Data transmission method and device, equipment, storage medium and program product

Abstract

The invention provides a data transmission method, which can be applied to the financial field, and comprises the following steps: identifying to-be-transmitted service data corresponding to a service request, and determining a first type of data and a second type of data in the to-be-transmitted service data, the first type of data being service data containing sensitive fields, and the second type of data being service data containing non-sensitive fields; performing first encryption processing on a first type of data in the to-be-transmitted service data to obtain a partially encrypted service data body; assembling the service request context and the partially encrypted service data volume to obtain a complete data packet to be subjected to signature verification; calculating a message authentication code for the complete data packet through the symmetric key of the current session, and adding the message authentication code into the complete data packet to generate a target data packet to be transmitted; and performing second encryption processing on the to-be-transmitted target data packet through the symmetric key, and sending the to-be-transmitted target data packet to the server. The invention further provides a data transmission device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] This disclosure relates to the field of encrypted transmission technology, which can be applied to the financial sector, and more specifically to a data transmission method, apparatus, device, storage medium, and program product. Background Technology

[0002] In the financial sector, within financial applications and online banking systems, data transmission during business request processing must ensure overall communication security while also meeting the additional protection requirements for sensitive fields, and balancing performance and compliance requirements. Traditional static key data transmission methods are often insufficiently secure, susceptible to security threats such as data tampering or leakage. Existing technologies typically employ full-message encryption, which is not only computationally expensive but also involves complex key management, making it difficult to achieve efficient data exchange and business processing while ensuring security. Summary of the Invention

[0003] In view of the above problems, this disclosure provides a data transmission method, apparatus, device, storage medium, and program product.

[0004] According to a first aspect of this disclosure, a data transmission method is provided, applied to a client, comprising: identifying business data to be transmitted corresponding to a business request; determining a first type of data and a second type of data in the business data to be transmitted, wherein the first type of data is business data containing sensitive fields and the second type of data is business data containing non-sensitive fields; performing a first encryption process on the first type of data in the business data to be transmitted to obtain a partially encrypted business data body; assembling a business request context with the partially encrypted business data body to obtain a complete data packet to be verified; calculating a message authentication code on the complete data packet using the symmetric key of the current session, and appending the message authentication code to the complete data packet to generate a target data packet to be transmitted; performing a second encryption process on the target data packet to be transmitted using the symmetric key, and sending it to a server via a network.

[0005] According to a second aspect of this disclosure, a data transmission method is provided, applied to a server, comprising: decrypting a received encrypted target data packet using a symmetric key shared with a client to obtain a partially encrypted business data body, a business request context, and a message authentication code; validating a business request based on the partially encrypted business data body, the business request context, and the message authentication code to obtain a verification result; and, if the verification result is successful, performing decryption processing corresponding to the first encryption processing on a first type of data in the partially encrypted business data body to obtain the original business data to be transmitted, thereby completing the business request processing.

[0006] According to an embodiment of this disclosure, a first encryption process is performed on a first type of data in the service data to be transmitted, including: encrypting the first type of data using a target key, wherein the target key is a key isolated from the symmetric key.

[0007] According to embodiments of this disclosure, decryption processing corresponding to the first encryption processing is performed on a first type of data in a partially encrypted business data body, including: when the symmetric key is uncertain, the server decrypts the sensitive fields of the first type of data by calling a decryption service corresponding to the target key.

[0008] According to embodiments of this disclosure, the business request context includes a timestamp and an encryption algorithm version identifier. Based on the partially encrypted business data body, the business request context, and the message authentication code, the validity of the business request is verified, including: verifying whether the difference between the timestamp and the current time is within a preset time window to complete the time validity verification; verifying whether the encryption algorithm represented by the version identifier is supported by the server and is enabled to complete the version compatibility verification; and recalculating the message authentication code on the decrypted partially encrypted business data body and business request context using a symmetric key, and comparing it with the message authentication code sent by the client to complete the data integrity verification.

[0009] According to embodiments of this disclosure, the method includes: terminating data transmission if any one of the verification results—time validity verification, version compatibility verification, and data integrity verification—fails.

[0010] According to embodiments of this disclosure, before verifying the validity of a business request, the method further includes: obtaining an initial dynamic token generated by the client from the business request context, wherein the initial dynamic token is generated by the client based on a device fingerprint, a timestamp, and a symmetric key; regenerating a target dynamic token using the same algorithm as the client based on device information, a timestamp, and a symmetric key; and comparing the initial dynamic token with the target dynamic token.

[0011] According to embodiments of this disclosure, the method further includes: generating a symmetric key for the next data transmission, encrypting it together with the business request processing result using the current symmetric key, and sending it to the client, so as to realize the update of the transmission key after each business request.

[0012] According to a third aspect of this disclosure, a data transmission apparatus is provided, comprising: a client processing module, configured to identify business data to be transmitted corresponding to a business request, determine a first type of data and a second type of data in the business data to be transmitted, wherein the first type of data is business data containing sensitive fields, and the second type of data is business data containing non-sensitive fields; perform a first encryption process on the first type of data in the business data to be transmitted to obtain a partially encrypted business data body; assemble a business request context with the partially encrypted business data body to obtain a complete data packet to be verified; calculate a message authentication code on the complete data packet using the symmetric key of the current session, and append the message authentication code to the complete data packet to generate a data packet to be transmitted. The target data packet is sent; a second encryption process is performed on the target data packet to be transmitted using a symmetric key, and then sent to the server via the network; the server processing module is used to decrypt the received encrypted target data packet using a symmetric key shared with the client to obtain a partially encrypted business data body, a business request context, and a message authentication code; based on the partially encrypted business data body, the business request context, and the message authentication code, the validity of the business request is verified to obtain a verification result; if the verification result is successful, the first type of data in the partially encrypted business data body is decrypted according to the first encryption process to obtain the original business data to be transmitted, thereby completing the business request processing.

[0013] A fourth aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] The fifth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] A sixth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 This diagram schematically illustrates an application scenario of the data transmission method according to an embodiment of the present disclosure.

[0018] Figure 2 A flowchart illustrating a method for data transmission by a client according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 3 A flowchart illustrating a method for data transmission by a server according to an embodiment of the present disclosure is shown schematically.

[0020] Figure 4 This illustration schematically shows a flowchart of a service request validity verification process performed by a server according to an embodiment of the present disclosure.

[0021] Figure 5 This illustration schematically shows a flowchart of a server performing dynamic token authentication according to an embodiment of the present disclosure;

[0022] Figure 6 A schematic block diagram of a data transmission apparatus according to an embodiment of the present disclosure is shown; and

[0023] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a data transmission method according to an embodiment of the present disclosure. Detailed Implementation

[0024] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0025] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, and necessary measures have been taken to ensure that they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0026] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0027] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0028] Embodiments of this disclosure provide a data transmission method applied to a client, comprising: identifying business data to be transmitted corresponding to a business request; determining a first type of data and a second type of data in the business data to be transmitted, wherein the first type of data is business data containing sensitive fields and the second type of data is business data containing non-sensitive fields; performing a first encryption process on the first type of data in the business data to be transmitted to obtain a partially encrypted business data body; assembling the business request context and the partially encrypted business data body to obtain a complete data packet to be verified; calculating a message authentication code on the complete data packet using the symmetric key of the current session, and appending the message authentication code to the complete data packet to generate a target data packet to be transmitted; performing a second encryption process on the target data packet to be transmitted using the symmetric key, and sending it to the server via the network.

[0029] Embodiments of this disclosure also provide a data transmission method applied to a server, comprising: decrypting a received encrypted target data packet using a symmetric key shared with the client to obtain a partially encrypted business data body, a business request context, and a message authentication code; validating the business request based on the partially encrypted business data body, the business request context, and the message authentication code to obtain a verification result; and, if the verification result is successful, performing decryption processing corresponding to the first encryption processing on a first type of data in the partially encrypted business data body to obtain the original business data to be transmitted, thereby completing the business request processing.

[0030] Through the embodiments of this disclosure, the method identifies and classifies data to be transmitted on the client side using a layered encryption and dynamic verification mechanism. Only sensitive fields are encrypted with high strength, while non-sensitive fields remain in plaintext or are processed lightly, thereby reducing encryption and decryption overhead while ensuring the security of core data. After the business data and request context are assembled, overall encryption and message authentication code verification are performed using a session symmetric key to ensure data integrity and tamper-proofness during transmission. The server decrypts sensitive data only after verifying time validity, algorithm version compatibility, and data integrity, achieving end-to-end security and controllability. This method not only improves the security of data transmission but also enhances system reliability, meeting the high security requirements for data transmission.

[0031] Figure 1 The diagram illustrates an application scenario of the data transmission method according to an embodiment of the present disclosure.

[0032] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0033] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the data transmission method provided in this embodiment can generally be executed by server 105. Correspondingly, the data transmission device provided in this embodiment can generally be located in server 105. The data transmission method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the data transmission device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-5 The data transmission method of the disclosed embodiments will be described in detail.

[0039] Figure 2 A flowchart illustrating a method for data transmission by a client according to an embodiment of the present disclosure is shown.

[0040] like Figure 2 As shown, the data transmission method applied to the client may further include operations S210 to S250.

[0041] In operation S210, the service data to be transmitted corresponding to the service request is identified, and the first type of data and the second type of data in the service data to be transmitted are determined. The first type of data is service data containing sensitive fields, and the second type of data is service data containing non-sensitive fields.

[0042] In the embodiments of this disclosure, in business scenarios with high security requirements, such as finance, secure data transmission requires confidentiality and integrity. For example, when the client is a computer, mobile phone, or other device, an application on these devices initiates a business request and transmits it to the backend server. The backend server can analyze and process the received business request and other data, and then feed the processing results back to the terminal device.

[0043] Specifically, on the client side, the business data to be transmitted corresponding to the business request is first identified to determine that some of the data to be transmitted is of the first type and others are of the second type.

[0044] In the embodiments of this disclosure, the first type of data is business data containing sensitive fields, such as ID card number, bank card number, password, etc. This type of data requires a high level of protection.

[0045] In the embodiments of this disclosure, the second type of data is business data containing non-sensitive fields. For example, fields that do not contain sensitive information, such as username, order type, timestamp, etc. This type of data can typically be protected in plaintext or at a lower level.

[0046] In operation S220, the first type of data in the service data to be transmitted is subjected to the first encryption process to obtain a service data body containing partial encryption.

[0047] In the embodiments of this disclosure, a first type of data (i.e., business data containing sensitive fields) in the business data to be transmitted undergoes a first encryption process. Specifically, the first type of data is encrypted using a target key, which is a key isolated from the symmetric key. It should be noted that the symmetric key here is a symmetric key shared with the server, and the target key is also a key shared with the server, but the target key is not a symmetric key and is isolated from the symmetric key.

[0048] Furthermore, after completing the first encryption process for the first type of data, the overall business data to be transmitted now becomes a business data body containing partial encryption.

[0049] In operation S230, the business request context is assembled with the business data body containing partial encryption to obtain the complete data packet to be verified.

[0050] First, the client will generate a business request context based on the business request. The business request context includes at least a timestamp and an encryption algorithm version identifier.

[0051] Furthermore, the context is assembled with the partially encrypted business data body to form a complete data packet to be verified.

[0052] In operation S240, the message authentication code is calculated on the complete data packet using the symmetric key of the current session, and the message authentication code is appended to the complete data packet to generate the target data packet to be transmitted.

[0053] In operation S250, the target data packet to be transmitted is subjected to a second encryption process using a symmetric key and then sent to the server over the network.

[0054] Specifically, the symmetric key of the current session is used to calculate the message authentication code (MAC) for the assembled complete data packet, and this MAC is appended to the data packet to generate the target data packet to be transmitted. This ensures data integrity and tamper resistance. The receiver (i.e., the server) can then recalculate the MAC using the same key and compare it with the received MAC. If they differ, it indicates that the data has been tampered with during transmission. Simultaneously, since the MAC calculation requires a key, it also provides authentication functionality, confirming that the data originates from a legitimate sender (i.e., the client).

[0055] Furthermore, the same symmetric key from the same session is used again to encrypt the entire target data packet to be transmitted (i.e., including the business data body, context, and additional message authentication code), and then the final ciphertext (i.e., the encrypted target data packet) is sent to the server over the network.

[0056] Through the embodiments of this disclosure, by encrypting sensitive fields, data can be effectively prevented from being intercepted or tampered with during transmission, ensuring the security of customer information and transaction data. Through the message authentication code mechanism, the receiver can verify the integrity of the data packet during transmission, preventing data from being maliciously tampered with.

[0057] Figure 3 A flowchart illustrating a method for data transmission by a server according to an embodiment of the present disclosure is shown.

[0058] like Figure 3 As shown, the data transmission method applied to the server may further include operations S310 to S330.

[0059] When operating the S310, the received encrypted target data packet is decrypted using the symmetric key shared with the client to obtain a partially encrypted business data body, business request context, and message authentication code.

[0060] In the embodiments of this disclosure, the server first performs transport layer decryption and data packet disassembly on the encrypted target data packet transmitted from the client to strip off the outermost transport encryption and restore the structured request information in preparation for subsequent verification.

[0061] For example, the server receives a complete encrypted target data packet stream from the network layer. This data packet was encrypted on the client using a symmetric key pre-shared with the server.

[0062] Furthermore, the server uses the same shared symmetric key to invoke the corresponding decryption algorithm to decrypt the data packet. This decryption process operates on the entire data packet and is the first decryption after it has securely arrived from the transmission channel. The result is not a single data block, but a composite object with a well-defined structure. This object typically contains three key parts: a partially encrypted business data body, a business context, and a message authentication code.

[0063] The embodiments of this disclosure employ a combination of symmetric keys and target keys, making key management more flexible and secure. The key isolation and update mechanisms effectively reduce the risk of key leakage.

[0064] When operating S320, the validity of the business request is verified based on the partially encrypted business data body, the business request context, and the message authentication code to obtain the verification result.

[0065] In the embodiments of this disclosure, when a client and server engage in business interactions involving sensitive data, the server must perform a series of stringent security checks to ensure the legitimacy, freshness, and integrity of the requests and the data. These checks typically include, but are not limited to: verifying whether the request was issued within a valid time window, verifying whether the encryption algorithm used is secure and supported, and verifying whether the transmitted data has been tampered with. The verification process is described in detail below.

[0066] Figure 4 The flowchart illustrating the server-side validation of business requests according to an embodiment of this disclosure is shown in the illustration.

[0067] like Figure 4 As shown in the embodiments of this disclosure, the service request context includes a timestamp and an encryption algorithm version identifier. Based on the partially encrypted service data body, the service request context, and the message authentication code, the validity of the service request is verified. This process may include operations S410 to S430.

[0068] In operation S410, verify whether the difference between the timestamp and the current time is within the preset time window to complete the time validity check.

[0069] For example, the server parses the timestamp sent by the client from a specified field in the request, and then subtracts the client's timestamp from its own current time to obtain the absolute value of the time difference.

[0070] Furthermore, it is determined whether the absolute value of this time difference is less than or equal to a preset time window value. If it is within the preset time window, the verification passes; otherwise, it fails.

[0071] When operating S420, verify whether the encryption algorithm represented by the version identifier is supported by the server and is enabled to complete the version compatibility check.

[0072] Specifically, based on the above, the version identifier is an identifier sent by the client that represents the version of the cryptographic algorithm suite used in this request. The server obtains the client's version identifier from the request and first checks whether the version identifier exists in the list of supported algorithms. If it does not exist, it means that the server cannot parse the request for that version at all, and should directly return an error, terminating the process.

[0073] Furthermore, after confirming support, the server checks whether the version identifier exists in the list of enabled algorithms. If the version identifier is both supported and enabled, it indicates that this is a safe and valid request, and the server will use the algorithm corresponding to that version for subsequent processing. If the version identifier is supported but not enabled, it means that the client is using an old algorithm that has been deprecated by the server, that is, the verification result is a failure, and an error is returned.

[0074] When operating the S430, the message authentication code is recalculated using a symmetric key on the decrypted business data body containing partial encryption and the business request context. This recalculated code is then compared with the message authentication code sent by the client to complete the data integrity verification.

[0075] Understandably, the client and server share a symmetric key, which is exchanged securely during the initial communication phase. Before sending a request, the client uses this symmetric key and the agreed-upon message authentication code algorithm to calculate a message authentication code value (i.e., the initial message authentication code value) based on the combination of the business data body and the business request context, and then attaches it to the request.

[0076] Furthermore, the server retrieves the corresponding symmetric key from secure storage based on information such as the client identifier in the request. It then uses the symmetric key to decrypt the encrypted business data.

[0077] Furthermore, the server uses the obtained symmetric key and the same message authentication code algorithm to perform the same calculations on the original combination data containing the partially encrypted business data body and the business request context obtained after decryption, and generates a new message authentication code value (i.e., the target message authentication code value).

[0078] For example, a constant-time comparison algorithm is used to compare the initial message authentication code value and the target message authentication code value. If the two values ​​match exactly, it proves that the data was intact and tamper-proof during transmission, the request is considered trustworthy, and business logic can be executed. If the two values ​​do not match, it indicates that the data was tampered with during transmission, or that the symmetric key used by the client does not match the server's, meaning the verification result fails and an error is returned.

[0079] Understandably, if any of the time validity check, version compatibility check, or data integrity check fails, the business request will be closed and data transmission will end.

[0080] Through the embodiments of this disclosure, multiple verification methods, such as time validity verification, version compatibility verification, and data integrity verification, are used to ensure that only validly verified requests can be processed, thereby further enhancing the security of the system.

[0081] In operation S330, if the verification result is passed, the first type of data in the partially encrypted business data body is decrypted according to the first encryption process to obtain the original business data to be transmitted, so as to complete the business request processing.

[0082] Specifically, if the verification result is successful, the innermost layer of sensitive data is decrypted to restore the complete original business data for use in business logic. Here, the decryption algorithm and key (i.e., the target key) corresponding to the first encryption process are used for decryption.

[0083] It should be noted that even when the symmetric key is uncertain, the server will still decrypt the sensitive fields of the first type of data by calling the decryption service corresponding to the target key. That is, the target key is a key that is isolated from the symmetric key.

[0084] Furthermore, the decrypted first type of data (plaintext) is recombined with the plaintext portion of the business data body (i.e., the second type of data) to form complete, original business data to be transmitted.

[0085] The embodiments disclosed herein employ a combination of symmetric and target keys, making key management more flexible and secure. Furthermore, the server verifies time validity, algorithm version compatibility, and data integrity before decrypting sensitive data, achieving end-to-end security and controllability. This method not only improves data transmission security but also enhances system reliability, meeting the high security requirements for data transmission.

[0086] Figure 5 The flowchart illustrating dynamic token authentication performed by the server according to an embodiment of the present disclosure is shown schematically.

[0087] like Figure 5 As shown, in the embodiments of this disclosure, before performing the validity verification of the business request, a dynamic token authentication process is also included, which includes operations S510 to S530.

[0088] When operating S510, the initial dynamic token generated by the client is obtained from the business request context. The initial dynamic token is generated by the client based on the device fingerprint, timestamp, and symmetric key.

[0089] In the embodiments of this disclosure, verifying the identity of the request initiator and the validity of the request is crucial before the server processes the core business logic. Dynamic token authentication is a key security step in this process, ensuring that the request originates from a legitimate client and has not been tampered with during transmission.

[0090] Furthermore, the server extracts the initial dynamic token generated by the client from the received business request context. This token is typically located in the request header. The initial dynamic token is not randomly generated, but rather generated by the client using a predefined, irreversible algorithm based on device fingerprint, timestamp, and symmetric key.

[0091] When operating the S520, the target dynamic token is regenerated based on device information, timestamp, and symmetric key, using the same algorithm as the client.

[0092] When operating S530, compare the initial dynamic token and the target dynamic token.

[0093] In the embodiments of this disclosure, in order to perform verification, the server needs to recalculate a target dynamic token locally using the same algorithm and input parameters as the client. Then, a constant-time comparison algorithm is used to compare the initial dynamic token and the target dynamic token.

[0094] Furthermore, if the two tokens are completely identical, it means that the client has the correct symmetric key and device fingerprint, and authentication is successful.

[0095] Furthermore, due to network latency, there may be slight discrepancies between the client and server times. Therefore, a time tolerance window (e.g., ±2 minutes) is typically used. During the comparison, the server not only uses the timestamp T sent by the client for calculation, but also generates multiple target tokens at time points such as T-1 minutes, T-2 minutes, T+1 minutes, and T+2 minutes. Authentication is considered successful if any one of these target tokens matches the initial dynamic token. If no token matches within any of the time windows, authentication fails, and the server should immediately terminate the request processing.

[0096] The embodiments of this disclosure introduce a dynamic token mechanism, which generates an initial dynamic token using device fingerprints and timestamps, thereby enhancing the security and reliability of authentication and preventing replay attacks.

[0097] In embodiments of this disclosure, after the business data restoration and business request processing steps, the method further includes: generating a symmetric key for the next data transmission, encrypting it together with the business request processing result using the current symmetric key, and sending it to the client, so as to realize the update of the transmission key after each business request.

[0098] Understandably, after each successful business request is processed, both parties will synchronously change the symmetric key (session key) used for the next communication. That is, a symmetric key for the next data transmission will be generated and encrypted together with the business request processing result using the current symmetric key before being sent to the client. This will ensure that the transmission key is updated after each business request and will also keep the risk of key leakage to a small extent.

[0099] Based on the above data transmission method, this disclosure also provides a data transmission apparatus. The following will be combined with... Figure 6 The device is described in detail.

[0100] Figure 6 A schematic block diagram of a data transmission apparatus according to an embodiment of the present disclosure is shown.

[0101] like Figure 6 As shown, the data transmission device 600 of this embodiment includes a client processing module 610 and a server processing module 620.

[0102] The client processing module 610 is used to identify the business data to be transmitted corresponding to the business request, determine the first type of data and the second type of data in the business data to be transmitted, wherein the first type of data is business data containing sensitive fields and the second type of data is business data containing non-sensitive fields; perform a first encryption process on the first type of data in the business data to be transmitted to obtain a partially encrypted business data body; assemble the business request context with the partially encrypted business data body to obtain a complete data packet to be verified; calculate a message authentication code on the complete data packet using the symmetric key of the current session, and append the message authentication code to the complete data packet to generate the target data packet to be transmitted; perform a second encryption process on the target data packet to be transmitted using the symmetric key, and send it to the server through the network. In one embodiment, the client processing module 610 can be used to execute the operations S210~S250 described above, which will not be repeated here.

[0103] The server-side processing module 620 is used to decrypt the received encrypted target data packet using a symmetric key shared with the client, obtaining a partially encrypted business data body, a business request context, and a message authentication code; based on the partially encrypted business data body, business request context, and message authentication code, it performs a validity check on the business request to obtain a check result; if the check result is successful, it performs decryption processing on the first type of data in the partially encrypted business data body corresponding to the first encryption processing, obtaining the original business data to be transmitted, thus completing the business request processing. In one embodiment, the server-side processing module 620 can be used to execute the operations S310~S330 described above, which will not be repeated here.

[0104] In the embodiments of this disclosure, the server-side processing module 620 includes a business request validity verification submodule and a dynamic token authentication submodule.

[0105] In the embodiments of this disclosure, the business request validity verification submodule includes a time verification unit, a version compatibility verification unit, and a data integrity verification unit.

[0106] The time verification unit is used to verify whether the difference between the timestamp and the current time is within a preset time window, so as to complete the time validity verification. In one embodiment, the time verification unit can be used to perform the operation S410 described above, which will not be repeated here.

[0107] The version compatibility verification unit is used to verify whether the encryption algorithm represented by the version identifier is supported by the server and is enabled, in order to complete the version compatibility verification. In one embodiment, the version compatibility verification unit can be used to perform the operation S420 described above, which will not be repeated here.

[0108] The data integrity verification unit is used to recalculate the message authentication code on the decrypted business data body (containing partial encryption) and business request context using a symmetric key, and compare it with the message authentication code sent by the client to complete the data integrity verification. In one embodiment, the data integrity verification unit can be used to perform the operation S430 described above, which will not be repeated here.

[0109] In the embodiments of this disclosure, the dynamic token authentication submodule includes an initial dynamic token acquisition unit, a target dynamic token generation unit, and a comparison unit.

[0110] The initial dynamic token acquisition unit is used to obtain an initial dynamic token generated by the client from the business request context. The initial dynamic token is generated by the client based on the device fingerprint, timestamp, and symmetric key. In one embodiment, the initial dynamic token acquisition unit can be used to perform the operation S510 described above, which will not be repeated here.

[0111] The target dynamic token generation unit is used to regenerate the target dynamic token based on device information, a timestamp, and a symmetric key, using the same algorithm as the client. In one embodiment, the target dynamic token generation unit can be used to perform the operation S520 described above, which will not be repeated here.

[0112] The comparison unit is used to compare the initial dynamic token and the target dynamic token. In one embodiment, the comparison unit can be used to perform the operation S530 described above, which will not be repeated here.

[0113] According to embodiments of this disclosure, any plurality of modules in the client processing module 610 and the server processing module 620 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the client processing module 610 and the server processing module 620 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the client processing module 610 and the server processing module 620 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0114] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a data transmission method according to an embodiment of the present disclosure.

[0115] like Figure 7 As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 707 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0116] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0117] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 707 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 707 as needed.

[0118] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0119] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0120] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0121] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0122] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0123] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0124] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0125] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0126] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0127] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A data transmission method applied to a client, characterized in that, The method includes: Identify the business data to be transmitted corresponding to the business request, and determine the first type of data and the second type of data in the business data to be transmitted. The first type of data is business data containing sensitive fields, and the second type of data is business data containing non-sensitive fields. The first type of data in the service data to be transmitted is subjected to a first encryption process to obtain a service data body containing partial encryption. The business request context is assembled with the partially encrypted business data body to obtain the complete data packet to be verified; Using the symmetric key of the current session, a message authentication code is calculated on the complete data packet, and the message authentication code is appended to the complete data packet to generate the target data packet to be transmitted; The target data packet to be transmitted is subjected to a second encryption process using the symmetric key and then sent to the server via the network.

2. A data transmission method, applied to a server, characterized in that, The method includes: Using the symmetric key shared with the client, the received encrypted target data packet is decrypted to obtain a partially encrypted business data body, business request context, and message authentication code. Based on the partially encrypted business data body, business request context, and message authentication code, the validity of the business request is verified to obtain the verification result; If the verification result is passed, the first type of data in the partially encrypted business data body is decrypted according to the first encryption process to obtain the original business data to be transmitted, so as to complete the business request processing.

3. The data transmission method according to claim 1, characterized in that, The first encryption process for the first type of data in the service data to be transmitted includes: The first type of data is encrypted using a target key, which is a key isolated from the symmetric key.

4. The data transmission method according to claim 2, characterized in that, The decryption process corresponding to the first encryption process is performed on the first type of data in the partially encrypted business data body, including: When the symmetric key is uncertain, the server decrypts the sensitive fields of the first type of data by calling the decryption service corresponding to the target key.

5. The data transmission method according to claim 2, characterized in that, The business request context includes a timestamp and an encryption algorithm version identifier. The validity verification of the business request based on the partially encrypted business data body, the business request context, and the message authentication code includes: Verify whether the difference between the timestamp and the current time is within a preset time window to complete the time validity check; Verify whether the encryption algorithm represented by the version identifier is supported by the server and is enabled, in order to complete the version compatibility check; Using the symmetric key, the message authentication code is recalculated on the decrypted business data body containing partial encryption and the business request context, and compared with the message authentication code sent by the client to complete the data integrity verification.

6. The data transmission method according to claim 5, characterized in that, include: If any of the time validity check, version compatibility check, and data integrity check fails, the data transmission will end.

7. The data transmission method according to claim 2, characterized in that, Before validating the validity of business requests, the following steps are also included: Obtain an initial dynamic token generated by the client from the business request context. The initial dynamic token is generated by the client based on the device fingerprint, timestamp, and symmetric key. Based on device information, timestamp, and symmetric key, the target dynamic token is regenerated using the same algorithm as the client. Compare the initial dynamic token and the target dynamic token.

8. The data transmission method according to claim 2, characterized in that, Also includes: A symmetric key for the next data transmission is generated and encrypted together with the result of the business request processing using the current symmetric key before being sent to the client, so as to realize the update of the transmission key after each business request.

9. A data transmission device, characterized in that, The device includes: The client processing module is used to identify the business data to be transmitted corresponding to the business request, determine the first type of data and the second type of data in the business data to be transmitted, wherein the first type of data is business data containing sensitive fields and the second type of data is business data containing non-sensitive fields; perform a first encryption process on the first type of data in the business data to be transmitted to obtain a partially encrypted business data body; assemble the business request context with the partially encrypted business data body to obtain a complete data packet to be verified; calculate a message authentication code on the complete data packet using the symmetric key of the current session, and append the message authentication code to the complete data packet to generate a target data packet to be transmitted; perform a second encryption process on the target data packet to be transmitted using the symmetric key, and send it to the server through the network. The server-side processing module is used to decrypt the received encrypted target data packet using a symmetric key shared with the client, to obtain the partially encrypted business data body, business request context, and message authentication code; based on the partially encrypted business data body, business request context, and message authentication code, to perform validity verification on the business request to obtain a verification result; if the verification result is successful, to perform decryption processing on the first type of data in the partially encrypted business data body corresponding to the first encryption processing, to obtain the original business data to be transmitted, thereby completing the business request processing.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images