Data interaction method and device and readable storage medium

Abstract

The invention discloses a data interaction method and device and a readable storage medium, an electronic device obtains a license file integrated with an encryption and decryption key of a second client, the license file is decrypted by using a private key preset in an SDK to obtain decrypted data, and the decrypted data at least comprises the encryption and decryption key. And when the decryption data indicates that the license file is the license file of the offline version, the electronic equipment verifies whether the license file is valid or not in an offline environment. And when the license file is in a valid state, the electronic equipment encrypts and decrypts the data by using an encryption and decryption key obtained by decrypting the license file so as to perform data interaction with the second client. By adopting the scheme, the encryption and decryption keys are integrated in the license file, so that the encryption and decryption operations are completely processed by the electronic equipment without depending on a third party, and the secure encryption and decryption capability in a network-free environment is realized.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data interaction method, device and readable storage medium. Background Technology

[0002] Currently, with the acceleration of enterprise digital transformation, data interaction between different business systems and between different services of the same business system is becoming increasingly frequent.

[0003] To ensure data security, the data in transit needs to be encrypted and decrypted. A common method is to rely on third-party services for encryption and decryption. For example, a dedicated business system C can be set up as a ciphertext processing center. Business system C's input and output are both ciphertext; only internally within business system C is the ciphertext decrypted into plaintext and processed. Business system A receives encrypted data from business system B and provides it to system C for ciphertext processing.

[0004] However, the aforementioned data interaction relies heavily on third-party services and cannot meet the offline security requirements of confidential scenarios. Summary of the Invention

[0005] This application provides a data interaction method, device, and readable storage medium, which achieves secure encryption and decryption capabilities in a network-free environment by integrating encryption and decryption keys into a license file.

[0006] In a first aspect, this application provides a data interaction method applied to an electronic device, wherein a first client is integrated on the electronic device, and the method includes:

[0007] Obtain a license file, which integrates the encryption and decryption keys of the second client. The encryption and decryption keys are different for different clients.

[0008] The license file is decrypted using a private key pre-installed in the software development kit (SDK) to obtain decrypted data. The decrypted data includes at least the encryption / decryption key, and the private key is shared by different clients.

[0009] When the decrypted data indicates that the license file is an offline version of the license file, verify whether the license file is valid;

[0010] When the license file is valid, the first data is decrypted using the encryption / decryption key to interact with the second client. The first data is data encrypted by the second client using the encryption / decryption key.

[0011] Secondly, this application provides a data interaction device integrated on an electronic device, wherein a first client is integrated on the electronic device, and the data interaction device includes:

[0012] The transceiver module is used to obtain the license file, which integrates the encryption and decryption keys of the second client. The encryption and decryption keys are different for different clients.

[0013] The acquisition module is used to decrypt the license file using a private key pre-installed in the software development kit (SDK) to obtain decrypted data. The decrypted data includes at least the encryption / decryption key, and different clients share the private key.

[0014] The processing module is used to verify whether the license file is valid when the decrypted data indicates that the license file is an offline version of the license file;

[0015] An encryption / decryption module is used to decrypt first data using the encryption / decryption key when the license file is valid, in order to interact with the second client. The first data is data encrypted by the second client using the encryption / decryption key.

[0016] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it causes the electronic device to implement the method described in the first aspect or various possible implementations of the first aspect.

[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which, when executed by a processor, are used to implement the method described in the first aspect or various possible implementations of the first aspect.

[0018] Fifthly, embodiments of this application provide a computer program product comprising a computing program, wherein when the computer program is executed by a processor, it implements the method described in the first aspect or various possible implementations of the first aspect.

[0019] The data interaction method, device, and readable storage medium provided in this application involve an electronic device acquiring a license file that integrates encryption and decryption keys from a second client. The electronic device then decrypts the license file using a private key pre-installed in an SDK to obtain decrypted data, which at least contains the encryption and decryption keys. When the decrypted data indicates that the license file is an offline version, the electronic device verifies the validity of the license file in an offline environment. When the license file is valid, the electronic device uses the encryption and decryption keys obtained from decrypting the license file to encrypt and decrypt the data for data interaction with the second client. This approach integrates the encryption and decryption keys into the license file, allowing the electronic device to handle encryption and decryption operations entirely independently, without relying on a third party, thus achieving secure encryption and decryption capabilities even in offline environments. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the data interaction method provided in this application;

[0022] Figure 2 This is a flowchart illustrating the process of uploading an SDK to a remote database in the data interaction method provided in this application;

[0023] Figure 3 This is a schematic diagram illustrating the process of generating the license file in the data interaction method provided in this application;

[0024] Figure 4 This is another flowchart of the data interaction method provided in this application;

[0025] Figure 5 This is a schematic diagram of the data interaction device provided in this application;

[0026] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] As enterprises accelerate their digital transformation, business systems are becoming increasingly complex and distributed, making secure data interaction across applications and services a necessity. Cross-application, also known as cross-business system interaction, refers to data interaction between business systems. A business system can provide multiple services, and data interaction between different services is called cross-service data interaction. Traditional data protection solutions are often limited to single applications or closed environments, making it difficult to adapt to the security requirements of microservice architectures and Software-as-a-Service (SaaS) multi-tenant scenarios. Especially in heterogeneous environments such as hybrid cloud and edge computing, the frequent data flow between different business systems and services makes existing data protection solutions inadequate.

[0028] To ensure data security, it is urgent to encrypt and decrypt the data during transmission. In traditional solutions, one approach involves the data owner encrypting and decrypting the data. For example, business system A requests data from business system B, and business system B sends the decrypted data back to business system A. This requires mutual trust between business systems A and B, and the ability to access each other's data. In this approach, the data consumer, i.e., business system A, only consumes the data and does not perform any encryption or decryption processing.

[0029] In another approach, an additional business system C is introduced. Business system C can be considered a third-party service, acting as a ciphertext processing center. Both the input and output of this third-party service are ciphertext. In this way, after business system A receives encrypted data from business system B, it provides the encrypted data to system C. Business system C processes the encrypted data into plaintext, performs further processing, and then encrypts it back into ciphertext before providing it to business system A. In this approach, the data consumer, i.e., business system A, only consumes the data and does not perform any encryption or decryption processing.

[0030] In both of these methods, data encryption and decryption heavily rely on the data owner or third-party services, which cannot meet the offline security requirements of confidential scenarios.

[0031] Based on this, this application provides a data interaction method, device, and readable storage medium, which integrates encryption and decryption keys into a license file to achieve secure encryption and decryption capabilities in a network-free environment.

[0032] The executing entity of this application is an electronic device, such as a server. The electronic device can be hardware or software. When the electronic device is hardware, it is a single server or a distributed server cluster composed of multiple servers. When the electronic device is software, it is multiple software modules or a single software module, etc., and this application is not limited thereto. A business system is deployed on the electronic device; a business system is also called an application, and a business system can provide at least two services. Data interaction refers to data interaction between business systems or data interaction between at least two services provided by the same business system.

[0033] In this application, data interaction between business systems and data interaction between services are collectively referred to as data interaction between clients. From the perspective of data interaction between business systems, the first client and the second client are different business systems. From the perspective of data interaction between services, the first client and the second client are different services. When the first client and the second client are different business systems, the first client and the second client can be installed on the same electronic device or on different electronic devices.

[0034] In this application, each client has its own encryption / decryption key, and the encryption / decryption keys are different for different clients. For example, the encryption / decryption key of the first client is integrated into license file 'a'. When the first client sends second data to the second client, it uses its own encryption / decryption key to encrypt the data to be sent to obtain the second data, and then sends the second data to the second client. The second client obtains the first client's license file 'a', decrypts license file 'a' to obtain the first client's encryption / decryption key, and then uses the first client's encryption / decryption key to decrypt the ciphertext.

[0035] For example, the encryption / decryption key of the second client is integrated into the license file b. When the first client obtains the encrypted first data, it retrieves the license text b, decrypts the license file b to obtain the encryption / decryption key of the second client, and then uses the encryption / decryption key of the second client to decrypt the encrypted first data. Here, the first data is the data encrypted by the second client using its own encryption / decryption key.

[0036] In this application, taking the wind farm field as an example, when the first client and the second client are different business systems, i.e. different applications, the first client is, for example, the Green system, which is a cloud platform for the full life cycle design and management of the wind power industry. It aims to optimize the planning, design and operation of wind farms, reduce investment risks and improve economic benefits through big data analysis, high-performance computing and artificial intelligence technologies. The second client is, for example, a load analysis system, which is mainly used for dynamic load simulation, structural optimization and reliability verification of wind turbines and wind farms, as well as providing high-precision simulation capabilities for wind turbine design under complex wind conditions by combining big data and high-performance computing (HPC).

[0037] When the first client and the second client are different services within the same business system, assuming the business system is the Green system, and the Green system provides services including wind resource assessment, micro-site selection, wind turbine layout, and wind farm monitoring, then the first client might be the wind resource assessment service, and the second client might be the micro-site selection service. The first client generates a high-precision wind resource map, and the second client obtains the high-precision wind resource map to perform micro-site selection, i.e., selecting the specific location of the wind turbine generator.

[0038] In the wind farm sector, by integrating standardized SDKs into business systems such as Green, load analysis, and physical models, cross-platform encryption and decryption operations can be performed on shared data files based on a unified license mechanism. The validity of online license files is verified in real time, while offline license files are automatically verified through a pre-set validity period. This ensures the security of core data during transmission and storage, and also standardizes the data interaction process between various business systems.

[0039] In addition to the aforementioned wind farm sector, the data interaction method provided in this application can significantly improve the data security governance capabilities of enterprises under complex IT architectures. Therefore, it is applicable to scenarios such as cross-system transaction data protection in the financial industry, multi-institutional privacy computing in the healthcare field, and end-to-end secure communication between devices and cloud platforms in the industrial internet, providing security guarantees for digital transformation.

[0040] With this approach, the first client and the second client are two different applications, i.e., two different business systems; or, the first client and the second client are two different services under the same application, thus achieving the goal of secure data interaction across applications and services.

[0041] Figure 1 This is a flowchart of the data interaction method provided in this application. The execution subject of this embodiment is the aforementioned electronic device, on which a first client is integrated. This embodiment includes:

[0042] 101. Obtain the license file, which integrates the encryption and decryption keys of the second client. The encryption and decryption keys are different for different clients.

[0043] In this application, the first client interacts with the second client. The second client uses its own encryption and decryption keys to encrypt data to obtain the first data and sends it to the first client. The first client needs to decrypt the encrypted first data from the second client.

[0044] To decrypt the first data, the electronic device pre-acquires and deploys a Software Development Kit (SDK) and a second client's license file. Different clients have different license files, each containing the corresponding encryption / decryption key. These keys are used to encrypt or decrypt data. For example, after receiving encrypted first data from the second client, the first client uses the second client's encryption / decryption key to decrypt the first data. Similarly, when the first client sends second data to the second client, it first uses its own encryption / decryption key to encrypt the data to be sent, resulting in encrypted second data.

[0045] This application does not limit the method by which the electronic device obtains the license file. For example, the electronic device interacts with a license server to obtain the license file from a second client. Alternatively, after the license server generates the license file for the second client, the user downloads the license file and saves it to a USB flash drive. Then, the user inserts the USB flash drive into a terminal device such as a computer, and the terminal device uploads the license file to the electronic device; or, the user directly inserts the USB flash drive into the electronic device, and the electronic device reads the license file from the USB flash drive.

[0046] In this application, an electronic device acquires and deploys multiple license files. For example, a first client and a second client are located on different electronic devices. The electronic device with the first client installed acquires and deploys the license files of both the first and second clients. In this way, the electronic device uses the encryption / decryption key in the first client's license file to encrypt the data to be sent, obtains the second data, and then sends the second data to the second client. Similarly, the first client on the electronic device receives the first data from the second client, encrypted using the encryption / decryption key in the second client's license file, acquires the second client's license file, and decrypts the first data using the second client's encryption / decryption key.

[0047] 102. Decrypt the license file using the private key pre-installed in the software development kit (SDK) to obtain decrypted data. The decrypted data includes at least the encryption / decryption key, and different clients share the private key.

[0048] In this application, the license file is a file generated using a private key encryption. For example, the license server uses the private key to encrypt the client information, environment information, and encryption / decryption key of the first client, thereby obtaining ciphertext, which is the license file. The environment information indicates whether the license file is suitable for offline or online environments.

[0049] When encrypting data from the first client, the electronic device obtains the license file from the first client and decrypts it using the private key built into the SDK to obtain decrypted data. This decrypted data includes at least the encryption and decryption keys. Then, the electronic device uses the encryption and decryption keys from the first client to encrypt the data to be sent, obtaining the second data.

[0050] When decrypting the first data from the second client, the electronic device obtains the license file of the second client, decrypts the license file using the private key built into the SDK to obtain decrypted data, which includes at least the encryption / decryption key. Then, the electronic device uses the encryption / decryption key from the second client to decrypt the first data.

[0051] This application does not limit the content of the decrypted data. Taking the first client as an example, when the license file of the first client is an offline version of the license file, the decrypted data includes the client information, environment information, encryption / decryption key, and validity period of the first client. The client information includes the identifier of the first client, the validity period indicates the effective period of the license file, and the environment information indicates that the license file is used in an offline environment.

[0052] When the license file is an online version, the decrypted data includes client information, environment information, and encryption / decryption keys for the first client. Client information includes the identifier of the first client, and environment information indicates that the license file is intended for a wired environment.

[0053] 103. When the decrypted data indicates that the license file is an offline version of the license file, verify whether the license file is valid.

[0054] This application does not limit the way an electronic device determines whether a license file is a wired or offline version. For example, the electronic device determines whether an expiration date exists in the decrypted data. If the decrypted data contains an expiration date, the electronic device determines that the license file is an offline version; if the decrypted data does not contain an expiration date, the electronic device determines that the license file is an online version.

[0055] For example, an electronic device determines the version of the license file based on environmental information in the decrypted data. When the environmental information indicates an offline environment, the electronic device determines that the license file is an offline version; when the environmental information indicates an online environment, the electronic device determines that the license file is an online version.

[0056] After the electronic device determines that the license file is an offline version, it further verifies the validity of the license file. In one approach, the SDK includes a preset expiration date. If the expiration date is less than the preset date, the electronic device considers the license file valid. For example, if the preset expiration date is August 7, 2025, and the expiration date is August 6 or 7, 2025, then the license file is valid; if the expiration date is August 8, 2025, then the license file is invalid.

[0057] In another approach, the electronic device uses the SDK to obtain the current time. If the current time is less than or equal to the expiration date, the license file is considered valid; if the current time is greater than the expiration date, the license file is considered invalid. For example, if the expiration date is August 7, 2025, and the current time is August 6 or 7, 2025, the license file is valid; if the expiration date is August 8, 2025, the license file is invalid.

[0058] This approach eliminates the need for interaction with the license server to verify the license file. Instead, it verifies the license file's validity within the SDK, resulting in high speed and accuracy. It achieves the goal of verifying license files in an offline environment.

[0059] 104. When the license file is valid, the first data is decrypted using the encryption / decryption key to interact with the second client. The first data is data encrypted by the second client using the encryption / decryption key.

[0060] When the second client's license file is valid, the electronic device uses the encryption / decryption key obtained by decrypting the license file to decrypt the first data in order to interact with the second client. This first data is obtained by the second client using its own encryption / decryption key to encrypt data, and is data acquired by the electronic device before it obtains the second client's license file.

[0061] Furthermore, when the first client sends data to the second client, and the second client needs to verify the validity of the first client's license file in an offline environment, the first client encrypts the data to be sent using its own offline encryption / decryption key to obtain the second data, and sends the second data to the second client. The second client obtains the first client's license file, decrypts the license file using a preset private key to obtain the first client's offline encryption / decryption key, verifies the first client's license file, and if the license file is valid, decrypts the second data using the first client's encryption / decryption key.

[0062] When the license file is invalid, the electronic device is prohibited from using the encryption / decryption key.

[0063] The data interaction method provided in this application involves an electronic device acquiring a license file that integrates encryption and decryption keys from a second client. The electronic device then decrypts the license file using a private key pre-installed in an SDK to obtain decrypted data, which at least contains the encryption and decryption keys. When the decrypted data indicates that the license file is an offline version, the electronic device verifies the validity of the license file in an offline environment. When the license file is valid, the electronic device uses the encryption and decryption keys obtained from decrypting the license file to encrypt and decrypt the data for data interaction with the second client. This approach integrates the encryption and decryption keys into the license file, allowing the electronic device to handle encryption and decryption operations entirely on its own, without relying on a third party, thus achieving secure encryption and decryption capabilities in offline environments. Furthermore, a dynamic license mechanism enables secure synchronization of encryption and decryption keys in a distributed environment, allowing the electronic device to acquire and install multiple license files as needed, and enabling multiple clients to seamlessly share encryption and decryption capabilities.

[0064] In the above embodiments, when the decryption data indicates that the second client's license file is an offline version, the electronic device verifies whether the license file is valid. If the license file is valid, the encryption / decryption key in the license file is used for further encryption or decryption. If the license file is invalid, the electronic device prevents the first client from using the second client's encryption / decryption key to decrypt the first data, thus preventing the first client from further decrypting the first data.

[0065] In addition, the decrypted data also carries the status of the license file, which can be either active or inactive. When the decrypted data indicates that the license file is inactive, the electronic device prevents the first client from using the second client's encryption / decryption key to decrypt the first data, thus preventing the first client from further decrypting the first data.

[0066] Similarly, when the decrypted data indicates that the first client's license file is an offline version, and verification reveals that the license file is invalid or unavailable, the electronic device prevents the first client from using its own encryption / decryption key to encrypt data, thus preventing the first client from generating further second data.

[0067] This approach automatically prevents electronic devices from using encryption or decryption keys when the license file becomes invalid or unavailable, forming a complete security loop and improving the security of data interaction.

[0068] In the above embodiments, when the license file is an offline version, the electronic device verifies its validity or usability in an offline environment. When the license file is an online version, the electronic device performs online verification. During online verification, the electronic device sends a verification request to the license server, requesting the server to verify the license file online. Afterward, the electronic device receives a verification response from the license server, indicating whether the license file is valid.

[0069] For example, for an online version of a license file, the electronic device interacts with the license server to request verification of the license file's validity. Upon receiving the verification request, the license server performs basic checks, identity and permission verifications, etc., on the online version of the license file to determine its validity. Basic checks include field integrity verification, while identity and permission verification includes digital signature verification and blacklist checks. After verification, the license server sends a verification response to the electronic device, indicating whether the license file is valid.

[0070] With this approach, when the license file is an online version, the electronic device interacts with the license server to verify the validity of the license file, making it compatible with both offline and online environments and expanding the applicability of the data interaction method.

[0071] In the above embodiments, regardless of whether the environment is online or offline, data encryption and decryption are performed by the SDK of the data consumer. That is, when the first client sends data to the second client, it uses the encryption / decryption key of the first client to encrypt the data to be sent to obtain the second data and then sends it; when the first client receives the first data, which is in an encrypted state, from the second client, it uses the encryption / decryption key of the second client to decrypt the first data. Obviously, the data interaction method provided by this application does not rely on a third party, and the data flowing between clients is in an encrypted state, which provides high security. In other words, by deploying the SDK on the electronic device, when the electronic device obtains the license file, the SDK completes the verification of the license file, data encryption, and data decryption, thereby making data interaction no longer dependent on a third party. Even in an online environment, the third-party license server only verifies the validity of the license file online, without relying on a third party for data encryption and decryption.

[0072] The data interaction method provided in this application mainly includes a pre-processing stage, a generation stage, and a deployment and execution stage. These three stages are described in detail below.

[0073] Chief, preliminary stage.

[0074] The main task of the pre-deployment phase is to deploy the SDK on electronic devices. During deployment, the electronic device downloads the target utility package from a remote database based on the SDK version it supports. Based on the electronic device's operating system, it determines the target binary file from the target utility package and calls the autoload script within the target utility package to load the target binary file, thereby installing the toolkit. The remote database stores utility packages for different versions of the SDK. Each utility package is a package of multiple binary files and autoload scripts, with different binary files corresponding to different operating systems.

[0075] In this application, SDK is also referred to as the standardized Python SDK. To prevent insufficient SDK security from leading to the leakage of encryption and decryption keys, and to meet the requirements of modern distributed architectures that support cross-platform and cross-application, the security server pre-generates different wheel packages for different SDK versions and stores these wheel packages in a remote database. When an electronic device requires a wheel package, it downloads the target wheel package from the remote database based on its supported SDK version. The process of the security service uploading wheel packages to the remote database is described in detail below. For an example, please refer to... Figure 2 , Figure 2 This is a flowchart of uploading an SDK to a remote database in the data interaction method provided in this application.

[0076] Please refer to Figure 2 The security server includes an encryption module and a packaging module. This embodiment includes:

[0077] 201. Compile to generate binary files.

[0078] In this application, the SDK versions include SDK version 3.10, SDK version 3.6, etc., and electronic devices often support one of these SDK versions. Different electronic devices use different operating systems, including but not limited to Windows, Linux, and macOS. For each version and corresponding operating system, the security protection server uses compilation technologies such as Cython to convert core components such as the key derivation module and encryption / decryption interfaces into binary files adapted to the corresponding operating system. For example, for SDK version 3.10, a binary file with the .pyc extension is generated for Windows; and a binary file with the .so extension is generated for Linux and macOS, thus achieving source code-level protection.

[0079] The cryptographic derivation module is used to decrypt the license file using the private key to obtain the encryption / decryption key, while the encryption / decryption interface is used to encrypt or decrypt data.

[0080] 202. The encryption module sends the binary file to the packaging module.

[0081] 203. The packaging module packages the binary file and the auto-loading script to obtain the wheel package.

[0082] For each version of the SDK, the electronic device packages the corresponding binary files for various operating systems and the autoloader script into a standard wheel package, which has the .whl extension. The autoloader script (loader.py) is used to load the compatible target binary files.

[0083] Taking SDKs including versions 3.6 and 3.10 as an example, the packaging module packages each binary file and the autoloading script to obtain two packages, namely the package corresponding to version 3.6 SDK and the package corresponding to version 3.10 SDK, which are represented by Py3.6.whl and Py3.10whl respectively.

[0084] 204. The packaging module uploads the wheel package to the remote database.

[0085] After the packaging module obtains the corresponding wheel packages for each SDK version,

[0086] Based on this preliminary stage, when the electronic device subsequently executes the data interaction method, it downloads the target utility package from the remote database according to the SDK version supported by the electronic device. For example, if the electronic device supports SDK version 3.10, the target utility package is the utility package corresponding to SDK version 3.10, and the electronic device downloads the utility package corresponding to SDK version 3.10 from the remote database.

[0087] Next, the electronic device further determines the target binary file from the target wheel package based on its operating system. For example, if the target wheel package contains binary files corresponding to Windows, Linux, and Mac OS, and the electronic device's operating system is Windows, then the target binary file will be the binary file corresponding to Windows.

[0088] Once the target binary file is identified, the electronic device uses the autoload script in the target toolkit to load the target binary file, which is the binary file corresponding to the Windows operating system, thereby installing the SDK on the electronic device. Afterwards, during data exchange, the electronic device uses the SDK to verify the license file, decrypt the first piece of data, or encrypt the second piece of data, etc.

[0089] In this application, the cross-platform nature of the SDK allows it to be embedded in various electronic devices for use by various clients. Once the SDK is installed on an electronic device, all business systems and services on that device can use the SDK, thereby ensuring data consistency protection throughout the entire chain, including application programming interfaces (APIs), message queues, and file transfers.

[0090] This approach enables electronic devices to achieve source-code-level encryption based on compilation technologies such as Cython, effectively protecting the key derivation process and core interfaces from reverse engineering and improving data interaction security. Furthermore, standardized SDK integration facilitates rapid integration with various business systems, and the security protection system based on Cython compilation and runtime environment detection forms a multi-layered defense mechanism.

[0091] Optionally, in the above embodiments, when the license file is valid, during the process of the electronic device using the encryption / decryption key to decrypt the first data to interact with the second client, an encryption / decryption interface is established using the toolkit, and the first data is provided to the encryption / decryption interface so that the encryption / decryption interface can decrypt the first data using the encryption / decryption key. The encryption / decryption interface supports multiple data formats.

[0092] For example, the target binary file is a binary file compiled by the security server using Cython technology, converting core components such as the key derivation module and encryption / decryption interface into a binary file adapted to the corresponding operating system. After the electronic device obtains the binary file, it establishes an encryption / decryption interface based on the binary file. This interface is used to decrypt the first data or encrypt the data to be sent to obtain the second data. The data formats supported by this encryption / decryption interface include, but are not limited to, files, characters, and data streams. The supported encryption / decryption algorithms include, but are not limited to, the Advanced Encryption Standard with 256-bit key (AES-256) algorithm and the ShangMi4 (SM4) algorithm.

[0093] When decrypting data, the electronic device provides the first data to the encryption / decryption interface, which then uses the encryption / decryption key to decrypt the first data. When encrypting data, the electronic device provides the data to be sent to the encryption / decryption interface, which then uses the encryption / decryption key to encrypt the data to be sent to obtain the second data. The encryption algorithms used in the encryption process include, but are not limited to, AED-256 and SM4 encryption / decryption algorithms. The first and second data include, but are not limited to, files, characters, and data streams.

[0094] Verification revealed that this application, based on a standardized SDK, supports multiple data formats including files, characters, and data streams, and supports various encryption and decryption algorithms. Through dynamic loading technology, it adapts to multiple operating systems such as Windows and Linux, reducing encryption and decryption compatibility issues by 70% and deployment costs by 60%, making it particularly suitable for complex IT environments such as hybrid clouds. Furthermore, it employs Cython compilation technology to achieve binary encapsulation of core modules, combined with runtime environment detection mechanisms to form multi-layered protection. Security tests show that this solution can effectively resist over 99% of decompilation attacks, and the risk of key leakage is reduced by two orders of magnitude compared to conventional solutions.

[0095] This approach establishes an encryption / decryption interface, enabling data encryption and decryption based on this interface. This supports multiple data formats and encryption / decryption algorithms, thereby improving the flexibility of data interaction and expanding its applicability.

[0096] Secondly, the generation phase.

[0097] In this application, the generation stage is essentially a preliminary step. The main task of this stage is to generate encryption and decryption keys for the client, and then generate the license file.

[0098] This application does not limit the triggering conditions for generating the license file. For example, when an electronic device carrying the first client needs to decrypt the first data, it sends an acquisition request to the license service to request the license file and receives an acquisition response from the license server. The license file is generated by the license server after receiving the acquisition request. The acquisition request carries the client information and environment information of the second client. When the environment information indicates an offline environment, the license file is generated by the license server based on the client information, the encryption / decryption key, and the environment information. The acquisition response carries the license file.

[0099] Figure 3 This is a schematic diagram illustrating the license file generation process in the data interaction method provided in this application. Please refer to... Figure 3 This embodiment includes an application stage, an approval stage, and a generation stage. The application stage includes step 301; the approval stage includes step 302; and the generation stage includes steps 303 to 310.

[0100] 301. Fill out the application request.

[0101] Users can fill out the application request via a terminal device, or fill out the request based on a pre-installed template on their electronic device. The information provided includes, but is not limited to, client information and environment information. Client information includes the client identifier and the version of the SDK supported by the client. Environment information indicates whether the license file is intended for an offline or online environment.

[0102] 302. The administrator approves the application request. If the approval is successful, proceed to step 303; otherwise, the process ends.

[0103] After a user or electronic device submits an application request, the administrator determines whether to approve it based on user permissions, client permissions, and other factors. A multi-level administrator system can be designed, with subsequent steps (303) only executed after each level of approval has been completed.

[0104] 303. The license server checks whether the client has registered. If the client has not registered, proceed to step 304; if the client has registered, proceed to step 308.

[0105] In this application, the client can be a business system or a service under a business system, thereby realizing fine-grained access control under a microservice architecture, and different business systems or services may obtain data access permissions as needed.

[0106] 304. Register the client and generate a random encryption / decryption key for the client.

[0107] In this step, the license server registers the client and generates a unique key for the client, i.e., the encryption and decryption key, based on environmental information and other factors using a cryptographically secure pseudo-random number generator.

[0108] 305. Determine whether the environment indicated by the environment information is an offline environment or an online environment. If the environment indicated by the environment information is an offline environment, proceed to step 306; if the environment indicated by the environment information is an online environment, proceed to step 307.

[0109] 306. Generate an offline version of the license file.

[0110] The license server uses a private key to encrypt client information, encryption / decryption keys, environment information, and validity period to obtain an offline version of the license file. The environment information indicates that the license file is suitable for offline environments.

[0111] 307. Generate the online version of the license file.

[0112] The license server uses a private key to encrypt client information, encryption / decryption keys, and environment information to obtain an online version of the license file. The environment information indicates that the license file is suitable for online environments.

[0113] 308. Determine whether the environment indicated by the environment information is an offline environment or an online environment. If the environment indicated by the environment information is an offline environment, proceed to step 309; if the environment indicated by the environment information is an online environment, proceed to step 310.

[0114] 309. Determine if the offline version of the license file exists. If the offline version of the license file exists, the process ends; otherwise, proceed to step 306.

[0115] 310. Determine if the online version's license file exists. If the online version's license file exists, the process ends; otherwise, proceed to step 307.

[0116] In this application, during the generation phase, offline or online versions of license files can be generated for any business system or any service, and these license files are stored on a license server.

[0117] During the deployment and execution phase, after the first client receives the encrypted first data from the second client, the electronic device carrying the first client obtains the license file of the second client from the license server, decrypts the license file using a pre-set private key to obtain the encryption and decryption key of the second client, and uses the encryption and decryption key to decrypt the first data.

[0118] Similarly, when the first client needs to send data to the second client, the electronic device carrying the first client obtains the first client's license file from the license server, decrypts the license file using a pre-set private key to obtain the first client's encryption / decryption key, and uses the encryption / decryption key to encrypt the data to be sent, thereby obtaining the second data.

[0119] Please refer to Figure 3During the generation phase, the application request includes client information, environment information, etc. After multi-level approval by the administrator, the license server generates a client-specific key, i.e., an encryption / decryption key, based on a password-secure pseudo-random number generator. The encryption / decryption key is then bound to the client information, and a license file is generated through an encryption algorithm. An expiration date is added to the offline version of the license file to ensure secure data encryption and decryption operations can be performed even in a network environment, thus effectively solving the technical problem that traditional solutions cannot support offline environments.

[0120] Verification revealed that the data interaction method provided in this application innovatively constructs a dynamic license system that supports both offline and online modes. It achieves full lifecycle management of keys through a cryptographically secure pseudo-random number generator and a multi-level approval mechanism, so that data encryption and decryption operations in confidential environments no longer depend on network connections. At the same time, it improves the efficiency of cross-service and cross-application key synchronization by 90%, solving the problem of environmental adaptability defects in traditional solutions.

[0121] This approach relies on a third-party license server to generate license files for each client only during the generation phase. In the subsequent deployment and execution phase, the electronic device obtains the client's license file and performs data interactions based on it without relying on a third-party license server, thus achieving secure encryption and decryption capabilities in offline environments.

[0122] Finally, the deployment and execution phase.

[0123] The main task of this stage is to obtain the license file required by the electronic device and to perform data interaction based on the encryption and decryption keys integrated in the license file. For example, please refer to... Figure 4 .

[0124] Figure 4 This is another flowchart of the data interaction method provided in this application. Please follow... Figure 4 The electronic device includes a deployment module and an SDK module. The deployment module obtains the license file, while the SDK module downloads the target utility package from a remote database based on the SDK version supported by the electronic device, identifies the target binary file from the target utility package based on the electronic device's operating system, and calls the auto-loading script within the target utility package to load the target binary file for installation. After the deployment module obtains and deploys the license file, and the SDK module installs the SDK, data interaction is performed. Figure 4 The illustrated embodiment includes the following steps:

[0125] 401. Configure the license file.

[0126] Electronic devices interact with the license server to obtain and configure the license file; alternatively, users can copy the license file from the license server using a USB flash drive or similar device, insert the USB flash drive into the electronic device, and the electronic device will read and configure the license file from the USB flash drive.

[0127] 402. Use the built-in private key to decrypt the license file to obtain the decrypted data.

[0128] 403. Determine the version of the license file based on the decrypted data. If the license file is an offline version, proceed to step 404; if the license file is an online version, proceed to step 405.

[0129] 404. Verify the validity of the license file based on its expiration date. If the license file is valid, proceed to step 405; if the license file is invalid, proceed to step 406.

[0130] 405. Use encryption / decryption keys to encrypt or decrypt data.

[0131] 406. Electronic devices are prohibited from using encryption / decryption keys.

[0132] 407. The license server verifies whether the online version of the license file is valid. If the license file is valid, proceed to step 405; if the license file is invalid, proceed to step 406.

[0133] For example, an electronic device sends a verification request to a license server. This verification request, such as a Hypertext Transfer Protocol (HTTP) request, requests the license server to verify the license file online.

[0134] The electronic device receives a verification response from the license server. This verification response indicates whether the license file is valid. If the license file is valid, proceed to step 405; if the license file is invalid, proceed to step 406.

[0135] Understandable, Figure 4Even if the license file deployed by the deployment module in step 401 has a problem, the subsequent SDK module can still detect it. For example, the first client is Green, and the first client needs to send data to the second client, but the license file is the license file of the load analysis system. The SDK uses its built-in private key to decrypt the license file to obtain decrypted data. This decrypted data contains the client information of the load analysis system and the encryption / decryption key of the load analysis system. The SDK knows the client information of the first client, and by comparing the client information in the decrypted data with the client information of the first client, it can find that the license file is incorrect.

[0136] For example, the first client is Green, and the second client is the load analysis system. The first client receives encrypted first data from the second client and needs to decrypt this first data, therefore it needs to obtain the second client's license file. Assume the license file deployed by the deployment module is the physical model system's license file. The SDK uses its built-in private key to decrypt the license file to obtain decrypted data, which contains the physical model system's client information and the physical model system's encryption / decryption key. Clearly, this encryption / decryption key cannot decrypt the first data.

[0137] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0138] Figure 5 This is a schematic diagram of the data interaction device provided in this application. The data interaction device is integrated on an electronic device, which integrates a first client. The data interaction device 500 includes: a transceiver module 51, an acquisition module 52, a processing module 53, and an encryption / decryption module 54.

[0139] The transceiver module 51 is used to obtain a license file, which integrates the encryption and decryption keys of the second client. The encryption and decryption keys of different clients are different.

[0140] The acquisition module 52 is used to decrypt the license file using a private key pre-installed in the software development kit (SDK) to obtain decrypted data. The decrypted data includes at least the encryption / decryption key, and the private key is shared by different clients.

[0141] Processing module 53 is used to verify whether the license file is valid when the decrypted data indicates that the license file is an offline version of the license file;

[0142] The encryption / decryption module 54 is used to decrypt first data using the encryption / decryption key when the license file is valid, so as to interact with the second client. The first data is data encrypted by the second client using the encryption / decryption key.

[0143] In one feasible implementation, before the acquisition module 52 decrypts the license file using a private key pre-installed in the Software Development Kit (SDK) to obtain decrypted data, the processing module 63 is further configured to download a target utility package from a remote database according to the SDK version supported by the electronic device. The remote database stores utility packages for different versions of the SDK. Each utility package is encapsulated from multiple binary files and an autoloading script, with different binary files corresponding to different operating systems. The target binary file is determined from the target utility package based on the operating system of the electronic device. The autoloading script in the target utility package is then invoked to load the target binary file to install the utility package.

[0144] In one feasible implementation, when the license file is valid, the processing module 63 uses the encryption / decryption key to decrypt the first data to interact with the second client, and then uses the toolkit to establish an encryption / decryption interface, which supports multiple data formats; and provides the first data to the encryption / decryption interface so that the encryption / decryption interface can decrypt the first data using the encryption / decryption key.

[0145] In one feasible implementation, the processing module 53 is used to obtain the current time using the SDK; when the current time is less than or equal to the validity period, the license file is determined to be valid, and the validity period is included in the decrypted data.

[0146] In one feasible implementation, the transceiver module 51 is further configured to send a verification request to the license server when the decrypted data indicates that the license file is an online version of the license file, in order to request the license server to verify the license file online; and receive a verification response from the license server, the verification response being used to indicate whether the license file is valid.

[0147] In one feasible implementation, the transceiver module 51 is used to send an acquisition request to the license service to request the license file. The license file is generated by the license server after receiving the application request. The application request carries the client information and environment information of the second client. When the environment information indicates an offline environment, the license file is generated by the license server based on the client information, the encryption / decryption key, and the environment information. The transceiver module 51 receives an acquisition response from the license server, which carries the license file.

[0148] In one feasible implementation, the processing module 53 is further configured to prohibit the use of the encryption / decryption key when the license file is unavailable.

[0149] In one feasible implementation, the first client and the second client are two different applications; or, the first client and the second client are two different services under the same application.

[0150] The data interaction device provided in this application embodiment can perform the actions of the electronic device in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0151] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. The electronic device 600 includes:

[0152] Processor 61 and memory 62;

[0153] The memory 62 stores computer instructions;

[0154] The processor 61 executes the computer instructions stored in the memory 62, causing the processor 61 to perform the log collection method implemented as described above for edge clusters or central clusters.

[0155] The specific implementation process of processor 61 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0156] Optionally, the electronic device 600 also includes a communication component 63. The processor 61, memory 62, and communication component 63 can be connected via a bus 64.

[0157] This application also provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, are used to implement the data interaction method described above.

[0158] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the data interaction method described above.

[0159] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0160] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A data interaction method, characterized in that, Applied to an electronic device, wherein a first client is integrated on the electronic device, the method includes: Obtain a license file, which integrates the encryption and decryption keys of the second client. The encryption and decryption keys are different for different clients. The license file is decrypted using a private key pre-installed in the software development kit (SDK) to obtain decrypted data. The decrypted data includes at least the encryption / decryption key, and the private key is shared by different clients. When the decrypted data indicates that the license file is an offline version of the license file, verify whether the license file is valid; When the license file is valid, the first data is decrypted using the encryption / decryption key to interact with the second client. The first data is data encrypted by the second client using the encryption / decryption key.

2. The method according to claim 1, characterized in that, Before using the private key pre-installed in the Software Development Kit (SDK) to decrypt the license file and obtain the decrypted data, the process also includes: Download the target toolkit from a remote database according to the SDK version supported by the electronic device. The remote database stores toolkits for different versions of the SDK. The toolkit is a package of multiple binary files and autoloading scripts. Different binary files correspond to different operating systems. The target binary file is determined from the target wheel package based on the operating system of the electronic device; The autoload script in the target wheel package is invoked to load the target binary file in order to install the toolkit.

3. The method according to claim 2, characterized in that, When the license file is valid, the first data is decrypted using the encryption / decryption key to interact with the second client, including: The toolkit is used to establish an encryption / decryption interface, which supports multiple data formats; The first data is provided to the encryption / decryption interface so that the encryption / decryption interface decrypts the first data using the encryption / decryption key.

4. The method according to any one of claims 1 to 3, characterized in that, When the decrypted data indicates that the license file is an offline version, verifying the validity of the license file includes: Use the SDK to obtain the current time; When the current time is less than or equal to the validity period, the license file is determined to be valid, and the validity period is included in the decrypted data.

5. The method according to any one of claims 1 to 4, characterized in that, Also includes: When the decrypted data indicates that the license file is an online version of the license file, a verification request is sent to the license server to request the license server to verify the license file online; Receive a verification response from the license server, the verification response indicating whether the license file is valid.

6. The method according to any one of claims 1 to 4, characterized in that, The obtained license file includes: A request is sent to the license service to request the license file. The license file is generated by the license server after receiving the request. The request carries the client information and environment information of the second client. When the environment information indicates an offline environment, the license file is generated by the license server based on the client information, the encryption / decryption key, and the environment information. Receive a response from the license server, the response carrying the license file.

7. The method according to any one of claims 1 to 4, characterized in that, Also includes: The encryption / decryption key is prohibited when the license file is unavailable.

8. The method according to any one of claims 1 to 4, characterized in that, The first client and the second client are two different applications; or, The first client and the second client are two different services under the same application.

9. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it causes the electronic device to implement the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 8.

Images