Data encryption processing method, device, system and computer readable storage medium

Abstract

The application provides a data encryption processing method, device, system and computer readable storage medium. The method comprises: in response to an encryption request, calling an integrated encryption module at a JavaScript layer, inputting a field to be encrypted and a public key into the integrated encryption module, obtaining an encrypted field and an encryption key output by the integrated encryption module; and sending the encrypted field and the encryption key to a server, so that the server decrypts the encryption key through a private key to obtain a symmetric key, and then decrypts the encrypted field through the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key. By encapsulating the generation and use logic of the symmetric key entirely inside the integrated encryption module, the JavaScript layer only inputs the field to be encrypted and the public key, and does not input or receive the symmetric key, thereby avoiding exposure of the front-end encryption logic and the symmetric key at the JavaScript layer, and improving the security of sensitive data.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a data encryption processing method, apparatus, system, and computer-readable storage medium. Background Technology

[0002] In the front-end of web applications, there are scenarios where sensitive data needs to be transmitted encrypted. Traditional front-end encryption methods typically implement encryption logic at the JavaScript layer. However, JavaScript code and its runtime environment are open, making the front-end code and encryption logic easily debugged, broken through, and reverse-engineered in the browser's developer tools. Attackers can obtain the encryption logic and keys through dynamic debugging, memory hijacking, and other methods, thereby decrypting and tampering with the data.

[0003] Therefore, a technical solution is needed to achieve data encryption at the front-end application layer and secure transmission between the front-end and the server when the JavaScript execution environment is untrusted. Summary of the Invention

[0004] The main objective of this application is to provide a data encryption processing method, apparatus, system, and computer-readable storage medium to at least solve the problem of insufficient security of sensitive data caused by the exposure of front-end encryption logic and keys in the JavaScript layer in the prior art.

[0005] To achieve the above objectives, according to a first aspect of this application, a data encryption processing method is provided, applicable to a client, comprising:

[0006] In response to an encryption request, an integrated encryption module is invoked at the JavaScript layer. The field to be encrypted and a public key are input to the integrated encryption module, which outputs an encrypted field and an encryption key. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key. The symmetric key is generated by the integrated encryption module when it is invoked and deleted after the call ends.

[0007] The encrypted field and the encrypted key are sent to the server so that the server can decrypt the encrypted key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

[0008] Optionally, the method further includes:

[0009] In response to the encryption request, the client sends a public key acquisition request to the server.

[0010] The client obtains the public key returned by the server.

[0011] Optionally, the integrated encryption module further includes a glue function; the glue function is used to implement the calling interface function of the integrated encryption module. When called, the glue function loads the WebAssembly binary file of the integrated encryption function and converts the WebAssembly binary file of the integrated encryption function into an instance that can be called by the JavaScript layer.

[0012] Optionally, the public key is a Base64-encoded DER public key; the integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key, including:

[0013] The public key is Base64 decoded using the integrated encryption function to obtain DER binary bytes, and the DER binary bytes are then DER decoded to obtain the binary string of the public key.

[0014] The symmetric key is encrypted using the binary string of the public key.

[0015] Optionally, the integrated encryption module uses the AES-GCM algorithm to implement symmetric encryption; the integrated encryption module uses the symmetric key to perform symmetric encryption on the field to be encrypted, including:

[0016] The integrated encryption module generates the symmetric key and the random number;

[0017] The field to be encrypted is symmetrically encrypted using the symmetric key and the random number.

[0018] Optionally, the integrated encryption module further outputs the random number, and the method further includes:

[0019] The random number, the encrypted field, and the encryption key are sent to the server together, so that the server can decrypt the encryption key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key and the random number to obtain the field to be encrypted.

[0020] Optionally, sending the encrypted field and the encryption key to the server includes:

[0021] Under TLS transport layer protection, the encrypted field, the encryption key, and the random number nonce are sent to the server via a POST request.

[0022] According to a second aspect of this application, a data encryption processing apparatus is provided, suitable for a client, comprising: a response module, an integrated encryption module, and a transmission module;

[0023] The response module is used to respond to an encryption request by calling the integrated encryption module in the JavaScript layer, inputting the field to be encrypted and the public key to the integrated encryption module, and obtaining the encrypted field and encryption key output by the integrated encryption module; wherein, the integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file; the encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted; the encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key; the symmetric key is generated by the integrated encryption module when it is called and deleted after the call ends;

[0024] The transmission module is used to send the encrypted field and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

[0025] According to a third aspect of this application, a data encryption processing system is provided, comprising:

[0026] The client, responding to an encryption request, invokes the integrated encryption module in the JavaScript layer, inputting the field to be encrypted and a public key to the integrated encryption module, and obtaining the encrypted field and encryption key output by the integrated encryption module. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key. The symmetric key is generated by the integrated encryption module when it is invoked and deleted after the invocation.

[0027] The client is also used to send the encrypted field and the encryption key to the server;

[0028] The server is used to decrypt the encryption key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

[0029] According to a fourth aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform any of the data encryption processing methods described above.

[0030] According to a fifth aspect of this application, a processor is provided for running a program, wherein the program executes the data encryption processing method described in any one of the preceding claims.

[0031] According to a sixth aspect of this application, an electronic device is provided, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data encryption processing method described in any one of the preceding claims.

[0032] By applying the technical solution of this application, the generation and use logic of the symmetric key are entirely encapsulated within an integrated encryption module of the WebAssembly binary file. The JavaScript layer only passes the field to be encrypted and the public key, without passing or receiving the symmetric key, thus avoiding the exposure of the front-end encryption logic and the symmetric key at the JavaScript layer and improving the security of sensitive data. Simultaneously, asymmetric encryption is used to protect the symmetric key, and symmetric encryption is used to protect sensitive data, achieving application-layer digital envelope encryption. Even if the transport layer is compromised, attackers cannot directly obtain the plaintext from the encrypted field and encryption key. Furthermore, the symmetric key is used once-and-for-use and deleted after the call, further shortening the key lifecycle and improving the security of front-end encryption. Attached Figure Description

[0033] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0034] Figure 1 This paper shows a hardware structure block diagram of a mobile terminal for a data encryption processing method provided in an embodiment of this application;

[0035] Figure 2 A schematic flowchart of a data encryption processing method according to an embodiment of this application is shown;

[0036] Figure 3 A schematic diagram of the encryption process of an integrated encryption function provided according to an embodiment of this application is shown;

[0037] Figure 4 A schematic diagram of a process for constructing an integrated encryption module according to an embodiment of this application is shown;

[0038] Figure 5 A schematic diagram illustrating a process of a front-end project calling an integrated encryption module to complete encryption according to an embodiment of this application is shown.

[0039] Figure 6 A schematic diagram of the structure of a data encryption processing apparatus according to an embodiment of this application is shown;

[0040] Figure 7 A schematic diagram of the architecture of a data encryption processing system provided according to an embodiment of this application is shown.

[0041] The above figures include the following reference numerals:

[0042] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device; 601. Response module; 602. Integrated encryption module; 603. Transmission module. Detailed Implementation

[0043] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0044] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0045] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0046] As described in the background section, traditional front-end encryption methods typically implement encryption logic at the JavaScript layer. Due to the open nature of the front-end JavaScript technology stack, the code logic is exposed, making the front-end code and encryption logic easily debugged and parsed by attackers in the browser's developer tools. This can lead to security vulnerabilities such as symmetric key leakage and exposure of encryption logic. If HTTPS is compromised, attackers can snoop on and obtain plaintext messages, threatening the confidentiality of sensitive data transmissions such as transfer amounts, customer transaction passwords, and account balances. Attackers can even tamper with amounts or sensitive data and replay request messages to the server, achieving a man-in-the-middle attack without the attacker's knowledge.

[0047] To address the aforementioned issues, embodiments of this application provide a data encryption processing method, apparatus, system, and computer-readable storage medium.

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. For ease of description, some terms or nouns involved in the embodiments of this application will be explained below:

[0049] HTTPS: It adds the SSL / TLS transport layer security protocol to the HTTP protocol to encrypt and authenticate transmitted data, and is a typical example of transport layer encryption.

[0050] WebAssembly is a portable, fast-loading new binary format for the web that supports the creation of portable binary executables from different languages.

[0051] Binary encoding: is a sequence of instructions consisting of 0s and 1s, such as 1011010100110101001.

[0052] Front-end: refers to the presentation of interfaces such as web pages or app applications, and the implementation of user interface interactions through HTML / CSS / JavaScript and derivative technologies.

[0053] JavaScript: A high-level front-end language used for web page interaction and front-end development, enhancing the interactivity and dynamism of web pages, and efficiently handling front-end interaction logic.

[0054] JavaScript reverse engineering refers to the process of analyzing and reconstructing the logic of obfuscated and compressed JavaScript code when it is impossible to directly obtain it.

[0055] Symmetric encryption: This refers to an encryption method that uses the same key for both encryption and decryption. Currently, the most mainstream and secure encryption algorithms include AES. Its advantages include fast encryption and decryption speeds, making it suitable for encrypting large amounts of data.

[0056] Asymmetric encryption: Its security is based on the problem of factoring large numbers. It uses a public key and a private key. Currently, the most mainstream algorithms include RSA, which are used for information tamper-proofing and key protection.

[0057] Digital envelope encryption refers to encrypting data using a symmetric key and then encrypting the symmetric key using a public key for asymmetric encryption, thereby balancing encryption performance and key distribution security.

[0058] Application layer encryption / decryption: refers to a sensitive data protection method performed by the application itself, in addition to transport layer encryption / decryption.

[0059] This embodiment provides a data encryption processing method running on a mobile terminal, mobile terminal, or similar computing device. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here. In addition, the acquisition, storage, use, and processing of data involved in this application embodiment all comply with relevant national laws and regulations.

[0060] Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a data encryption processing method according to an embodiment of the present invention.

[0061] like Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0062] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the data encryption processing method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the aforementioned data encryption processing method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one instance, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0063] Figure 2 This is a flowchart of a data encryption processing method according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0064] Step S201: In response to the encryption request, the integrated encryption module is called in the JavaScript layer. The field to be encrypted and the public key are input into the integrated encryption module, and the encrypted field and encryption key are output by the integrated encryption module. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using the symmetric key to perform symmetric encryption on the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to perform asymmetric encryption on the symmetric key. The symmetric key is generated by the integrated encryption module when it is called and deleted after the call ends.

[0065] This involves encryption requests. An encryption request is a request generated by a client when it needs to encrypt sensitive data at the application layer. It should be noted that the triggering method of the encryption request is not limited in this embodiment. When the client detects that sensitive data needs to be transmitted, it triggers the data encryption processing flow of this application embodiment through an encryption request, so as to protect the sensitive data at the application layer, rather than relying solely on HTTPS protection at the transport layer.

[0066] This involves the JavaScript layer. The JavaScript layer refers to the JavaScript execution layer in the client's front-end runtime environment. The front-end page uses HTML, CSS, JavaScript, and derivative technologies to implement user interface interaction and business logic processing. The JavaScript layer is typically responsible for receiving user input, organizing business parameters, and initiating network requests. In this embodiment, the JavaScript layer is not responsible for implementing specific encryption algorithms, nor for generating or storing symmetric keys. Instead, it is only responsible for calling the integrated encryption module and passing the field to be encrypted and the public key to the integrated encryption module. Through this design, the encryption key and encryption logic can be moved from the JavaScript layer to the WebAssembly binary module, making it difficult for attackers to directly debug the JavaScript code through browser developer tools and thus learn the encryption details.

[0067] This involves an integrated encryption module. An integrated encryption module is an encryption module that encapsulates operations such as symmetric key generation, symmetric encryption, asymmetric encryption, and key destruction together. The integrated encryption module includes integrated encryption functions, which are compiled into WebAssembly binary files. WebAssembly is a portable, fast-loading binary instruction format that can be compiled from high-level languages ​​such as Rust and C / C++ and executed in environments such as browsers. Because WebAssembly files exist in binary instruction form, compared to pure JavaScript code, it is difficult for attackers to directly read and reverse engineer the internal logic. The integrated encryption module can expose only a few call interfaces, and the JavaScript layer can complete the entire encryption operation by calling these interfaces. By encapsulating the complex encryption process in a single call, the number of interactions between the JavaScript layer and the underlying encryption logic can be reduced, cross-language call overhead can be lowered, and the exposure surface of the JavaScript layer can be reduced.

[0068] This involves fields to be encrypted. These fields refer to sensitive data that requires confidentiality protection. The fields exist in plaintext at the JavaScript layer and are passed to an integrated encryption module, which internally encrypts them, thus preventing plaintext data from directly entering the network transmission process. It should be noted that this embodiment does not impose specific limitations on the content of the fields to be encrypted.

[0069] This involves the use of public keys. A public key is a publicly disclosed key used to encrypt data in asymmetric encryption. The public key and the private key held by the server form an asymmetric key pair. The public key can be pre-installed on the client or distributed by the server. By encrypting the symmetric key with the public key, only the server holding the corresponding private key can decrypt it and obtain the symmetric key, thus solving the problem of secure distribution of symmetric keys.

[0070] This involves encrypted fields. The encrypted field is the ciphertext obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted. Symmetric encryption refers to an encryption method that uses the same symmetric key for both encryption and decryption. In this embodiment, the integrated encryption module generates a symmetric key when it is invoked. The symmetric key can be a one-time pad random key, meaning a new symmetric key is generated each time the integrated encryption module is invoked, rather than a fixed key. This way, even if the symmetric key is leaked once, it will not affect the data encrypted in other calls. After the symmetric key is generated, the integrated encryption module uses this symmetric key to symmetrically encrypt the field to be encrypted, obtaining the encrypted field. The advantage of symmetric encryption is its fast encryption and decryption speed, making it suitable for encrypting large amounts of data. This embodiment uses symmetric encryption to process large amounts of sensitive data, balancing encryption security and encryption performance.

[0071] This involves an encryption key. The encryption key is the ciphertext obtained by the integrated encryption module using the public key to perform asymmetric encryption on the symmetric key. Asymmetric encryption uses a public key and a secret private key, where the public key is used for encryption and the private key is used for decryption. In this embodiment, the integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key to obtain the encryption key. Thus, the symmetric key itself does not appear in plaintext in the front-end transmitted messages, nor is it exposed to the JavaScript layer in plaintext. Only the server holding the private key can decrypt the encryption key to obtain the symmetric key. Using asymmetric encryption to protect the symmetric key allows it to be securely transmitted from the client to the server without exposing the plaintext symmetric key on the front end. The symmetric key is generated by the integrated encryption module when it is invoked and deleted after the call ends. The lifespan of the symmetric key is limited to a single call to the integrated encryption module. Since the JavaScript layer cannot directly read the symmetric key in the internal memory of the WebAssembly module, attackers find it difficult to obtain the symmetric key by debugging JavaScript code. Even if an attacker sets breakpoints or attempts memory hijacking, the symmetric key has already been deleted after the call ends, thus reducing the risk of key leakage.

[0072] This step leverages the speed of symmetric encryption to encrypt large amounts of sensitive data, while utilizing the high security of asymmetric encryption to protect the symmetric key. The front-end JavaScript layer only needs to pass the field to be encrypted and the public key to the integrated encryption module. The integrated encryption module automatically handles symmetric key generation, symmetric encryption, asymmetric encryption, and key destruction. The front-end does not hold the private key or the plaintext symmetric key. Therefore, the confidentiality of sensitive data transmission is enhanced from the client-side source.

[0073] Step S202: Send the encrypted field and encryption key to the server so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein, the private key matches the public key.

[0074] This involves the server-side. The server is the party that receives encrypted messages from the client and decrypts them. The server holds a private key that matches the public key. As a trusted party, the server is responsible for generating or holding the private key in the asymmetric key pair and using it to decrypt the encryption key sent by the client, thereby obtaining the symmetric key. The private key is a secret key in asymmetric encryption, used to decrypt data encrypted with the public key. A matching private and public key means that the private and public keys belong to the same asymmetric key pair; data encrypted with the public key can only be decrypted with the corresponding private key. The security of asymmetric encryption is based on the large number factorization problem, making it difficult for attackers to deduce the private key from the public key alone. Therefore, storing the private key on the server, while the front-end only holds the public key, fundamentally eliminates the risk of front-end private key leakage.

[0075] Asymmetric encryption addresses the secure distribution of symmetric keys, while symmetric encryption addresses the performance issues associated with encrypting large amounts of data. The front-end holds only the public key, while the server holds the private key. The front-end uses the public key to encrypt the symmetric key, forming the encryption key; the server uses the private key to decrypt the encryption key, obtaining the symmetric key. Even if an attacker obtains the encrypted field and the encryption key, they cannot decrypt the encryption key without the private key, thus preventing them from obtaining the symmetric key and ultimately decrypting the encrypted field. Therefore, even if HTTPS at the transport layer is compromised, the attacker can only obtain the ciphertext, making it difficult to spy on plaintext messages, tamper with amounts or sensitive data, or replay request messages.

[0076] This embodiment encapsulates the entire symmetric and asymmetric hybrid encryption algorithm process within a unified encryption function. This function body is compiled into WebAssembly binary instructions, and then a glue function `myGlue.js` is constructed to combine the two into a unified encryption module, which can be called by the front-end JavaScript. The front-end JavaScript only needs to pass the sensitive field values ​​and the public key to call the unified encryption module once to complete the entire encryption operation. The client then sends the encrypted fields and encryption key to the server, which uses its private key to perform the decryption operation. Throughout the entire process, the front-end JavaScript only needs to make one call to complete the digital envelope encryption, reducing the number of interactions between JavaScript and the underlying encryption logic, lowering cross-language call overhead, and hiding the core encryption logic within the WebAssembly binary instructions, increasing the cost of reverse engineering and ensuring the confidentiality of sensitive data transmission from the client-side source.

[0077] Furthermore, the entire application-layer encryption and decryption process implemented in this application embodiment can be understood as a certificate-free simplified version of the TLS / SSL protocol. The main difference is that the public key transmission in the TLS / SSL protocol relies on digital certificates, while the public key transmission in this application embodiment uses a simplified Base64 format. Additionally, the reason for using symmetric encryption for sensitive fields first, instead of directly encrypting sensitive fields with an asymmetric public key, is primarily due to the fact that asymmetric encryption is slow and has a performance bottleneck for large amounts of sensitive fields. Therefore, a hybrid symmetric and asymmetric digital envelope method is adopted, which can utilize symmetric encryption to ensure performance and encryption speed, while also ensuring security through asymmetric encryption.

[0078] In some embodiments, the data encryption processing method further includes: in response to an encryption request, sending a public key acquisition request to the server; and acquiring the public key returned by the server. In this embodiment, the public key is generated and distributed by the server, and the private key is always stored on the server. The client does not generate or store an asymmetric encryption private key, thereby avoiding the risk of front-end private key leakage.

[0079] For example, the server can pre-generate an RSA public-private key pair, storing the private key in a secure server storage area and providing the public key to the client in Base64-encoded DER format. The client requests the public key from the server when encryption is needed, or uses a pre-built-in public key. The private key is held solely by the server and used for subsequent decryption of the encryption key. Because the front-end does not generate the private key, attackers cannot reverse engineer it through the front-end.

[0080] In some embodiments, the integrated encryption module further includes a glue function. This glue function implements the calling interface functionality of the integrated encryption module. When called, the glue function loads the WebAssembly binary file of the integrated encryption function and transforms it into an instance that can be called by the JavaScript layer. In this embodiment, the glue function bridges the gap between the high-level JavaScript language and the WebAssembly binary machine code, enabling the front-end JavaScript to use the integrated encryption function in a normal function call manner, thereby reducing the cost of front-end engineering integration.

[0081] For example, the monolithic encryption function can be written in Rust and marked as an interface that can be exposed to JavaScript via the `wasm_bindgen` macro. The monolithic encryption function can receive the field to be encrypted and the public key, and return the encrypted field, the encrypted key, and a random number. The glue function can asynchronously load and instantiate the corresponding WebAssembly binary file, allowing the JavaScript layer to import the initialization interface and the monolithic encryption function via module import. The front-end JavaScript does not need to understand the internal structure of the WebAssembly binary file; it only needs to call the interface exposed by the glue function.

[0082] In some embodiments, the public key is a Base64-encoded DER public key; the integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key, including: using the integrated encryption function to Base64 decode the public key to obtain DER binary bytes, performing DER decoding on the DER binary bytes to obtain the binary string of the public key; and using the binary string of the public key to perform asymmetric encryption on the symmetric key. In this embodiment, using Base64-encoded DER as the public key transmission format between the JavaScript layer and the integrated encryption function is smaller in size and simpler to parse than the PEM format, which is beneficial for improving transmission and parsing efficiency.

[0083] For example, the integrated encryption function can first Base64 decode the incoming public key to obtain DER binary bytes; then parse the DER binary bytes into an RSA public key object according to a specific ASN.1 structure; if the parsing fails, it returns a verification failure message. Subsequently, the symmetric key is encrypted using this RSA public key object, with the padding scheme using PKCS#1v1.5, and the encryption result is Base64 encoded to obtain the encryption key. The content of the PEM file after removing the header and footer tags and newline characters can then be passed in as the Base64 encoded DER public key.

[0084] In some embodiments, the integrated encryption module employs the AES-GCM algorithm to implement symmetric encryption. The integrated encryption module uses a symmetric key to perform symmetric encryption on the field to be encrypted, including: generating a symmetric key and a random number; and using the symmetric key and the random number to perform symmetric encryption on the field to be encrypted. In this embodiment, using the AES-GCM mode can provide integrity verification capabilities while ensuring encryption speed. The random number (nonce) is used only once, avoiding the security risks associated with reuse.

[0085] Specifically, in AES-GCM mode, the integrated encryption module also outputs a random number. The data encryption processing method also includes: sending the random number, the encryption field, and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encryption field with the symmetric key and the random number to obtain the field to be encrypted.

[0086] For example, the integrated encryption module can generate a 256-bit AES key and a 12-byte random number when called by the client. The random number can be generated using the `getrandom` method. Then, the AES-GCM algorithm is used to encrypt the field to be encrypted using the symmetric key and the random number, resulting in the encrypted field. After RSA encryption is complete, the `zeroize()` method is called to clear the symmetric key from memory, ensuring its secure destruction. This ensures the symmetric key is not exposed to the JavaScript execution environment throughout the process, achieving one-time use and destruction. After the integrated encryption module returns the encrypted field, encryption key, and random number to the client, the client sends these three elements to the server. The server uses its own RSA private key to decrypt the encryption key, obtaining the symmetric key; then, it uses the symmetric key and the random number to perform AES-GCM decryption on the encrypted field, obtaining the original sensitive field. It should be noted that AES-GCM mode requires the same random number for correct decryption; therefore, the random number must be transmitted along with the encrypted field and encryption key. The random number itself is not a key and can be publicly transmitted, but it must be ensured that it is not reused in each encryption.

[0087] In some embodiments, sending the encrypted field and encryption key to the server includes: sending the encrypted field, encryption key, and random number (nonce) to the server via a POST request under TLS transport layer protection. In this embodiment, the client sends a POST request to the server under TLS transport layer protection. The server decrypts the RSA private key obtained from the security key platform to obtain the AES key. The server then uses the AES key to decrypt the plaintext field. The RSA private key is always stored on the server and is never exposed in the front-end environment. Even if HTTPS is compromised and an attacker obtains the message, they can only obtain the encrypted field and encryption key, but not the symmetric key and private key, making it difficult to eavesdrop on the plaintext message and improving the confidentiality and integrity of sensitive data transmission.

[0088] To enable those skilled in the art to better understand the technical solution of this application, the implementation process and implementation principle of the data encryption processing method of this application will be described in detail below with reference to specific embodiments.

[0089] First, the implementation principle of the data encryption processing method in this application is introduced. The core of this data encryption processing method lies in encapsulating the entire symmetric and asymmetric hybrid encryption algorithm process within an integrated encryption function. This function body is compiled into WebAssembly binary instruction format, and then a glue function, myGlue.js, adapted to JavaScript's calls to binary encoded instructions is constructed, combining the two into an integrated encryption module for use by the front-end JavaScript. The front-end JavaScript only needs to pass in the sensitive field values ​​and the public key to call the integrated encryption module to complete the entire encryption operation in one go. The client then securely sends the encrypted message to the server via a POST request under the HTTPS protocol at the transport layer, and the server uses its private key to perform the decryption operation.

[0090] The implementation principle of data encryption processing methods can be divided into three main parts.

[0091] The first part implements the core encryption algorithm using an integrated encryption function.

[0092] Specifically, to avoid the security risks posed by exposing the symmetric key on the front end, an integrated encryption function is constructed. This function encapsulates operations such as symmetric key generation, symmetric encryption, asymmetric encryption, and key destruction within a single function. The goal is to allow JavaScript to complete all front-end encryption operations with a single call, avoiding multiple interactions between JavaScript and the integrated encryption function, reducing the exposure surface to the front-end JavaScript, and thus hiding the entire encryption operation within the WebAssembly binary code, preventing front-end debugging and "spying." The core idea is to use the integrated encryption function to implement digital envelope encryption based on a hybrid of symmetric and asymmetric encryption. This includes generating the symmetric encryption key `aes_key` and a random number `nonce`, encrypting sensitive fields using the symmetric key `aes_key`, and encrypting the symmetric key `aes_key` using the passed-in RSA public key. Then, the `zeroize()` method clears the symmetric key `aes_key` from memory, ensuring its secure destruction. In this way, the symmetric key is not exposed to the JavaScript execution environment throughout the entire process, thus preventing its acquisition through JavaScript debugging. Figure 3 As shown, the encryption process of the integrated encryption function is as follows:

[0093] (301) First, define the integrated encryption function myEncrypt() and use it via # The macro marks the function as an interface that can be exposed to JavaScript. It accepts two arguments from JavaScript: an encrypted field `data` and a Base64-formatted RSA public key `public_key`. It outputs three pieces of data to JavaScript: the encrypted field `encrypted_data`, the encrypted key `encrypted_key`, and a random number `nonce`.

[0094] For example, the declaration of the unified encryption function is as follows:

[0095] #

[0096] pub fn myEncrypt(data:str,publickey:str)->Result<EncryptionResult,JsValue> {……}.

[0097] (302) Decode the Base64-encoded public key into a binary string `public_key_bytes`. Considering the complexity of parsing the prefix and suffix of the PEM format public key, the front-end uses Base64-encoded DER as the public key transmission format for the JavaScript layer and the integrated encryption function. Transmitting the public key using the Base64-encoded DER format results in a size approximately 20% to 30% smaller than the PEM format, which helps reduce the amount of data transmitted. For example, the code for decoding the public key is as follows:

[0098] let public_key_bytes = de

[0099] map_err(|e| JsValue::from_str(&format!

[0100] ("Base64 decoding failed: {}", e)))?

[0101] (303) Load the RSA public key from the DER format, parsing the binary string `public_key_bytes` in (302) above into the RSA public key `public_key_rsa`. This requires loading a DER format public key conforming to a specific ASN.1 structure. If it is not a valid RSA public key, an exception is thrown indicating verification failure. For example, the code for loading the public key is as follows:

[0102] let public_key_rsa = RsaPublicKey::from_public_key_

[0103] .map_err(|e| JsValue::from_str(&format!

[0104] ("Failed to load RSA public key: {}", e)))?

[0105] (304) Generate symmetric key aes_key and nonce random number: Generate a 256-bit AES key aes_key and a nonce random number (for GCM mode, the nonce is random and cannot be reused), and fill the random value using getrandom. For example, the code for generating the symmetric key aes_key and nonce random number is as follows:

[0106] let mut aes_key = vec!

[0107] [0u8; 32];

[0108] getra .map_err(|e| JsValue::from_str(&format!

[0109] ("Failed to generate AES key: {}", e)))? ;

[0111] let mut nonce_bytes = [0u8; 12];

[0112] getra .map_err(|e| JsValue::from_str(&format!

[0113] ("Failed to generate nonce: {}", e)))? ;

[0115] let nonce = Nonce::from_s .

[0116] (305) To encrypt the sensitive input field using AES-GCM mode, first convert the aes_key to the format used by AES-GCM, create an encryption instance, and then encrypt the field using the nonce and symmetric key in GCM mode to obtain the encrypted field data encrypted_data. For example, the encryption process code is as follows:

[0117] let encrypted_data = {

[0118] let key = Key:: <aes256gcm>::from_s ;

[0119] let cipher = Aes256Gcm::new(key);

[0120] cipher.encrypt(nonce, data.as_bytes())

[0121] .map_err(|e| JsValue::from_str(&format!

[0122] ("AES-GCM encryption failed: {}", e)))?

[0123] }

[0124] (306) RSA Encryption of AES Key: Encrypt the symmetric key aes_key using the public key public_key_rsa parsed in (303), using PKCS#1 v1.5 as the padding scheme, and Base64 encode the result to obtain the encrypted key encrypted_key. For example, the code for encrypting the RSA-to-AES key is as follows:

[0125] let encrypted_key = {

[0126] let mut rng = rand::thread_rng();

[0127] let encrypted_bytes = public_key_rsa.enc

[0128] .map_err(|e| JsValue::from_str(&format!

[0129] ("RSA encryption failed: {}", e)))? ;

[0131] en .

[0132] (307) Use the zeroize method to clear the symmetric key aes_key generated in step (304), ensuring that sensitive data in memory is securely destroyed, reducing the key's lifespan, and preventing exposure to the JavaScript layer. For example, the code to clear the symmetric key is: aes_key.zeroize().

[0133] (308) Encapsulate the encrypted field, the encrypted key, and the Base64-encoded random number into an `EncryptionResult` structure and return it to JavaScript. For example, the code for returning the data is as follows:

[0134] Ok(EncryptionResult {

[0135] encrypted_data: en ,

[0136] encrypted_key,

[0137] nonce: en ,

[0138] }).

[0139] The second part involves compiling and encapsulating an integrated encryption function and building glue functions to enable the front-end to call the binary WebAssembly.

[0140] Specifically, this part mainly encapsulates the algorithm logic in the first part and compiles it into a WebAssembly binary file. To ensure that JavaScript can call the WebAssembly binary file, a glue function myGlue.js is created to implement the initialization and loading of the module. The compiled binary encoded file and the glue function are combined into an integrated encryption module.

[0141] like Figure 4 As shown, the specific process for building an integrated encryption module includes the following steps:

[0142] (401) First, the wasm-pack build command is used to compile the integrated encryption function into a WebAssembly binary file. The target web option is set to ensure that the generated WebAssembly binary file can be used directly in the browser's ES module environment.

[0143] (402) Since JavaScript is a high-level language, it cannot directly call WebAssembly binary files. To ensure JavaScript's ability to call and interact with machine language, a bridge needs to be built between the high-level language and the binary machine language to handle the interaction between them. Therefore, this step solves this problem by constructing a glue function. Define an asynchronous glue function myGlue, whose main function is to load and instantiate binary encoded files. For example, the declaration code of the glue function is as follows:

[0144] async function myGlue(module_or_path) { ......

[0146] }

[0147] (403) Set the default path to the path of the compiled binary encoded file and obtain asynchronous resources via fetch. Here, `myEncrypt` is the name of the integrated encryption function defined in (401) above. For example, the code corresponding to this step is as follows:

[0148] module_or_path = new URL(myEncrypt.wasm', import.meta.url);

[0149] module_or_path = fetch(module_or_path).

[0150] (404) Load and instantiate the binary encoded file. For example, the code corresponding to this step is as follows:

[0151] const { instance, module} = await load(await module_or_path,imports);

[0152] await WebAssembly.instantiateStreaming(module, imports).

[0153] (405) Combine the compiled binary encoded file and the constructed myGlue glue function into an integrated encryption module.

[0154] The third part involves the front-end project completing all front-end encryption operations by calling the integrated encryption module.

[0155] Specifically, an integrated encryption module is introduced into the front-end project. It takes the plaintext sensitive field to be encrypted and the RSA public key as input, and outputs the encrypted field, encryption key, and random number. All front-end encryption operations are completed through a single call to the integrated encryption module, reducing exposure to JavaScript and lowering the performance overhead of JavaScript interacting with the module.

[0156] like Figure 5 As shown, the specific process of the front-end project calling the integrated encryption module to complete encryption includes the following steps:

[0157] (501) Place the integrated encryption module in the directory of the front-end project.

[0158] (502) Include and install the binary instruction file and glue function myGlue.js in the configuration file of the front-end project. For example, the code corresponding to this step is as follows:

[0159] import init,{myEncrypt} from "myEncrypt" .

[0160] (503) Initialize the integrated encryption module by calling the init() function in the front-end JavaScript.

[0161] (504) The entire digital envelope encryption is completed by calling the integrated encryption function myEncrypt() once. The sensitive field to be encrypted, para, is passed in, along with the RSA public key publicKey. The public key is a Base64-encoded DER format public key, which is the content of the PEM file after removing the header and footer tags and newline characters. The encrypted result result includes the encrypted field encrypted_data, the encrypted key encrypted_key, and the random number nonce. These three are then sent to the server.

[0162] For example, the code corresponding to this step is as follows:

[0163] function encryptPara(para,publicKey){

[0164] init();

[0165] const result = myEncrypt(para,publicKey);

[0166] return result;

[0167] }

[0168] This application also provides a data encryption processing apparatus suitable for a client. It should be noted that the data encryption processing apparatus of this application can be used to execute the data encryption processing method provided in this application. This apparatus is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0169] The data encryption processing apparatus provided in the embodiments of this application will be described below. Figure 6 A structural block diagram of a data encryption processing apparatus according to an embodiment of this application is shown. Figure 6 As shown, the device includes: a response module 601, an integrated encryption module 602, and a transmission module 603.

[0170] The response module 601, in response to an encryption request, calls the integrated encryption module 602 in the JavaScript layer, inputting the field to be encrypted and the public key to the integrated encryption module 602, and obtaining the encrypted field and encryption key output by the integrated encryption module 602. The integrated encryption module 602 includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module 602 using the symmetric key to perform symmetric encryption on the field to be encrypted. The encryption key is obtained by the integrated encryption module 602 using the public key to perform asymmetric encryption on the symmetric key. The symmetric key is generated by the integrated encryption module 602 when it is called and deleted after the call ends.

[0171] The transmission module 603 is used to send the encrypted field and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

[0172] Optionally, the response module 601 is also configured to respond to the encryption request by sending a public key acquisition request to the server and obtaining the public key returned by the server.

[0173] Optionally, the integrated encryption module 602 also includes a glue function; the glue function is used to implement the calling interface function of the integrated encryption module 602. When called, the glue function loads the WebAssembly binary file of the integrated encryption function and converts the WebAssembly binary file of the integrated encryption function into an instance that can be called by the JavaScript layer.

[0174] Optionally, the public key is a Base64 encoded DER public key; the integrated encryption module 602 is specifically used to: use the integrated encryption function to Base64 decode the public key to obtain DER binary bytes, perform DER decoding on the DER binary bytes to obtain the binary string of the public key; and use the binary string of the public key to perform asymmetric encryption on the symmetric key.

[0175] Optionally, the integrated encryption module 602 uses the AES-GCM algorithm to implement symmetric encryption; the integrated encryption module 602 uses a symmetric key to perform symmetric encryption on the field to be encrypted, including: the integrated encryption module 602 generates a symmetric key and a random number; and uses the symmetric key and the random number to perform symmetric encryption on the field to be encrypted.

[0176] Optionally, the integrated encryption module 602 also outputs a random number, and the transmission module 603 is further used to: send the random number, the encryption field and the encryption key together to the server so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encryption field with the symmetric key and the random number to obtain the field to be encrypted.

[0177] Optionally, the transmission module 603 is also used to send the encrypted field, encryption key, and random number nonce to the server via a POST request under TLS transport layer protection.

[0178] This embodiment also provides a data encryption processing system, such as Figure 7 As shown, the data encryption processing system includes a client and a server.

[0179] The client, responding to encryption requests, invokes the integrated encryption module in the JavaScript layer, inputting the field to be encrypted and the public key into the integrated encryption module, and obtaining the encrypted field and encryption key output by the integrated encryption module. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key. The symmetric key is generated by the integrated encryption module when it is invoked and deleted after the call ends.

[0180] The client is also used to send encrypted fields and encryption keys to the server;

[0181] The server uses the private key to decrypt the encryption key to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted field to obtain the field to be encrypted; the private key matches the public key.

[0182] It should be noted that the data encryption processing system of this application embodiment can be used to execute the data encryption processing method provided in the embodiments of this application. This system is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated.

[0183] This embodiment also provides a computer-readable storage medium, which includes a stored program, wherein, when the program runs, it controls the device where the computer-readable storage medium is located to execute the data encryption processing method described in any one of the above-mentioned methods, the method including the following steps:

[0184] This application also provides a processor for running a program, wherein the program executes the privilege escalation vulnerability detection method described in any one of the above-mentioned methods, the method comprising the following steps:

[0185] Step S201: In response to the encryption request, the integrated encryption module is called in the JavaScript layer. The field to be encrypted and the public key are input into the integrated encryption module, and the encrypted field and encryption key are output by the integrated encryption module. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using the symmetric key to perform symmetric encryption on the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to perform asymmetric encryption on the symmetric key. The symmetric key is generated by the integrated encryption module when it is called and deleted after the call ends.

[0186] Step S202: Send the encrypted field and encryption key to the server so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein, the private key matches the public key.

[0187] Optionally, the data encryption processing method further includes: in response to the encryption request, sending a public key acquisition request to the server; and acquiring the public key returned by the server.

[0188] Optionally, the integrated encryption module also includes glue functions; the glue functions are used to implement the calling interface functions of the integrated encryption module. When called, the glue functions load the WebAssembly binary file of the integrated encryption function and convert the WebAssembly binary file of the integrated encryption function into an instance that can be called by the JavaScript layer.

[0189] Optionally, the public key is a Base64 encoded DER public key; the integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key, including: using the integrated encryption function to Base64 decode the public key to obtain DER binary bytes, performing DER decoding on the DER binary bytes to obtain the binary string of the public key; and using the binary string of the public key to perform asymmetric encryption on the symmetric key.

[0190] Optionally, the integrated encryption module uses the AES-GCM algorithm to implement symmetric encryption; the integrated encryption module uses a symmetric key to perform symmetric encryption on the field to be encrypted, including: the integrated encryption module generates a symmetric key and a random number; and uses the symmetric key and the random number to perform symmetric encryption on the field to be encrypted.

[0191] Optionally, the integrated encryption module also outputs a random number. The data encryption processing method further includes: sending the random number, the encryption field, and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encryption field with the symmetric key and the random number to obtain the field to be encrypted.

[0192] Optionally, sending the encrypted field and encryption key to the server includes: sending the encrypted field, encryption key, and random number nonce to the server via a POST request under TLS transport layer protection.

[0193] This application also provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the data encryption processing method described in any one of the above-mentioned methods, which includes the following steps:

[0194] Step S201: In response to the encryption request, the integrated encryption module is called in the JavaScript layer. The field to be encrypted and the public key are input into the integrated encryption module, and the encrypted field and encryption key are output by the integrated encryption module. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using the symmetric key to perform symmetric encryption on the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to perform asymmetric encryption on the symmetric key. The symmetric key is generated by the integrated encryption module when it is called and deleted after the call ends.

[0195] Step S202: Send the encrypted field and encryption key to the server so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein, the private key matches the public key.

[0196] Optionally, the data encryption processing method further includes: in response to the encryption request, sending a public key acquisition request to the server; and acquiring the public key returned by the server.

[0197] Optionally, the integrated encryption module also includes glue functions; the glue functions are used to implement the calling interface functions of the integrated encryption module. When called, the glue functions load the WebAssembly binary file of the integrated encryption function and convert the WebAssembly binary file of the integrated encryption function into an instance that can be called by the JavaScript layer.

[0198] Optionally, the public key is a Base64 encoded DER public key; the integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key, including: using the integrated encryption function to Base64 decode the public key to obtain DER binary bytes, performing DER decoding on the DER binary bytes to obtain the binary string of the public key; and using the binary string of the public key to perform asymmetric encryption on the symmetric key.

[0199] Optionally, the integrated encryption module uses the AES-GCM algorithm to implement symmetric encryption; the integrated encryption module uses a symmetric key to perform symmetric encryption on the field to be encrypted, including: the integrated encryption module generates a symmetric key and a random number; and uses the symmetric key and the random number to perform symmetric encryption on the field to be encrypted.

[0200] Optionally, the integrated encryption module also outputs a random number. The data encryption processing method further includes: sending the random number, the encryption field, and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encryption field with the symmetric key and the random number to obtain the field to be encrypted.

[0201] Optionally, sending the encrypted field and encryption key to the server includes: sending the encrypted field, encryption key, and random number nonce to the server via a POST request under TLS transport layer protection.

[0202] It will be apparent to those skilled in the art that the modules or steps of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using device-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular hardware and software combination.

[0203] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0204] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0205] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0206] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0207] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0208] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0209] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0210] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0211] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0212] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0213] 1) By applying the technical solution of this application, the generation and use logic of the symmetric key is completely encapsulated in the integrated encryption module of the WebAssembly binary file. The JavaScript layer only passes in the field to be encrypted and the public key, and does not pass in or receive the symmetric key, thereby avoiding the exposure of the front-end encryption logic and the symmetric key in the JavaScript layer and improving the security of sensitive data.

[0214] 2) Simultaneously, asymmetric encryption is used to protect the symmetric key, and symmetric encryption is used to protect sensitive data, achieving application-layer digital envelope encryption. Even if the transport layer is compromised, attackers cannot directly obtain the plaintext from the encrypted fields and encryption key. Furthermore, the symmetric key uses a one-time pad and is deleted after the call, further shortening the key lifecycle and improving the security of the front-end encryption.

[0215] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data encryption processing method, applicable to a client, characterized in that, include: In response to an encryption request, an integrated encryption module is invoked at the JavaScript layer. The field to be encrypted and a public key are input to the integrated encryption module, which outputs an encrypted field and an encryption key. The integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file. The encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted. The encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key. The symmetric key is generated by the integrated encryption module when it is invoked and deleted after the call ends. The encrypted field and the encrypted key are sent to the server so that the server can decrypt the encrypted key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

2. The method of claim 1, wherein, The method further includes: In response to the encryption request, a public key acquisition request is sent to the server; Obtain the public key returned by the server.

3. The method of claim 1, wherein, The integrated encryption module also includes a glue function; the glue function is used to implement the calling interface function of the integrated encryption module. When called, the glue function loads the WebAssembly binary file of the integrated encryption function and converts the WebAssembly binary file of the integrated encryption function into an instance that can be called by the JavaScript layer.

4. The method of claim 3, wherein, The public key is a Base64 encoded DER public key; The integrated encryption module uses the public key to perform asymmetric encryption on the symmetric key, including: The public key is Base64 decoded using the integrated encryption function to obtain DER binary bytes, and the DER binary bytes are then DER decoded to obtain the binary string of the public key. The symmetric key is encrypted using the binary string of the public key.

5. The method of claim 1, wherein, The integrated encryption module uses the AES-GCM algorithm to achieve symmetric encryption; the integrated encryption module uses the symmetric key to perform symmetric encryption on the field to be encrypted, including: The integrated encryption module generates the symmetric key and the random number; The field to be encrypted is symmetrically encrypted using the symmetric key and the random number.

6. The method according to claim 5, characterized in that, The integrated encryption module also outputs the random number, and the method further includes: The random number, the encrypted field, and the encryption key are sent to the server together, so that the server can decrypt the encryption key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key and the random number to obtain the field to be encrypted.

7. The method according to claim 1, characterized in that, Sending the encrypted field and the encrypted key to the server includes: Under TLS transport layer protection, the encrypted field, the encryption key, and the random number nonce are sent to the server via a POST request.

8. A data encryption processing device, suitable for a client, characterized in that, include: Response module, integrated encryption module, and transmission module; The response module is used to respond to an encryption request by calling the integrated encryption module in the JavaScript layer, inputting the field to be encrypted and the public key to the integrated encryption module, and obtaining the encrypted field and encryption key output by the integrated encryption module; wherein, the integrated encryption module includes an integrated encryption function, which is a WebAssembly binary file; the encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted; the encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key; the symmetric key is generated by the integrated encryption module when it is called and deleted after the call ends; The transmission module is used to send the encrypted field and the encryption key to the server, so that the server can decrypt the encryption key with the private key to obtain the symmetric key, and then decrypt the encrypted field with the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

9. A data encryption processing system, characterized in that, include: The client, in response to an encryption request, calls the integrated encryption module in the JavaScript layer, inputs the field to be encrypted and the public key to the integrated encryption module, and obtains the encrypted field and encryption key output by the integrated encryption module; wherein the integrated encryption module includes an integrated encryption function, and the integrated encryption function is a WebAssembly binary file; The encrypted field is obtained by the integrated encryption module using a symmetric key to symmetricly encrypt the field to be encrypted; the encryption key is obtained by the integrated encryption module using the public key to asymmetricly encrypt the symmetric key; the symmetric key is generated by the integrated encryption module when it is invoked and deleted after the invocation ends. The client is also used to send the encrypted field and the encryption key to the server; The server is used to decrypt the encryption key using the private key to obtain the symmetric key, and then decrypt the encrypted field using the symmetric key to obtain the field to be encrypted; wherein the private key matches the public key.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 7.

Images