Data encryption method, data decryption method, device and equipment
By sorting and encrypting the sequence of request parameters between the client and server, and generating verification information for comparison, the risk of tampering in data transmission is resolved, and the security and integrity of data transmission are guaranteed.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-18
- Publication Date
- 2026-03-24
Smart Images
Figure CN121727802A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a data encryption method, data decryption method, apparatus, and device. Background Technology
[0002] With the rapid development of mobile internet, cloud computing, and microservice architecture, it is necessary to ensure the security of data transmission between clients and servers.
[0003] Currently, the common method for detecting data tampering during data transmission between clients and servers is to use simple encryption. However, this method is vulnerable to interception by unauthorized users who can then encrypt the tampered data using methods that mimic those used by the client and server, making it difficult for the server to detect the tampering and compromising data transmission security.
[0004] To solve the above problems, it is necessary to improve the data encryption and decryption methods. Summary of the Invention
[0005] This invention provides a data encryption method, a data decryption method, an apparatus, and a device to address the risk of data tampering during data transmission between a client and a server.
[0006] In a first aspect, embodiments of the present invention provide a data encryption method, comprising:
[0007] Before the client sends the pending access request, the original request parameter sequence carried by the pending access request is sorted to obtain the target request parameter sequence;
[0008] Based on the target request parameter sequence and the request address of the access request to be processed, the first verification information is obtained;
[0009] The first verification information is encrypted to obtain the information to be decrypted;
[0010] The original request parameter sequence and the information to be decrypted are inserted into the request header of the access request to be processed to obtain the target access request, and the target access request is sent to the server.
[0011] Secondly, embodiments of the present invention provide a data decryption method, including:
[0012] Receive the target access request sent by the client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed;
[0013] The information to be decrypted is decrypted to obtain first verification information, and the target request parameter sequence and the request address of the target access request are obtained based on the first verification information; wherein the request address of the target access request and the access request to be processed are the same.
[0014] Based on the target request parameter sequence, determine the target sorting method corresponding to the request parameter sequence to be confirmed, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed;
[0015] Based on the sequence of parameters to be processed and the request address of the target access request, the second verification information is obtained;
[0016] The first verification information and the second verification information are compared, and the processing method for the target access request is determined based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.
[0017] Thirdly, embodiments of the present invention also provide a data encryption device, comprising:
[0018] The client sorting module is used to sort the original request parameter sequence carried by the pending access request before the client sends the pending access request to obtain the target request parameter sequence.
[0019] The first verification information determination module is used to obtain first verification information based on the target request parameter sequence and the request address of the access request to be processed;
[0020] An encryption module is used to encrypt the first verification information to obtain the information to be decrypted;
[0021] The request sending module is used to insert the original request parameter sequence and the information to be decrypted into the request header of the access request to be processed to obtain the target access request, and send the target access request to the server.
[0022] Fourthly, embodiments of the present invention also provide a data encryption device, comprising:
[0023] The receiving module is used to receive the target access request sent by the client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed.
[0024] The decryption module is used to decrypt the information to be decrypted to obtain first verification information, and to obtain the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request address of the target access request and the access request to be processed are the same;
[0025] The sorting method determination module is used to determine the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed.
[0026] The second verification information determination module is used to obtain second verification information based on the sequence of parameters to be processed and the request address of the target access request.
[0027] The comparison module is used to compare the first verification information and the second verification information, and determine the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.
[0028] Thirdly, embodiments of the present invention also provide an electronic device, comprising:
[0029] At least one processor; and
[0030] A memory communicatively connected to the at least one processor; wherein,
[0031] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the data encryption method and data decryption method according to any embodiment of the present invention.
[0032] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement the data encryption method and data decryption method described in any embodiment of the present invention.
[0033] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the data encryption method and data decryption method as described in any of the embodiments of the present invention.
[0034] The technical solution of this invention involves sorting the original request parameter sequence carried in the pending access request before the client sends the request to obtain a target request parameter sequence; obtaining first verification information based on the target request parameter sequence and the request address of the pending access request; encrypting the first verification information to obtain information to be decrypted; embedding the original request parameter sequence and the information to be decrypted into the request header of the pending access request to obtain a target access request; and sending the target access request to the server. In this technical solution, the client obtains the target request parameter sequence by sorting the original request parameter sequence before sending the pending access request, thus achieving the first layer of protection during data transmission between the client and server. Specifically, by sorting the original request parameter sequence, unauthorized users cannot modify the transmitted data without knowing the original request parameters, and this modification goes undetected. Furthermore, by encrypting the target request parameter sequence and the request address to obtain the first verification information, and then encrypting the first verification information using a public key to obtain the information to be decrypted, the security of data transmission is further enhanced. Furthermore, the original request parameter sequence and the information to be decrypted are encrypted into the request header of the access request to be processed to obtain the target access request. This allows the server to directly obtain the original request parameter sequence and the information to be decrypted from the request header of the target access request, and then verify the first verification information sent by the client to determine whether there is a data tampering problem in the data transmission. Based on this, the server receives the target access request sent by the client, obtains the information to be decrypted and the original request parameter sequence from the request header of the target access request, and uses the original request parameter sequence as the request parameter sequence to be confirmed; decrypts the information to be decrypted to obtain first verification information, and obtains the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request address of the target access request and the request to be processed are the same; determines the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sorts the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed; obtains second verification information based on the request parameter sequence to be processed and the request address of the target access request; compares the first verification information and the second verification information, and determines the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.In this technical solution, after receiving the information to be decrypted, the server obtains the first verification information through reverse parsing. Based on the first verification information, it determines the target sorting method used by the client to sort the original request parameter sequence. The received request parameter sequence is then sorted according to this target sorting method, thus replicating the client's complete operation on the original request parameter sequence to obtain the second verification information. Furthermore, by comparing the first verification information generated by the client with the second verification information, it is determined whether data tampering has occurred during data transmission. This solves the problem of data tampering risk in existing technologies when transmitting data between the client and server. By employing multiple encryption protections for the transmitted data, the security of data transmission is ensured. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the content of the embodiments of the present invention and these drawings without creative effort.
[0036] Figure 1 This is a flowchart of a data encryption method provided according to Embodiment 1 of the present invention;
[0037] Figure 2 This is a schematic diagram of a request interception method provided in Embodiment 1 of the present invention;
[0038] Figure 3 This is a flowchart of a data decryption method provided in Embodiment 2 of the present invention;
[0039] Figure 4 This is a schematic diagram of the structure of a data encryption device according to Embodiment 3 of the present invention;
[0040] Figure 5 This is a schematic diagram of the structure of a data decryption device according to Embodiment 4 of the present invention;
[0041] Figure 6 This is a schematic diagram of the structure of an electronic device that implements the data encryption method and data decryption of the present invention. Detailed Implementation
[0042] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. The acquisition, transmission, storage, use, and processing of data in the technical solutions of this application comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, certain software, components, or models and other existing solutions in the industry may be mentioned. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions of this application, but it does not mean that the applicant has or necessarily used such solutions.
[0043] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.
[0044] Example 1
[0045] Figure 1 The flowchart of a data encryption method provided in Embodiment 1 of the present invention is applicable to the data transmission process between the client and the server. By intercepting the request before it is sent and performing corresponding sorting and encryption on the transmitted data, a first verification information is generated. The server then compares the first verification information to determine whether the data transmission has been tampered with. This method can be executed by a data encryption device, which can be implemented in hardware and / or software. The data encryption device can be configured in a computing device capable of executing the data encryption method.
[0046] like Figure 1 As shown, the method includes:
[0047] S110. Before the client sends the pending access request, sort the original request parameter sequence carried by the pending access request to obtain the target request parameter sequence.
[0048] In this context, a pending access request refers to a request sent by the client but not yet processed by the server. For example, a pending access request could be a login request, a data query request, a file transfer request, or an account registration request. The original request parameter sequence refers to the core data carried in the pending access request that the client needs to transmit to the server, including at least one request parameter. For example, the request parameters in the original request parameter sequence could be a username, registration information parameters, location parameters, and time parameters. It is understood that the request parameters in the original request parameter sequence are strongly correlated with the pending access request and can be customized according to actual needs. The target request parameter sequence refers to the request parameter sequence obtained by sorting at least one request parameter from the original request parameter sequence according to a specified sorting method.
[0049] Optionally, sorting the original request parameter sequence carried by the access request to be processed to obtain a target request parameter sequence includes: determining a target sorting method from at least one candidate sorting method, and sorting at least one request parameter in the original request parameter sequence carried by the access request to be processed based on the target sorting method to obtain a parameter sequence to be used; adding the sorting method identifier corresponding to the target sorting method to the parameter sequence to be used to obtain the target request parameter sequence.
[0050] In this technical solution, candidate sorting methods can be used to sort parameters in the original request parameter sequence. The client can pre-set at least one candidate sorting method to select a target sorting method from among these when sorting the original request parameter sequence. The parameter sequence to be used refers to the parameter sequence obtained after reordering the original request parameter sequence based on the target sorting method. A sorting method identifier is used to characterize the target sorting method. The sorting method identifier can be a preset field of the target sorting method, or unique encoding information corresponding to the target sorting method, etc. The target request parameter sequence refers to the parameter sequence obtained by adding a sorting method identifier to the parameter sequence to be used. The sorting method identifier can be added to any position in the parameter sequence to be used, such as the first parameter position, middle parameter position, or last parameter position.
[0051] For example, at least one pre-set candidate sorting method includes method 1, method 2, method 3, method 4, and method 5. If method 3 is used when sorting the request parameters this time, then method 3 is the target sorting method. The request parameters in the original request parameter sequence are sorted using method 3 to obtain the parameter sequence to be used. Based on this, the sorting method identifier of method 3 is added to the end of the parameter sequence to be used to obtain the target request parameter sequence.
[0052] In a specific example, such as Figure 2As shown, when a user logs in through the client, the server obtains a tokenID. Using the tokenID and a random number, it generates a public key and a private key to be used via SM2. The generated private key is encrypted and written into the token, while the public key is returned to the client and stored in the browser cache. Due to the complexity of the business logic, the public key stored in the browser must be up-to-date to avoid mismatches between the encrypted public and private keys used by the front-end and back-end. After a successful API request, the public key is stored in a cookie. The front-end needs to check if the public key exists in the cookie; if it does, it stores the public key in localStorage and then deletes it from the cookie. A cookie is a small data fragment sent by the server and stored on the client, used to maintain state (such as a session identifier) across multiple requests. A token is a credential generated by the server and returned to the client, carried by the client in subsequent requests to prove identity or authorization, typically used for stateless authentication.
[0053] Based on this, the user sends an access request to the server through the client. Before the request is sent, it is intercepted to obtain the request address and the original request parameter sequence, and then encrypted. The interception of the access request can be based on the `open` and `send` methods. `open` represents the request creation method, used to obtain the type and request address of the access request, while `send` represents the request sending method, used to obtain the original request parameter sequence and set the request headers.
[0054] Based on the above example, after the user sends an access request to be processed through the client, the request address and the original request parameter sequence of the access request to be processed are sorted according to the target sorting method corresponding to the original request parameter sequence to obtain the parameter sequence to be used. At the same time, the sorting method identifier of the target sorting method is added to the parameter sequence to be used to obtain the target request parameter sequence.
[0055] S120. Based on the target request parameter sequence and the request address of the access request to be processed, the first verification information is obtained.
[0056] In this technical solution, the first verification information is obtained based on the target request parameter sequence and the request address of the access request to be processed, including: encrypting the target request parameter sequence and the request address of the access request to be processed based on a preset encryption algorithm to obtain a first digest; and adding a random number to the first digest based on a preset salting algorithm to obtain the first verification information.
[0057] The preset encryption algorithm refers to a pre-defined algorithm used to encrypt the target request parameter sequence and the request address of the access request to be processed. For example, the preset encryption algorithm could be a Commercial Cryptography Hash Algorithm (SM3). The first digest represents the encrypted data after encrypting the target request parameter sequence and the request address of the access request to be processed based on the preset encryption algorithm. The preset salting algorithm refers to a salting algorithm pre-agreed between the client and the server, used to add a random number to the first digest to obtain the first verification information.
[0058] Based on the above example, the target request parameter sequence and the request address of the access request to be processed are encrypted using the SM3 algorithm to obtain the first digest. Then, the first digest is encrypted a second time using a preset salting algorithm, such as the commercial cryptography algorithm (SM2 EllipticCurve Public Key Cryptography), to obtain the first verification information.
[0059] S130. Encrypt the first verification information to obtain the information to be decrypted.
[0060] Based on the above example, the client obtains the public key to be used from the security certificate issued by the server, and uses the public key to encrypt the first verification information to obtain the information to be decrypted.
[0061] S140. The original request parameter sequence and the information to be decrypted are inserted into the request header of the access request to be processed to obtain the target access request, and the target access request is sent to the server.
[0062] In practical applications, data transmission between the client and server may face multiple risks of tampering during request sending, transmission, and before server reception. To ensure the integrity and security of data transmission, this solution encrypts the original request parameter sequence before the client initiates the access request to be processed, thus achieving data confidentiality. Simultaneously, to facilitate efficient verification of data authenticity by the server, the client embeds the original request parameter sequence along with the encrypted first verification information into the request header, generates the target access request, and sends it to the server.
[0063] It's worth noting that adding the original request parameter sequence and verification information to the request header has several advantages. Firstly, as the request header is a standard component of the HTTP protocol, the server can quickly extract and verify data integrity, avoiding the performance overhead of parsing the request body. Secondly, separating the request header and request body makes it difficult for unauthorized users to tamper with both simultaneously, and the verification information is protected by encryption, providing double protection for data security.
[0064] Furthermore, during security verification on the server side, the same encryption algorithm and processing procedure as on the client side are used to re-encrypt and calculate the received original request parameter sequence, generating second verification information, which is then compared with the first verification information provided by the client. Therefore, even if an unauthorized user obtains the original request parameter sequence and attempts to tamper with it, the server will recalculate the verification value based on the tampered original request parameter sequence, and this value will inevitably not match the first verification information sent by the client. Thus, it can accurately identify whether the data has been tampered with.
[0065] In other words, the advantage of this setup is that even if an unauthorized user obtains the original request parameter sequence after the target access request is sent, they cannot forge the correct verification information. Therefore, any modification to the request parameters in the original request parameter sequence will result in inconsistencies between the encryption results of the client and the server, ensuring that the server can accurately identify illegal tampering.
[0066] The technical solution of this invention involves sorting the original request parameter sequence carried in the pending access request before the client sends the request to obtain a target request parameter sequence; obtaining first verification information based on the target request parameter sequence and the request address of the pending access request; encrypting the first verification information to obtain information to be decrypted; embedding the original request parameter sequence and the information to be decrypted into the request header of the pending access request to obtain a target access request; and sending the target access request to the server. In this technical solution, the client obtains the target request parameter sequence by sorting the original request parameter sequence before sending the pending access request, thus achieving the first layer of protection during data transmission between the client and server. Specifically, by sorting the original request parameter sequence, unauthorized users cannot modify the transmitted data without knowing the original request parameters, and this modification goes undetected. Furthermore, by encrypting the target request parameter sequence and the request address to obtain the first verification information, and then encrypting the first verification information using a public key to obtain the information to be decrypted, the security of data transmission is further enhanced. Furthermore, the original request parameter sequence and the information to be decrypted are encrypted into the request header of the access request to be processed, thus obtaining the target access request. This allows the server to directly obtain the original request parameter sequence and the information to be decrypted from the request header of the target access request, and then verify the first verification information sent by the client to determine whether there is any data tampering during data transmission. This solves the problem of data tampering risk in existing technologies when transmitting data between the client and the server. By using multiple encryption protections for transmitted data, the security of data transmission is ensured.
[0067] Example 2
[0068] Figure 3 The flowchart of a data decryption method provided in Embodiment 1 of the present invention is applicable to a server that, after receiving a request from a client, generates corresponding second verification information by replicating the client's data sorting and encryption operations, and compares the first and second verification information generated by the client to determine whether the data transmission has been tampered with. This method can be executed by a data decryption device, which can be implemented in hardware and / or software, and can be configured in a computing device capable of executing the data decryption method.
[0069] like Figure 3 As shown, the method includes:
[0070] S210. Receive the target access request sent by the client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed.
[0071] Based on the above example, the server receives the target access request sent by the client and obtains the information to be decrypted and the original request parameter sequence from the token in the request header of the target access request. In order to distinguish between the request parameter sequences processed by the server and the client, the request parameter sequence processed by the client is called the original request parameter sequence, and the request parameter sequence processed by the server is called the request parameter sequence to be confirmed. However, in reality, the original request parameter sequence and the request parameter sequence to be confirmed are exactly the same.
[0072] S220. Decrypt the information to be decrypted to obtain first verification information, and obtain the target request parameter sequence and the request address of the target access request based on the first verification information.
[0073] The target access request and the pending access request share the same request address.
[0074] In practical applications, the server stores a private key corresponding to the public key to be used. Upon receiving the information to be decrypted, optionally, the process of decrypting the information to be decrypted to obtain first verification information, and obtaining the target request parameter sequence and the target access request address based on the first verification information, includes: decrypting the information to be decrypted based on the private key corresponding to the public key to be used on the client to obtain the first verification information; and parsing the first verification information based on the anti-parse algorithm corresponding to the preset salting algorithm to obtain the target request parameter sequence and the target access request address.
[0075] S230. Determine the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed.
[0076] In this technical solution, the target sorting method corresponding to the request parameter sequence to be confirmed is determined based on the target request parameter sequence, and the request parameter sequence to be confirmed is sorted based on the target sorting method to obtain the request parameter sequence to be processed. This includes: identifying the sorting method identifier in the target request parameter sequence, and determining the target sorting method of the request parameter sequence to be confirmed from the target mapping table based on the sorting method identifier; and sorting the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed.
[0077] The target mapping table includes at least one candidate sorting method, and the target mapping table is a mapping table that the client sends to the server in advance.
[0078] Specifically, after obtaining the target request parameter sequence, the server can obtain the sorting method identifier in the target request parameter sequence through a pre-agreed identification method with the client, and determine the target sorting method used by the client based on the sorting method identifier.
[0079] For example, taking a preset field identified by a sorting method as a candidate sorting method as an example, after receiving the target request parameter sequence, the server determines whether the target request parameter sequence contains a preset field corresponding to a candidate sorting method. If it exists, the server queries the target mapping table for the candidate sorting method corresponding to the preset field and determines the corresponding candidate sorting method as the target sorting method (that is, the target sorting method used by the client when sorting the original request parameter sequence). Based on this, the server sorts the request parameter sequence to be confirmed using the target sorting method to obtain the request parameter sequence to be processed.
[0080] S240. Based on the sequence of request parameters to be processed and the request address of the target access request, obtain the second verification information.
[0081] In practical applications, after receiving the sequence of request parameters to be processed, the server replicates the client's processing operations on the original sequence of request parameters and the request address of the access request to be processed, and obtains the second verification information to ensure that the processing object and process of the server are consistent with those of the client. Then, the server compares the first verification information sent by the client with the second verification information generated by the server itself.
[0082] Specifically, the server obtains second verification information based on the sequence of request parameters to be processed and the request address of the target access request, including: encrypting the sequence of request parameters to be processed and the request address of the target access request based on a preset encryption algorithm to obtain a second digest; adding a random number to the second digest based on a preset salting algorithm to obtain a digest to be processed; and encrypting the digest to be processed based on the private key to be used corresponding to the public key to be used by the client to obtain the second verification information.
[0083] S250. Compare the first verification information and the second verification information, and determine the processing method for the target access request based on the comparison result.
[0084] The processing method is to respond to the request or refuse to respond to the request.
[0085] Specifically, if the first and second verification information match, it indicates that the data transmitted between the client and the server has not been tampered with, and the server responds to the target access request. Conversely, if the first and second verification information do not match, it indicates that the data transmitted between the client and the server has been tampered with, and the server refuses to respond to the target access request and issues a warning.
[0086] The advantage of this technical solution lies in its enhanced data transmission security. When sending a request, the client sorts the original request parameter sequence according to a specific target sorting method, generating a sequence of parameters to be used. The sorting method identifier is also added to this sequence, forming the final target request parameter sequence. Upon receiving the data, the server reconstructs the client's sorting process by parsing the sorting method identifier, reorders the original parameters, and generates second verification information, which is then compared with the first verification information provided by the client. The core benefit of this mechanism is that even if the original request parameter sequence is intercepted during transmission, unauthorized users cannot tamper with the data undetected because they are unaware of the specific sorting rules. Therefore, by sorting the request parameters, not only is the reliability of data integrity verification ensured (any parameter tampering will lead to verification failure), but the difficulty of reverse engineering is also increased. This is because the generation of correct verification information relies on hidden sorting logic, thus achieving effective anti-tampering protection while transmitting plaintext parameters.
[0087] The technical solution of this invention involves the server receiving a target access request sent by the client, obtaining the information to be decrypted and the original request parameter sequence from the request header of the target access request, and using the original request parameter sequence as the request parameter sequence to be confirmed; decrypting the information to be decrypted to obtain first verification information, and obtaining the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request address of the target access request and the request to be processed are the same; determining the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sorting the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed; obtaining second verification information based on the request parameter sequence to be processed and the request address of the target access request; comparing the first verification information and the second verification information, and determining the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request. In this technical solution, after receiving the information to be decrypted, the server obtains the first verification information through reverse parsing. Based on the first verification information, it determines the target sorting method used by the client to sort the original request parameter sequence. The server then sorts the received request parameter sequence based on this target sorting method, thus replicating the client's complete operation on the original request parameter sequence to obtain the second verification information. Furthermore, by comparing the first verification information generated by the client with the second verification information, the server determines whether data tampering has occurred during data transmission. This solves the problem of data tampering risk in existing technologies when transmitting data between the client and server. By employing multiple encryption protections for the transmitted data, the server ensures the security of data transmission.
[0088] Example 3
[0089] Figure 4 This is a schematic diagram of a data encryption device provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a client sorting module 310, a first verification information determination module 320, an encryption module 330, and a request sending module 340.
[0090] The client sorting module 310 is used to sort the original request parameter sequence carried by the pending access request before the client sends the pending access request to obtain the target request parameter sequence.
[0091] The first verification information determination module 320 is used to obtain first verification information based on the target request parameter sequence and the request address of the access request to be processed;
[0092] The encryption module 330 is used to encrypt the first verification information to obtain the information to be decrypted;
[0093] The request sending module 340 is used to insert the original request parameter sequence and the information to be decrypted into the request header of the access request to be processed to obtain the target access request, and send the target access request to the server.
[0094] The technical solution of this invention involves sorting the original request parameter sequence carried in the pending access request before the client sends the request to obtain a target request parameter sequence; obtaining first verification information based on the target request parameter sequence and the request address of the pending access request; encrypting the first verification information to obtain information to be decrypted; embedding the original request parameter sequence and the information to be decrypted into the request header of the pending access request to obtain a target access request; and sending the target access request to the server. In this technical solution, the client obtains the target request parameter sequence by sorting the original request parameter sequence before sending the pending access request, thus achieving the first layer of protection during data transmission between the client and server. Specifically, by sorting the original request parameter sequence, unauthorized users cannot modify the transmitted data without knowing the original request parameters, and this modification goes undetected. Furthermore, by encrypting the target request parameter sequence and the request address to obtain the first verification information, and then encrypting the first verification information using a public key to obtain the information to be decrypted, the security of data transmission is further enhanced. Furthermore, the original request parameter sequence and the information to be decrypted are encrypted into the request header of the access request to be processed, thus obtaining the target access request. This allows the server to directly obtain the original request parameter sequence and the information to be decrypted from the request header of the target access request, and then verify the first verification information sent by the client to determine whether there is any data tampering during data transmission. This solves the problem of data tampering risk in existing technologies when transmitting data between the client and the server. By using multiple encryption protections for transmitted data, the security of data transmission is ensured.
[0095] Optionally, the client sorting module includes: a client sorting unit, used to determine a target sorting method from at least one candidate sorting method, and sort at least one request parameter in the original request parameter sequence carried by the access request to be processed based on the target sorting method to obtain a parameter sequence to be used;
[0096] Add the sorting method identifier corresponding to the target sorting method to the parameter sequence to be used to obtain the target request parameter sequence.
[0097] Optionally, the encryption module includes: a first digest determination unit, used to encrypt the target request parameter sequence and the request address of the access request to be processed based on a preset encryption algorithm to obtain a first digest;
[0098] The first verification information determination unit is used to add random numbers to the first digest based on a preset salting algorithm to obtain the first verification information.
[0099] The encryption unit is used to encrypt the first verification information based on the public key to be used obtained from the server, so as to obtain the information to be decrypted.
[0100] The data encryption device provided in the embodiments of the present invention can execute the data encryption method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.
[0101] Example 4
[0102] Figure 5 This is a schematic diagram of a data decryption device provided in Embodiment 4 of the present invention. Figure 5 As shown, the device includes: a receiving module 410, a decryption module 420, a server sorting module 430, a second verification information determination module 440, and a comparison module 450.
[0103] The receiving module 410 is used to receive a target access request sent by a client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed.
[0104] The decryption module 420 is used to decrypt the information to be decrypted to obtain first verification information, and to obtain the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request address of the target access request and the access request to be processed are the same.
[0105] The server-side sorting module 430 is used to determine the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed.
[0106] The second verification information determination module 440 is used to obtain second verification information based on the sequence of parameters to be processed and the request address of the target access request;
[0107] The comparison module 450 is used to compare the first verification information and the second verification information, and determine the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.
[0108] The technical solution of this invention includes receiving a target access request sent by the client; obtaining the information to be decrypted and the original request parameter sequence from the request header of the target access request; using the original request parameter sequence as the request parameter sequence to be confirmed; decrypting the information to be decrypted to obtain first verification information; and obtaining the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request addresses of the target access request and the access request to be processed are the same; determining the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence; sorting the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed; obtaining second verification information based on the request parameter sequence to be processed and the request address of the target access request; comparing the first verification information and the second verification information; and determining the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request. In this technical solution, after receiving the information to be decrypted, the server obtains the first verification information through reverse parsing. Based on the first verification information, it determines the target sorting method used by the client to sort the original request parameter sequence. The server then sorts the received request parameter sequence based on this target sorting method, thus replicating the client's complete operation on the original request parameter sequence to obtain the second verification information. Furthermore, by comparing the first verification information generated by the client with the second verification information, the server determines whether data tampering has occurred during data transmission. This solves the problem of data tampering risk in existing technologies when transmitting data between the client and server. By employing multiple encryption protections for the transmitted data, the server ensures the security of data transmission.
[0109] Optionally, the decryption module includes: a decryption unit, used to decrypt the information to be decrypted based on the private key to be used corresponding to the public key to be used by the client, to obtain the first verification information;
[0110] The parsing unit is used to parse the first verification information based on the anti-parsing algorithm corresponding to the preset salting algorithm, so as to obtain the target request parameter sequence and the request address of the target access request.
[0111] Optionally, the server-side sorting module includes: an identifier identification unit, used to identify the sorting method identifier in the target request parameter sequence, and determine the target sorting method for the request parameter sequence to be confirmed from the target mapping table based on the sorting method identifier; wherein, the target mapping table includes at least one candidate sorting method, and the target mapping table is a mapping table pre-sent by the client to the server;
[0112] The server-side sorting unit is used to sort the sequence of request parameters to be confirmed based on the target sorting method to obtain the sequence of request parameters to be processed.
[0113] Optionally, the second verification information determination module includes: a second digest determination unit, used to encrypt the sequence of request parameters to be processed and the request address of the target access request based on a preset encryption algorithm to obtain a second digest;
[0114] The second verification information determination unit is used to add random numbers to the second digest based on a preset salting algorithm to obtain the second verification information.
[0115] The data decryption device provided in the embodiments of the present invention can execute the data decryption method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.
[0116] Example 5
[0117] Figure 6 A schematic diagram of the structure of an electronic device 10 according to an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.
[0118] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0119] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0120] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data encryption methods and data decryption methods.
[0121] In some embodiments, the data encryption and decryption methods may be implemented as computer programs tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data encryption and decryption methods described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data encryption and decryption methods by any other suitable means (e.g., by means of firmware).
[0122] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0123] Computer programs for implementing the data encryption and decryption methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0124] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0125] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0126] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0127] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.
[0128] Example 7
[0129] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data encryption method and data decryption method provided in any embodiment of this application.
[0130] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages or a combination thereof. Programming languages include object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0131] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0132] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A data encryption method, characterized in that, include: Before the client sends the pending access request, the original request parameter sequence carried by the pending access request is sorted to obtain the target request parameter sequence; Based on the target request parameter sequence and the request address of the access request to be processed, the first verification information is obtained; The first verification information is encrypted to obtain the information to be decrypted; The original request parameter sequence and the information to be decrypted are inserted into the request header of the access request to be processed to obtain the target access request, and the target access request is sent to the server.
2. The method according to claim 1, characterized in that, The step of sorting the original request parameter sequence carried by the access request to be processed to obtain the target request parameter sequence includes: A target sorting method is determined from at least one candidate sorting method, and at least one request parameter in the original request parameter sequence carried by the access request to be processed is sorted based on the target sorting method to obtain a parameter sequence to be used. Add the sorting method identifier corresponding to the target sorting method to the parameter sequence to be used to obtain the target request parameter sequence.
3. The method according to claim 1, characterized in that, The process of obtaining the information to be decrypted based on the target request parameter sequence and the request address of the access request to be processed includes: Based on a preset encryption algorithm, the target request parameter sequence and the request address of the access request to be processed are encrypted to obtain a first digest; Random numbers are added to the first digest based on a preset salting algorithm to obtain the first verification information; The first verification information is encrypted using the public key obtained from the server to obtain the information to be decrypted.
4. A data decryption method, characterized in that, include: Receive a target access request sent by a client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed; The information to be decrypted is decrypted to obtain first verification information, and the target request parameter sequence and the request address of the target access request are obtained based on the first verification information; wherein the request address of the target access request and the access request to be processed are the same. Based on the target request parameter sequence, determine the target sorting method corresponding to the request parameter sequence to be confirmed, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed; Based on the sequence of parameters to be processed and the request address of the target access request, the second verification information is obtained; The first verification information and the second verification information are compared, and the processing method for the target access request is determined based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.
5. The method according to claim 4, characterized in that, The process of decrypting the information to be decrypted to obtain first verification information, and obtaining the target request parameter sequence and the request address of the target access request based on the first verification information, includes: The information to be decrypted is decrypted based on the private key corresponding to the public key to be used by the client to obtain the first verification information; The first verification information is parsed using an anti-parsing algorithm corresponding to the preset salting algorithm to obtain the target request parameter sequence and the request address of the target access request.
6. The method according to claim 4, characterized in that, The step of determining the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sorting the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed includes: Identify the sorting method identifier in the target request parameter sequence, and determine the target sorting method for the request parameter sequence to be confirmed from the target mapping table based on the sorting method identifier; wherein, the target mapping table includes at least one candidate sorting method, and the target mapping table is a mapping table pre-sent by the client to the server; The sequence of request parameters to be confirmed is sorted according to the target sorting method to obtain the sequence of request parameters to be processed.
7. The method according to claim 4, characterized in that, The second verification information obtained based on the sequence of parameters of the request to be processed and the request address of the target access request includes: Based on a preset encryption algorithm, the sequence of request parameters to be processed and the request address of the target access request are encrypted to obtain a second digest; Random numbers are added to the second digest based on a preset salting algorithm to obtain the second verification information.
8. A data encryption device, characterized in that, include: The client sorting module is used to sort the original request parameter sequence carried by the pending access request before the client sends the pending access request to obtain the target request parameter sequence. The first verification information determination module is used to obtain first verification information based on the target request parameter sequence and the request address of the access request to be processed; An encryption module is used to encrypt the first verification information to obtain the information to be decrypted; The request sending module is used to insert the original request parameter sequence and the information to be decrypted into the request header of the access request to be processed to obtain the target access request, and send the target access request to the server.
9. A data decryption device, characterized in that, include: The receiving module is used to receive the target access request sent by the client, obtain the information to be decrypted and the original request parameter sequence from the request header of the target access request, and use the original request parameter sequence as the request parameter sequence to be confirmed. The decryption module is used to decrypt the information to be decrypted to obtain first verification information, and to obtain the target request parameter sequence and the request address of the target access request based on the first verification information; wherein the request address of the target access request and the access request to be processed are the same; The server-side sorting module is used to determine the target sorting method corresponding to the request parameter sequence to be confirmed based on the target request parameter sequence, and sort the request parameter sequence to be confirmed based on the target sorting method to obtain the request parameter sequence to be processed. The second verification information determination module is used to obtain second verification information based on the sequence of parameters to be processed and the request address of the target access request. The comparison module is used to compare the first verification information and the second verification information, and determine the processing method for the target access request based on the comparison result; wherein the processing method is to respond to the request or refuse to respond to the request.
10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data encryption method of any one of claims 1-3 or the data decryption method of any one of claims 4-7.