring data processing efficiency.

[0090] In an exemplary embodiment, as shown in FIG3 , a data encryption processing method is provided, which is described by taking the method applied to the server in FIG1 as an example, including:

[0091] Step 302: Receive a request sent by a browser client.

[0092] Specifically, when the browser client determines that it currently needs to access the national secret WEB server based on the actual application scenario, it can obtain the address of the national secret WEB server and generate an HTTP request based on the address, so that the browser client can send the request to the server.

[0093] Step 304: If encryption processing is required based on the protocol corresponding to the request, the digital certificate, signature private key and encryption private key are determined, and the digital certificate and public key are sent to the client, so that the client performs encryption processing based on the digital certificate and public key to obtain a symmetric encryption key.

[0094] Specifically, after receiving the request, the server can determine the protocol corresponding to the request, and determine whether the request needs to be encrypted based on the protocol. The server can pre-configure one or more protocol types that need to be encrypted in the local storage space. In this way, after determining the protocol corresponding to the request, the server can query in the server local storage space. If the protocol corresponding to the request is queried, the server can determine that the request needs to be encrypted at present. In this way, the server can determine the digital certificate, the signature private key and the encryption private key. The server can generate a response message corresponding to the request based on the signature certificate, the encryption certificate and the public key. That is, the server can send a response message to the browser client, and the response message carries at least the signature certificate, the encryption certificate and the public key.

[0095] Based on this, after receiving the response message sent by the server, the browser client can parse the response message and obtain the public key, signature certificate and encryption certificate carried by the response message. In this way, the browser client can verify the legitimacy based on the signature certificate; if the browser client determines that the legitimacy verification has passed based on the signature certificate, the browser client can determine the target national encryption algorithm pre-negotiated with the server, and perform encryption processing using the public key and the target national encryption algorithm to obtain the symmetric encryption key.

[0096] Step 306: Receive the symmetric encryption key sent by the client, and perform symmetric encryption communication with the client based on the symmetric encryption key.

[0097] Specifically, the browser client can send the obtained symmetric encryption key to the server, the server can receive the symmetric encryption key, and perform symmetric encryption communication with the browser client based on the symmetric encryption key, thereby achieving secure transmission of data between the browser client and the server and avoiding the risk of data leakage.

[0098] In this embodiment, the security of the Web application is improved by enabling browsing of the OpenResty national encryption Web server through the Tongsuo cryptographic library and the browser client.

[0099] In an exemplary embodiment, the data encryption processing method further includes:

[0100] When establishing a connection with the client, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and the national encryption suite and the target national encryption algorithm are determined to be used for encrypted communication with the client.

[0101] Among them, the national secret encryption suite includes digital certificates, public keys, signature private keys, and encryption private keys.

[0102] Specifically, the user device can access the Openresty Web server through the browser client, so that when the browser client establishes a connection with the server, it can use the national encryption suite and the national encryption algorithm for encrypted communication through handshake negotiation, and negotiate the specific content of the national encryption suite to be used and the type of national encryption algorithm to be used, that is, determine the national encryption suite and the target national encryption algorithm. An SSL / TLS connection can be established between the browser client and the server, so that the browser client and the server can determine the national encryption suite and the target national encryption algorithm through SSL / TLS handshake negotiation.

[0103] In this embodiment, the browser client determines in advance the encrypted communication through handshake negotiation with the server, as well as the national encryption suite and national encryption algorithm used for the encrypted communication. The tongsuo encryption module and the national encryption web server are integrated to realize the encryption of web data and improve the efficiency of encryption processing.

[0104] In an exemplary embodiment, the specific implementation process of the step of "receiving the symmetric encryption key sent by the client, and performing symmetric encryption communication with the client based on the symmetric encryption key" may include:

[0105] The symmetric encryption key is decrypted based on the encryption private key and the target national encryption algorithm to obtain a random code. The communication data is symmetrically encrypted based on the random code and the target national encryption algorithm to obtain the symmetrically encrypted content, and the symmetrically encrypted content is sent to the client.

[0106] The communication data may be web application data, or may be data that is transmitted between other browser clients and servers and that needs to ensure security.

[0107] Specifically, the server can decrypt the symmetric encryption key sent by the browser client based on the encryption private key determined by the above embodiment and the target national encryption algorithm, and obtain the decrypted symmetric encryption key, that is, decrypt the random code determined by the browser client. Based on this, when the server determines that it is currently necessary to transmit communication data with the browser client, the server can perform symmetric encryption processing on the communication data through the random code and the target national encryption algorithm to obtain symmetric encrypted content, and send the symmetric encrypted content to the browser client, for example, through the symmetric encryption communication channel established between the browser client and the server, to transmit the symmetric encrypted content. Through the symmetric encryption signal, the server can send the symmetric encrypted content to the browser client.

[0108] Optionally, the specific process of decryption is that the server decrypts the symmetric encryption key with the encryption private key through the target national secret algorithm to obtain the decrypted symmetric encryption key, that is, the random code; the specific process of encryption can be that the server inputs the random code and the communication data into the target national secret algorithm together to obtain the output result of the target national secret algorithm, that is, the symmetric encryption content.

[0109] Optionally, an encryption processing module may be integrated in the server, and the tongsuo encryption module may be called through the encryption processing module to perform encryption and decryption processing of the data. That is, after the server determines the target national encryption algorithm during the handshake negotiation, it may call the target national encryption algorithm in the tongsuo encryption module through the internally integrated encryption processing module, and implement decryption processing or encryption processing of the data based on the target national encryption algorithm.

[0110] In this embodiment, based on the symmetric encryption key synchronized between the browser client and the server, symmetric encryption transmission of data is achieved, as well as high-speed encryption and decryption processing of data, thereby ensuring data security while ensuring data processing efficiency.

[0111] In the following, in conjunction with a specific embodiment, a detailed description of the specific implementation process of the above data encryption processing method may include:

[0112] The data encryption processing method provided in this embodiment is a method for implementing the OpenResty national secret Web server based on Tongsuo. By integrating the Tongsuo encryption module with the OpenResty Web server, the national secret algorithm encryption of Web communication data is realized, and the security and data processing efficiency of the Web server are improved. The method provided in this embodiment can be applied to a data encryption system, which may include a Tongsuo encryption module, an OpenResty Web server, an encryption communication module, an encryption processing module, and a browser client. The Tongsuo encryption module can execute the national secret algorithm and provide high-speed and efficient encryption and decryption services. OpenResty Web server: As the core of the Web service, it is responsible for processing HTTP requests and responses and providing various functions of Web services. Secret communication module: responsible for establishing an encrypted communication channel between the Web server and the client to ensure the security of data during transmission. Encryption processing module: integrated in OpenResty, responsible for calling the Tongsuo encryption module to encrypt and decrypt data.

[0113] The processing of the system architecture may include, HTTP connection event monitoring: event monitoring, event loop, event processing and queue; HTTPS connection processing includes: TLS / SSL handshake, key exchange, certificate exchange and encryption condition negotiation; HTTPS transmission data encryption and decryption includes: tongsuo national secret algorithm encryption and tongsuo national secret algorithm decryption; HTTP request processing and response includes: reverse proxy, local request response, redirection, intercept request and client verification.

[0114] In this embodiment, the above-mentioned OpenResty national secret access system based on Tongsuo can be constructed. By modifying the Nginx encryption processing, certificate loading, encryption suite loading and other module codes in Openresty to adapt to the Tongsuo cryptographic library, the Tongsuo cryptographic library and the national secret algorithm module can be integrated into the OpenResty server to support the national secret encryption suite. The national secret dual certificate (encryption certificate and signature certificate) can be configured on the Openresty server. When accessing, the national secret browser client can be used to access the Web service so that it selects the national secret encryption suite when establishing an SSL / TLS connection, thereby using the national secret algorithm for communication. The specific implementation process is as follows:

[0115] Step 1: Modify the Nginx encryption and decryption module code in Openresty to support the Tongsuo cryptographic library.

[0116] Step 2: Modify the Nginx certificate loading module code in Openresty to support dual national encryption certificates.

[0117] Step 3: Specify Openssl as the Tongsuo cryptographic library path and compile Openresty.

[0118] Step 4: Configure the signature certificate and encryption certificate in Openresty and enable the national encryption communication module.

[0119] Step 5: Start the Openresty web server.

[0120] Step 6: Use the national encryption client browser to access the Openresty web server.

[0121] Step 7: When the national encryption browser client establishes an SSL / TLS connection with the server, the national encryption suite and target national encryption algorithm are used for encrypted communication through SSL / TLS handshake negotiation.

[0122] As shown in Figure 4, the communication process between the configured national secret browser client and the Openresty Web server, or the main process when the national secret browser client accesses the Openresty Web server through the HTTPS protocol is as follows, which includes the national secret browser client and the national secret WEB server, specifically including the certificate verification process and the data transmission process. The data transmission process may include asymmetric encryption and symmetric encryption processes, specifically:

[0123] Step 1: The Guomi browser client sends a request to the Guomi WEB server, the request is https: / / www.guomi.com; when the Web server (WEB server) receives the HTTP request, the encryption processing module integrated in the server will decide whether encryption processing is required based on the protocol corresponding to the request.

[0124] Step 2: If the server determines that encryption processing is required, the encryption processing module will negotiate the use of the national encryption related encryption suite based on the content of the supported encryption suite sent to the server by the national encryption browser client during the TLS handshake.

[0125] Step 3: The server can load and use the national encryption dual certificate, load the signature certificate, encryption certificate, encryption private key, signature private key and public key; and generate a response message; the server requests a response, carrying a public key and a digital certificate, that is, the server generates a response message corresponding to the request, and the response message carries a public key and a digital certificate (signature certificate, encryption certificate), and sends it to the national encryption browser client.

[0126] Step 4: The National Encryption Browser Client uses the signed certificate to verify the legitimacy. After the legitimacy verification is passed, it negotiates the communication key with the Openresty Web server. The specific client can use the public key to generate a random code key, and encrypt the random code key through the National Encryption Algorithm to obtain the encrypted key; the client sends the encrypted KEY to the server as the next symmetric encryption key. After receiving the symmetric encryption key, the server uses the National Encryption Algorithm to decrypt it through the encrypted private key to obtain the random code.

[0127] Step 5: The National Encryption Browser Client and the Openresty Web Server use the National Encryption Algorithm to encrypt and decrypt the data before communicating. Specifically, after obtaining the random code, the server can use the National Encryption Algorithm to symmetric encrypt the data to obtain symmetric encrypted content. The server can pass the symmetric encrypted content to the client to achieve symmetric encrypted communication between the browser client and the server.

[0128] In one example, when receiving data, the server calls the Tongsuo cryptographic library to decrypt the data using the national secret algorithm. The decrypted data is processed and responded to by OpenResty. After responding to the HTTP request, the server calls the Tongsuo cryptographic library to encrypt the data using the national secret algorithm before sending the data to complete the entire Web service process.

[0129] The data encryption processing method provided in this embodiment includes the steps of compiling and deploying the OpenResty environment, integrating the Tongsuo national secret library, modifying the national secret encryption module, modifying the national secret dual certificate loading module, configuring the OpenResty server, and testing the deployment. Among them, the national secret encryption and decryption module and the national secret dual certificate loading module are modified based on Nginx to realize the encryption and decryption functions of HTTP requests and responses. The OpenResty server enables the national secret encryption module through the configuration file and sets the relevant encryption parameters and keys.

[0130] The data encryption processing method provided in this embodiment improves the security of Web applications, realizes the encrypted transmission of data through the national secret algorithm, and effectively prevents data leakage and malicious attacks. The Tongsuo encryption module provides high-speed and efficient encryption and decryption services. OpenResty can use Nginx's non-blocking I / O model to achieve high-performance Web services and support high-concurrency request processing. It fully utilizes the advantages of the Tongsuo cryptographic library and the OpenResty Web server to improve the performance and scalability of the system. It also simplifies the integration process of the national secret algorithm in Web applications, reduces the difficulty and cost of development, and improves the customization and flexibility of development.

[0131] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0132] Based on the same inventive concept, the embodiment of the present application also provides a data encryption processing device for implementing the data encryption processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more data encryption processing devices provided below can refer to the limitations of the data encryption processing method above, and will not be repeated here.

[0133] In an exemplary embodiment, as shown in FIG5 , a data encryption processing device 500 is provided, comprising:

[0134] A first sending module 502 is used to send a request to a server, where the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is required;

[0135] A first receiving module 504, configured to receive the public key and the digital certificate sent by the server;

[0136] The first encryption module 506 is used to, if it is determined based on the digital certificate that the legitimacy verification has been passed, perform encryption processing using the public key and the target national encryption algorithm to obtain a symmetric encryption key, and send the symmetric encryption key to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

[0137] In one embodiment, the device further comprises:

[0138] The second determination module is used to determine the national secret encryption suite and the target national secret algorithm through handshake negotiation when establishing a connection with the server, and determine to use the national secret encryption suite and the target national secret algorithm to perform encrypted communication with the server.

[0139] In one embodiment, the digital certificate includes a signature certificate; and the first encryption module is specifically used for:

[0140] The legitimacy of the signature certificate is verified. If it is determined that the signature certificate passes the legitimacy verification, a random code is generated using the public key, and the random code is encrypted based on the target national encryption algorithm and the public key to obtain the encrypted random code, and the encrypted random code is determined to be a symmetric encryption key.

[0141] In one embodiment, the device further comprises:

[0142] A content receiving module, used for receiving symmetrically encrypted content sent by the server, wherein the symmetrically encrypted content is obtained after the server encrypts the communication data based on the symmetrical encryption key;

[0143] The first decryption module is used to decrypt the symmetrically encrypted content based on the random code and the target national encryption algorithm to obtain communication data.

[0144] In an exemplary embodiment, as shown in FIG6 , a data encryption processing device 600 is provided, comprising:

[0145] The second receiving module 602 is used to receive a request sent by a browser client;

[0146] A first determination module 604 is configured to determine a digital certificate, a signature private key, and an encryption private key if encryption processing is required based on the protocol corresponding to the request, and send the digital certificate and the public key to the client, so that the client performs encryption processing based on the digital certificate and the public key to obtain a symmetric encryption key;

[0147] The third receiving module 606 is used to receive the symmetric encryption key sent by the client, and perform symmetric encryption communication with the client based on the symmetric encryption key.

[0148] In one embodiment, the device further comprises:

[0149] The connection establishment module is used to determine the national secret encryption suite and the target national secret algorithm through handshake negotiation when establishing a connection with the client, and to determine to use the national secret encryption suite and the target national secret algorithm to perform encrypted communication with the client. The national secret encryption suite includes a digital certificate, a public key, a signature private key, and an encryption private key.

[0150] In one embodiment, the third receiving module is specifically used for:

[0151] Decrypting the symmetric encryption key based on the encryption private key and the target national encryption algorithm to obtain a random code;

[0152] The communication data is symmetrically encrypted based on the random code and the target national encryption algorithm to obtain symmetrically encrypted content, and the symmetrically encrypted content is sent to the client.

[0153] Each module in the above data encryption processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0154] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data corresponding to symmetric encrypted content for communication between a browser client and a server. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a data encryption processing method is implemented.

[0155] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above embodiments when executing the computer program.

[0157] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above embodiments are implemented.

[0158] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above embodiments are implemented.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0160] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0161] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0162] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data encryption processing method, characterized in that: Applied to a browser client, the method includes: Sending a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required; Receiving the public key and the digital certificate sent by the server; If it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target national encryption algorithm to obtain a symmetric encryption key, which is then sent to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

2. The method according to claim 1, characterized in that The method further comprises: When establishing a connection with the server, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and it is determined to use the national encryption suite and the target national encryption algorithm to perform encrypted communication with the server.

3. The method according to claim 2, characterized in that The digital certificate includes a signature certificate; if it is determined based on the digital certificate that the legitimacy verification has been passed, encryption processing is performed using the public key and the target country secret algorithm to obtain a symmetric encryption key, including: The legitimacy of the signature certificate is verified. If it is determined that the signature certificate passes the legitimacy verification, a random code is generated using the public key, and the random code is encrypted based on the target national encryption algorithm and the public key to obtain the encrypted random code, and the encrypted random code is determined to be a symmetric encryption key.

4. The method according to claim 3, characterized in that The method further comprises: Receiving symmetrically encrypted content sent by the server, where the symmetrically encrypted content is obtained after the server encrypts communication data based on the symmetrical encryption key; Based on the random code and the target national encryption algorithm, the symmetrically encrypted content is decrypted to obtain communication data.

5. A data encryption processing method, characterized in that: Applied to a server, the method comprises: Receive requests sent by browser clients; If it is determined based on the protocol corresponding to the request that encryption processing is required, a digital certificate, a signature private key, and an encryption private key are determined, and the digital certificate and the public key are sent to the client, so that the client performs encryption processing based on the digital certificate and the public key to obtain a symmetric encryption key; The symmetric encryption key sent by the client is received, and symmetric encryption communication is performed with the client based on the symmetric encryption key.

6. The method according to claim 5, characterized in that The method further comprises: When establishing a connection with the client, the national encryption suite and the target national encryption algorithm are determined through handshake negotiation, and it is determined to use the national encryption suite and the target national encryption algorithm to perform encrypted communication with the client. The national encryption suite includes a digital certificate, a public key, a signature private key, and an encryption private key.

7. The method according to claim 6, characterized in that The receiving the symmetric encryption key sent by the client, and performing symmetric encryption communication with the client based on the symmetric encryption key, includes: Decrypting the symmetric encryption key based on the encryption private key and the target national encryption algorithm to obtain a random code; The communication data is symmetrically encrypted based on the random code and the target national encryption algorithm to obtain symmetrically encrypted content, and the symmetrically encrypted content is sent to the client.

8. A data encryption processing device, characterized in that: The device comprises: A first sending module, configured to send a request to a server, wherein the request is used by the server to determine a digital certificate, a signature private key, and an encryption private key based on a protocol corresponding to the request, if encryption processing is determined to be required; A first receiving module, used for receiving the public key and the digital certificate sent by the server; The first encryption module is used to, if it is determined that the digital certificate has passed the legitimacy verification based on the digital certificate, perform encryption processing using the public key and the target national encryption algorithm to obtain a symmetric encryption key, and send the symmetric encryption key to the server. The symmetric encryption key is used for symmetric encryption communication between the browser client and the server.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images