A data encryption method, apparatus, device and medium

Abstract

This application discloses a data encryption method, apparatus, device, and medium, belonging to the field of information security technology. In this method, a terminal device sends a first request to a proxy device; receives response information returned by the proxy device based on the first request; if the response information includes a first script program, an asymmetric key is generated based on the first script program; the first script program is used to instruct the encryption of sensitive data; a key request including the public key of the asymmetric key is sent to the proxy device; key information sent by the proxy device in response to the key request is received, and the key information is decrypted using the private key of the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key; sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a data encryption method, apparatus, device and medium. Background Technology

[0002] With the rapid development of Internet technology, under HTTP (Hypertext Transfer Protocol), data is transmitted between clients and servers in plaintext. However, the data may be overheard by other users on the shared channel or recorded in the logs of network devices, which could lead to the data being exploited by malicious users and causing network security problems.

[0003] In related technologies, the solution is to transform the site into an HTTPS (Hypertext Transfer Protocol Secure) site, which means converting the HTTP site into an HTTPS site and relying on the SSL / TLS layer to complete the encryption of the entire request and response, so that HTTP data can be transmitted over the network in encrypted form.

[0004] However, for web application cleansing service providers, since the source site (client) is not HTTPS, they cannot provide an SSL certificate, and therefore cannot complete the HTTPS conversion. Furthermore, for self-owned sites, purchasing an SSL certificate introduces additional costs, adding to the burden.

[0005] Therefore, how to encrypt sensitive data based on HTTP requests and protect the security of network data is a significant challenge in security operations. Summary of the Invention

[0006] This application provides a data encryption method, apparatus, device, and medium for encrypting sensitive data based on HTTP requests, thereby protecting the security of network data.

[0007] In a first aspect, embodiments of this application provide a data encryption method applied to a terminal device, the method comprising:

[0008] Send the first request to the proxy device;

[0009] Receive the response information returned by the proxy device based on the first request;

[0010] If the response information includes a first script program, then an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0011] A key request is sent to the agent device; the key request includes the public key of the asymmetric key;

[0012] The system receives key information from the proxy device in response to the key request, and decrypts the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key.

[0013] The sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

[0014] In some embodiments, the method further includes:

[0015] If the response information includes a second script program, then target cache data is generated based on the second script program;

[0016] Send a first request, including the target cached data, to the proxy device.

[0017] In some embodiments, the step of decrypting the key information using the private key from the asymmetric key to obtain the symmetric key includes:

[0018] The key information is decrypted using the private key in the asymmetric key to obtain the symmetric key and the corresponding number.

[0019] In some embodiments, the method further includes:

[0020] Based on the first script program, a random string is obtained;

[0021] The target key is obtained by combining the random string and the symmetric key.

[0022] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0023] In some embodiments, generating an asymmetric key based on the first script program includes:

[0024] The public encryption interface in the first script program is called to generate an asymmetric key using an asymmetric key generation algorithm.

[0025] In some embodiments, the method further includes:

[0026] The terminal device receives a request message sent by the proxy device when it detects that the usage information of the symmetric key exceeds a preset threshold; the request message is used to instruct the terminal device to update the symmetric key.

[0027] In some embodiments, the usage information of the symmetric key exceeds a preset threshold, including:

[0028] The duration of use of the symmetric key exceeds a preset duration threshold; and / or,

[0029] The symmetric key has been used more than a preset threshold number of times; and / or,

[0030] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0031] Secondly, embodiments of this application provide a data encryption method applied to a proxy device, the method comprising:

[0032] Receive the first request sent by the terminal device;

[0033] If it is determined that the first request includes cached data, then a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0034] The system receives a key request sent by the terminal device and sends key information in response to the key request to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key.

[0035] The system receives encrypted sensitive data, decrypts the encrypted sensitive data using the symmetric key, and forwards the decrypted sensitive data to the server.

[0036] In some embodiments, the method further includes:

[0037] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, then a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data;

[0038] Receive a first request sent by the terminal device, which includes the target cached data.

[0039] In some embodiments, sending key information for the key request to the terminal device includes:

[0040] Based on the key request, a symmetric key and a corresponding number are randomly generated.

[0041] The public key in the asymmetric key is used to encrypt the symmetric key and the number corresponding to the symmetric key to obtain the key information;

[0042] The key information is sent to the terminal device.

[0043] In some embodiments, the method further includes:

[0044] If the usage information of the symmetric key is detected to exceed a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0045] In some embodiments, the usage information of the symmetric key exceeds a preset threshold, including:

[0046] The duration of use of the symmetric key exceeds a preset duration threshold; and / or,

[0047] The symmetric key has been used more than a preset threshold number of times; and / or,

[0048] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0049] Thirdly, embodiments of this application provide a data encryption device applied to a terminal device, the device comprising:

[0050] The first sending module is used to send the first request to the proxy device;

[0051] The first receiving module is used to receive the response information returned by the proxy device based on the first request;

[0052] The execution module is configured to generate an asymmetric key based on the first script program if the response information includes the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0053] The first sending module is further configured to send a key request to the proxy device; the key request includes the public key in the asymmetric key;

[0054] The first decryption module is configured to receive key information sent by the proxy device in response to the key request, and decrypt the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key;

[0055] The first encryption module is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device can decrypt the encrypted sensitive data according to the symmetric key and forward the decrypted sensitive data to the server.

[0056] In some embodiments, the running module is further configured to:

[0057] If the response information includes a second script program, then target cache data is generated based on the second script program;

[0058] The first sending module is further configured to send a first request, including the target cached data, to the proxy device.

[0059] In some embodiments, the first decryption module is specifically used for:

[0060] The key information is decrypted using the private key in the asymmetric key to obtain the symmetric key and the corresponding number.

[0061] In some embodiments, the first encryption module is further configured to:

[0062] Based on the first script program, a random string is obtained;

[0063] The target key is obtained by combining the random string and the symmetric key.

[0064] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0065] In some embodiments, the running module is specifically used for:

[0066] The public encryption interface in the first script program is called to generate an asymmetric key using an asymmetric key generation algorithm.

[0067] In some embodiments, the first receiving module is further configured to:

[0068] The terminal device receives a request message sent by the proxy device when it detects that the usage information of the symmetric key exceeds a preset threshold; the request message is used to instruct the terminal device to update the symmetric key.

[0069] Fourthly, embodiments of this application provide a data encryption device applied to a proxy device, the device comprising:

[0070] The second receiving module is used to receive the first request sent by the terminal device;

[0071] The second sending module is configured to send a first response message to the terminal device if it is determined that the first request includes cached data; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0072] The second encryption module is configured to receive a key request sent by the terminal device and send key information in response to the key request to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key;

[0073] The second decryption module is used to receive the encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

[0074] In some embodiments, the second sending module is further configured to:

[0075] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, then a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data;

[0076] The second receiving module is further configured to receive a first request sent by the terminal device, which includes the target cached data.

[0077] In some embodiments, the second encryption module is specifically used for:

[0078] Based on the key request, a symmetric key and a corresponding number are randomly generated.

[0079] The public key in the asymmetric key is used to encrypt the symmetric key and the number corresponding to the symmetric key to obtain the key information;

[0080] The key information is sent to the terminal device.

[0081] In some embodiments, the second sending module is further configured to:

[0082] If the usage information of the symmetric key is detected to exceed a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0083] Fifthly, embodiments of this application provide an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0084] The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to perform the data encryption method described in the first or second aspect above.

[0085] In a sixth aspect, embodiments of this application provide a computer storage medium in which, when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device is able to execute the data encryption method described in the first or second aspect above.

[0086] The method provided in this application has the following beneficial effects:

[0087] In this embodiment, after determining that the page request sent by the terminal device is a replay request, that is, after determining that the page request includes valid cached data cookies, the proxy device inserts a first script program into the response information of the target type returned by the server and sends it to the terminal device. The first script program is used to instruct the encryption of sensitive data. The terminal device first runs the first script program to generate an asymmetric key, and then sends the public key of the asymmetric key to the proxy device to request a symmetric key. The proxy device uses the public key to encrypt the symmetric key and sends it to the terminal device. Then, the terminal device uses the private key to decrypt the symmetric key and uses the symmetric key to encrypt the sensitive data and sends it to the proxy device. Finally, the proxy device decrypts the sensitive data and sends it to the server.

[0088] Therefore, by first encrypting the symmetric key with an asymmetric key to prevent leakage of the symmetric key during transportation, and then encrypting the sensitive data with the symmetric key to prevent leakage of the sensitive data, the security of the sensitive data is higher than that of encrypting the sensitive data with only an asymmetric key or only a symmetric key, the risk of the symmetric key being cracked is reduced, and the security of network data is protected.

[0089] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0090] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0091] Figure 1 This is a schematic diagram illustrating an application scenario of a data encryption method provided in an embodiment of this application;

[0092] Figure 2 This is a schematic diagram illustrating another application scenario of a data encryption method provided in the embodiments of this application;

[0093] Figure 3 This is a schematic diagram illustrating another application scenario of a data encryption method provided in the embodiments of this application;

[0094] Figure 4 A flowchart illustrating a data encryption method provided in an embodiment of this application;

[0095] Figure 5 This is a schematic diagram illustrating the interaction of encrypted data provided in an embodiment of this application;

[0096] Figure 6 A flowchart illustrating another data encryption method provided in an embodiment of this application;

[0097] Figure 7 This is a schematic diagram illustrating the interaction of key information provided in an embodiment of this application;

[0098] Figure 8 This is an interactive schematic diagram of a data encryption method provided in an embodiment of this application;

[0099] Figure 9 This application provides a schematic diagram of a redirection interaction.

[0100] Figure 10 A schematic diagram illustrating the recording and monitoring of symmetric key usage, provided as an embodiment of this application;

[0101] Figure 11 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application;

[0102] Figure 12 This is a schematic diagram of another data encryption device provided in an embodiment of this application;

[0103] Figure 13 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0104] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0105] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0106] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0107] To facilitate understanding of the data encryption method provided in the embodiments of this application, some terms appearing in this application will be explained below.

[0108] HTTP (Hypertext Transfer Protocol): The fundamental protocol for web services, providing the request and response format for clients and servers. Request and response message headers are given in ASCII format; while the message content has a MIME-like format.

[0109] HTTPS (Hypertext Transfer Protocol Secure): HTTP runs on top of the SSL / TLS protocol. The SSL / TLS layer provides encryption and decryption functions, enabling HTTP data to be transmitted over the network in encrypted form.

[0110] JS (JavaScript): A programming language commonly used as a scripting language for web pages.

[0111] Cookies: Data (usually encrypted) stored on a user's local device by a website to identify the user. This information is temporarily or permanently stored on the user's client computer. In simpler terms, it refers to cached data, including personal information such as usernames, passwords, registered accounts, and phone numbers.

[0112] HTML (Hyper Text Markup Language): A markup language that includes a series of tags that unify the format of documents on the web, making scattered Internet resources appear as a logical whole.

[0113] With the rapid development of Internet technology, under HTTP (Hypertext Transfer Protocol), data is transmitted between clients and servers in plaintext.

[0114] However, the data may be overheard by other users on the shared channel or logged in the network device's logs, potentially leading to malicious use and cybersecurity issues.

[0115] In related technologies, the solution is to transform the site into an HTTPS (Hypertext Transfer Protocol Secure) site, which means converting the HTTP site into an HTTPS site and relying on the SSL / TLS layer to complete the encryption of the entire request and response, so that HTTP data can be transmitted over the network in encrypted form.

[0116] However, for web application cleansing service providers, since the source site (client) is not HTTPS, they cannot provide an SSL certificate and therefore cannot complete the HTTPS conversion. Furthermore, for self-owned sites, purchasing an SSL certificate introduces additional costs, adding to the burden.

[0117] Therefore, how to encrypt sensitive data based on HTTP requests and protect the security of network data is a significant challenge in security operations.

[0118] In view of this, embodiments of this application provide a data encryption method, apparatus, device, and medium for encrypting sensitive data based on HTTP requests, thereby protecting the security of network data.

[0119] The inventive concept of this application embodiment is as follows: In this application embodiment, after determining that the page request sent by the terminal device is a replay request, that is, after determining that the page request includes valid cached data cookies, the proxy device inserts a first script program into the response information of the target type returned by the server and sends it to the terminal device; the first script program is used to instruct the encryption of sensitive data; the terminal device first runs the first script program to generate an asymmetric key, and then sends the public key of the asymmetric key to the proxy device to request a symmetric key. The proxy device uses the public key to encrypt the symmetric key and sends it to the terminal device. Then, the terminal device uses the private key to decrypt and uses the symmetric key to encrypt the sensitive data and sends it to the proxy device. Finally, the proxy device decrypts the sensitive data and sends it to the server.

[0120] First, an asymmetric key is used to encrypt the symmetric key, preventing leakage during symmetric key transportation. Then, the symmetric key is used to encrypt sensitive data, preventing leakage of sensitive data. Compared to using only an asymmetric key or only a symmetric key to encrypt sensitive data, the security of sensitive data is higher, the risk of symmetric key being cracked is reduced, and network data security is protected.

[0121] After introducing the main inventive ideas of the embodiments of this application, the application scenarios of a data encryption method provided by the embodiments of this application will be described below with reference to the accompanying drawings.

[0122] like Figure 1 The diagram shown is an application scenario illustration of a data encryption method provided in an embodiment of this application. Figure 1 It includes terminal device 110, web proxy device 120 and web server 130.

[0123] The data encryption method provided in this application embodiment is used in the scenario of web application protection. For applications using HTTP, since they do not have the SSL layer of HTTPS for encryption, the interactive data between the terminal device and the server is transmitted in plaintext, and sensitive data is easily captured.

[0124] By applying a data encryption method provided in this application embodiment to the web proxy device 120 and terminal device 110 of the web server 130, the hiding of HTTP sensitive data can be achieved.

[0125] In this process, terminal device 110 sends a first request to web proxy device 120; if web proxy device 120 determines that the first request includes cached data cookie, it sends a first response message to terminal device 110; the first response message includes sub-response information returned by web server 130 for the target type of the first request and a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0126] Then, the terminal device 110 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the Web proxy device 120 to request a symmetric key;

[0127] After generating a symmetric key randomly, the Web proxy device 120 encrypts the symmetric key using the public key and sends it to the terminal device 110. The terminal device 110 then decrypts the symmetric key using the private key from the asymmetric key to obtain the symmetric key. The terminal device 110 then uses the symmetric key to encrypt sensitive data and sends the encrypted sensitive data to the Web proxy device 120. Finally, the Web proxy device 120 uses the symmetric key to decrypt the sensitive data and sends it to the Web server 130.

[0128] The terminal device 110 and the Web proxy device 120, as well as the Web proxy device 120 and the Web server 130, can communicate. The communication method can be wired communication technology, such as communicating through a network cable or serial cable; or wireless communication technology, such as communicating through Bluetooth or WIFI. There are no specific restrictions.

[0129] like Figure 2 The diagram shown illustrates another application scenario of a data encryption method provided in this application embodiment. Figure 2 It includes terminal device 210, Web application firewall (proxy device) 220 and Web server 230.

[0130] When a third party provides security services, for web security service providers, adding this functionality to terminal device 210 and web application firewall (proxy device) 220 provides further protection for customers' sensitive information without requiring an SSL certificate.

[0131] In this process, terminal device 210 sends a first request to Web Application Firewall (proxy device) 220; if Web Application Firewall (proxy device) 220 determines that the first request includes cached data cookie, it sends a first response information to terminal device 210; the first response information includes sub-response information returned by Web server 230 for the target type of the first request and a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0132] Then, the terminal device 210 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the Web application firewall (proxy device) 220 to request a symmetric key;

[0133] After the Web Application Firewall (Proxy Device) 220 randomly generates a symmetric key, it encrypts the symmetric key using the public key and sends it to the terminal device 210. Then, the terminal device 210 decrypts the symmetric key using the private key from the asymmetric key to obtain the symmetric key. After that, the terminal device 210 uses the symmetric key to encrypt sensitive data and sends the encrypted sensitive data to the Web Application Firewall (Proxy Device) 220. Finally, the Web Application Firewall (Proxy Device) 220 uses the symmetric key to decrypt the sensitive data and sends it to the Web server 230.

[0134] The terminal device 210 and the Web application firewall (proxy device) 220, as well as the Web application firewall (proxy device) 220 and the Web server 230, can communicate. The communication method can be wired communication technology, such as communicating through a network cable or serial cable; or wireless communication technology, such as communicating through Bluetooth or WIFI. There are no specific restrictions.

[0135] like Figure 3 The diagram shown illustrates another application scenario of a data encryption method provided in this application embodiment. Figure 3 It includes terminal device 310, existing agent device 320 and web server 330.

[0136] In the case of a self-owned website, for web security service providers, a proxy device is already set up in front of the web server. This function can be added to the terminal device 310 and the existing proxy device 320 by modifying the existing proxy device 320. Then the original web server 330 does not need to be modified, providing further protection for the customer's sensitive information without the need for an SSL certificate.

[0137] Specifically, terminal device 310 sends a first request to existing proxy device 320; if existing proxy device 320 determines that the first request includes cached data cookie, it sends a first response information to terminal device 310; the first response information includes sub-response information returned by web server 330 for the target type of the first request and a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0138] Then, the terminal device 310 first runs the first script program to generate an asymmetric key, and then sends the public key in the asymmetric key to the existing agent device 320 to request a symmetric key;

[0139] After the existing proxy device 320 randomly generates a symmetric key, it encrypts the symmetric key using the public key and sends it to the terminal device 310. Then, the terminal device 310 decrypts the symmetric key using the private key from the asymmetric key to obtain the symmetric key. After that, the terminal device 310 uses the symmetric key to encrypt sensitive data and sends the encrypted sensitive data to the existing proxy device 320. Finally, the existing proxy device 320 decrypts the sensitive data using the symmetric key and sends it to the web server 330.

[0140] The terminal device 310 and the existing agent device 320, as well as the existing agent device 320 and the web server 330, can communicate. The communication method can be wired communication technology, such as communicating through a network cable or serial cable; or wireless communication technology, such as communicating through Bluetooth or WIFI. There are no specific restrictions.

[0141] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0142] See Figure 4 This is a flowchart illustrating a data encryption method provided in an embodiment of this application. The method is applied in a terminal device and includes, for example... Figure 4 The steps shown are as follows:

[0143] In step 401, a first request is sent to the proxy device.

[0144] In step 402, the response information returned by the proxy device based on the first request is received.

[0145] In step 403, if the response information includes a first script program, an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0146] In some embodiments, if the response information includes a second script, target cache data is generated based on the second script; and a first request including the target cache data is sent to the proxy device.

[0147] The process of generating an asymmetric key based on the first script program can be executed as follows: calling the public encryption interface in the first script program and using the asymmetric key generation algorithm to generate the asymmetric key.

[0148] In step 404, a key request is sent to the agent device; the key request includes the public key in the asymmetric key.

[0149] In step 405, the key information for the key request sent by the agent device is received, and the key information is decrypted using the private key in the asymmetric key to obtain the symmetric key; the key information includes the symmetric key encrypted with the public key.

[0150] In some embodiments, the key information is decrypted using the private key from the asymmetric key to obtain the symmetric key, which can be specifically executed as follows:

[0151] The private key from the asymmetric key is used to decrypt the key information, yielding the symmetric key and its corresponding number.

[0152] In step 406, the sensitive data is encrypted using a symmetric key, and the encrypted sensitive data is sent to the agent device so that the agent device can decrypt the encrypted sensitive data according to the symmetric key and forward the decrypted sensitive data to the server.

[0153] Furthermore, in this application, after the terminal device encrypts the sensitive data using a symmetric key, it sends the encrypted sensitive data and the number corresponding to the symmetric key to the proxy device. After receiving the encrypted sensitive data and the number corresponding to the symmetric key, the proxy device determines the symmetric key required for decrypting the encrypted sensitive data from the pre-stored symmetric key set according to the number corresponding to the symmetric key, and then uses the symmetric key required for decrypting the encrypted sensitive data to decrypt the encrypted sensitive data.

[0154] The pre-stored symmetric key set includes symmetric keys and their corresponding numbers. The pre-stored symmetric key set can be a series of symmetric keys generated by the proxy device during initialization and numbered for each key, or it can be generated when using symmetric keys, requiring only the recently used keys and their numbers to be recorded. This application does not limit the method of generating the symmetric key set.

[0155] Sensitive data includes, but is not limited to, sensitive information in asynchronous requests based on AJAX or Fetch.

[0156] Unlike HTTPS, which encrypts the entire request data, this embodiment only encrypts a small portion of the sensitive data in the request. Therefore, the probability of the same plaintext being encrypted into the same ciphertext is greatly increased.

[0157] Furthermore, to enhance data security, this application embodiment may employ a one-time pad encryption method to ensure that the ciphertext obtained each time is different. Specifically, it can be implemented as follows:

[0158] Based on the first script program, a random string is obtained;

[0159] The target key is obtained by combining the random string and the symmetric key.

[0160] The sensitive data is encrypted using the target key, and the encrypted sensitive data is then sent to the agent device.

[0161] like Figure 5As shown, the terminal device generates a random string yxa@ based on the first script program, then combines the random string yxa@ with the symmetric key to obtain the target key, and uses the target key to encrypt the sensitive data; then the random string yxa@, the encrypted sensitive data, and the number 001 corresponding to the symmetric key are sent to the agent device.

[0162] After receiving the HTTP request data, the proxy device obtains the random string yxa@ and the corresponding number of the symmetric key. Then, it first determines the symmetric key required to decrypt the encrypted sensitive data based on the number corresponding to the symmetric key in the pre-stored symmetric key set. Then, it combines the random string yxa@ and the symmetric key to obtain the target key, and uses the target key to decrypt the encrypted sensitive data.

[0163] In some embodiments, to increase the difficulty of decryption, the symmetric key can be updated periodically, specifically as follows:

[0164] The terminal device receives a request message when it detects that the usage information of the symmetric key exceeds a preset threshold; the request message is used to instruct the terminal device to update the symmetric key.

[0165] Among them, the information regarding the use of the symmetric key exceeds a preset threshold, including:

[0166] The duration of symmetric key usage exceeds a preset duration threshold; and / or,

[0167] The symmetric key has been used more than a preset threshold number of times; and / or,

[0168] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0169] See Figure 6 This is a flowchart illustrating a data encryption method provided in an embodiment of this application. The method is applied in a proxy device, including, for example... Figure 6 The steps shown are as follows:

[0170] In step 601, a first request sent by the terminal device is received.

[0171] In step 602, if it is determined that the first request includes cached data, a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0172] In some embodiments, if it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data; and to receive the first request including the target cached data sent by the terminal device.

[0173] The cached data is a cookie.

[0174] It is important to note that because cookies are shared between different browser tabs (while in JavaScript each tab corresponds to an instance), the key used to encrypt cookies is different from the key used to encrypt sensitive data. Therefore, the proxy device will add the key index information to the browser by setting a new cookie. This index corresponds one-to-one with the cookie key in JavaScript.

[0175] The terminal device can obtain the key corresponding to the cookie based on the index information, and then encrypt the cookie. After receiving the first request, the proxy device first decrypts the cookie using the cookie key, and then determines whether the cookie exists in the first request and whether the cookie's timestamp is valid.

[0176] In step 603, a key request sent by a terminal device is received, and key information in response to the key request is sent to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key.

[0177] In some embodiments, sending key information for a key request to the terminal device can be performed as follows:

[0178] Based on the key request, a symmetric key and its corresponding number are randomly generated.

[0179] The public key from the asymmetric key is used to encrypt the symmetric key and its corresponding number to obtain the key information.

[0180] Send the key information to the terminal device.

[0181] like Figure 7 As shown, after receiving a key request, the agent device randomly generates a symmetric key "Key1" and its corresponding number 001 from the pre-stored symmetric key set. Then, it encrypts the symmetric key and its corresponding number using the public key in the asymmetric key and sends it to the terminal device through a function code. After receiving the encrypted key information, the terminal device decrypts the key information using the private key in the asymmetric key to obtain the symmetric key and its corresponding number.

[0182] The pre-stored symmetric key set can be a series of symmetric keys generated by the agent device during initialization and numbered for each symmetric key, or it can be generated when using symmetric keys. Only the recently used keys and their numbers need to be recorded. This application does not limit the way the symmetric key set is generated.

[0183] In step 604, the encrypted sensitive data is received, and the encrypted sensitive data is decrypted according to the symmetric key, and the decrypted sensitive data is forwarded to the server.

[0184] To facilitate understanding of the data encryption method provided in the embodiments of this application, Figure 8 A schematic diagram illustrating interactions between devices is provided. For example... Figure 8 As shown in the figure, a data encryption method provided in this application includes the following steps:

[0185] In step 801, the terminal device sends a first request to the proxy device.

[0186] In step 802, the proxy device detects the first request and determines whether the first request includes a cookie;

[0187] If the proxy device determines that the first request does not include a cookie, or that the timestamp of the cookie in the first request is invalid, then proceed to step 803;

[0188] If the proxy device determines that the first request includes a cookie, it will proceed directly to step 805.

[0189] In step 803, the agent device sends a second response message, including a second script program, to the terminal device.

[0190] The second script program is used to instruct the terminal device to generate a cookie and send a first request including the cookie.

[0191] In practice, if the first request sent by the terminal device does not include a cookie, or the timestamp of the cookie in the first request is invalid, the proxy device will reject the request and send an error page script including the second script program to the terminal device.

[0192] It should be noted that since the JavaScript program will exit execution once the browser page is refreshed, two JavaScript programs will be used in this embodiment. The second script program (hereinafter referred to as JS2) is used to generate cookies and refresh the page (re-send the first request to the proxy device); the first script program (hereinafter referred to as JS1) is used to instruct the terminal device to encrypt sensitive data and periodically update the timestamp in the cookie, but does not actively refresh the page.

[0193] In step 804, the terminal device generates a cookie based on the second script program and sends a first request including the cookie to the proxy device.

[0194] In practice, after receiving the second response information, the terminal device parses the script of the HTML error page, automatically downloads and runs the second script program, generates a cookie, and then refreshes the page. The refresh page then sends a first request, including the cookie, to the proxy device.

[0195] In step 805, the proxy device sends a first request, including a cookie, to the server.

[0196] In step 806, the server sends sub-response information of the target type for the first request, including the cookie, to the proxy device.

[0197] In step 807, the agent device sends a first response message to the terminal device.

[0198] The first response information includes a sub-response information sent by the server for the target type of the first request and a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0199] It is important to note that after receiving the sub-response information from the server in response to the first request, the proxy device first needs to determine whether the sub-response information is of the target type.

[0200] If the sub-response information is of the target type, the first script program JS1 is inserted into the sub-response information to generate the first response information and send it to the terminal device; if the sub-response information is not of the target type, the sub-response information is sent directly to the terminal device.

[0201] The target type is HTML.

[0202] In step 808, the terminal device generates an asymmetric key based on the first script program in the first response information and sends a key request including the public key of the asymmetric key to the agent device.

[0203] In step 809, the agent device receives the key request sent by the terminal device and sends key information in response to the key request to the terminal device; the key information includes a symmetric key encrypted using a public key.

[0204] In step 810, the terminal device receives the key information sent by the agent device, and decrypts the key information using the private key in the asymmetric key to obtain the symmetric key; it then uses the symmetric key to encrypt the sensitive data and sends the encrypted sensitive data to the agent device.

[0205] In step 811, the agent device decrypts the encrypted sensitive data using the symmetric key.

[0206] In step 812, the proxy device sends the decrypted sensitive data to the server.

[0207] In this case, after the proxy device obtains the server's response information for sensitive data, if the type of the response information is the target type, it can also insert the first script program after the response information for sensitive data before sending it to the terminal device.

[0208] It should be noted that in the embodiments of this application, there may be situations where sensitive data is invalid: one is that the cached data cookie is missing or invalid; the other is that the sensitive data decryption fails.

[0209] For situations where cached data cookies are missing or invalid:

[0210] In this embodiment, the proxy device will reject the request and send a response message including the second script to the terminal device. The terminal device updates the cookie based on the second script and sends a request including the updated cookie to the proxy device.

[0211] For situations where decryption of sensitive data fails:

[0212] The request may be forged or the configuration information on the proxy device may have changed. Therefore, in this embodiment, the proxy device can renegotiate the symmetric key and configuration information with the terminal device.

[0213] Specifically, the proxy device and the terminal device renegotiate the symmetric key and configuration information, which can be implemented as follows: Figure 9 The steps shown are as follows:

[0214] In step 901, if the sensitive data decryption fails, the proxy device sets a special response header and sends it to the terminal device.

[0215] The special response header is set randomly by the developers as needed, and this application embodiment does not impose any restrictions on it. This special response header instructs the terminal device to redirect.

[0216] In step 902, if the terminal device discovers a special response header when generating an asymmetric key based on the first script program, it sends a second request to the proxy device. The second request is used to request the configuration information required for redirection.

[0217] In step 903, the agent device adds the configuration information required for redirection as parameters to the first script program and sends it to the terminal device.

[0218] The configuration information includes, but is not limited to, URI (Uniform Resource Identifier), methods, parameters, and other information.

[0219] In step 904, the terminal device re-requests the first script program from the proxy device based on the parameter.

[0220] In step 905, the agent device sends the first script program that was requested again to the terminal device.

[0221] The first script program for the re-request includes the renegotiated symmetric key or configuration information.

[0222] In step 906, the terminal device redirects based on the first script program of the re-request.

[0223] In some embodiments, to increase the difficulty of decryption, the symmetric key can be updated periodically, specifically as follows:

[0224] The proxy device monitors the usage of the symmetric key. If it detects that the usage information of the symmetric key exceeds a preset threshold, it sends a request message to the terminal device. The request message is used to instruct the terminal device to update the symmetric key.

[0225] Among them, the information regarding the use of the symmetric key exceeds a preset threshold, including:

[0226] The duration of symmetric key usage exceeds a preset duration threshold; and / or,

[0227] The symmetric key has been used more than a preset threshold number of times; and / or,

[0228] Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

[0229] In practice, the proxy device can use cookies as an index to record and monitor the usage of the symmetric key. For example... Figure 10As shown, in the request sent by the terminal device, the cookie information is uid=1234. The proxy device can then use uid=1234 as an index to record and monitor the usage of the symmetric key: the symmetric key ID (MasterkeyID) corresponding to uid=1234 is 001, the usage time (UseTime) is 171229 seconds, the number of uses (Requests) is 5, and the random symmetric key (Random) is r1, r2, ..., rn, etc. The proxy device can then determine the usage of the symmetric key. If the usage information exceeds a preset threshold, the proxy device intercepts the current request and forces the terminal device to refresh the original HTML and update the symmetric key.

[0230] It should be noted that, apart from the situation where the usage information of the symmetric key exceeds the preset threshold, the symmetric key needs to be updated if the terminal device is accessing the page for the first time or refreshing the page for the first time.

[0231] Based on the preceding description, after determining that the page request sent by the terminal device is a replay request, i.e., after determining that the page request includes valid cached data cookies, the proxy device inserts a first script program into the response information of the target type returned by the server and sends it to the terminal device. The first script program is used to instruct the encryption of sensitive data. The terminal device first runs the first script program to generate an asymmetric key, and then sends the public key of the asymmetric key to the proxy device to request a symmetric key. The proxy device uses the public key to encrypt the symmetric key and sends it to the terminal device. Then, the terminal device uses its private key to decrypt the symmetric key and uses the symmetric key to encrypt the sensitive data and sends it to the proxy device. Finally, the proxy device decrypts the sensitive data and sends it to the server.

[0232] Therefore, by first encrypting the symmetric key with an asymmetric key to prevent leakage of the symmetric key during transportation, and then encrypting the sensitive data with the symmetric key to prevent leakage of the sensitive data, the security of the sensitive data is higher than that of encrypting the sensitive data with only an asymmetric key or only a symmetric key, the risk of the symmetric key being cracked is reduced, and the security of network data is protected.

[0233] Based on the same technical concept as the above-described data encryption method, this application also provides a data encryption device. The principle of the data encryption device in solving the problem is similar to that of the above-described data encryption method. Therefore, the implementation of the data encryption device can refer to the implementation of the data encryption method, and the repeated parts will not be described again.

[0234] Figure 11This is a schematic diagram of a data encryption device provided in an embodiment of this application. The device is applied to a terminal device and includes a first sending module 1101, a first receiving module 1102, a running module 1103, a first decryption module 1104, and a first encryption module 1105, wherein:

[0235] The first sending module 1101 is used to send a first request to the proxy device;

[0236] The first receiving module 1102 is used to receive response information returned by the proxy device based on the first request;

[0237] The running module 1103 is used to generate an asymmetric key based on the first script program if the response information includes the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data.

[0238] The first sending module 1101 is further configured to send a key request to the proxy device; the key request includes the public key in the asymmetric key.

[0239] The first decryption module 1104 is used to receive key information sent by the proxy device in response to the key request, and to decrypt the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key;

[0240] The first encryption module 1105 is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device can decrypt the encrypted sensitive data according to the symmetric key and forward the decrypted sensitive data to the server.

[0241] In some embodiments, the operation module 1103 is further configured to:

[0242] If the response information includes a second script program, then target cache data is generated based on the second script program;

[0243] The first sending module 1101 is further configured to send a first request including the target cached data to the proxy device.

[0244] In some embodiments, the first decryption module 1104 is specifically used for:

[0245] The key information is decrypted using the private key in the asymmetric key to obtain the symmetric key and the corresponding number.

[0246] In some embodiments, the first encryption module 1105 is further configured to:

[0247] Based on the first script program, a random string is obtained;

[0248] The target key is obtained by combining the random string and the symmetric key.

[0249] The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

[0250] In some embodiments, the running module 1103 is specifically used for:

[0251] The public encryption interface in the first script program is called to generate an asymmetric key using an asymmetric key generation algorithm.

[0252] In some embodiments, the first receiving module 1102 is further configured to:

[0253] The terminal device receives a request message sent by the proxy device when it detects that the usage information of the symmetric key exceeds a preset threshold; the request message is used to instruct the terminal device to update the symmetric key.

[0254] Figure 12 This is a schematic diagram of a data encryption device provided in an embodiment of this application. The device is applied to a proxy device and includes a second receiving module 1201, a second sending module 1202, a second encryption module 1203, and a second decryption module 1204, wherein:

[0255] The second receiving module 1201 is used to receive the first request sent by the terminal device;

[0256] The second sending module 1202 is configured to send a first response message to the terminal device if it is determined that the first request includes cached data; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data;

[0257] The second encryption module 1203 is configured to receive a key request sent by the terminal device and send key information in response to the key request to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key;

[0258] The second decryption module 1204 is used to receive encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

[0259] In some embodiments, the second sending module 1202 is further configured to:

[0260] If it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, then a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data;

[0261] The second receiving module 1201 is further configured to receive a first request sent by the terminal device, which includes the target cached data.

[0262] In some embodiments, the second encryption module 1203 is specifically used for:

[0263] Based on the key request, a symmetric key and a corresponding number are randomly generated.

[0264] The public key in the asymmetric key is used to encrypt the symmetric key and the number corresponding to the symmetric key to obtain the key information;

[0265] The key information is sent to the terminal device.

[0266] In some embodiments, the second sending module 1202 is further configured to:

[0267] If the usage information of the symmetric key is detected to exceed a preset threshold, a request message is sent to the terminal device; the request message is used to instruct the terminal device to update the symmetric key.

[0268] The module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. Coupling between modules can be achieved through interfaces, typically electrical communication interfaces, but mechanical interfaces or other types of interfaces are also possible. Therefore, modules described as separate components may or may not be physically separate; they can be located in one place or distributed across different locations on the same or different devices. The integrated modules described above can be implemented in hardware or as software functional modules.

[0269] Having described a data encryption method and apparatus according to an exemplary embodiment of this application, we will now describe an electronic device according to another exemplary embodiment of this application.

[0270] The following reference Figure 13 To describe an electronic device 1300 implemented according to this embodiment of the present application. Figure 13 The electronic device 1300 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0271] like Figure 13 As shown, the electronic device 1300 is presented in the form of a general-purpose electronic device. The components of the electronic device 1300 may include, but are not limited to: at least one processor 1301, at least one memory 1302, and a bus 1303 connecting different system components (including memory 1302 and processor 1301).

[0272] At least one memory 1302 stores a computer program that can be executed by at least one processor 1301. When the computer program is executed by at least one processor 1301, it can cause at least one processor 1301 to perform the steps of any data encryption method provided in the embodiments of this application.

[0273] Bus 1303 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or a local bus using any of the various bus structures.

[0274] The memory 1302 may include a readable medium in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0275] The memory 1302 may also include a program / utility having a set (at least one) of program modules, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0276] Electronic device 1300 can also communicate with one or more external devices 1304 (e.g., keyboard, pointing device, etc.), one or more devices that enable a user to interact with electronic device 1300, and / or any device that enables electronic device 1300 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1305. Furthermore, electronic device 1300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1306. As shown, network adapter 1306 communicates with other modules used in electronic device 1300 via bus 1303. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1300, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0277] In an exemplary embodiment, a computer storage medium is also provided, which enables the electronic device to execute any of the above-described data encryption methods when a computer program in the computer storage medium is executed by a processor of the electronic device. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0278] In an exemplary embodiment, a computer program product is also provided, which, when executed by an electronic device, enables the electronic device to implement the steps of any data encryption method provided in this application.

[0279] Furthermore, computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0280] The program product for device discovery in this application embodiment may be a CD-ROM and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0281] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0282] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, radio frequency (RF), or any suitable combination thereof.

[0283] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0284] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0285] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0286] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0287] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0288] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0289] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0290] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0291] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, then this application also includes such modifications and variations.

Claims

1. A data encryption method, characterized in that, Applied to a terminal device, the method includes: Send the first request to the proxy device; The system receives response information returned by the proxy device based on the first request; wherein, if the first request does not include a cookie, or the timestamp of the cookie in the first request is invalid, the response information includes a second script program; the second script program is used to instruct the terminal device to generate a cookie and send a first request including the cookie; if the first request includes a cookie, the response information includes a first script program. If the response information includes a second script program, then target cache data is generated based on the second script program, and a first request including the target cache data is sent to the proxy device; the target cache data is a cookie. If the response information includes a first script program, then an asymmetric key is generated based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data. A key request is sent to the agent device; the key request includes the public key of the asymmetric key; The system receives key information from the proxy device in response to the key request, and decrypts the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key. The sensitive data is encrypted using the symmetric key, and the encrypted sensitive data is sent to the proxy device, so that the proxy device decrypts the encrypted sensitive data according to the symmetric key and forwards the decrypted sensitive data to the server.

2. The method as described in claim 1, characterized in that, The step of decrypting the key information using the private key from the asymmetric key to obtain the symmetric key includes: The key information is decrypted using the private key in the asymmetric key to obtain the symmetric key and the corresponding number.

3. The method as described in claim 1, characterized in that, The method further includes: Based on the first script program, a random string is obtained; The target key is obtained by combining the random string and the symmetric key. The sensitive data is encrypted using the target key, and the encrypted sensitive data is sent to the proxy device.

4. The method as described in claim 1, characterized in that, The generation of an asymmetric key based on the first script program includes: The public encryption interface in the first script program is called to generate an asymmetric key using an asymmetric key generation algorithm.

5. The method as described in claim 1, characterized in that, The method further includes: The terminal device receives a request message sent by the proxy device when it detects that the usage information of the symmetric key exceeds a preset threshold; the request message is used to instruct the terminal device to update the symmetric key.

6. The method as described in claim 5, characterized in that, The usage information of the symmetric key exceeds a preset threshold, including: The duration of use of the symmetric key exceeds a preset duration threshold; and / or, The symmetric key has been used more than a preset threshold number of times; and / or, Within a preset time period, the ratio of the number of occurrences of the symmetric key to the total number of occurrences of all symmetric keys is greater than a preset ratio threshold.

7. A data encryption method, characterized in that, Applied to a proxy device, the method includes: Receive the first request sent by the terminal device; If it is determined that the first request includes cached data, then a first response message is sent to the terminal device; the first response message includes a first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; if it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, then a second response message is sent to the terminal device; the second response message includes a second script program; the second script program is used to instruct the terminal device to generate target cached data and send a first request including the target cached data; the terminal device receives the first request including the target cached data; the cached data is a cookie; The system receives a key request sent by the terminal device and sends key information in response to the key request to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key. The system receives encrypted sensitive data, decrypts the encrypted sensitive data using the symmetric key, and forwards the decrypted sensitive data to the server.

8. The method as described in claim 7, characterized in that, Sending key information for the key request to the terminal device includes: Based on the key request, a symmetric key and a corresponding number are randomly generated. The public key in the asymmetric key is used to encrypt the symmetric key and the number corresponding to the symmetric key to obtain the key information; The key information is sent to the terminal device.

9. A data encryption device, characterized in that, Applied to a terminal device, the device includes: The first sending module is used to send the first request to the proxy device; A first receiving module is configured to receive response information returned by the proxy device based on the first request; wherein, if the first request does not include a cookie, or the timestamp of the cookie in the first request is invalid, the response information includes a second script program; the second script program is configured to instruct the terminal device to generate a cookie and send a first request including the cookie; if the first request includes a cookie, the response information includes a first script program. The execution module is configured to, if the response information includes a second script program, generate target cache data based on the second script program and send a first request including the target cache data to the proxy device; the target cache data is a cookie; if the response information includes a first script program, generate an asymmetric key based on the first script program; the first script program is used to instruct the terminal device to encrypt sensitive data; The first sending module is further configured to send a key request to the proxy device; the key request includes the public key in the asymmetric key; The first decryption module is configured to receive key information sent by the proxy device in response to the key request, and decrypt the key information using the private key in the asymmetric key to obtain a symmetric key; the key information includes a symmetric key encrypted using the public key; The first encryption module is used to encrypt the sensitive data using the symmetric key and send the encrypted sensitive data to the proxy device, so that the proxy device can decrypt the encrypted sensitive data according to the symmetric key and forward the decrypted sensitive data to the server.

10. A data encryption device, characterized in that, Applied to a proxy device, the device includes: The second receiving module is used to receive the first request sent by the terminal device; The second sending module is configured to: if it is determined that the first request includes cached data, send a first response message to the terminal device; the first response message includes a first script program; the first script program is configured to instruct the terminal device to encrypt sensitive data; if it is determined that the first request does not include cached data, or the timestamp of the cached data in the first request is invalid, send a second response message to the terminal device; the second response message includes a second script program; the second script program is configured to instruct the terminal device to generate target cached data and send a first request including the target cached data; and receive the first request including the target cached data sent by the terminal device; the cached data is a cookie. The second encryption module is configured to receive a key request sent by the terminal device and send key information in response to the key request to the terminal device; the key request includes the public key in the asymmetric key; the key information includes a symmetric key encrypted using the public key; The second decryption module is used to receive the encrypted sensitive data, decrypt the encrypted sensitive data according to the symmetric key, and forward the decrypted sensitive data to the server.

11. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to said at least one processor, wherein: The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-8.

12. A computer storage medium, characterized in that, When the computer program in the computer storage medium is executed by the processor of the electronic device, the electronic device is capable of performing the method as described in any one of claims 1-8.

Images