Message body encryption method, server, electronic equipment and storage medium

Abstract

The invention discloses a message body encryption method, a server, electronic equipment and a storage medium, and relates to the technical field of security encryption, and the message body encryption method applied to the server comprises the following steps: generating a session key according to a received equipment identifier under the condition that the authentication of the electronic equipment is passed; encrypting the session key by using a preset private key to obtain an encrypted string, and sending the encrypted string to the electronic equipment, so that the electronic equipment decrypts the encrypted string by using a preset public key to obtain the session key, and encrypts the initial message body by using the session key to obtain an encrypted message body; under the condition that the encrypted message body and the first algorithm identifier sent by the electronic equipment are received, determining a decryption algorithm according to the first algorithm identifier; and decrypting the encrypted message body by using a decryption algorithm and the session key to obtain an initial message body. Through encrypted transmission, the probability of occurrence of data leakage in the data transmission process is reduced.

Description

Technical Field

[0001] The present application relates to a specific technical field, and in particular to a message body encryption method, a server, an electronic device and a storage medium. Background Art

[0002] With the widespread application of information technology, message communications between devices and servers have become increasingly frequent. In order to protect the security and integrity of data, a variety of message body encryption methods are commonly used in conventional technologies, including but not limited to using encryption algorithms to encrypt data and using dynamic key negotiation mechanisms to ensure key updates for each communication.

[0003] Common authentication protocols and digital signature technologies also provide identity authentication and data integrity protection at the message transmission level, further enhancing the security of data during transmission. Although conventional security protection strategies provide strong protection for communications, the difficulty of secure storage of static keys, the cumbersome process of key negotiation, and the difficulty of encryption algorithms to maintain long-term effectiveness all increase the risk of data being illegally intercepted or leaked during transmission.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a message body encryption method, server, electronic device and storage medium, aiming to reduce the probability of data leakage during communication.

[0006] To achieve the above purpose, the present application proposes a message body encryption method, which is applied to a server, and the method comprises: If the electronic device is authenticated, a session key is generated according to the received device identification; Encrypting the session key using a preset private key to obtain an encrypted string, and sending the encrypted string to the electronic device so that the electronic device decrypts the encrypted string using a preset public key to obtain a session key, and encrypts the initial message body using the session key to obtain an encrypted message body; Upon receiving the encrypted message body and the first algorithm identifier sent by the electronic device, determining a decryption algorithm according to the first algorithm identifier; The encrypted message body is decrypted using the decryption algorithm and the session key to obtain the initial message body.

[0007] In one embodiment, the step of encrypting the session key using a private key to obtain an encrypted string, and sending the encrypted string to the electronic device includes: Encrypt the session key using the private key and a random number to obtain an encrypted string; The encrypted string and the random number are sent to the electronic device, so that the electronic device uses the public key and the random number to decrypt the encrypted string to obtain a session key.

[0008] In one embodiment, before the step of generating a session key according to the received device identification, the method further includes: Upon receiving the device identification, the first key string, and the second algorithm identification sent by the electronic device, determining the device password according to the device identification; determining an encryption algorithm according to the second algorithm identifier, wherein the encryption algorithm is an algorithm used by the electronic device to encrypt the device password; Encrypt the device password using the encryption algorithm to obtain a second key string; In a case where the first key string and the second key string are the same, it is confirmed that the electronic device authentication is successful.

[0009] In addition, to achieve the above purpose, the present application also proposes a message body encryption method, which is applied to an electronic device, and the method includes: Upon receiving the encrypted string sent by the server, decrypt the encrypted string using a preset public key to obtain a session key, wherein the session key is generated by the server according to the device identifier, and the encrypted string is obtained by encrypting the session key by the server using a preset private key; Encrypt the initial message body using the session key to obtain an encrypted message body; The encrypted message body and the first algorithm identifier are sent to the server, so that the server determines the decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

[0010] In one embodiment, the step of sending the encrypted message body and the first algorithm identifier to the server includes: The first algorithm identifier is encapsulated in a flag bit of a message transmission protocol, and the encrypted message body is sent to the server through the message transmission protocol, so that the server obtains the first algorithm identifier by reading the flag bit of the message transmission protocol.

[0011] In one embodiment, before the step of encrypting the initial message body using the session key, the method further includes: When the encrypted string and the random number sent by the server are received, the encrypted string is decrypted using the public key and the random number to obtain a session key.

[0012] In one embodiment, after the step of obtaining the session key, the method further includes: In the case where the random number is a timestamp, comparing whether the time interval between the timestamp and the current time exceeds a preset time threshold; When the time interval exceeds the time threshold, disconnecting the connection with the server; In a case where the time interval does not exceed the time threshold, the steps of encrypting the initial message body using the session key and subsequent steps are performed.

[0013] In addition, to achieve the above purpose, the present application also proposes a message body encryption device, which is applied to a server and includes: A key generation module, used to generate a session key according to the received device identification when the electronic device is authenticated; A key encryption module, used to encrypt the session key using a preset private key to obtain an encrypted string, and send the encrypted string to the electronic device, so that the electronic device decrypts the encrypted string using a preset public key to obtain a session key, and encrypts an initial message body using the session key to obtain an encrypted message body; an algorithm determination module, configured to determine a decryption algorithm according to the first algorithm identifier when receiving the encrypted message body and the first algorithm identifier sent by the electronic device; The message body decryption module is used to decrypt the encrypted message body using the decryption algorithm and the session key to obtain the initial message body.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a message body encryption device, which is applied to an electronic device, and the message body encryption device comprises: A key decryption module, configured to, upon receiving an encrypted string sent by the server, decrypt the encrypted string using a preset public key to obtain a session key, wherein the session key is generated by the server according to the device identifier, and the encrypted string is obtained by encrypting the session key by the server using a preset private key; A message body encryption module, used to encrypt the initial message body using the session key to obtain an encrypted message body; A message sending module is used to send the encrypted message body and a first algorithm identifier to the server, so that the server determines a decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

[0015] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the message body encryption method described above are implemented.

[0016] One or more technical solutions proposed in the present application, when applied to a server, have at least the following technical effects: when the electronic device is authenticated, a session key is generated according to the received device identification, ensuring that each session has a unique key and reducing the risk of the session being eavesdropped or cracked; then, the session key is encrypted using a preset private key to obtain an encrypted string, and encryption using the private key ensures the confidentiality of the session key during transmission; the encrypted string is then sent to the electronic device, and an unauthorized device (i.e., a device without a corresponding public key) cannot obtain the session key even if it eavesdrops on the encrypted string; further, upon receiving the encrypted message body and the first algorithm identifier sent by the electronic device, In the case of, according to the first algorithm identifier, determine the decryption algorithm used to decrypt the encrypted message body. Only the device that knows the matching relationship between the algorithm identifier and the encryption and decryption algorithm can determine the correct decryption algorithm to avoid message leakage; wherein, the encrypted message body is generated by the electronic device using the session key to encrypt the initial message body. Only the device with the correct session key can generate a valid encrypted message body, which not only ensures the confidentiality of the message, but also serves as an identity authentication for the electronic device; use the decryption algorithm and session key to decrypt the encrypted message body to obtain the initial message body. Most tampering with the message will result in decryption failure, thereby ensuring the integrity of the message during transmission. This application ensures the confidentiality and reliability of data transmission through the encryption and decryption process, and reduces the probability of data leakage during communication between electronic devices and servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 A flowchart of the first embodiment of the message body encryption method of the present application is provided; Figure 2 This is a general architecture diagram of the message body encryption method provided in Example 1 of the present application; Figure 3An interactive diagram of device authentication provided in Example 1 of the present application; Figure 4 A schematic diagram of message communication between an electronic device and a server provided in Embodiment 2 of the present application; Figure 5 This is a schematic diagram of the module structure of a message body encryption device according to an embodiment of the present application; Figure 6 This is a schematic diagram of the module structure of another message body encryption device according to an embodiment of the present application; Figure 7 This is a schematic diagram of the structure of the server involved in the message body encryption method in the embodiment of the present application; Figure 8 It is a structural schematic diagram of the electronic device involved in the message body encryption method in the embodiment of the present application. DETAILED DESCRIPTION

[0020] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0021] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0022] In conventional technology, static keys face the risk of leakage during long-term storage. If the static keys are illegally obtained, the confidentiality of the data is difficult to guarantee even if the communicating parties use encryption technology. Moreover, with the enhancement of computing power and the emergence of new attack methods, the original encryption algorithms may no longer be secure, and the message content between devices and servers may be stolen by third parties, resulting in message leakage. All of these directly lead to an increased probability of data leakage.

[0023] The present application provides a solution, which is applied to a server. First, before communication, the device password is determined according to the device identification sent by the electronic device, and the key string sent by the electronic device is verified by encrypting the device password, thereby ensuring the legitimacy of the electronic device; when the electronic device is authenticated, a session key is dynamically generated according to the received device identification, ensuring that each communication has a unique key, effectively preventing the risk of the session key being reused or stolen, and effectively preventing replay attacks, thereby enhancing the confidentiality of data transmission; then, the session key is encrypted using a preset private key, an encrypted string is generated and sent to the electronic device, and this The process not only protects the secure transmission of session keys, but also uses the uniqueness and confidentiality of private keys to further strengthen the communication link, making it more difficult to be cracked by unauthorized third parties; when the encrypted message body and the first algorithm identifier sent by the electronic device are received, the decryption algorithm is determined according to the algorithm identifier. This flexibility allows the device and the server to use a variety of encryption and decryption algorithms for corresponding encryption and decryption, reducing the possibility of brute force cracking; finally, the encrypted message body is decrypted using the session key and the determined decryption algorithm to restore the original message body, ensuring the integrity and readability of the information during transmission, while reducing the communication failure rate caused by decryption errors.

[0024] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device that can realize the above functions.

[0025] The present embodiment is described below by taking a server as an execution subject as an example.

[0026] Based on this, the embodiment of the present application provides a message body encryption method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the message body encryption method of the present application.

[0027] In this embodiment, the message body encryption method includes steps S10 to S40: Step S10, when the electronic device is authenticated, a session key is generated according to the received device identification; It should be noted that the session key is a key used to encrypt and decrypt message content in a communication session. It can be a random number generated by an algorithm or a hash value calculated based on a device identifier. It is equivalent to a one-time, non-replicable key that is temporarily generated during each communication process.

[0028] For example, when an electronic device attempts to access a server, it first needs to pass an authentication process (such as entering a correct username and password); after authentication, a unique session key is generated based on the unique identifier of the electronic device (device identifier), and the session key is sent to the electronic device for subsequent data encryption and decryption operations.

[0029] It is understandable that by randomly generating a key string, it is ensured that each generated key string is unique, difficult to be cracked and reused, and replay attacks are prevented.

[0030] Step S20, encrypting the session key using a preset private key to obtain an encrypted string, and sending the encrypted string to the electronic device, so that the electronic device uses a preset public key to decrypt the encrypted string to obtain the session key, and uses the session key to encrypt the initial message body to obtain an encrypted message body; In one feasible embodiment, the server uses a private key to encrypt a session key (session key), and then sends the encrypted session key (encrypted string) to the client. The client uses the public key to decrypt to obtain the session key, and uses the session key to encrypt subsequent communication data.

[0031] It should be noted that the public key and private key must be used in pairs and stored in the electronic device and the server respectively before communication; the message body refers to the specific content that the electronic device wants to communicate with the server.

[0032] For example, the server first uses the private key to encrypt the initial temporary session key, and then sends the encrypted result (encrypted string) to the electronic device to prevent the temporary session key from being stolen. After receiving it, the electronic device uses the corresponding public key to decrypt it and obtain the original temporary session key. Then, the temporary session key is used to encrypt the message body to be transmitted to obtain the encrypted message body. Even if the encrypted message body is intercepted or stolen by a third party, it is difficult to be decrypted without knowing the decryption algorithm and key.

[0033] Exemplarily, digital signature technology may also be introduced on the server side to ensure the integrity of the temporary session key transmission, which is also an identity authentication of the server to avoid man-in-the-middle attacks.

[0034] For example, when using a preset private key to encrypt a session key, a set of encryption algorithms can be randomly selected from multiple preset encryption and decryption algorithms or a set of encryption algorithms can be selected according to the user's security requirements; after the encryption is completed, the encrypted string and the algorithm identifier are sent to the electronic device. After receiving the electronic device, the corresponding decryption algorithm is determined according to the algorithm identifier, and then the corresponding decryption algorithm and public key are used to decrypt the encrypted string to obtain the session key. This can avoid the encrypted string being violently cracked due to the long-term use of the same encryption algorithm, resulting in the leakage of the session key, and further reduce the risk of data leakage.

[0035] It can be understood that by using the private key to encrypt and the public key to decrypt, the confidentiality and integrity of the temporary session key during transmission are ensured, ensuring that only authorized entities can obtain the temporary session key information, preventing third parties from stealing messages or impersonating legitimate users, and effectively reducing the possibility of information leakage to unauthorized third parties and identity theft.

[0036] Step S30, upon receiving the encrypted message body and the first algorithm identifier sent by the electronic device, determining a decryption algorithm according to the first algorithm identifier; It should be noted that the algorithm identifier refers to a code or identifier used to identify a specific encryption algorithm or decryption algorithm, and the first algorithm identifier is an identifier used to identify the encryption algorithm used to encrypt the message body; the decryption algorithm corresponds to the above-mentioned encryption algorithm, and refers to the algorithm used to restore the encrypted message body to the original data content.

[0037] Exemplarily, multiple sets of paired encryption algorithms and decryption algorithms are preset in the electronic device and the server, and are stored in association with the corresponding first algorithm identifier. When the electronic device encrypts the message body, it randomly selects an encryption algorithm to encrypt the initial message body, and sends the encrypted message body and the first algorithm identifier to the server. After receiving it, the server can determine the corresponding decryption algorithm according to the first algorithm identifier.

[0038] For example, please refer to Figure 2 , Figure 2 An overall architecture diagram of a message body encryption method is provided, in which a maintenance personnel 300 presets a public key and an encryption / decryption algorithm in the electronic device 100, and presets a private key and the same encryption / decryption algorithm in the server 200; the electronic device 100 and the server 200 can determine the encryption / decryption algorithm used by the other party based on the received algorithm identifier.

[0039] It can be understood that by setting up multiple encryption algorithms, even if one of them is cracked, it will not lead to data leakage of other messages; through the first algorithm identification, it is ensured that only the recipient who matches the correct decryption algorithm can decrypt the message body, reducing the possibility of unauthorized access to sensitive information and data leakage during the communication process.

[0040] Step S40: decrypt the encrypted message body using the decryption algorithm and the session key to obtain the initial message body.

[0041] Exemplarily, after determining the decryption algorithm, the server directly determines the corresponding temporary session key (session key) according to the device identifier, and uses the corresponding decryption algorithm and the temporary session key to decrypt the encrypted message body, thereby obtaining the original, unencrypted message content.

[0042] It can be understood that through the coordinated use of the decryption algorithm and the temporary session key, it is ensured that only the recipient who knows the correct decryption algorithm and the correct key can decrypt the message, ensuring that only the authorized recipient can access and understand the original message, thereby reducing the risk of data leakage and unauthorized access.

[0043] This embodiment provides a message body encryption method, which prevents the temporary session key from being stolen by a third party by using a private key to encrypt the temporary session key; determines the corresponding decryption algorithm through a first algorithm identifier, and even if the encrypted message body is intercepted by a third party, the corresponding decryption algorithm cannot be determined, and the original message content cannot be obtained.

[0044] In a feasible implementation manner, step S20 includes: Step S21, encrypting the session key using the private key and the random number to obtain an encrypted string; It should be noted that random numbers refer to difficult-to-predict one-time data used in the encryption process, such as tiny voltage fluctuations and network delays when computer hardware is running.

[0045] Exemplarily, in a payment scenario, when sending a payment request, the server encrypts the payment information using a private key and a timestamp (random number).

[0046] Step S22, sending the encrypted string and the random number to the electronic device, so that the electronic device uses the public key and the random number to decrypt the encrypted string to obtain the session key.

[0047] Exemplarily, after receiving the encrypted information, the electronic device (such as a payment terminal) uses the public key and random number to decrypt and verify the timestamp to ensure that the payment request is within the valid time. If the request is out of date, the payment terminal will refuse to process it and disconnect.

[0048] Exemplarily, a hash check may be performed on the random number to ensure that the data has not been tampered with during transmission.

[0049] In this implementation, by encrypting the session key and securely transmitting it to the electronic device, it can be ensured that the session key will not be obtained by an unauthorized third party, thereby protecting the confidentiality and integrity of the communication.

[0050] In a feasible implementation manner, before step S10, the method further includes: Step S01, upon receiving a device identification, a first key string, and a second algorithm identification sent by an electronic device, determining a device password according to the device identification; It should be noted that the device password is stored in the server when the electronic device is registered.

[0051] Step S02, determining an encryption algorithm according to the second algorithm identifier, wherein the encryption algorithm is an algorithm used by the electronic device to encrypt the device password; Exemplarily, multiple encryption algorithms are preset in the electronic device and the server. When the electronic device encrypts the device password, it generally randomly selects an encryption algorithm from them. The server can determine which encryption algorithm the electronic device uses through the algorithm identifier for subsequent first key string verification.

[0052] It is understandable that since the encryption algorithm used each time may be different, the encrypted body (first key string) generated each time the same device password is encrypted is different, making it difficult for a third party to brute force the encrypted body, thereby reducing the probability of data leakage during communication between electronic devices and servers.

[0053] Step S03, encrypting the device password using an encryption algorithm to obtain a second key string; Step S04: confirming that the electronic device authentication is successful when the first key string and the second key string are the same.

[0054] Exemplarily, during the authentication process of an electronic device, the server uses an encryption algorithm to encrypt the device password to obtain a second key string, and compares it with the received first key string to confirm the identity of the electronic device. If the two are the same, the electronic device is authenticated as a legitimate user and can communicate with the server.

[0055] For example, please refer to Figure 3 , Figure 3 An interactive schematic diagram of device authentication is provided, specifically: first, the electronic device executes step S101, randomly selects a set of encryption algorithms, encrypts the device password input by the user, and obtains a first key string (S102); then executes step S103, and sends the device identification, the first key string and the algorithm identification to the server; after receiving the device identification, the first key string and the algorithm identification sent by the electronic device, the server executes step S104, retrieves the device password stored in the database according to the device identification, and determines the encryption algorithm selected by the electronic device according to the algorithm identification; then enters step S105, uses the encryption algorithm to encrypt the retrieved device password to obtain a second key string, and compares the first key string with the second key string (S106); if the two are the same, it is confirmed that the electronic device authentication is passed, and the electronic device and the server can communicate subsequently (S107).

[0056] In this embodiment, when an electronic device wishes to authenticate through a device password, an encryption algorithm is used to encrypt the device password, which can effectively prevent the password from being directly stolen or cracked; the server determines the corresponding encryption algorithm through the algorithm identifier, and compares whether the encrypted key string is the same as the received key string to complete the device authentication process, confirming the legitimacy of the device identity, thereby reducing the probability of data leakage and unauthorized access.

[0057] Based on the above first embodiment, a second embodiment of the message body encryption method of the present application is proposed. In this embodiment, the message body encryption method is applied to an electronic device, and the message body encryption method includes: Step A10, upon receiving the encrypted string sent by the server, decrypt the encrypted string using the preset public key to obtain a session key, wherein the session key is generated by the server according to the device identifier, and the encrypted string is obtained by encrypting the session key using the private key of the server; Exemplarily, after receiving the encrypted version of the session key (second key string) sent by the server, the encrypted return key is decrypted using a preset public key to obtain a session key (session key) for subsequent communications.

[0058] It is understandable that by using asymmetric encryption technology, the risk of data leakage during data transmission is reduced, ensuring that only devices holding the correct public key can decrypt and access the data. At the same time, private key encryption is equivalent to a digital signature, preventing the server from denying the information sent.

[0059] Step A20, encrypting the initial message body using the session key to obtain an encrypted message body; It can be understood that the initial message body is encrypted using a session key (session key), which ensures the confidentiality of the initial message body and prevents data leakage.

[0060] Step A30, sending the encrypted message body and the first algorithm identifier to the server, so that the server determines the decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

[0061] Exemplarily, the client encrypts the transaction data using the session key, and sends the encrypted data and the algorithm identifier to the server. The server determines the decryption algorithm according to the algorithm identifier, and decrypts the transaction data using the session key to verify the transaction information.

[0062] For example, to help understand the implementation process of the message body encryption method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 4 , Figure 4A schematic diagram of message communication between an electronic device and a server is provided, specifically: the server first executes step S201, randomly generates a session key according to a device identifier, the session key is randomly generated at the beginning of each session, and is destroyed after the communication ends, so as to ensure that a different session key is used for each communication; then executes step S202, encrypts the generated session key using a preset private key to obtain an encrypted string, and sends the encrypted string to the electronic device (S203); after receiving the encrypted string, the electronic device executes step S204, decrypts the encrypted string using a preset public key, and obtains the session key used for communication encryption; then executes step S205, encrypts an initial message body using the session key to obtain an encrypted message body, and sends each encrypted message body with an algorithm identifier to the server (S206); after receiving the algorithm identifier and the encrypted message body, the server executes step S207, determines a corresponding decryption algorithm according to the algorithm identifier; then executes step S208, decrypts the encrypted message body using the previously generated session key, obtains the initial message body, and stores it.

[0063] In this embodiment, through encrypted communication, the confidentiality and integrity of the initial message body during transmission are ensured, and data leakage and tampering are prevented; by introducing algorithm identification, electronic devices and servers can communicate based on different algorithms, reducing the possibility of the encrypted message body being brute-force cracked, thereby reducing the probability of data leakage during communication.

[0064] In a feasible implementation manner, step A30 includes: Step A31, encapsulate the first algorithm identifier in the flag bit of the message transmission protocol, and send the encrypted message body to the server through the message transmission protocol, so that the server obtains the first algorithm identifier by reading the flag bit of the message transmission protocol.

[0065] It should be noted that the message transmission protocol refers to a set of rules that specify how data is transmitted in the network, including the format and transmission mechanism of the data packet; the flag bit is a bit or field used to indicate specific information in the message transmission protocol, which is used to carry additional information. Message transmission protocols that can embed additional information include but are not limited to AMQP (Advanced Message Queuing Protocol) and MQTT (Message Queuing Telemetry Transport).

[0066] Exemplarily, the encryption algorithm identifier (such as "AES-256") is encapsulated in the header flag of the email protocol, and the encrypted email content is sent to the recipient. The recipient can obtain the encryption algorithm identifier (first algorithm identifier) ​​by reading the flag in the email header and use the corresponding decryption algorithm to decrypt the data.

[0067] It can be understood that by encapsulating the algorithm identifier in the flag bit of the message transmission protocol, the data transmission overhead can be reduced, and at the same time, the risk of the algorithm identifier being tampered with can be reduced, so that the algorithm identifier is protected by the protocol, further reducing the probability of data leakage during the communication process.

[0068] In a feasible implementation manner, before step A20, the method further includes: Step B10, upon receiving the encrypted string and random number sent by the server, use the public key and random number to decrypt the encrypted string to obtain the session key, and execute the steps of encrypting the initial message body using the session key and subsequent steps.

[0069] Exemplarily, according to preset rules between the server (such as taking the last 4 digits of the random number for encryption and decryption), the encrypted session key (encrypted string) is decrypted using the pre-installed public key and the last four digits of the random number to obtain the session key (session key), which is used for subsequent communications.

[0070] Exemplarily, in the subsequent communication process, the message body is encrypted using the session key and the random number to obtain an encrypted message body, and the encryption algorithm identifier is encapsulated in the flag bit of MQTT, and the encrypted message body is sent to the server via MQTT.

[0071] In this implementation, by introducing random numbers and public key encryption technology, the confidentiality and integrity of the session key (session key) during transmission are ensured, preventing man-in-the-middle attacks and key leakage; at the same time, the use of random numbers makes each communication unique, even if an attacker intercepts and cracks the session key, it cannot be reused in subsequent communications.

[0072] In a feasible implementation manner, after step B10, the method further includes: Step B20, when the random number is a timestamp, comparing whether the time interval between the timestamp and the current time exceeds a preset time threshold; It should be noted that the timestamp is a mark of the time when a certain data or event is generated. It is used to verify the timeliness of the data. It is usually a character sequence that can be accurate to the seconds or milliseconds when the event occurs. The current time refers to the current date and time obtained from the system clock or other time source; the time threshold is used to control the validity period of certain operations or data.

[0073] It can be understood that the use of timestamps and preset time threshold interval checks ensures that data is processed within the valid time, prevents outdated data from causing erroneous operations, and ensures the integrity and tamper-resistance of the data.

[0074] Step B30, when the time interval exceeds the time threshold, disconnecting the connection with the server; Step B40: When the time interval does not exceed the time threshold, execute the step of encrypting the initial message body using the session key.

[0075] Exemplarily, after receiving the timestamp sent as a random number, the current date and time are obtained, the difference (time interval) between the timestamp and the current time is calculated, and the calculated time interval is compared with a preset time threshold. If the difference is too large and exceeds the safe time threshold, it is considered that the current information may be outdated and may be tampered with by a third party, and the connection with the server is disconnected to ensure security. If the time difference is within an acceptable range, the current communication continues.

[0076] In this implementation, by verifying the timestamp, it is possible to prevent attackers from using old data packets to attack, thereby ensuring the timeliness of the message and reducing the risk of message leakage during the communication process.

[0077] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the message body encryption method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0078] The present application also provides a message body encryption device, please refer to Figure 5 The message body encryption device is applied to the server, and the device includes: The key generation module 10 is used to generate a session key according to the received device identification when the electronic device is authenticated; The key encryption module 20 is used to encrypt the session key using a preset private key to obtain an encrypted string, and send the encrypted string to the electronic device so that the electronic device decrypts the encrypted string using a preset public key to obtain a session key, and encrypts the initial message body using the session key to obtain an encrypted message body; The algorithm determination module 30 is used to determine a decryption algorithm according to the first algorithm identifier when receiving the encrypted message body and the first algorithm identifier sent by the electronic device; The message body decryption module 40 is used to decrypt the encrypted message body using the decryption algorithm and the session key to obtain the initial message body.

[0079] The message body encryption device provided in the embodiment of the present application adopts the message body encryption method in the above embodiment, which can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the message body encryption device provided by the present application are the same as the beneficial effects of the message body encryption method provided in the above embodiment, and other technical features in the message body encryption device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0080] The present application also provides a message body encryption device, please refer to Figure 6 The message body encryption device is applied to an electronic device, and the device comprises: The key decryption module 50 is used to decrypt the encrypted string using a preset public key to obtain a session key when receiving the encrypted string sent by the server, wherein the session key is generated by the server according to the device identifier, and the encrypted string is obtained by encrypting the session key by the server using a preset private key; A message body encryption module 60, configured to encrypt an initial message body using the session key to obtain an encrypted message body; The message sending module 70 is used to send the encrypted message body and the first algorithm identifier to the server, so that the server determines the decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

[0081] The message body encryption device provided in the embodiment of the present application adopts the message body encryption method in the above embodiment, which can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the message body encryption device provided by the present application are the same as the beneficial effects of the message body encryption method provided in the above embodiment, and other technical features in the message body encryption device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0082] An embodiment of the present application provides a server, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the message body encryption method in the above-mentioned embodiment one.

[0083] Reference below Figure 7, which shows a schematic diagram of the structure of a server suitable for implementing the embodiment of the present application. The server in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions: tablet computers), PMPs (Portable Media Players: portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The server shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0084] like Figure 7 As shown, the server may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which may perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. Various programs and data required for the operation of the server are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems may be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the server to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a server with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0085] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0086] The server provided in the embodiment of the present application adopts the message body encryption method in the above embodiment, which can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the server provided in the present application are the same as the beneficial effects of the message body encryption method provided in the above embodiment, and other technical features in the server are the same as those disclosed in the method of the previous embodiment, which will not be repeated here.

[0087] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0088] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0089] An embodiment of the present application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the message body encryption method in the above-mentioned embodiment one.

[0090] Reference below Figure 8, which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions: tablet computers), PMPs (Portable Media Players: portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0091] like Figure 8 As shown, the electronic device may include a processing device 2001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 2002 or a program loaded from a storage device 2003 to a random access memory (RAM: Random Access Memory) 2004. In RAM2004, various programs and data required for the operation of the electronic device are also stored. The processing device 2001, ROM2002, and RAM2004 are connected to each other through a bus 2005. An input / output (I / O) interface 2006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 2006: an input device 2007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 2008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 2003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 2009. The communication device 2009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0092] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 2003, or installed from a ROM 2002. When the computer program is executed by the processing device 2001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0093] The electronic device provided in the embodiment of the present application adopts the message body encryption method in the above embodiment, which can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the electronic device provided in the present application are the same as the beneficial effects of the message body encryption method provided in the above embodiment, and the other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0094] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0095] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0096] An embodiment of the present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, wherein the computer-readable program instructions are used to execute the message body encryption method in the above-mentioned embodiment.

[0097] The computer-readable storage medium provided in the embodiment of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0098] The computer-readable storage medium may be included in the server and / or the electronic device; or may exist independently without being installed in the server and / or the electronic device.

[0099] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the server, the server: generates a session key according to the received device identification when the electronic device authentication is passed; encrypts the session key using a preset private key to obtain an encrypted string, and sends the encrypted string to the electronic device, so that the electronic device uses a preset public key to decrypt the encrypted string to obtain the session key, and uses the session key to encrypt the initial message body to obtain an encrypted message body; determines the decryption algorithm according to the first algorithm identification when the encrypted message body and the first algorithm identification sent by the electronic device are received; and decrypts the encrypted message body using the decryption algorithm and the session key to obtain the initial message body.

[0100] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: upon receiving an encrypted string sent by a server, uses a preset public key to decrypt the encrypted string to obtain a session key, wherein the session key is generated by the server according to a device identifier, and the encrypted string is obtained by encrypting the session key by the server using a preset private key; uses the session key to encrypt an initial message body to obtain an encrypted message body; sends the encrypted message body and a first algorithm identifier to the server, so that the server determines a decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

[0101] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0104] The readable storage medium provided in the embodiment of the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned message body encryption method, and can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the message body encryption method provided in the above-mentioned embodiment, and will not be repeated here.

[0105] An embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of the message body encryption method as described above when executed by a processor.

[0106] The computer program product provided in the embodiment of the present application can reduce the probability of data leakage during communication. Compared with the prior art, the beneficial effects of the computer program product provided in the present application are the same as the beneficial effects of the message body encryption method provided in the above embodiment, which will not be repeated here.

[0107] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A message body encryption method, characterized in that: The message body encryption method is applied to the server, and the method includes: If the electronic device is authenticated, a session key is generated according to the received device identification; Encrypting the session key using a preset private key to obtain an encrypted string, and sending the encrypted string to the electronic device so that the electronic device decrypts the encrypted string using a preset public key to obtain a session key, and encrypts the initial message body using the session key to obtain an encrypted message body; Upon receiving the encrypted message body and the first algorithm identifier sent by the electronic device, determining a decryption algorithm according to the first algorithm identifier; The encrypted message body is decrypted using the decryption algorithm and the session key to obtain the initial message body.

2. The message body encryption method according to claim 1, characterized in that: The step of encrypting the session key with a preset private key to obtain an encrypted string, and sending the encrypted string to the electronic device comprises: Encrypt the session key using the private key and a random number to obtain an encrypted string; The encrypted string and the random number are sent to the electronic device, so that the electronic device uses the public key and the random number to decrypt the encrypted string to obtain a session key.

3. The message body encryption method according to claim 1, characterized in that: Before the step of generating a session key according to the received device identification, the method further includes: Upon receiving the device identification, the first key string, and the second algorithm identification sent by the electronic device, determining the device password according to the device identification; determining an encryption algorithm according to the second algorithm identifier, wherein the encryption algorithm is an algorithm used by the electronic device to encrypt the device password; Encrypt the device password using the encryption algorithm to obtain a second key string; In a case where the first key string and the second key string are the same, it is confirmed that the electronic device authentication is successful.

4. A message body encryption method, characterized in that: The message body encryption method is applied to electronic equipment, and the method includes: Upon receiving the encrypted string sent by the server, decrypt the encrypted string using a preset public key to obtain a session key, wherein the session key is generated by the server according to the device identifier, and the encrypted string is obtained by encrypting the session key by the server using a preset private key; Encrypt the initial message body using the session key to obtain an encrypted message body; The encrypted message body and the first algorithm identifier are sent to the server, so that the server determines the decryption algorithm according to the first algorithm identifier, and uses the decryption algorithm and the session key to decrypt the encrypted message body to obtain the initial message body.

5. The message body encryption method according to claim 4, characterized in that: The step of sending the encrypted message body and the first algorithm identifier to the server comprises: The first algorithm identifier is encapsulated in a flag bit of a message transmission protocol, and the encrypted message body is sent to the server through the message transmission protocol, so that the server obtains the first algorithm identifier by reading the flag bit of the message transmission protocol.

6. The message body encryption method according to claim 4, characterized in that: Before the step of encrypting the initial message body using the session key, the method further includes: When the encrypted string and the random number sent by the server are received, the encrypted string is decrypted using the public key and the random number to obtain a session key.

7. The message body encryption method according to claim 6, characterized in that: After the step of obtaining the session key, the method further includes: In the case where the random number is a timestamp, comparing whether the time interval between the timestamp and the current time exceeds a preset time threshold; When the time interval exceeds the time threshold, disconnecting the connection with the server; In a case where the time interval does not exceed the time threshold, the steps of encrypting the initial message body using the session key and subsequent steps are performed.

8. A server, characterized in that: The server comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the message body encryption method according to any one of claims 1 to 3.

9. An electronic device, characterized in that: The electronic device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the message body encryption method as described in any one of claims 4 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the message body encryption method according to any one of claims 1 to 7 are implemented.

Images