Data communication method and device and computer equipment

Abstract

The invention relates to a data communication method and device and computer equipment. The method comprises the following steps: acquiring handshake hash information pre-generated for a server and a coding factor provided by the server; encoding the handshake hash information by using a white box private key encoded in a white box program in advance to obtain first signature data; performing coding processing on the first signature data by using the coding factor to obtain second signature data; sending the to-be-transmitted data to be transmitted to the server and the second signature data to the server; and the server is used for decoding the second signature data by using the coding factor to obtain third signature data, and receiving the to-be-transmitted data under the condition that the signature verification of the third signature data is passed. By adopting the method, the private key can be prevented from being exposed, so that the communication security degree can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data communication method, device and computer equipment. BACKGROUND

[0002] With the development of communication technology, a technology for realizing communication between a client and a server through a private key of the client is provided. In the technology, the client can generate signature data by using the private key of the client, and transmit the signature data and data to be transmitted to the server. The server can verify the signature data, and receive the data after the signature data is verified.

[0003] However, in the above data communication method, the signature data is directly generated by the private key of the client, which can easily lead to exposure of the private key. Therefore, the existing data communication method has low communication security. SUMMARY

[0004] Therefore, it is necessary to provide a data communication method, device, computer equipment, computer readable storage medium and computer program product capable of improving communication security.

[0005] In a first aspect, the present application provides a data communication method applied to a client, comprising:

[0006] obtaining handshake hash information generated in advance for a server, and an encoding factor provided by the server;

[0007] encoding the handshake hash information by using a white-box private key encoded in advance in a white-box program to obtain first signature data;

[0008] encoding the first signature data by using the encoding factor to obtain second signature data;

[0009] sending data to be transmitted to the server and the second signature data to the server; the server is configured to decode the second signature data by using the encoding factor to obtain third signature data, and receive the data to be transmitted in a case where signature verification of the third signature data is passed.

[0010] In one of the embodiments, the handshake hash information is obtained by the following steps: receiving handshake information of the client and the server from the server in a case where a handshake connection between the client and the server is established; the handshake information is generated by adding the encoding factor to original handshake information by the server; and generating the handshake hash information according to the handshake information.

[0011] In one of the embodiments, the encoding the handshake hash information by using the white-box private key pre-encoded in the white-box program to obtain the first signature data comprises: signing the handshake hash information by using the white-box private key to generate first original signature data; and encoding the first original signature data by using the white-box program to obtain the first signature data; and the server is further configured to decode the third signature data by using a decoding program corresponding to the white-box program to obtain second original signature data, and verify the second original signature data by using a public key corresponding to the white-box private key, so as to receive the to-be-transmitted data in a case where the second original signature data is signature data corresponding to the handshake hash information.

[0012] In a second aspect, the present application further provides a data communication method applied to a server, the method comprising:

[0013] obtaining to-be-transmitted data to be transmitted to the server and second signature data sent by a client, wherein the second signature data is obtained by encoding first signature data by using an encoding factor, the first signature data is obtained by encoding handshake hash information by using a white-box private key pre-encoded in a white-box program, the handshake hash information is pre-generated by the client, and the encoding factor is sent to the client by the server;

[0014] decoding the second signature data by using the encoding factor to obtain third signature data;

[0015] receiving the to-be-transmitted data in a case where the third signature data passes signature verification.

[0016] In one of the embodiments, the encoding factor is obtained by the following steps: obtaining a master key pre-set by the server, and generating a derived key for the client based on the master key; generating a random number by using the derived key as a seed, and taking the random number as the encoding factor.

[0017] In one of the embodiments, after the random number is taken as the encoding factor, the method further comprises: obtaining original handshake information of the client and the server in a case where the client and the server establish a handshake connection; adding the encoding factor into the original handshake information to obtain handshake information, and sending the handshake information to the client; and the client is configured to generate the handshake hash information according to the handshake information.

[0018] In one of the embodiments, the first signature data is obtained by encoding the first original signature data by the white-box program, the first original signature data being obtained by signing the handshake hash information by the white-box private key; and in the case that the third signature data passes the signature verification, the method further comprises: decoding the third signature data by a decoding program corresponding to the white-box program to obtain second original signature data; and verifying the second original signature data by a public key corresponding to the white-box private key, and in the case that the second original signature data is the signature data corresponding to the handshake hash information, receiving the to-be-transmitted data.

[0019] In a third aspect, the present application further provides a data communication device applied to a client, comprising:

[0020] The encoding factor obtaining module is configured to obtain handshake hash information generated in advance for a server and an encoding factor provided by the server.

[0021] The first signature generating module is configured to encode the handshake hash information by a white-box private key encoded in advance in a white-box program to obtain first signature data.

[0022] The second signature generating module is configured to encode the first signature data by the encoding factor to obtain second signature data.

[0023] The to-be-transmitted data sending module is configured to send to-be-transmitted data to be transmitted to the server and the second signature data to the server; and the server is configured to decode the second signature data by the encoding factor to obtain third signature data, and in the case that the third signature data passes the signature verification, receive the to-be-transmitted data.

[0024] In a fourth aspect, the present application further provides a data communication device applied to a server, comprising:

[0025] The to-be-transmitted data obtaining module is configured to obtain to-be-transmitted data to be transmitted to the server and second signature data sent by a client; the second signature data is obtained by encoding first signature data by an encoding factor, the first signature data is obtained by encoding handshake hash information by a white-box private key encoded in advance in a white-box program, the handshake hash information is generated in advance by the client, and the encoding factor is sent to the client by the server.

[0026] The third signature obtaining module is configured to decode the second signature data by the encoding factor to obtain third signature data.

[0027] The third signature verification module is used to receive the data to be transmitted if the third signature data verification passes.

[0028] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any one of the embodiments of the first or second aspect.

[0029] In a sixth aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the embodiments of the first or second aspect.

[0030] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the embodiments of the first or second aspect.

[0031] The aforementioned data communication method, apparatus, computer equipment, computer-readable storage medium, and computer program product obtain, through the client, handshake hash information pre-generated for the server and encoding factors provided by the server; encode the handshake hash information using a white-box private key pre-encoded in a white-box program to obtain first signature data; encode the first signature data using the encoding factors to obtain second signature data; send the data to be transmitted and the second signature data to the server; the server uses the encoding factors to decode the second signature data to obtain third signature data, and receives the data to be transmitted if the third signature data passes signature verification. The client in this application can pre-generate handshake hash information generated by the server and receive external encoding factors provided by the server. When sending data to be transmitted, the client can use the white-box private key pre-encoded in the white-box program to encode the handshake hash information to obtain the first signature data. Then, it can use the external encoding factors provided by the server to further encode the first signature data to obtain the second signature data. The client then sends the data to be transmitted and the second signature data to the server. The server can use the encoding factors to decode the second signature data to obtain the third signature data and perform signature verification. Only when the verification is successful will the client receive the data to be transmitted. Compared with directly generating signature data using the client's private key, this application can combine the private key in the white-box program and the external encoding factors provided by the server to generate signature data, which can prevent the private key from being exposed and thus improve the level of communication security. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a diagram illustrating the application environment of a data communication method in one embodiment.

[0034] Figure 2 This is a flowchart illustrating a data communication method in one embodiment;

[0035] Figure 3 This is a flowchart illustrating a data communication method in another embodiment;

[0036] Figure 4 This is a flowchart of a TLS white-box key protection method based on server-side encoding in one embodiment;

[0037] Figure 5 This is a structural block diagram of a data communication device in one embodiment;

[0038] Figure 6 This is a structural block diagram of a data communication device in another embodiment;

[0039] Figure 7 This is an internal structural diagram of a computer device in one embodiment;

[0040] Figure 8 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0042] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0043] The data communication method provided in this application embodiment can be applied to, for example...Figure 1 In the application environment shown, client 101 communicates with server 102 via a network. Specifically, when client 101 establishes a handshake connection with server 102, it generates handshake hash information and receives an external encoding factor provided by the server. Then, when client 101 sends data to be transmitted, it uses the white-box private key pre-stored in the white-box program to encode the handshake hash information, obtaining first signature data. It then further encodes the first signature data using the external encoding factor to obtain second signature data, and sends the data to be transmitted along with the second signature data to server 102. Upon receiving the second signature data, server 102 decodes it to obtain third signature data and verifies it. If the verification is successful, it accepts the data to be transmitted. Client 101 can be, but is not limited to, various vehicle terminals. Server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services, such as a vehicle networking server.

[0044] In one embodiment, such as Figure 2 As shown, a data communication method is provided, which is applied to... Figure 1 Taking client 101 as an example, the explanation includes the following steps:

[0045] Step S201: Obtain the handshake hash information pre-generated for server 102, and the encoding factor provided by server 102.

[0046] The handshake hash information refers to the hash value of the handshake information obtained during the handshake process between client 101 and server 102, while the encoding factor is an external encoding factor generated by server 102 and sent to client 101. This encoding factor can be a random encoded number. Specifically, when transmitting data, client 101 can obtain the handshake hash information pre-generated for server 102, as well as the encoding factor pre-provided by server 102.

[0047] Step S202: Using the white-box private key pre-encoded in the white-box program, the handshake hash information is encoded to obtain the first signature data.

[0048] The white-box private key refers to the private key encoded in a white-box program. It can be a Transport Layer Security (TLS) private key protected by a white-box protocol. This white-box program can be pre-deployed in client 101 and used to implement white-box encryption. The first signature data is the signature data obtained after encryption by the white-box program. Specifically, after receiving the handshake hash information, client 101 can use the white-box private key encoded in the white-box program to encode the handshake hash information and obtain the first signature data, which can be represented by the following expression:

[0049]

[0050] in, This represents the first signature data. This represents the handshake hash information, while This refers to using a white-box protected private key to output a fixed-encoded signature.

[0051] Step S203: Encode the first signature data using the encoding factor to obtain the second signature data.

[0052] The second signature data refers to the signature data generated after further encoding the first signature data using an external encoding factor. This encoding process can be XOR, modular addition, or modular multiplication, etc. Specifically, after obtaining the first signature data, client 101 can further encode the first signature data using the external encoding factor provided by server 102 to obtain the second signature data, which can be represented by the following expression:

[0053]

[0054] in, This represents the second signature data. This represents the first signature data. Represents the coding factor, while This refers to the encoding function, which can be an XOR, modular addition, or modular multiplication function, etc.

[0055] Step S204: Send the data to be transmitted and the second signature data to the server 102. The server 102 is used to decode the second signature data using the encoding factor to obtain the third signature data, and receives the data to be transmitted if the third signature data passes the signature verification.

[0056] The data to be transmitted to server 102 refers to the data that needs to be transmitted, which may be vehicle data. After obtaining the second signature data, the client can send the data to be transmitted and the second signature data together to server 102. Server 102 can use the encoding factor to decode the second signature data to obtain the third signature data. Then, it can use the third signature data to perform signature verification. If the signature verification of the third signature data is successful, the client can receive the data to be transmitted.

[0057] In the above data communication method, the client obtains the handshake hash information pre-generated for the server and the encoding factor provided by the server; the handshake hash information is encoded using the white-box private key pre-encoded in the white-box program to obtain the first signature data; the first signature data is encoded using the encoding factor to obtain the second signature data; the data to be transmitted and the second signature data are sent to the server; the server uses the encoding factor to decode the second signature data to obtain the third signature data, and receives the data to be transmitted if the third signature data passes the signature verification. In this application, client 101 can pre-generate handshake hash information for server 102 and receive external encoding factors provided by server 102. When sending data to be transmitted, it can use the white-box private key pre-encoded in the white-box program to encode the handshake hash information to obtain first signature data, and then use the external encoding factors provided by the server to further encode it to obtain second signature data. Thus, the data to be transmitted and the second signature data are sent to server 102. Server 102 can then use the encoding factors to decode the second signature data to obtain third signature data and perform signature verification. Only when the verification is successful will it receive the data to be transmitted. Compared with directly generating signature data using the private key of client 101, this application can combine the private key in the white-box program and the external encoding factors provided by server 102 to generate signature data, which can prevent the private key from being exposed and thus improve the level of communication security.

[0058] In one embodiment, the handshake hash information is generated through the following steps: when a handshake connection is established between the client 101 and the server 102, the handshake information between the client and the server is received from the server 102; the handshake information is generated by the server 102 by adding an encoding factor to the original handshake information; and the handshake hash information is generated based on the handshake information.

[0059] The original handshake information refers to the initial handshake information generated during the handshake process between the server 102 and the client 101. For example, it may be a CertificateRequest message. The handshake information used to generate the handshake hash information is obtained by adding an encoding factor to the initial handshake information. That is, an extension is appended to the CertificateRequest message, which may contain an encoded random number as an encoding factor.

[0060] Specifically, when client 101 and server 102 establish a handshake connection, server 102 can add its generated encoding factor to the initial handshake information with client 101, thus forming handshake information sent to client 101. After receiving the handshake information, client 101 can calculate the hash value of the handshake information as the handshake hash information. The handshake hash information calculated in this way can carry the encoding factor provided by the server, thus further improving the security of the signature data.

[0061] In this embodiment, handshake hash information can also be generated using handshake information with added encoding factors. The handshake hash information calculated in this way can carry the encoding factors provided by the server, thus further improving the security of the signature data.

[0062] In one embodiment, step S102 may further include: using a white-box private key to sign the handshake hash information to generate first original signature data; using a white-box program to encode the first original signature data to obtain the first signature data; the server 102 is further configured to use a decoding program corresponding to the white-box program to decode the third signature data to obtain second original signature data, and use the public key corresponding to the white-box private key to verify the signature of the second original signature data, so as to receive the data to be transmitted when the second original signature data is the signature data corresponding to the handshake hash information.

[0063] The first original signature data refers to the signature data obtained directly after the handshake hash information is signed using a white-box private key. In this embodiment, the process of generating the first signature data can be roughly divided into two stages: first, the handshake hash information is signed using a white-box private key to generate the first original signature data; then, the generated first original signature data is encoded using a white-box program to obtain the first signature data.

[0064] The second original signature data is obtained by white-box decoding of the third signature data. Theoretically, if the signature data has not been tampered with, the second original signature data can be identical to the first original signature data. After obtaining the second original signature data, the server 102 can use the client's public key to perform signature verification. For example, it can verify whether the second original signature data is the signature value of the handshake hash information. If so, it means that the signature verification of the second original signature data has passed, and the server 102 can then receive the data to be transmitted.

[0065] In this embodiment, the first signature data can be generated by signing the handshake hash information using a white-box private key and then encoding the signature using a white-box program. Therefore, after obtaining the third signature data, the server 102 can first decode the third signature data using the decoding program corresponding to the white-box program, and then use the public key corresponding to the white-box private key to complete the signature verification. This method can ensure the accuracy of the first signature data generation and the accuracy of the signature verification.

[0066] In one embodiment, such as Figure 3 As shown, a data communication method is provided, which is applied to... Figure 1 Taking server 102 as an example, the explanation includes the following steps:

[0067] Step S301: Obtain the data to be transmitted to the server 102 sent by the client 101 and the second signature data; the second signature data is obtained by encoding the first signature data with an encoding factor. The first signature data is obtained by encoding the handshake hash information with a white-box private key pre-encoded in the white-box program. The handshake hash information is pre-generated by the client 101, and the encoding factor is sent to the client 101 by the server 102.

[0068] Specifically, when sending data to be transmitted, client 101 can first obtain pre-generated handshake hash information and encoding factor sent by server 101. Then, it can use the white-box private key encoded in the white-box program stored in client 101 to encode the handshake hash information to obtain first signature data. Then, it can use the external encoding factor sent by server 101 to encode the first signature data to obtain second signature data. The second signature data and the data to be transmitted are then sent to server 102. Server 102 can then obtain the data to be transmitted and the second signature data.

[0069] Step S302: Decode the second signature data using the encoding factor to obtain the third signature data.

[0070] After obtaining the second signature data, server 102 can first use the encoding factor to decode the second signature data to obtain the third signature data, which can be represented by the following expression:

[0071]

[0072] This represents the third signature data. This represents the second signature data. Represents the coding factor, while It refers to the decoding function, which can be the inverse operation of the encoding function.

[0073] Step S303: If the third signature data signature verification is successful, receive the data to be transmitted.

[0074] Finally, after obtaining the third signature data, the server 102 can determine whether the third signature data passes the signature verification. If it does, the server will receive the data to be transmitted.

[0075] The above data communication method involves the server 102 acquiring the data to be transmitted from the client 101 and the second signature data. The second signature data is obtained by encoding the first signature data using an encoding factor. The first signature data is obtained by encoding the handshake hash information using a white-box private key pre-encoded in a white-box program. The handshake hash information is pre-generated by the client 101. The encoding factor is sent from the server 102 to the client 101, which uses the encoding factor to decode the second signature data to obtain the third signature data. If the third signature data passes the signature verification, the data to be transmitted is received. In this application, client 101 can pre-generate handshake hash information for server 102 and receive external encoding factors provided by server 102. When sending data to be transmitted, it can use the white-box private key pre-encoded in the white-box program to encode the handshake hash information to obtain first signature data, and then use the external encoding factors provided by the server to further encode it to obtain second signature data. Thus, the data to be transmitted and the second signature data are sent to server 102. Server 102 can then use the encoding factors to decode the second signature data to obtain third signature data and perform signature verification. Only when the verification is successful will it receive the data to be transmitted. Compared with directly generating signature data using the private key of client 101, this application can combine the private key in the white-box program and the external encoding factors provided by server 102 to generate signature data, which can prevent the private key from being exposed and thus improve the level of communication security.

[0076] In one embodiment, the encoding factor is generated through the following steps: obtaining the master key pre-set by the server 102, and generating a derived key for the client 101 based on the master key; using the derived key as a seed to generate a random number, and using the random number as the encoding factor.

[0077] In this embodiment, the encoding factor can be generated based on the derived key, rather than directly generated from the master key pre-set by the server 102. Specifically, the server 102 can use the master key to generate a derived key, and then use the derived key as a seed to generate a random number as the encoding factor, which is then sent to the client.

[0078] In this embodiment, a derived key can be generated internally by the server 102, and then an encoding factor can be generated using the derived key as a seed. Therefore, the encoding factor generated in this way is generated by the derived key of the server 102, while the master key of the server 102 is securely stored internally by the server 102. This can prevent the master key from being leaked due to the external encoding being reverse-engineered or eavesdropped during transmission, thereby improving the security of the master key.

[0079] In addition, after using the random number as the encoding factor, the method also includes: when the client 101 and the server 102 establish a handshake connection, obtaining the original handshake information between the client and the server; adding the encoding factor into the original handshake information to obtain the handshake information, and sending the handshake information to the client 101; the client 101 is used to generate handshake hash information based on the handshake information.

[0080] The raw handshake information refers to the raw information collected during the handshake connection establishment process between client 101 and server 102, while the handshake information is the handshake information that client 101 uses to generate handshake hash information and is ultimately used by the client.

[0081] In this embodiment, the handshake information used to generate the handshake hash information can be handshake information with added encoding factors. Specifically, after the server 102 generates the encoding factors, it can also add the encoding factors to the original handshake information. For example, it can append an extension containing the encoding factors to the CertificateRequest message, which is the original handshake information, to obtain the handshake information, and then send the handshake information to the client 101 so that the client 101 can generate the handshake hash information.

[0082] In this embodiment, an encoding factor can be added to the handshake information used to generate the handshake hash information, so that the calculated handshake hash information can carry the encoding factor provided by the server, thereby further improving the security of the signature data.

[0083] In one embodiment, the first signature data is encoded by the client 101 through a white-box program, and the first original signature data is obtained by signing the handshake hash information with the white-box private key; step S303 may further include: decoding the third signature data through the decoding program corresponding to the white-box program to obtain the second original signature data; verifying the signature of the second original signature data using the public key corresponding to the white-box private key, and receiving the data to be transmitted if the second original signature data is the signature data corresponding to the handshake hash information.

[0084] In this embodiment, the first signature data is generated by encoding the first original signature data using a white-box program. The first original signature data is obtained by signing the handshake hash information using a white-box private key. Specifically, client 101 can first sign the handshake hash information using a white-box private key to generate the first original signature data, and then encode the first original signature data using a white-box program to obtain the first signature data. Therefore, when verifying the decoded third signature data, white-box decoding is also required before signature verification.

[0085] Specifically, server 102 can first use the decoding program corresponding to the white-box program to decode the third signature data to obtain the second original signature data, which can be represented by the following expression:

[0086]

[0087] in, This represents the second original signature data. This represents the third signature data, and This represents the decoding function corresponding to the white-box program, i.e., the white-box decoding function.

[0088] After obtaining the second original signature data, it can be verified. Specifically, the public key of client 101 can be used to verify whether the second original signature data is the signature data of the handshake hash information. This process can be represented by the following expression:

[0089]

[0090] This indicates the signature verification result. This represents the handshake hash information. This represents the second original signature data. For client 101's public key, and This represents the signature verification function.

[0091] In this embodiment, the third signature data can be white-box decoded first using the decoding program corresponding to the white-box program to obtain the second original signature data. Then, the public key of the client 101 can be used to verify whether the second original signature data is the signature data of the handshake hash information. If it is, it means that the signature verification is successful. At this time, the server 102 can receive the above-mentioned data to be transmitted.

[0092] In this embodiment, the third signature data can be decoded first by the decoding program corresponding to the white-box program, and the second original signature data obtained after decoding can be verified by the public key corresponding to the white-box private key. This method can improve the accuracy of signature data verification.

[0093] In one embodiment, a TLS white-box key protection implementation method based on server-side encoding is also provided, such as... Figure 4 As shown, this method is implemented through the following steps:

[0094] 1. Server-side encoding factor: The server uses the master key to obtain a derived key, and uses the derived key as a seed to generate a random number as the encoding factor. coding factor Send to the client.

[0095] (1) Add encoding factor to the original handshake message: The server adds an extension to the original handshake message, i.e., the CertificateRequest message, which contains the encoding factor. The encoding factor random number can be different in each session because during the TLS handshake, communication from the server to the client is unencrypted until the handshake is complete, using a method derived from the master key. This ensures that even the encoding factor... Because the attacker does not have the master key, they are also unable to deduce the session encoding key.

[0096] (2) When the client calculates the handshake hash information, this extended encoding factor will also be hashed in.

[0097] 2. The client uses the private key encoded in the white-box program to sign the handshake hash information, obtaining the first signature data with a fixed encoding. .

[0098]

[0099] in Internally, a white-box protected private key is used, and the output is a fixed-encoded signature.

[0100] 3. Use coding factors right Encode to obtain the second signature data. .

[0101]

[0102] Encoding function It can be XOR, or modular addition or modular multiplication, but it must be invertible.

[0103] 4. The client will Send to the server.

[0104] 5. The server uses encoding factors. right Decode, obtain .

[0105]

[0106] Then use the corresponding white-box decoding function to... Decoded into second original signature data .

[0107]

[0108] 6. The server uses the client's public key for verification. Is it a signature of the handshake hash information?

[0109]

[0110] In this embodiment, the server generates and distributes a dynamic encoding factor (such as a random number) during the authentication challenge phase. This encoding factor participates in the client's signature calculation, while the server stores the corresponding decoding key for signature reconstruction before verification. The client no longer directly uses its private key for signing. The TLS handshake hash value, after input encoding, is sent to a white-box signer for processing, generating an encoded signature. The client's private key (used for TLS signing) and data encryption key are no longer in plaintext; the private key is converted into a white-box lookup program. Even if an attacker obtains the white-box program, they cannot directly use it for correct encryption / signing because they do not know the external encoding. Upon receiving the client's encoded signature value, the server first performs the inverse operation of the corresponding client encoding, then verifies the client's signature information using the public key in the client's certificate, ultimately completing client authentication. Furthermore, the white-box encryption program is implemented on the client side, effectively reducing the controller's security verification and security write time, avoiding long startup times and excessive communication channel resource consumption. In summary, by introducing external encoding for server-side collaboration, the client's private key is protected by white-box encryption, while the private key signing process is protected by external encoding. Since the external encoding needs to be removed in a trusted environment to recover the original input, it can largely replace trusted hardware in software form. This satisfies the client's security implementation based on symmetric and asymmetric encryption and decryption, hash calculation, and other cryptographic methods; it can also decouple from the hardware environment in pure software form, and finally reduce the cost of the controller to trusted hardware.

[0111] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0112] Based on the same inventive concept, this application also provides a data communication apparatus for implementing the data communication method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more data communication apparatus embodiments provided below can be found in the limitations of the data communication method described above, and will not be repeated here.

[0113] In one embodiment, such as Figure 5 As shown, a data communication device is provided for a client, comprising: an encoding factor acquisition module 501, a first signature generation module 502, a second signature generation module 503, and a data transmission module 504, wherein:

[0114] The encoding factor acquisition module 501 is used to acquire the handshake hash information pre-generated for the server, as well as the encoding factor provided by the server.

[0115] The first signature generation module 502 is used to encode the handshake hash information using a white-box private key pre-encoded in the white-box program to obtain the first signature data.

[0116] The second signature generation module 503 is used to encode the first signature data using an encoding factor to obtain the second signature data;

[0117] The data to be transmitted module 504 is used to send the data to be transmitted and the second signature data to the server. The server is used to decode the second signature data using the encoding factor to obtain the third signature data, and to receive the data to be transmitted if the third signature data passes the signature verification.

[0118] In one embodiment, the data communication device further includes: a handshake hash generation module, configured to receive handshake information between the client and the server from the server when a handshake connection is established between the client and the server; the handshake information is generated by the server adding an encoding factor to the original handshake information; and handshake hash information is generated based on the handshake information.

[0119] In one embodiment, the first signature generation module 502 is further configured to use a white-box private key to sign the handshake hash information to generate first original signature data; encode the first original signature data using a white-box program to obtain the first signature data; the server is further configured to use a decoding program corresponding to the white-box program to decode the third signature data to obtain second original signature data, and use the public key corresponding to the white-box private key to verify the signature of the second original signature data, so as to receive the data to be transmitted when the second original signature data is the signature data corresponding to the handshake hash information.

[0120] In one embodiment, such as Figure 6 As shown, a data communication device is provided for use on a server side, including: a data acquisition module 601 to be transmitted, a third signature acquisition module 602, and a third signature verification module 603, wherein:

[0121] The data to be transmitted acquisition module 601 is used to acquire the data to be transmitted to the server sent by the client and the second signature data; the second signature data is obtained by encoding the first signature data by encoding the encoding factor, and the first signature data is obtained by encoding the handshake hash information by encoding the white-box private key pre-encoded in the white-box program. The handshake hash information is pre-generated by the client, and the encoding factor is sent to the client by the server.

[0122] The third signature acquisition module 602 is used to decode the second signature data using the encoding factor to obtain the third signature data;

[0123] The third signature verification module 603 is used to receive the data to be transmitted if the third signature data signature verification is successful.

[0124] In one embodiment, the data communication device further includes: an encoding factor generation module, configured to obtain a master key pre-set by the server, and generate a derived key for the client based on the master key; generate a random number using the derived key as a seed, and use the random number as an encoding factor.

[0125] In one embodiment, the encoding factor generation module is further configured to obtain the original handshake information between the client and the server when a handshake connection is established between the client and the server; add the encoding factor to the original handshake information to obtain handshake information, and send the handshake information to the client; the client is configured to generate handshake hash information based on the handshake information.

[0126] In one embodiment, the first signature data is encoded by the client through a white-box program, and the first original signature data is obtained by signing the handshake hash information with the white-box private key; the third signature verification module 603 is further used to decode the third signature data through the decoding program corresponding to the white-box program to obtain the second original signature data; to verify the signature of the second original signature data using the public key corresponding to the white-box private key, and to receive the data to be transmitted if the second original signature data is the signature data corresponding to the handshake hash information.

[0127] Each module in the aforementioned data communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0128] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interfaces, and a communication interface. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a data communication method.

[0129] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data to be transmitted. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data communication method.

[0130] Those skilled in the art will understand that Figure 7 The structure shown in Figure 8 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0131] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0132] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0133] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0134] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0135] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0136] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0137] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data communication method, characterized in that, Applied to a client, the method includes: Obtain the handshake hash information pre-generated for the server, as well as the encoding factor provided by the server; The handshake hash information is encoded using a white-box private key pre-encoded in a white-box program to obtain the first signature data; The first signature data is encoded using the encoding factor to obtain the second signature data; The data to be transmitted and the second signature data are sent to the server. The server uses the encoding factor to decode the second signature data to obtain the third signature data, and receives the data to be transmitted if the third signature data passes the signature verification.

2. The method according to claim 1, characterized in that, The handshake hash information is generated through the following steps: When the client establishes a handshake connection with the server, the handshake information between the client and the server is received from the server. The handshake information is generated by the server adding the encoding factor to the original handshake information; Based on the handshake information, the handshake hash information is generated.

3. The method according to claim 1, characterized in that, The step of encoding the handshake hash information using a white-box private key pre-encoded in a white-box program to obtain first signature data includes: The handshake hash information is signed using the white-box private key to generate the first original signature data; The first original signature data is obtained by encoding the first signature data through the white-box program. The server is further configured to decode the third signature data using the decoding program corresponding to the white-box program to obtain the second original signature data, and to verify the signature of the second original signature data using the public key corresponding to the white-box private key, so as to receive the data to be transmitted if the second original signature data is the signature data corresponding to the handshake hash information.

4. A data communication method, characterized in that, Applied to the server side, the method includes: The server obtains the data to be transmitted to the server and the second signature data sent by the client; the second signature data is obtained by encoding the first signature data with an encoding factor, and the first signature data is obtained by encoding the handshake hash information with a white-box private key pre-encoded in the white-box program, the handshake hash information is pre-generated by the client, and the encoding factor is sent to the client by the server; The second signature data is decoded using the encoding factor to obtain the third signature data; If the third signature data verification is successful, the data to be transmitted is received.

5. The method according to claim 4, characterized in that, The coding factor is generated through the following steps: Obtain the master key pre-set by the server, and generate a derived key for the client based on the master key; Using the derived key as a seed, a random number is generated, and the random number is used as the encoding factor.

6. The method according to claim 5, characterized in that, After using the random number as the encoding factor, the method further includes: If the client and the server establish a handshake connection, obtain the original handshake information between the client and the server; The encoding factor is added to the original handshake information to obtain handshake information, and the handshake information is sent to the client; the client is used to generate the handshake hash information based on the handshake information.

7. The method according to claim 4, characterized in that, The first signature data is encoded by the client through the white-box program, and the first original signature data is obtained by the white-box private key signing the handshake hash information. The step of receiving the data to be transmitted after the third signature data signature verification is passed further includes: The third signature data is decoded by the decoding program corresponding to the white-box program to obtain the second original signature data; The public key corresponding to the white-box private key is used to verify the signature of the second original signature data, and the data to be transmitted is received if the second original signature data is the signature data corresponding to the handshake hash information.

8. A data communication device, characterized in that, Applied to a client, the device includes: The encoding factor acquisition module is used to acquire the handshake hash information pre-generated for the server, as well as the encoding factor provided by the server. The first signature generation module is used to encode the handshake hash information using a white-box private key pre-encoded in a white-box program to obtain the first signature data. The second signature generation module is used to encode the first signature data using the encoding factor to obtain the second signature data; The data to be transmitted module is used to send the data to be transmitted to the server and the second signature data to the server; the server is used to decode the second signature data using the encoding factor to obtain the third signature data, and to receive the data to be transmitted if the signature verification of the third signature data is successful.

9. A data communication device, characterized in that, Applied to the server side, the device includes: The data to be transmitted module is used to acquire the data to be transmitted to the server sent by the client and the second signature data; the second signature data is obtained by encoding the first signature data with an encoding factor, and the first signature data is obtained by encoding the handshake hash information with a white-box private key pre-encoded in the white-box program, the handshake hash information is pre-generated by the client, and the encoding factor is sent to the client by the server. The third signature acquisition module is used to decode the second signature data using the encoding factor to obtain the third signature data; The third signature verification module is used to receive the data to be transmitted if the third signature data signature verification is successful.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

Images