Data processing method and device, computer equipment and storage medium

Abstract

The invention provides a data processing method and device, computer equipment and a storage medium, and belongs to the technical field of communication. In the data processing process, for each time of data transmission, the first computer encrypts data by using a compression algorithm and a private key in the first key pair to obtain a signature of the data, generates a data key, encrypts the data by using the data key, encrypts the data by using a public key in the second key pair, and transmits the encrypted data to the first computer; the complexity of data encryption is improved by comprehensively using multiple encryption algorithms, and the compression algorithm is irreversible, the data keys used for each data transmission are different, and the private key in the first key pair is only held by the first computer equipment and the second computer equipment, so that the data encryption efficiency is improved. According to the method, whether the data is the data sent by the first computer equipment or not can be judged based on the compression algorithm, the data key and the first key pair, and the security of the data is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data processing method, device, computer equipment and storage medium. Background Art

[0002] With the development of communication technology, more and more businesses transmit data through the public Internet. During the data transmission process, the data security is guaranteed by encrypting the data.

[0003] At present, a data encryption method is that a first computer device encrypts data using a public key provided by a second computer device to obtain ciphertext, sends the ciphertext to the second computer device, and the second computer device decrypts the ciphertext using a private key to obtain data.

[0004] In the above method, the second computer device cannot determine whether the data is data sent by the first computer device, resulting in low data security. Summary of the invention

[0005] The embodiments of the present application provide a data processing method, apparatus, computer equipment and storage medium for improving data security. The technical solution is as follows:

[0006] In a first aspect, a data processing method is provided, which is executed by a first computer device, and the method includes: for each data transmission, encrypting the data using a compression algorithm to obtain a first data summary, the compression algorithm is used to convert the data into an irreversible fixed-length value; encrypting the first data summary using a private key in a first key pair to obtain a signature, the private key in the first key pair is provided by a second computer device; generating a data key, encrypting the data using the data key to obtain a data ciphertext; encrypting the data key using a public key in a second key pair to obtain a key ciphertext, the public key in the second key pair is provided by a second computer device; and sending the signature, the data ciphertext, and the key ciphertext to the second computer device.

[0007] In the above method, for each data transmission, the first computer uses the compression algorithm and the private key in the first key pair to encrypt the data, obtains the signature of the data, and then generates the data key, encrypts the data using the data key, and encrypts the data key using the public key in the second key pair. The comprehensive use of multiple encryption algorithms improves the complexity of data encryption. In addition, since the compression algorithm is irreversible, the data key used for each data transmission is different, and the private key in the first key pair is only held by the first computer device and the second computer device, the above method can determine whether the data is sent by the first computer device based on the compression algorithm, the data key and the first key pair, thereby improving the security of the data.

[0008] In some embodiments, the above method also includes: obtaining the length of the private key in the first key pair, dividing the length of the private key in the first key pair by the first number to obtain a first window length; based on the first window length, dividing the private key in the first key pair to obtain a first number of private key fragments; storing the first number of private key fragments in a first number of files respectively; when using the private key in the first key pair, obtaining the first number of private key fragments from the first number of files, and restoring the private key in the first key pair based on the first number of private key fragments.

[0009] Among them, the first computer device divides the private key in the first key pair and stores them in different files. When the private key in the first key pair needs to be used, the private key in the first key pair needs to be restored first, which increases the complexity of obtaining the private key in the first key pair and improves the security of the data.

[0010] In some embodiments, the above method also includes: obtaining the length of the public key in the second key pair, dividing the length of the public key in the second key pair by the second number to obtain a second window length; based on the second window length, dividing the public key in the second key pair to obtain a second number of private key fragments; storing the second number of private key fragments in a second number of files respectively; when using the public key in the second key pair, obtaining a second number of private key fragments from the second number of files, and restoring the public key in the second key pair based on the second number of private key fragments.

[0011] Among them, the first computer device divides the public key in the second key pair and stores them in different files. When the public key in the second key pair is needed, the public key in the second key pair needs to be restored first, which increases the complexity of obtaining the public key in the second key pair and improves data security.

[0012] In a second aspect, a data processing method is provided, which is executed by a second computer device, and the method includes: using a private key in a second key pair to decrypt a key ciphertext to obtain a data key, where the key ciphertext is obtained by the first computer device using a public key in the second key pair to encrypt the data key; using the data key to decrypt a data ciphertext to obtain data, where the data ciphertext is obtained by the first computer device using the data key to encrypt the data; using a compression algorithm to encrypt the data to obtain a second data summary, where the compression algorithm is used to convert the data into an irreversible fixed-length value; using the public key in the first key pair to decrypt a signature to obtain a first data summary, where the signature is obtained by the first computer device using the private key in the first key pair to encrypt the first data summary, where the first data summary is obtained by the first computer device using the compression algorithm to encrypt the data; based on the first data summary and the second data summary, determining whether the data is data sent by the first computer device.

[0013] When decrypting data, the second computer device uses the private key in the second key pair to decrypt the data key to obtain the data key, uses the data key to decrypt the data ciphertext to obtain the data, and then determines whether the data is sent by the first computer device based on the data and the signature. The decryption is performed using a combination of multiple algorithms, and the complexity of data decryption is high. The private key in the second key pair is only held by the second computer device, which ensures the security of the data. In addition, since the private key in the first key pair is only held by the first computer device and the second computer device, by decrypting the signature and comparing the data encrypted by the same compression algorithm, it is possible to determine whether the data is sent by the first computer device, thereby improving the security of the data.

[0014] In some embodiments, the above-mentioned decrypting the signature using the public key in the first key pair to obtain the first data summary includes: if the signature decryption using the public key in the first key pair fails, the data reception fails. Since the private key in the first key pair is only held by the first computer device and the second computer device, if the signature decryption using the public key in the first key pair fails, it indicates that the data is not sent by the first computer device, or the data is damaged during transmission.

[0015] In some embodiments, the above-mentioned determination of whether the data is data sent by the first computer device based on the first data digest and the second data digest includes: if the first data digest and the second data digest are the same, the data is data sent by the first computer device; if the first data digest and the second data digest are different, the data is not data sent by the first computer device. The first computer device and the second computer device use the same compression algorithm to encrypt data, so by comparing the data sent by the first computer device and the data received by the second computer device after being encrypted by the same compression algorithm, it is possible to determine whether the data received by the second computer device is data sent by the first computer device, thereby improving the security of the data.

[0016] In a third aspect, a data processing device is provided for executing the above data processing method. Specifically, the data processing device includes a functional module for executing the data processing method provided by the first aspect or any optional manner of the first aspect and executed by a first computer device.

[0017] In a fourth aspect, a data processing device is provided for executing the above data processing method. Specifically, the data processing device includes a functional module for executing the data processing method provided by the second aspect or any optional manner of the second aspect and executed by a second computer device.

[0018] In a fifth aspect, a computer device is provided, comprising a processor and a memory, the memory being used to store at least one computer program, the at least one computer program being loaded by the processor and executing operations such as those performed by the data processing method executed by the first computer device or the data processing method executed by the second computer device.

[0019] In a sixth aspect, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor to implement the operations performed by the data processing method executed by the first computer device or the data processing method executed by the second computer device as described above.

[0020] In the seventh aspect, a computer program product or a computer program is provided, which includes a computer program code, and the computer program code is stored in a computer-readable storage medium. A processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the data processing method provided in any one of the first and second aspects above or in various optional implementations of any one of the aspects.

[0021] Based on the implementations provided in the above aspects, the present application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a structural diagram of a data transmission system provided according to an embodiment of the present application;

[0024] Figure 2 is a flow chart of a data processing method provided according to an embodiment of the present application;

[0025] Figure 3 is a flow chart of another data processing method provided according to an embodiment of the present application;

[0026] Figure 4 is a block diagram of a data processing device provided according to an embodiment of the present application;

[0027] Figure 5 is a block diagram of another data processing device provided according to an embodiment of the present application;

[0028] Figure 6 It is a structural schematic diagram of a computer device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0030] In this application, the terms "first", "second", etc. are used to distinguish identical or similar items with basically the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on quantity and execution order.

[0031] In the present application, the term "at least one" means one or more, and the term "plurality" means two or more.

[0032] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. For example, the data involved in this application are all obtained with full authorization.

[0033] Figure 1 is a structural diagram of a data transmission system provided according to an embodiment of the present application. Figure 1 , the data transmission system includes a first computer device 101 and a second computer device 102, the first computer device 101 encrypts and sends data, the second computer device 102 receives and decrypts data, and the second computer device 102 can also send corresponding response data to the first computer device 101. The first computer device 101 can generate a data key, encrypt the data and the data key, and send the encrypted data and the data key to the second computer device 102. The second computer device 102 can receive the data and the data key, decrypt the data and the data key, and obtain the data sent by the first computer device 101. The second computer device 102 can also obtain response data based on the data, encrypt the response data and send it to the first computer device 101, and the first computer device 101 decrypts the response data to obtain the response data sent by the second computer device 102. The above-mentioned first computer device 101 and the second computer device 102 can be configured as terminals or servers, and are directly or indirectly connected through a wired network or a wireless network, and this application is not limited here.

[0034] In the embodiments of the present application, the computer device can be configured as a terminal or a server. When the computer device is configured as a terminal, the terminal can be used as the execution subject to implement the technical solution provided in the embodiments of the present application. When the computer device is configured as a server, the server can be used as the execution subject to implement the technical solution provided in the embodiments of the present application. The technical solution provided in the present application can also be implemented through interaction between the terminal and the server. The embodiments of the present application are not limited to this.

[0035] In some embodiments, the first computer device 101 or the second computer device 102 is configured as a terminal, which can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, an intelligent voice interaction device, a smart home appliance, a car terminal, etc., but is not limited thereto.

[0036] Those skilled in the art will appreciate that the number of the above terminals may be more or less. For example, the above terminal may be only one, or the above terminals may be dozens or hundreds, or more. The embodiment of the present application does not limit the number of terminals and device types.

[0037] In some embodiments, the first computer device 101 or the second computer device 102 is configured as a server, which can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), big data and artificial intelligence platforms.

[0038] Figure 2 is a flow chart of a data processing method provided according to an embodiment of the present application, the data processing method is executed by a first computer device, such as Figure 2 As shown, taking the example of a first computer device sending data to a second computer device, the method includes the following steps:

[0039] 201. For each data transmission, the first computer device encrypts the data using a compression algorithm to obtain a first data summary, where the compression algorithm is used to convert the data into an irreversible fixed-length value.

[0040] In the above process, the first computer device first obtains the data that needs to be encrypted and sent, and then uses the compression algorithm pre-agreed by the first computer device and the second computer device to encrypt the data. The above data can be data in the form of a string or a request instruction in the form of a text. The embodiment of the present application does not limit this. If the data that needs to be encrypted and sent is a request instruction in the form of a text, it is necessary to first convert the request instruction in the form of a string, and then encrypt the string. For example, convert the request instruction in the form of a text into a JSON (JavaScript Object Notation, JS object notation) string. The above-mentioned pre-agreed compression algorithm means that the compression algorithm used by the first computer device is the same as the compression algorithm used by the second computer device.

[0041] Since data encrypted by the compression algorithm is irreversible, the original data cannot be obtained by decrypting the first data digest. However, since different data corresponds to different first data digests, it is possible to determine whether the data is data sent by the first computer device based on the first data digest.

[0042] 202. The first computer device encrypts the first data digest using a private key in a first key pair to obtain a signature, where the private key in the first key pair is provided by the second computer device.

[0043] In an embodiment of the present application, the first computer device encrypts the first data summary based on an asymmetric encryption algorithm using a private key in a first key pair. The above-mentioned asymmetric encryption algorithm refers to the use of a key pair consisting of a public key and a private key to encrypt and decrypt data, wherein the key pair is generated by a computer device, the public key can be sent by the computer device to other computer devices for storage, and the private key is only stored by the computer device. In general, other computer devices use the public key to encrypt data and send it to the computer device, the computer device receives the data, and uses the private key to decrypt the data to obtain the original data, or the computer device uses the private key to generate a signature and sends it to other computer devices, and other computer devices use the public key to decrypt the signature to verify the source of the signature.

[0044] The private key in the above-mentioned first key pair is provided by the second computer device, which means that after the second computer device generates the first key pair, the private key in the first key pair is manually configured in the first computer device, or the second computer device sends the private key in the first key pair to the first computer device via a private network. The embodiment of the present application does not limit this and instructs the first computer device to store the private key in the first key pair in a preset storage method.

[0045] In some embodiments, the preset storage method is as follows: after the first computer device obtains the private key in the first key pair, it obtains the length of the private key in the first key pair, divides the length of the private key in the first key pair by the first quantity to obtain a first window length, and based on the first window length, divides the private key in the first key pair to obtain a first number of private key fragments, and stores the first number of private key fragments in a first number of files respectively. When the first computer device needs to send data to the second computer device, it needs to use the private key in the first key pair, then obtains the first number of private key fragments from the first number of files, and restores the private key in the first key pair based on the first number of private key fragments.

[0046] In some embodiments, the first computer device stores the first number of private key fragments in the first number of files named in a preset order, and when restoring the private key in the first key pair, obtains the first number of private key fragments from the first number of files, and splices the private key fragments in the order of file naming to obtain the private key in the first key pair. The preset order may indicate the position of the private key fragment stored in any file in the private key, and the preset order is not limited here.

[0047] For example, after the second computer device generates the first key pair, it manually configures the private key in the first key pair to the first computer device, or the second computer device sends the private key in the first key pair to the first computer device through a private network, instructing the first computer device to save the private key in the first key pair in two segments, then the first computer device divides the key length by 2 to obtain the window length, takes the part from 0 to the window length as the first segment, and the remaining part as the second segment, writes the first segment and the second segment into files secret_key_1.cer and secret_key_2.cer respectively, stores the above files, and grants read-only permission. When the first computer device needs to send data to the second computer device, it needs to use the private key in the first key pair, then the first computer device obtains the first segment and the second segment from the files secret_key_1.cer and secret_key_2.cer, splices the first segment and the second segment in the order of file naming, and obtains the private key in the first key pair. In the above restoration process, if the first computer device obtains less than two segments, the first computer device cannot use the private key in the first key pair.

[0048] In the above steps 201 to 202, after the first computer device encrypts the data using the compression algorithm and the asymmetric encryption algorithm, a signature with a shorter length can be obtained, and whether the data has been tampered with or damaged during transmission can be verified based on the signature.

[0049] 203. The first computer device generates a data key, and uses the data key to encrypt the data to obtain a data ciphertext.

[0050] In the above process, each time the first computer device transmits data to the second computer device, a data key is generated according to a preset rule based on the symmetric encryption algorithm, and the data is encrypted using the new data key to obtain data ciphertext. The preset rule can be generated randomly or according to a certain rule. For example, the preset rule is to generate an 8-bit data key, which consists of letters and numbers. The above symmetric encryption algorithm means that the same key is used to encrypt and decrypt data.

[0051] Among them, each data transmission uses a new data key to encrypt the data, which can effectively avoid the leakage of fixed keys, and thus prevent data leakage, more fully guarantee the privacy security of users, improve data security, and effectively prevent the second computer device from repeatedly receiving the same data.

[0052] 204. The first computer device encrypts the data key using a public key in a second key pair to obtain a key ciphertext, wherein the public key in the second key pair is provided by the second computer device.

[0053] In the above process, the first computer device uses the public key in the second key pair based on an asymmetric encryption algorithm to encrypt the data key. Since the private key in the second key pair is only held by the second computer device, the above key ciphertext can only be decrypted by the second computer device using the private key in the second key pair to obtain the data key, thereby ensuring the security of the data key.

[0054] The public key in the second key pair is provided by the second computer device, which means that after the second computer device generates the second key pair, the public key in the second key pair is manually configured in the first computer device, or the second computer device sends the public key in the second key pair to the first computer device through a private network. The embodiment of the present application does not limit this, and instructs the first computer device to store the public key in the second key pair in a preset storage method. The preset storage method is the same as the preset storage method in the above step 202, and the embodiment of the present application will not be repeated here.

[0055] The above steps 203 and 204 use multiple encryption algorithms to encrypt data, which enhances the encryption logic, ensures the security of data during public network transmission, and prevents data leakage.

[0056] 205. The first computer device sends the signature, the data ciphertext, and the key ciphertext to the second computer device.

[0057] In the above process, the first computer device assigns the signature and key ciphertext to the message header of the data message, and assigns the data ciphertext to the message body of the data message, thereby combining the signature, data ciphertext and key ciphertext into a data message, and sending the data message to the second computer device.

[0058] In the data processing method provided in the embodiment of the present application, for each data transmission, the first computer uses a compression algorithm and a private key in a first key pair to encrypt the data, obtains a signature of the data, and then generates a data key, uses the data key to encrypt the data, and uses the public key in a second key pair to encrypt the data key. The comprehensive use of multiple encryption algorithms improves the complexity of data encryption. In addition, since the compression algorithm is irreversible, the data key used for each data transmission is different, and the private key in the first key pair is only held by the first computer device and the second computer device, the above method can determine whether the data is data sent by the first computer device based on the compression algorithm, the data key and the first key pair, thereby improving the security of the data.

[0059] Figure 3 is a flow chart of another data processing method provided according to an embodiment of the present application, the data processing method is executed by a second computer device, such as Figure 3 As shown, taking the second computer device receiving data sent by the first computer device as an example, the method includes the following steps:

[0060] 301. The second computer device decrypts the key ciphertext using the private key in the second key pair to obtain the data key. The key ciphertext is obtained by encrypting the data key by the first computer device using the public key in the second key pair.

[0061] In the above process, after the second computer device receives the data message, it determines the computer device that sent the data message based on the interface that receives the data message. If the computer device that sent the data message is the first computer device, the second computer device obtains the key ciphertext in the data message, and uses the private key in the second key pair to decrypt the key ciphertext to obtain the data key. Since the second computer device stores the private key in the second key pair after generating the second key pair, and only configures or sends the public key in the second key pair to the first computer device, the private key in the second key pair is only held by the second computer device, which can effectively prevent the leakage of the data key and ensure the security of the data key.

[0062] In some embodiments, the second computer device may also determine the computer device that sends the data message based on the content of the data message, which is not limited in this embodiment of the present application.

[0063] 302. The second computer device decrypts the data ciphertext using the data key to obtain the data. The data ciphertext is obtained by encrypting the data using the data key by the first computer device.

[0064] In the above process, the second computer device obtains the data ciphertext in the data message, decrypts the data ciphertext using the data key, and obtains the data.

[0065] The data decryption process in the above steps 301 and 302 requires first decrypting the key ciphertext to obtain the data key, and then using the data key to decrypt the data ciphertext to obtain the data. The complexity of data decryption is high, which improves the security of the data.

[0066] 303. The second computer device encrypts the data using a compression algorithm to obtain a second data summary, where the compression algorithm is used to convert the data into an irreversible fixed-length value.

[0067] In the above process, since the compression algorithm is irreversible, the second computer device uses the compression algorithm used by the first computer device to encrypt the data to obtain a second data summary, and based on the second data summary, determines whether the data obtained in the above step 302 is the data sent by the first computer device, and then determines whether the data obtained in the above step 302 is the data sent by the first computer device based on the signature.

[0068] 304. The second computer device uses the public key in the first key pair to decrypt the signature to obtain a first data summary, where the signature is obtained by the first computer device using the private key in the first key pair to encrypt the first data summary, and the first data summary is obtained by the first computer device encrypting data using a compression algorithm.

[0069] In order to determine whether the data obtained in the above step 302 is data sent by the first computer device, the second computer device obtains the signature in the data message, and uses the public key in the first key pair to decrypt the signature to obtain the first data summary. Since the private key in the first key pair is only held by the first computer device and the second computer device, if the second computer device fails to decrypt the signature using the public key in the first key pair, it means that the data message received by the second computer device is not sent by the first computer device, or it means that the data message is damaged during the data transmission process. Therefore, if the second computer device fails to decrypt the signature using the public key in the first key pair, the data reception fails.

[0070] 305. The second computer device determines whether the data is data sent by the first computer device based on the first data digest and the second data digest.

[0071] The above process is a process in which the second computer device compares the first data digest and the second data digest to determine whether the data received by the second computer device is the data sent by the first computer device after the second computer device obtains the first data digest and the second data digest through step 303 and step 304. Since the first computer device and the second computer device use the same compression algorithm, if the first data digest and the second data digest are the same, the data received by the second computer device is the data sent by the first computer device, and if the first data digest and the second data digest are different, the data received by the second computer device is not the data sent by the first computer device.

[0072] In the data processing method provided in the embodiment of the present application, the second computer device uses the private key in the second key pair to decrypt the data key to obtain the data key, uses the data key to decrypt the data ciphertext to obtain the data, and then determines whether the data is sent by the first computer device based on the data and the signature. The data is decrypted using a combination of multiple algorithms, and the complexity of data decryption is high. The private key in the second key pair is only held by the second computer device, which ensures the security of the data. In addition, since the private key in the first key pair is only held by the first computer device and the second computer device, by decrypting the signature and comparing the data encrypted by the same compression algorithm, it is possible to determine whether the data is sent by the first computer device, thereby improving the security of the data.

[0073] In some embodiments, after the second computer device receives and decrypts the data sent by the first computer device, it obtains response data based on the data, encrypts the response data and sends it to the first computer device, which then decrypts the response data. It should be noted that in some embodiments, the decryption system in the second computer device receives and decrypts the data, sends the decrypted data to the data processing system, and the data processing system processes the data to obtain response data, which is then sent to the decryption system, which encrypts the response data and sends it to the first computer device. The above process is described below.

[0074] After the second computer device receives and decrypts the data sent by the first computer device, it processes the decrypted data to obtain response data, then encrypts the response data using a compression algorithm to obtain a first response data digest, encrypts the first response data digest using the private key in the second key pair to obtain a signature of the response data, encrypts the response data using the data key in the above step 301 to obtain a ciphertext of the response data, assigns the signature of the response data to the message header, and assigns the ciphertext of the response data to the message body, thereby combining the signature of the response data and the ciphertext of the response data into a response message, and sending it to the first computer device.

[0075] The first computer device receives the above-mentioned response message, and based on the interface for receiving the response message, determines the computer device that sends the response message; if the computer device that sends the response message is the second computer device, the data key in the above-mentioned step 203 is used to decrypt the response data ciphertext to obtain the response data, and then the compression algorithm is used to encrypt the response data to obtain the second response data digest, and the public key in the second key pair is used to decrypt the signature of the response data to obtain the first response data digest, and based on the first response data digest and the second response data digest, it is determined whether the response data is the response data sent by the second computer device.

[0076] In some embodiments, the data processing method executed by the first computer device and the data processing method executed by the second computer device can be combined to realize data interaction in the business. The following takes the case where the first computer device sends a business request to the second computer device, the compression algorithm is the SHA (Secure Hash Algorithm) 256 algorithm, the first key pair and the second key pair are the key pairs in the RSA (Rivest-Shamir-Adleman) algorithm, and the data key is the key in the 3DES (Triple Data Encryption Algorithm) algorithm as an example to illustrate the above data processing flow. The parameters involved in the data processing process are as follows:

[0077] rsa_pri_1: the private key of the first key pair in the RSA algorithm;

[0078] rsa_pub_1: the public key of the first key pair in the RSA algorithm;

[0079] rsa_pri_2: the private key of the second key pair in the RSA algorithm;

[0080] rsa_pub_2: the public key of the second key pair in the RSA algorithm;

[0081] sha256_data1: data encrypted by the first computer device using the SHA256 algorithm;

[0082] sha256_data2: data encrypted by the second computer device using the SHA256 algorithm;

[0083] 3des_secret_key: the key in the 3DES algorithm;

[0084] data: data to be encrypted;

[0085] ciphertext_data: data ciphertext;

[0086] sign: signature;

[0087] ciphertext_key: key ciphertext, that is, the key in the encrypted 3DES algorithm;

[0088] res_data: response data.

[0089] The above data processing flow is as follows:

[0090] 1. The first computer device encrypts the request data and sends it to the second computer device.

[0091] 1.1. Obtaining a signature. Each time the first computer device transmits data to the second computer device, it converts the request data into a string, i.e., the data to be encrypted data, and encrypts data using the SHA256 algorithm to obtain the encrypted data sha256_data1. It then uses the private key rsa_pri_1 of the first key pair in the RSA algorithm to encrypt sha256_data1 to obtain the signature sign.

[0092] 1.2. Data encryption: The first computer device automatically generates a key 3des_secret_key in the 3DES algorithm, and uses the 3des_secret_key to encrypt the data to obtain a data ciphertext ciphertext_data.

[0093] 1.3. Data key encryption: The first computer device uses the public key rsa_pub_2 in the second key pair in the RSA algorithm to encrypt the 3des_secret_key generated by this data transmission to obtain the key ciphertext ciphertext_key.

[0094] 1.4. Combined message: The first computer device assigns sign and ciphertext_key to the request header, and assigns ciphertext_data to the request body to obtain a request message.

[0095] 1.5. Send a request message. The first computer device sends a request message to the second computer device.

[0096] 2. The second computer device receives and decrypts the request message.

[0097] 2.1. Obtaining the data key. The second computer device determines that the request message is sent by the first computer device based on the interface receiving the request message, and then obtains the key ciphertext_key in the request header, and decrypts the ciphertext_key using the private key rsa_pri_2 in the second key pair in the RSA algorithm to obtain the key 3des_secret_key in the 3DES algorithm.

[0098] 2.2. Obtaining data. The second computer device obtains the data ciphertext ciphertext_data in the request body, and decrypts the ciphertext_data using 3des_secret_key to obtain the data data.

[0099] 2.3. Verify the signature. The second computer device obtains the signature sign in the request header, encrypts data using the SHA256 algorithm, obtains the encrypted data sha256_data2, and then uses the public key rsa_pub_1 in the first key pair in the RSA algorithm to decrypt sign to obtain sha256_data1, compares sha256_data1 and sha256_data2, if sha256_data1 and sha256_data2 are the same, then processes data; if sha256_data1 and sha256_data2 are different, then data reception fails and data is not processed.

[0100] If the second computer device needs to process the data sent by the first computer device and send response data to the first computer device, the following steps are also required:

[0101] 3. The second computer device processes the data to obtain response data, encrypts the response data and sends it to the first computer device.

[0102] 3.1. Obtain the signature of the response data. The second computer device obtains the response data res_data, encrypts res_data using the SHA256 algorithm, assigns the encryption result to sha256_data2, encrypts sha256_data2 using rsa_pri_2, and assigns the encryption result to sign.

[0103] 3.2. Response data encryption: The second computer device uses 3des_secret_key to encrypt res_data and assigns the encryption result to ciphertext_data.

[0104] 3.3. Assemble the response message. Assign the sign to the response header and the ciphertext_data to the response body to get the response message.

[0105] 3.4. Send a response message. The second computer device sends a response message to the first computer device.

[0106] 4. The first computer device receives and decrypts the response message.

[0107] 4.1. Obtain response data. The first computer device determines that the response message is sent by the second computer device based on the interface for receiving the response message, obtains the ciphertext_data in the response body, and decrypts the ciphertext_data using 3des_secret_key to obtain the response data res_data.

[0108] 4.2. Verify the signature of the response data. The first computer device obtains the signature sign in the response header, encrypts res_data using the SHA256 algorithm, assigns the encryption result to sha256_data1, decrypts sign using rsa_pub_2, assigns the decryption result to sha256_data2, compares sha256_data1 and sha256_data2, if sha256_data1 and sha256_data2 are the same, res_data is processed, if sha256_data1 and sha256_data2 are different, data reception fails, and res_data is not processed.

[0109] The algorithm formed by the combination of RAS, SHA256 and 3DES used in the above data processing flow meets the bank's security audit and external regulatory compliance requirements, and is highly feasible and innovative in the banking system.

[0110] Figure 4 is a block diagram of a data processing device provided according to an embodiment of the present application. The device is used to execute the steps of the above data processing method. Figure 4 , the data processing device comprises:

[0111] A compression encryption module 401 is used to encrypt data using a compression algorithm for each data transmission to obtain a first data summary, wherein the compression algorithm is used to convert the data into an irreversible fixed-length value;

[0112] A signature encryption module 402, configured to encrypt the first data summary using a private key in a first key pair to obtain a signature, wherein the private key in the first key pair is provided by a second computer device;

[0113] The data encryption module 403 is used to generate a data key, and use the data key to encrypt the data to obtain a data ciphertext;

[0114] A key encryption module 404, configured to encrypt the data key using a public key in a second key pair to obtain a key ciphertext, wherein the public key in the second key pair is provided by the second computer device;

[0115] The sending module 405 is used to send the signature, the data ciphertext and the key ciphertext to the second computer device.

[0116] In some embodiments, the above apparatus further comprises:

[0117] A window acquisition module, configured to acquire the length of a private key in the first key pair, and divide the length of the private key in the first key pair by a first quantity to obtain a first window length;

[0118] A segmentation module, configured to segment the private key in the first key pair based on the first window length to obtain a first number of private key fragments;

[0119] A storage module, used to store a first number of private key fragments into a first number of files respectively;

[0120] The restoration module is used to obtain a first number of private key fragments from a first number of files when using the private key in the first key pair, and restore the private key in the first key pair based on the first number of private key fragments.

[0121] In some embodiments, the window acquisition module is further used to acquire the length of the public key in the second key pair, and divide the length of the public key in the second key pair by the second number to obtain the second window length.

[0122] In some embodiments, the above-mentioned segmentation module is also used to segment the public key in the second key pair based on the second window length to obtain a second number of private key fragments.

[0123] In some embodiments, the storage module is further used to store a second number of private key fragments into a second number of files respectively.

[0124] In some embodiments, the restoration module is further used to obtain a second number of private key fragments from a second number of files when using the public key in the second key pair, and restore the public key in the second key pair based on the second number of private key fragments.

[0125] It should be noted that: when the device provided in the above embodiment performs data processing, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0126] Figure 5 is a block diagram of a data processing device provided according to an embodiment of the present application. The device is used to execute the steps of the above data processing method. Figure 5 , the data processing device comprises:

[0127] A key decryption module 501 is used to decrypt a key ciphertext using a private key in the second key pair to obtain a data key, where the key ciphertext is obtained by encrypting the data key by the first computer device using a public key in the second key pair;

[0128] A data decryption module 502 is used to decrypt the data ciphertext using the data key to obtain the data, where the data ciphertext is obtained by encrypting the data using the data key by the first computer device;

[0129] A compression encryption module 503, used to encrypt data using a compression algorithm to obtain a second data summary, where the compression algorithm is used to convert the data into an irreversible fixed-length value;

[0130] The signature decryption module 504 is used to decrypt the signature using the public key in the first key pair to obtain a first data summary, where the signature is obtained by the first computer device encrypting the first data summary using the private key in the first key pair, where the first data summary is obtained by the first computer device encrypting data using a compression algorithm;

[0131] The judgment module 505 is used to judge whether the data is data sent by the first computer device based on the first data digest and the second data digest.

[0132] In some embodiments, the signature decryption module 504 is further used for: if the signature decryption using the public key in the first key pair fails, data reception fails.

[0133] In some embodiments, the judgment module 505 is further used to: if the first data digest is the same as the second data digest, the data is data sent by the first computer device; if the first data digest is different from the second data digest, the data is not data sent by the first computer device.

[0134] It should be noted that: when the device provided in the above embodiment performs data processing, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0135] Figure 6It is a structural diagram of a computer device provided according to an embodiment of the present application. The computer device 600 may have relatively large differences due to different configurations or performances, and may include one or more CPUs (Central Processing Units, processors) 601 and one or more memories 602, wherein the memory 602 stores at least one computer program, and the at least one computer program is loaded and executed by the processor 601 to implement the data processing methods provided by the above-mentioned various method embodiments. Of course, the computer device may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output, and the computer device may also include other components for implementing device functions, which will not be repeated here.

[0136] The embodiment of the present application also provides a computer-readable storage medium, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor of a computer device to implement the operation performed by the first computer device or the second computer device in the method of the above embodiment. For example, the computer-readable storage medium can be a ROM (Read-Only Memory), a RAM (Random Access Memory), a CD-ROM (Compact Disc Read-Only Memory), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0137] In some embodiments, the computer program involved in the embodiments of the present application may be deployed and executed on a computer device, or on multiple computer devices located at one location, or on multiple computer devices distributed at multiple locations and interconnected by a communication network. Multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain system.

[0138] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer program code, and the computer program code is stored in a computer-readable storage medium. The processor of the computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the data processing method provided in the above various optional implementations.

[0139] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0140] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data processing method, characterized in that: Executed by a first computer device, the method includes: For each data transmission, encrypt the data using a compression algorithm to obtain a first data summary, wherein the compression algorithm is used to convert the data into an irreversible fixed-length value; Encrypt the first data digest using a private key in a first key pair to obtain a signature, wherein the private key in the first key pair is provided by a second computer device; Generate a data key, and use the data key to encrypt the data to obtain data ciphertext; Encrypt the data key using a public key in a second key pair to obtain a key ciphertext, wherein the public key in the second key pair is provided by the second computer device; The signature, the data ciphertext and the key ciphertext are sent to the second computer device.

2. The method according to claim 1, characterized in that: The method further comprises: Obtaining the length of a private key in the first key pair, and dividing the length of the private key in the first key pair by a first quantity to obtain a first window length; Based on the first window length, split the private key in the first key pair to obtain the first number of private key fragments; storing the first number of private key fragments in the first number of files respectively; When the private key in the first key pair is used, the first number of private key fragments are obtained from the first number of files, and the private key in the first key pair is restored based on the first number of private key fragments.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining the length of the public key in the second key pair, and dividing the length of the public key in the second key pair by the second quantity to obtain a second window length; Based on the second window length, split the public key in the second key pair to obtain the second number of private key fragments; storing the second number of private key fragments into the second number of files respectively; When the public key in the second key pair is used, the second number of private key fragments are obtained from the second number of files, and the public key in the second key pair is restored based on the second number of private key fragments.

4. A data processing method, characterized in that: Executed by a second computer device, the method includes: decrypting the key ciphertext using the private key in the second key pair to obtain the data key, wherein the key ciphertext is obtained by encrypting the data key by the first computer device using the public key in the second key pair; Decrypting the data ciphertext using the data key to obtain the data, wherein the data ciphertext is obtained by encrypting the data by the first computer device using the data key; Encrypting the data using a compression algorithm to obtain a second data summary, wherein the compression algorithm is used to convert the data into an irreversible fixed-length value; decrypting the signature using a public key in a first key pair to obtain a first data digest, wherein the signature is obtained by encrypting the first data digest using a private key in the first key pair by the first computer device, and the first data digest is obtained by encrypting the data using the compression algorithm by the first computer device; Based on the first data digest and the second data digest, it is determined whether the data is data sent by the first computer device.

5. The method according to claim 4, characterized in that Decrypting the signature using the public key in the first key pair to obtain the first data summary includes: If the signature fails to be decrypted using the public key in the first key pair, the data reception fails.

6. The method according to claim 4, characterized in that The determining, based on the first data digest and the second data digest, whether the data is data sent by the first computer device comprises: If the first data digest is the same as the second data digest, then the data is data sent by the first computer device; If the first data digest is different from the second data digest, the data is not data sent by the first computer device.

7. A data processing device, characterized in that: The device comprises: A compression encryption module, used for encrypting data using a compression algorithm for each data transmission to obtain a first data summary, wherein the compression algorithm is used for converting the data into an irreversible fixed-length value; A signature encryption module, used to encrypt the first data summary using a private key in a first key pair to obtain a signature, wherein the private key in the first key pair is provided by a second computer device; A data encryption module, used to generate a data key, and use the data key to encrypt the data to obtain a data ciphertext; a key encryption module, used to encrypt the data key using a public key in a second key pair to obtain a key ciphertext, wherein the public key in the second key pair is provided by the second computer device; A sending module is used to send the signature, the data ciphertext and the key ciphertext to the second computer device.

8. A data processing device, characterized in that: The device comprises: A key decryption module, used to decrypt a key ciphertext using a private key in the second key pair to obtain a data key, wherein the key ciphertext is obtained by encrypting the data key by the first computer device using a public key in the second key pair; A data decryption module, used to decrypt the data ciphertext using the data key to obtain the data, wherein the data ciphertext is obtained by encrypting the data by the first computer device using the data key; A compression encryption module, used for encrypting the data using a compression algorithm to obtain a second data summary, wherein the compression algorithm is used for converting the data into an irreversible fixed-length value; a signature decryption module, configured to decrypt a signature using a public key in a first key pair to obtain a first data digest, wherein the signature is obtained by encrypting the first data digest by the first computer device using a private key in the first key pair, and the first data digest is obtained by encrypting the data by the first computer device using the compression algorithm; A judgment module is used to judge whether the data is data sent by the first computer device based on the first data summary and the second data summary.

9. A computer device, characterized in that: The computer device comprises a processor and a memory, wherein the memory is used to store at least one computer program, and the at least one computer program is loaded by the processor to execute the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store at least one computer program, and the at least one computer program is used to execute the method according to any one of claims 1 to 6.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images