Data encryption method and device, equipment and medium

Abstract

The invention discloses a data encryption method and device, equipment and a medium, and belongs to the technical field of information security. In the method, terminal equipment sends a first request to proxy equipment; receiving response information returned by the proxy device based on the first request; if the response information comprises the first script program, generating an asymmetric key based on the first script program; the first script program is used for indicating encryption sensitive data; sending a key request including a public key in the asymmetric keys to the proxy device; receiving key information which is sent by the proxy equipment and aims at the key request, and decrypting the key information by using a private key in the asymmetric key to obtain a symmetric key; the key information comprises a symmetric key encrypted by using a public key; and encrypting the sensitive data by using the symmetric key, and sending the encrypted sensitive data to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data encryption method, device, equipment and medium. Background Art

[0002] With the rapid development of Internet technology, under HTTP (HyperText Transfer Protocol), data is transmitted between the client and the server in plain text. However, the data may be intercepted by other users on the shared channel or may be recorded in the log of the network device, causing the data to be exploited by malicious users and causing network security problems.

[0003] In the related technology, the solution is to perform HTTPS (Hypertext Transfer Protocol Secure) transformation, that is, to change the HTTP site to an HTTPS site, rely on the SSL / TLS layer to complete the encryption processing of the entire request response, so that HTTP data can be transmitted in ciphertext on the network.

[0004] However, for web application cleaning service providers, since the source site (client) is not HTTPS, they cannot provide SSL certificates and cannot complete HTTPS transformation. In addition, for self-owned site scenarios, purchasing SSL certificates will also introduce additional costs, which will add a burden.

[0005] Therefore, how to encrypt sensitive data based on HTTP requests and protect the security of network data is an important challenge in security operations. Summary of the invention

[0006] The embodiments of the present application provide a data encryption method, apparatus, device and medium for encrypting sensitive data based on HTTP requests to protect the security of network data.

[0007] In a first aspect, an embodiment of the present application provides a data encryption method, which is applied to a terminal device, and the method includes:

[0008] sending a first request to the proxy device;

[0009] receiving response information returned by the proxy device based on the first request;

[0010] If the response information includes a first script program, an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0011] Sending a key request to the proxy device; the key request includes a public key in the asymmetric key;

[0012] receiving key information for the key request sent by the proxy device, and decrypting the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key;

[0013] The sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

[0014] In some embodiments, the method further comprises:

[0015] If the response information includes a second script program, generating target cache data based on the second script program;

[0016] A first request including the target cache data is sent to the proxy device.

[0017] In some embodiments, decrypting the key information using a private key in the asymmetric key to obtain a symmetric key includes:

[0018] The key information is decrypted using the private key in the asymmetric key to obtain a symmetric key and a serial number corresponding to the symmetric key.

[0019] In some embodiments, the method further comprises:

[0020] Based on the first script program, a random character string is obtained;

[0021] Combining the random string and the symmetric key to obtain a target key;

[0022] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0023] In some embodiments, generating an asymmetric key based on the first script program includes:

[0024] The public encryption interface in the first script program is called, and an asymmetric key generation algorithm is used to generate an asymmetric key.

[0025] In some embodiments, the method further comprises:

[0026] Receive request information sent by the proxy device when detecting that usage information of the symmetric key exceeds a preset threshold; the request information is used to instruct the terminal device to update the symmetric key.

[0027] In some embodiments, the usage information of the symmetric key exceeds a preset threshold, including:

[0028] The usage time of the symmetric key is greater than a preset time threshold; and\or,

[0029] The number of times the symmetric key is used is greater than a preset number threshold; and\or,

[0030] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0031] In a second aspect, an embodiment of the present application provides a data encryption method, which is applied to a proxy device, and the method includes:

[0032] Receiving a first request sent by a terminal device;

[0033] If it is determined that the first request includes cached data, a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0034] receiving a key request sent by the terminal device, and sending key information for the key request to the terminal device; the key request includes a public key in an asymmetric key; the key information includes a symmetric key encrypted using the public key;

[0035] The encrypted sensitive data is received, and the encrypted sensitive data is decrypted according to the symmetric key, and the decrypted sensitive data is forwarded to the server.

[0036] In some embodiments, the method further comprises:

[0037] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, sending a second response message to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send the first request including the target cached data;

[0038] A first request including the target cache data is received and sent by the terminal device.

[0039] In some embodiments, the sending key information for the key request to the terminal device includes:

[0040] Based on the key request, randomly generate a symmetric key and a number corresponding to the symmetric key;

[0041] Using the public key in the asymmetric key, encrypt the symmetric key and the serial number corresponding to the symmetric key to obtain the key information;

[0042] The key information is sent to the terminal device.

[0043] In some embodiments, the method further comprises:

[0044] If it is detected that the usage information of the symmetric key exceeds a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0045] In some embodiments, the usage information of the symmetric key exceeds a preset threshold, including:

[0046] The usage time of the symmetric key is greater than a preset time threshold; and\or,

[0047] The number of times the symmetric key is used is greater than a preset number threshold; and\or,

[0048] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0049] In a third aspect, an embodiment of the present application provides a data encryption device, applied to a terminal device, the device comprising:

[0050] A first sending module, used for sending a first request to a proxy device;

[0051] A first receiving module, configured to receive response information returned by the proxy device based on the first request;

[0052] An operation module, configured to generate an asymmetric key based on a first script program if the response information includes the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0053] The first sending module is further used to send a key request to the proxy device; the key request includes a public key in the asymmetric key;

[0054] A first decryption module, configured to receive key information for the key request sent by the proxy device, and decrypt the key information using a private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key;

[0055] The first encryption module is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

[0056] In some embodiments, the operation module is further used to:

[0057] If the response information includes a second script program, generating target cache data based on the second script program;

[0058] The first sending module is further configured to send a first request including the target cache data to the proxy device.

[0059] In some embodiments, the first decryption module is specifically used to:

[0060] The key information is decrypted using the private key in the asymmetric key to obtain a symmetric key and a serial number corresponding to the symmetric key.

[0061] In some embodiments, the first encryption module is further used to:

[0062] Based on the first script program, a random character string is obtained;

[0063] Combining the random string and the symmetric key to obtain a target key;

[0064] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0065] In some embodiments, the operation module is specifically used to:

[0066] The public encryption interface in the first script program is called, and an asymmetric key generation algorithm is used to generate an asymmetric key.

[0067] In some embodiments, the first receiving module is further configured to:

[0068] Receive request information sent by the proxy device when detecting that usage information of the symmetric key exceeds a preset threshold; the request information is used to instruct the terminal device to update the symmetric key.

[0069] In a fourth aspect, an embodiment of the present application provides a data encryption device, which is applied to a proxy device, and the device includes:

[0070] A second receiving module, used to receive a first request sent by a terminal device;

[0071] A second sending module, configured to send a first response message to the terminal device if it is determined that the first request includes cached data; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0072] A second encryption module, used to receive a key request sent by the terminal device, and send key information for the key request to the terminal device; the key request includes a public key in an asymmetric key; the key information includes a symmetric key encrypted using the public key;

[0073] The second decryption module is used to receive the encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

[0074] In some embodiments, the second sending module is further used to:

[0075] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, sending a second response message to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send the first request including the target cached data;

[0076] The second receiving module is further configured to receive a first request including the target cache data and sent by the terminal device.

[0077] In some embodiments, the second encryption module is specifically used to:

[0078] Based on the key request, randomly generate a symmetric key and a number corresponding to the symmetric key;

[0079] Using the public key in the asymmetric key, encrypt the symmetric key and the serial number corresponding to the symmetric key to obtain the key information;

[0080] The key information is sent to the terminal device.

[0081] In some embodiments, the second sending module is further used to:

[0082] If it is detected that the usage information of the symmetric key exceeds a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0083] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0084] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data encryption method described in the first aspect or the second aspect above.

[0085] In a sixth aspect, an embodiment of the present application provides a computer storage medium. When a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can execute the data encryption method described in the first aspect or the second aspect above.

[0086] The method provided in the embodiment of the present application has the following beneficial effects:

[0087] In the embodiment of the present application, after determining that the page request sent by the terminal device is a replay request, that is, after determining that the page request includes a valid cache data cookie, the proxy device inserts a first script program in the response information of the target type returned by the server, and sends it to the terminal device; the first script program is used to indicate the encryption of sensitive data; the terminal device first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the proxy device to request a symmetric key. The proxy device encrypts the symmetric key with the public key and sends it to the terminal device. The terminal device then decrypts the sensitive data with the private key and uses the symmetric key to encrypt the sensitive data and sends it to the proxy device. Finally, the proxy device decrypts the sensitive data and sends it to the server.

[0088] Therefore, the symmetric key is first encrypted with an asymmetric key to avoid leakage of the symmetric key during transportation, and then the sensitive data is encrypted with the symmetric key to avoid leakage of sensitive data. Compared with using only asymmetric keys or only symmetric keys to encrypt sensitive data, the security of sensitive data is higher, the risk of symmetric keys being cracked is reduced, and the security of network data is protected.

[0089] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0091] Figure 1 A schematic diagram of an application scenario of a data encryption method provided in an embodiment of the present application;

[0092] Figure 2 A schematic diagram of another application scenario of a data encryption method provided in an embodiment of the present application;

[0093] Figure 3 A schematic diagram of another application scenario of a data encryption method provided in an embodiment of the present application;

[0094] Figure 4 A schematic diagram of a data encryption method provided in an embodiment of the present application;

[0095] Figure 5 A schematic diagram of an encrypted data interaction provided in an embodiment of the present application;

[0096] Figure 6 A schematic diagram of a flow chart of another data encryption method provided in an embodiment of the present application;

[0097] Figure 7 A schematic diagram of the interaction of key information provided in an embodiment of the present application;

[0098] Figure 8 An interactive schematic diagram of a data encryption method provided in an embodiment of the present application;

[0099] Fig. 9 A schematic diagram of a redirection interaction provided in an embodiment of the present application;

[0100] Fig.10 A schematic diagram of recording and monitoring the usage of a symmetric key provided in an embodiment of the present application;

[0101] Fig.11 A schematic diagram of the structure of a data encryption device provided in an embodiment of the present application;

[0102] Fig.12 A schematic diagram of the structure of another data encryption device provided in an embodiment of the present application;

[0103] Fig.13 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0104] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0105] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0106] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more.

[0107] In order to facilitate understanding of a data encryption method provided in an embodiment of the present application, some terms appearing in the present application are explained below.

[0108] HTTP (HyperText Transfer Protocol): The basic protocol of Web services, the request and response format of clients and servers. The headers of request and response messages are given in ASCII format; while the message content has a MIME-like format.

[0109] HTTPS (Hypertext Transfer Protocol Secure): HTTP running on the SSL / TLS protocol. The SSL / TLS layer provides encryption and decryption functions, allowing HTTP data to be transmitted in ciphertext over the network.

[0110] JS (JavaScript): A programming language, often used as a scripting language for web pages.

[0111] Cookie: Data (usually encrypted) stored on the user's local terminal in order to identify the user. Information temporarily or permanently saved by the user's client computer. Generally speaking, it refers to cached data, including user names, passwords, registered accounts, mobile phone numbers and other personal information of citizens.

[0112] HTML (Hyper Text Markup Language): A markup language that includes a series of tags that can be used to unify the document format on the Internet and display scattered Internet resources as a logical whole.

[0113] With the rapid development of Internet technology, data is transmitted between the client and the server in plain text under HTTP (HyperText Transfer Protocol).

[0114] However, the data may be intercepted by other users on the shared channel, or may be recorded in the log of the network device, which may cause the data to be exploited by malicious users and cause network security problems.

[0115] In the related technology, the solution is to perform HTTPS (Hypertext Transfer Protocol Secure) transformation, that is, to change the HTTP site to an HTTPS site, rely on the SSL / TLS layer to complete the encryption processing of the entire request response, so that HTTP data can be transmitted in ciphertext on the network.

[0116] However, for web application cleaning service providers, since the source site (client) is not HTTPS, they cannot provide SSL certificates and cannot complete HTTPS transformation. In addition, for self-owned site scenarios, purchasing SSL certificates will also introduce additional costs, which will add a burden.

[0117] Therefore, how to encrypt sensitive data based on HTTP requests and protect the security of network data is an important challenge in security operations.

[0118] In view of this, embodiments of the present application provide a data encryption method, apparatus, device and medium for encrypting sensitive data based on HTTP requests to protect the security of network data.

[0119] The inventive concept of the embodiment of the present application: in the embodiment of the present application, after determining that the page request sent by the terminal device is a replay request, that is, after determining that the page request includes a valid cache data cookie, the proxy device inserts a first script program in the response information of the target type returned by the server, and sends it to the terminal device; the first script program is used to indicate the encryption of sensitive data; the terminal device first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the proxy device to request a symmetric key, the proxy device uses the public key to encrypt the symmetric key and sends it to the terminal device, and then the terminal device uses the private key to decrypt and uses the symmetric key to encrypt the sensitive data and send it to the proxy device, and finally the proxy device decrypts the sensitive data and sends it to the server.

[0120] First use an asymmetric key to encrypt the symmetric key to avoid leakage of the symmetric key during transportation, and then use the symmetric key to encrypt sensitive data to avoid leakage of sensitive data. Compared with using only asymmetric keys or only symmetric keys to encrypt sensitive data, the security of sensitive data is higher, the risk of symmetric keys being cracked is reduced, and the security of network data is protected.

[0121] After introducing the main inventive concept of the embodiment of the present application, an application scenario of a data encryption method provided by the embodiment of the present application is introduced below in conjunction with the accompanying drawings.

[0122] like Figure 1 The figure is a schematic diagram of an application scenario of a data encryption method provided in an embodiment of the present application. Figure 1 The system includes a terminal device 110, a Web proxy device 120 and a Web server 130.

[0123] A data encryption method provided in an embodiment of the present application is used in the scenario of Web application protection. For applications using HTTP, since they do not have the SSL layer of HTTPS for encryption, the interactive data between the terminal device and the server is transmitted in plain text, and sensitive data is easily captured.

[0124] By applying a data encryption method provided in an embodiment of the present application to the Web proxy device 120 of the Web server 130 and the terminal device 110, hiding of HTTP sensitive data can be achieved.

[0125] Among them, the terminal device 110 sends a first request to the Web proxy device 120; if the Web proxy device 120 determines that the first request includes the cache data Cookie, it sends a first response information to the terminal device 110; the first response information includes the sub-response information and the first script program returned by the Web server 130 for the target type of the first request; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0126] Then, the terminal device 110 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the Web proxy device 120 to request a symmetric key;

[0127] After the Web proxy device 120 randomly generates a symmetric key, it uses the public key to encrypt the symmetric key and sends it to the terminal device 110. The terminal device 110 then uses the private key in the asymmetric key to decrypt it to obtain the symmetric key. The terminal device 110 then uses the symmetric key to encrypt the sensitive data and sends the encrypted sensitive data to the Web proxy device 120. Finally, the Web proxy device 120 uses the symmetric key to decrypt the sensitive data and sends it to the Web server 130.

[0128] Among them, the terminal device 110 and the Web proxy device 120, as well as the Web proxy device 120 and the Web server 130 can communicate, and the communication method can be to use wired communication technology for communication, such as communicating by connecting a network cable or a serial port cable; or to use wireless communication technology for communication, for example, communicating through Bluetooth or WIFI and other technologies, without specific limitation.

[0129] like Figure 2 , which is a schematic diagram of another application scenario of a data encryption method provided in an embodiment of the present application. Figure 2 It includes a terminal device 210, a Web application firewall (proxy device) 220 and a Web server 230.

[0130] In the case where a third party provides security services, for the Web security service provider, adding this function to the terminal device 210 and the Web application firewall (proxy device) 220 can provide further protection for the customer's sensitive information without the need for an SSL certificate.

[0131] Among them, the terminal device 210 sends a first request to the Web application firewall (proxy device) 220; if the Web application firewall (proxy device) 220 determines that the first request includes the cache data Cookie, it sends a first response information to the terminal device 210; the first response information includes the sub-response information and the first script program returned by the Web server 230 for the target type of the first request; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0132] Then, the terminal device 210 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the Web application firewall (proxy device) 220 to request a symmetric key;

[0133] After the Web application firewall (proxy device) 220 randomly generates a symmetric key, it uses the public key to encrypt the symmetric key and sends it to the terminal device 210. The terminal device 210 then uses the private key in the asymmetric key to decrypt it to obtain the symmetric key. The terminal device 210 then uses the symmetric key to encrypt the sensitive data and sends the encrypted sensitive data to the Web application firewall (proxy device) 220. Finally, the Web application firewall (proxy device) 220 uses the symmetric key to decrypt the sensitive data and sends it to the Web server 230.

[0134] Among them, the terminal device 210 and the Web application firewall (proxy device) 220, as well as the Web application firewall (proxy device) 220 and the Web server 230 can communicate, and the communication method can be to use wired communication technology for communication, such as communicating by connecting a network cable or a serial port cable; or to use wireless communication technology for communication, for example, communicating through technologies such as Bluetooth or WIFI, etc., without specific restrictions.

[0135] like Figure 3 , which is a schematic diagram of another application scenario of a data encryption method provided in an embodiment of the present application. Figure 3 It includes a terminal device 310, an existing proxy device 320 and a Web server 330.

[0136] In the case of own sites, for Web security service providers, a proxy device is originally set up in front of the Web server. The existing proxy device 320 can be modified to add this function to the terminal device 310 and the existing proxy device 320. Then, the original Web server 330 does not need to be modified, providing further protection for the customer's sensitive information without the need for an SSL certificate.

[0137] Among them, the terminal device 310 sends a first request to the existing proxy device 320; if the existing proxy device 320 determines that the first request includes the cache data Cookie, it sends a first response information to the terminal device 310; the first response information includes the sub-response information and the first script program returned by the Web server 330 for the target type of the first request; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0138] Then, the terminal device 310 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the existing proxy device 320 to request a symmetric key;

[0139] After the existing proxy device 320 randomly generates a symmetric key, it uses the public key to encrypt the symmetric key and sends it to the terminal device 310. Then the terminal device 310 uses the private key in the asymmetric key to decrypt and obtain the symmetric key. After that, the terminal device 310 uses the symmetric key to encrypt the sensitive data and sends the encrypted sensitive data to the existing proxy device 320. Finally, the existing proxy device 320 uses the symmetric key to decrypt the sensitive data and sends it to the Web server 330.

[0140] Among them, the terminal device 310 and the existing proxy device 320, as well as the existing proxy device 320 and the Web server 330 can communicate, and the communication method can be to use wired communication technology for communication, such as communicating by connecting a network cable or a serial port cable; or to use wireless communication technology for communication, for example, communicating through Bluetooth or WIFI and other technologies, without specific limitation.

[0141] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.

[0142] See also Figure 4 , is a flow chart of a data encryption method provided in an embodiment of the present application. The method is applied in a terminal device, including: Figure 4 Steps shown:

[0143] In step 401, a first request is sent to a proxy device.

[0144] In step 402, response information returned by the proxy device based on the first request is received.

[0145] In step 403, if the response information includes a first script program, an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0146] In some embodiments, if the response information includes a second script program, target cache data is generated based on the second script program; and a first request including the target cache data is sent to the proxy device.

[0147] Among them, generating an asymmetric key based on the first script program can be executed as follows: calling a public encryption interface in the first script program and using an asymmetric key generation algorithm to generate an asymmetric key.

[0148] In step 404, a key request is sent to the proxy device; the key request includes a public key in the asymmetric key.

[0149] In step 405, key information for the key request sent by the proxy device is received, and the key information is decrypted using the private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key.

[0150] In some embodiments, the key information is decrypted using the private key in the asymmetric key to obtain the symmetric key, which can be specifically performed as follows:

[0151] Use the private key in the asymmetric key to decrypt the key information and obtain the symmetric key and the number corresponding to the symmetric key.

[0152] In step 406, the sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

[0153] Furthermore, in the present application, after the terminal device uses a symmetric key to encrypt the sensitive data, the encrypted sensitive data and the number corresponding to the symmetric key are sent to the proxy device. After receiving the encrypted sensitive data and the number corresponding to the symmetric key, the proxy device determines the symmetric key required for decrypting the encrypted sensitive data from a pre-stored symmetric key set according to the number corresponding to the symmetric key, and then uses the symmetric key required for decrypting the encrypted sensitive data to decrypt the encrypted sensitive data.

[0154] The pre-stored symmetric key set includes a symmetric key and a number corresponding to the symmetric key. The pre-stored symmetric key set can be a series of symmetric keys generated by the proxy device during initialization, and each symmetric key is numbered, or it can be generated when the symmetric key is used, and only the recently used keys and numbers need to be recorded. The embodiment of the present application does not limit the generation method of the symmetric key set.

[0155] Sensitive data includes, but is not limited to, sensitive information in asynchronous requests based on AJAX or Fetch.

[0156] Unlike HTTPS which encrypts the entire request data, in the embodiment of the present application, only a small portion of the requested sensitive data is encrypted, so the probability that the ciphertext of the same plaintext is the same after encryption is greatly increased.

[0157] Furthermore, in order to increase the security of data, in the embodiment of the present application, a one-time one-key method can also be used to ensure that the ciphertext obtained each time is different, which can be specifically implemented as follows:

[0158] Based on the first script program, a random string is obtained;

[0159] Combine the random string and the symmetric key to obtain the target key;

[0160] The sensitive data is encrypted using the target key and sent to the proxy device.

[0161] like Figure 5As shown, the terminal device generates a random string yxa@ based on the first script program, then combines the random string yxa@ and the symmetric key to obtain a target key, and uses the target key to encrypt the sensitive data; then sends the random string yxa@, the encrypted sensitive data and the number 001 corresponding to the symmetric key to the proxy device.

[0162] After receiving the HTTP request data, the proxy device obtains the random string yxa@ and the number corresponding to the symmetric key, and then determines the symmetric key required to decrypt the encrypted sensitive data in the pre-stored symmetric key set according to the number corresponding to the symmetric key, and then combines the random string yxa@ and the symmetric key to obtain the target key, and uses the target key to decrypt the encrypted sensitive data.

[0163] In some embodiments, in order to increase the difficulty of decryption, the symmetric key may also be updated regularly, which is specifically implemented as follows:

[0164] The request information sent by the receiving proxy device when detecting that the usage information of the symmetric key exceeds a preset threshold value; the request information is used to instruct the terminal device to update the symmetric key.

[0165] The usage information of the symmetric key exceeds the preset threshold, including:

[0166] The usage time of the symmetric key is greater than the preset time threshold; and\or,

[0167] The number of times the symmetric key is used is greater than a preset number threshold; and\or,

[0168] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0169] See also Figure 6 , is a flow chart of a data encryption method provided in an embodiment of the present application. The method is applied in a proxy device, including: Figure 6 Steps shown:

[0170] In step 601, a first request sent by a terminal device is received.

[0171] In step 602, if it is determined that the first request includes cached data, a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0172] In some embodiments, if it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data; and the first request including the target cached data sent by the terminal device is received.

[0173] Among them, cached data is cookies.

[0174] It should be noted that since cookies are shared between different browser tabs (and each tab corresponds to an instance in JS), the key used to encrypt cookies is different from the key used to encrypt sensitive data. Therefore, the proxy device will add the key index information to the browser by setting a new cookie. This index corresponds to the cookie key in JS.

[0175] The terminal device can obtain the key corresponding to the cookie according to the index information, thereby encrypting the cookie. After obtaining the first request, the proxy device first uses the cookie key to decrypt the cookie, and then determines whether the cookie exists in the first request and whether the cookie timestamp is valid.

[0176] In step 603, a key request sent by the terminal device is received, and key information for the key request is sent to the terminal device; the key request includes a public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key.

[0177] In some embodiments, sending key information for a key request to a terminal device may be performed as follows:

[0178] Based on the key request, a symmetric key and a number corresponding to the symmetric key are randomly generated;

[0179] Use the public key in the asymmetric key to encrypt the symmetric key and the number corresponding to the symmetric key to obtain key information;

[0180] Send the key information to the terminal device.

[0181] like Figure 7 As shown, after receiving the key request, the proxy device randomly generates a symmetric key "Key1" and a number 001 corresponding to the symmetric key from the pre-stored symmetric key set, and then encrypts the symmetric key and the number corresponding to the symmetric key using the public key in the asymmetric key, and sends them to the terminal device through a function code. After receiving the encrypted key information, the terminal device uses the private key in the asymmetric key to decrypt the key information and obtain the symmetric key and the number corresponding to the symmetric key.

[0182] Among them, the pre-stored symmetric key set can be a series of symmetric keys generated by the proxy device during initialization, and each symmetric key is numbered, or it can be generated when the symmetric key is used, and only the recently used keys and numbers need to be recorded. The embodiment of the present application does not limit the way the symmetric key set is generated.

[0183] In step 604, the encrypted sensitive data is received, and the encrypted sensitive data is decrypted according to the symmetric key, and the decrypted sensitive data is forwarded to the server.

[0184] In order to facilitate understanding of a data encryption method provided in an embodiment of the present application, Figure 8 A schematic diagram of the interaction between devices is provided. Figure 8 As shown, a data encryption method provided in an embodiment of the present application includes the following steps:

[0185] In step 801, the terminal device sends a first request to the proxy device.

[0186] In step 802, the proxy device detects the first request and determines whether the first request includes a cookie;

[0187] If the proxy device determines that the first request does not include a cookie, or the timestamp of the cookie in the first request is invalid, step 803 is executed;

[0188] If the proxy device determines that the first request includes Cookie, step 805 is directly executed.

[0189] In step 803, the proxy device sends a second response message including a second script program to the terminal device.

[0190] The second script program is used to instruct the terminal device to generate a Cookie and send a first request including the Cookie.

[0191] In specific implementation, since the first request sent by the terminal device does not include Cookie, or the timestamp of Cookie in the first request is invalid, the proxy device rejects the request and sends the error page script including the second script program to the terminal device.

[0192] It should be noted that once the browser page is refreshed, the JS script program will exit execution; therefore, two JS script programs will be used in the embodiment of the present application. The second script program (hereinafter referred to as JS2) is used to generate cookies and refresh the page (re-send the first request to the proxy device); the first script program (hereinafter referred to as JS1) is used to instruct the terminal device to encrypt sensitive data and regularly update the timestamp in the cookie, but does not actively refresh the page.

[0193] In step 804, the terminal device generates a cookie based on the second script program, and sends a first request including the cookie to the proxy device.

[0194] In specific implementation, after receiving the second response information, the terminal device will parse the script of the HTML error page, automatically download and run the second script program, generate a cookie, and then refresh the page. The refresh page will send the first request including the cookie to the proxy device.

[0195] In step 805, the proxy device sends a first request including a Cookie to the server.

[0196] In step 806, the server sends sub-response information of the target type for the first request including Cookie to the proxy device.

[0197] In step 807, the proxy device sends a first response message to the terminal device.

[0198] The first response information includes sub-response information of the target type for the first request and a first script program sent by the server; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0199] It should be noted that after receiving the sub-response information sent by the server for the first request, the proxy device first needs to determine whether the sub-response information is of the target type.

[0200] If the sub-response information is of the target type, the first script program JS1 is inserted into the sub-response information to generate the first response information and send it to the terminal device; if the sub-response information is not of the target type, the sub-response information is directly sent to the terminal device.

[0201] The target type is HTML.

[0202] In step 808, the terminal device generates an asymmetric key based on the first script program in the first response information, and sends a key request including the public key in the asymmetric key to the proxy device.

[0203] In step 809, the proxy device receives the key request sent by the terminal device, and sends key information corresponding to the key request to the terminal device; the key information includes a symmetric key encrypted by a public key.

[0204] In step 810, the terminal device receives the key information sent by the proxy device, and uses the private key in the asymmetric key to decrypt the key information to obtain a symmetric key; uses the symmetric key to encrypt the sensitive data, and sends the encrypted sensitive data to the proxy device.

[0205] In step 811, the proxy device decrypts the encrypted sensitive data according to the symmetric key.

[0206] In step 812, the proxy device sends the decrypted sensitive data to the server.

[0207] After the proxy device obtains the response information of the server for sensitive data, if the type of the response information is the target type, the proxy device may also insert the first script program into the response information for sensitive data before sending it to the terminal device.

[0208] It should be noted that in the embodiments of the present application, there may be situations where sensitive data is invalid: one is that the cache data cookie is missing or invalid; the other is that the sensitive data decryption fails.

[0209] For situations where cached data cookies are missing or invalid:

[0210] In the embodiment of the present application, the proxy device will reject the request and send a response message including the second script program to the terminal device. The terminal device updates the cookie based on the second script program and sends a request including the updated cookie to the proxy device.

[0211] In case of failure to decrypt sensitive data:

[0212] The request may be forged or the configuration information on the proxy device may be changed. Therefore, in the embodiment of the present application, the proxy device may renegotiate the symmetric key and configuration information with the terminal device.

[0213] Specifically, the proxy device and the terminal device renegotiate the symmetric key and configuration information, which can be implemented as follows: Fig. 9 Steps shown:

[0214] In step 901, if the sensitive data decryption fails, the proxy device sets a special response header and sends it to the terminal device.

[0215] The special response header is randomly set by the developer according to the needs, and the embodiment of the present application does not limit this. The special response header instructs the terminal device to redirect.

[0216] In step 902, when the terminal device generates an asymmetric key based on the first script program, if a special response header is found, a second request is sent to the proxy device, where the second request is used to request configuration information required for redirection.

[0217] In step 903, the proxy device adds the configuration information required for redirection to the first script program in the form of parameters, and sends it to the terminal device.

[0218] The configuration information includes, but is not limited to, URI (Uniform Resource Identifier), method, parameter and other information.

[0219] In step 904, the terminal device re-requests the first script program from the proxy device based on the parameter.

[0220] In step 905, the proxy device sends the re-requested first script program to the terminal device.

[0221] The re-requested first script program includes the renegotiated symmetric key or configuration information.

[0222] In step 906, the terminal device redirects based on the re-requested first script program.

[0223] In some embodiments, in order to increase the difficulty of decryption, the symmetric key may be updated regularly, which may be specifically implemented as follows:

[0224] The proxy device monitors the usage of the symmetric key. If it detects that the usage information of the symmetric key exceeds a preset threshold, it sends a request message to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0225] The usage information of the symmetric key exceeds the preset threshold, including:

[0226] The usage time of the symmetric key is greater than the preset time threshold; and\or,

[0227] The number of times the symmetric key is used is greater than a preset number threshold; and\or,

[0228] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0229] In specific implementation, the proxy device can use cookies as indexes to record and monitor the use of symmetric keys. Fig.10As shown, in the request sent by the terminal device, the cookie information is uid=1234, then the proxy device can record and monitor the usage of the symmetric key by using uid=1234 as the index: the number (MasterkeyID) of the symmetric key corresponding to uid=1234 is 001, the usage time (UseTime) is 171229 seconds, the number of uses (Requests) is 5 times, and the random symmetric key (Random) is r1, r2, ..., rn, etc. Then the proxy device can determine the usage of the symmetric key. If the usage information of the symmetric key exceeds the preset threshold, the proxy device intercepts the current request and forces the terminal device to refresh the original HTML and update the symmetric key.

[0230] It should be noted that, except for the case where the usage information of the above-mentioned symmetric key exceeds the preset threshold, if the terminal device visits the page for the first time or refreshes the page for the first time, the symmetric key needs to be updated.

[0231] Based on the foregoing description, after determining that the page request sent by the terminal device is a replay request, that is, after determining that the page request includes a valid cache data cookie, the proxy device inserts the first script program in the response information of the target type returned by the server, and sends it to the terminal device; the first script program is used to indicate the encryption of sensitive data; the terminal device first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the proxy device to request a symmetric key. The proxy device uses the public key to encrypt the symmetric key and sends it to the terminal device. The terminal device then uses the private key to decrypt the sensitive data and uses the symmetric key to encrypt the sensitive data and send it to the proxy device. Finally, the proxy device decrypts the sensitive data and sends it to the server.

[0232] Therefore, the symmetric key is first encrypted with an asymmetric key to avoid leakage of the symmetric key during transportation, and then the sensitive data is encrypted with the symmetric key to avoid leakage of sensitive data. Compared with using only asymmetric keys or only symmetric keys to encrypt sensitive data, the security of sensitive data is higher, the risk of symmetric keys being cracked is reduced, and the security of network data is protected.

[0233] Based on the same technical concept as the above-mentioned data encryption method, the embodiment of the present application also provides a data encryption device. The principle of solving the problem by the data encryption device is similar to that of the above-mentioned data encryption method. Therefore, the implementation of the data encryption device can refer to the implementation of the data encryption method, and the repeated parts will not be repeated.

[0234] Fig.11A schematic diagram of the structure of a data encryption device provided in an embodiment of the present application, which is applied to a terminal device, includes a first sending module 1101, a first receiving module 1102, an operation module 1103, a first decryption module 1104 and a first encryption module 1105, wherein:

[0235] A first sending module 1101, configured to send a first request to a proxy device;

[0236] A first receiving module 1102, configured to receive response information returned by the proxy device based on the first request;

[0237] The running module 1103 is used to generate an asymmetric key based on a first script program if the response information includes the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0238] The first sending module 1101 is further used to send a key request to the proxy device; the key request includes the public key in the asymmetric key;

[0239] A first decryption module 1104 is configured to receive key information for the key request sent by the proxy device, and decrypt the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key;

[0240] The first encryption module 1105 is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

[0241] In some embodiments, the operation module 1103 is further used to:

[0242] If the response information includes a second script program, generating target cache data based on the second script program;

[0243] The first sending module 1101 is further configured to send a first request including the target cache data to the proxy device.

[0244] In some embodiments, the first decryption module 1104 is specifically configured to:

[0245] The key information is decrypted using the private key in the asymmetric key to obtain the symmetric key and the serial number corresponding to the symmetric key.

[0246] In some embodiments, the first encryption module 1105 is further configured to:

[0247] Based on the first script program, a random character string is obtained;

[0248] Combining the random string and the symmetric key to obtain a target key;

[0249] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0250] In some embodiments, the operation module 1103 is specifically used to:

[0251] The public encryption interface in the first script program is called, and an asymmetric key generation algorithm is used to generate an asymmetric key.

[0252] In some embodiments, the first receiving module 1102 is further configured to:

[0253] Receive request information sent by the proxy device when detecting that usage information of the symmetric key exceeds a preset threshold; the request information is used to instruct the terminal device to update the symmetric key.

[0254] Fig.12 A schematic diagram of the structure of a data encryption device provided in an embodiment of the present application, the device is applied to a proxy device, including a second receiving module 1201, a second sending module 1202, a second encryption module 1203 and a second decryption module 1204, wherein:

[0255] The second receiving module 1201 is used to receive a first request sent by a terminal device;

[0256] The second sending module 1202 is used to send a first response message to the terminal device if it is determined that the first request includes cached data; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0257] The second encryption module 1203 is used to receive a key request sent by the terminal device, and send key information for the key request to the terminal device; the key request includes a public key in an asymmetric key; the key information includes a symmetric key encrypted using the public key;

[0258] The second decryption module 1204 is used to receive the encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

[0259] In some embodiments, the second sending module 1202 is further configured to:

[0260] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, sending a second response message to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send the first request including the target cached data;

[0261] The second receiving module 1201 is further configured to receive a first request including the target cache data sent by the terminal device.

[0262] In some embodiments, the second encryption module 1203 is specifically used to:

[0263] Based on the key request, randomly generate a symmetric key and a number corresponding to the symmetric key;

[0264] Using the public key in the asymmetric key, encrypt the symmetric key and the serial number corresponding to the symmetric key to obtain the key information;

[0265] The key information is sent to the terminal device.

[0266] In some embodiments, the second sending module 1202 is further configured to:

[0267] If it is detected that the usage information of the symmetric key exceeds a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0268] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated into a processor, or may exist physically alone, or two or more modules may be integrated into one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0269] After introducing a data encryption method and device according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0270] Refer to the following Fig.13 To describe the electronic device 1300 implemented according to this embodiment of the present application. Fig.13 The electronic device 1300 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0271] like Fig.13 As shown, the electronic device 1300 is in the form of a general electronic device. The components of the electronic device 1300 may include but are not limited to: at least one processor 1301, at least one memory 1302, and a bus 1303 connecting different system components (including the memory 1302 and the processor 1301).

[0272] Among them, at least one memory 1302 stores a computer program that can be executed by at least one processor 1301. When the computer program is executed by at least one processor 1301, the at least one processor 1301 can perform the steps of any data encryption method provided in the embodiments of the present application.

[0273] Bus 1303 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0274] The memory 1302 may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0275] Memory 1302 may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0276] The electronic device 1300 may also communicate with one or more external devices 1304 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1300, and / or communicate with any device that enables the electronic device 1300 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1305. Furthermore, the electronic device 1300 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1306. As shown, the network adapter 1306 communicates with other modules for the electronic device 1300 via a bus 1303. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1300, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0277] In an exemplary embodiment, a computer storage medium is also provided, and when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above data encryption methods. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0278] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement the steps of any data encryption method provided in the present application.

[0279] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0280] The program product for device discovery in the embodiment of the present application may adopt a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0281] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0282] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0283] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0284] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0285] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0286] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0287] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0288] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0289] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0290] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0291] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A data encryption method, characterized in that: Applied to a terminal device, the method comprises: sending a first request to a proxy device; receiving response information returned by the proxy device based on the first request; If the response information includes a first script program, an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; Sending a key request to the proxy device; the key request includes a public key in the asymmetric key; receiving key information for the key request sent by the proxy device, and decrypting the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key; The sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

2. The method according to claim 1, characterized in that The method further comprises: If the response information includes a second script program, generating target cache data based on the second script program; A first request including the target cache data is sent to the proxy device.

3. The method according to claim 1, characterized in that The using the private key in the asymmetric key to decrypt the key information to obtain the symmetric key includes: The key information is decrypted using the private key in the asymmetric key to obtain a symmetric key and a serial number corresponding to the symmetric key.

4. The method according to claim 1, characterized in that The method further comprises: Based on the first script program, a random character string is obtained; Combining the random string and the symmetric key to obtain a target key; The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

5. The method according to claim 1, characterized in that The step of generating an asymmetric key based on the first script program includes: The public encryption interface in the first script program is called, and an asymmetric key generation algorithm is used to generate an asymmetric key.

6. The method according to claim 1, characterized in that The method further comprises: Receive request information sent by the proxy device when detecting that usage information of the symmetric key exceeds a preset threshold; the request information is used to instruct the terminal device to update the symmetric key.

7. The method according to claim 6, characterized in that The usage information of the symmetric key exceeds a preset threshold, including: The usage time of the symmetric key is greater than a preset time threshold; and\or, The number of times the symmetric key is used is greater than a preset number threshold; and\or, Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

8. A data encryption method, characterized in that: Applied to a proxy device, the method comprises: Receiving a first request sent by a terminal device; If it is determined that the first request includes cached data, a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; receiving a key request sent by the terminal device, and sending key information for the key request to the terminal device; the key request includes a public key in an asymmetric key; the key information includes a symmetric key encrypted using the public key; The encrypted sensitive data is received, and the encrypted sensitive data is decrypted according to the symmetric key, and the decrypted sensitive data is forwarded to the server.

9. The method according to claim 8, characterized in that The method further comprises: If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, sending a second response message to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send the first request including the target cached data; A first request including the target cache data is received and sent by the terminal device.

10. The method according to claim 8, characterized in that The sending the key information for the key request to the terminal device includes: Based on the key request, randomly generate a symmetric key and a number corresponding to the symmetric key; Using the public key in the asymmetric key, encrypt the symmetric key and the serial number corresponding to the symmetric key to obtain the key information; The key information is sent to the terminal device.

11. A data encryption device, characterized in that: Applied to a terminal device, the device comprises: A first sending module, used for sending a first request to a proxy device; A first receiving module, configured to receive response information returned by the proxy device based on the first request; An operation module, configured to generate an asymmetric key based on a first script program if the response information includes the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; The first sending module is further used to send a key request to the proxy device; the key request includes a public key in the asymmetric key; A first decryption module, configured to receive key information for the key request sent by the proxy device, and decrypt the key information using a private key in the asymmetric key to obtain a symmetric key; the key information includes the symmetric key encrypted using the public key; The first encryption module is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

12. A data encryption device, characterized in that: Applied to a proxy device, the device comprises: A second receiving module, used to receive a first request sent by a terminal device; A second sending module, configured to send a first response message to the terminal device if it is determined that the first request includes cached data; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; A second encryption module, used to receive a key request sent by the terminal device, and send key information for the key request to the terminal device; the key request includes a public key in an asymmetric key; the key information includes a symmetric key encrypted using the public key; The second decryption module is used to receive the encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

13. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 10.

14. A computer storage medium, characterized in that: When the computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can perform the method according to any one of claims 1 to 10.

Images