Data processing method and related device

Abstract

Embodiments of the present application provide a data processing method and a related device. The method comprises: when a service request initiated by an application is detected, acquiring a temporary key randomly allocated for the service request; performing encryption processing on the temporary key using a certificate public key, to obtain an encrypted temporary key, the certificate public key being preset in source code of the application, and a certificate private key corresponding to the certificate public key being stored in a server; performing encryption processing on data requested by the service request using the temporary key, to obtain a ciphertext; generating a network response request packet on the basis of the encrypted temporary key and the ciphertext; and sending to the server the network response request packet, the network response request packet being used to request the server to respond to the service request. The embodiments of the present application can ensure data security in a data transmission process, and reduce resource overhead for a server.

Description

A data processing method and related equipment

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 14, 2023, with application number 202310864633.6 and application name “A data processing method and related equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of Internet technology, and specifically to a data processing method and related equipment, and in particular to a data processing method, a data processing device, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0003] Currently, to protect data from being stolen during transmission, data can be encrypted before being transmitted. Existing data encryption methods primarily involve two communicating parties (such as an application running on a terminal device and a server) first establishing an encrypted channel and then exchanging keys over that channel. Once the application and server have the same key, they use it to encrypt the data and send it to the server. However, this process requires the server to maintain the correspondence between the negotiated key and the application, resulting in high server resource overhead. Therefore, how to ensure data security during data transmission while reducing server resource overhead has become a hot topic of research.

[0004] Summary of the Invention

[0005] The embodiments of the present application provide a data processing method and related equipment, which can ensure data security during data transmission and save server resource overhead.

[0006] In one aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0007] When a service request initiated by an application is detected, a temporary key randomly assigned to the service request is obtained;

[0008] The temporary key is encrypted using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; the certificate private key corresponding to the certificate public key is stored in the server;

[0009] The temporary key is used to encrypt the request data of the service request to obtain a ciphertext;

[0010] Generate a network response request packet based on the encrypted temporary key and the ciphertext, and send the network response request packet to the server. The network response request packet is used to request the server to respond to the service request.

[0011] In one aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0012] Receive a network response request packet sent by an application; the network response request packet includes an encryption temporary key and ciphertext;

[0013] The encrypted temporary key is decrypted using the certificate private key. If the encrypted temporary key is encrypted using the certificate public key preset in the source code of the application, the decrypted temporary key is randomly assigned to the service request of the application.

[0014] Decrypt the ciphertext using the temporary key to obtain the request data of the business request;

[0015] Based on the request data, respond to the business request.

[0016] In one aspect, an embodiment of the present application provides a data processing device, comprising:

[0017] a processing unit, configured to, when detecting a service request initiated by an application, obtain a temporary key randomly assigned to the service request;

[0018] The processing unit is further configured to encrypt the temporary key using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; and the certificate private key corresponding to the certificate public key is stored in the server;

[0019] The processing unit is further configured to encrypt the request data of the service request using the temporary key to obtain a ciphertext;

[0020] The processing unit is further configured to generate a network response request packet based on the encryption temporary key and the ciphertext;

[0021] The sending unit is used to send a network response request packet to the server, where the network response request packet is used to request the server to respond to the service request.

[0022] The processing unit is specifically configured to encrypt the temporary key using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key;

[0023] The processing unit is specifically configured to encrypt the request data of the service request using a temporary key according to a second encryption algorithm to obtain a ciphertext; the first encryption algorithm is different from the second encryption algorithm.

[0024] The temporary key includes the first subkey; the processing unit is specifically configured to:

[0025] Obtaining a first subkey from the temporary key;

[0026] The request data of the service request is encrypted using the first subkey according to the second encryption algorithm to obtain a ciphertext.

[0027] The temporary key also includes a second subkey; the processing unit is specifically configured to:

[0028] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code;

[0029] The encryption temporary key, ciphertext and message authentication code are encapsulated to form a network response request packet.

[0030] The processing unit is specifically used for:

[0031] The encryption temporary key is determined as the packet header, the ciphertext is determined as the packet body, and the message authentication code is determined as the packet tail;

[0032] The packet header, packet body and packet tail are spliced ​​together to form a network response request packet.

[0033] The processing unit is further configured to:

[0034] Get the priority of the requested data;

[0035] Get the key length that matches the priority of the requested data;

[0036] Randomly assign temporary keys to service requests according to the matching key length;

[0037] The higher the priority of the requested data, the more important the requested data is, and the longer the matching key length is.

[0038] The processing unit is further configured to:

[0039] Get the priority of the requested data and the key length of the temporary key;

[0040] determining a second encryption algorithm according to one or both of a priority of the request data and a key length of the temporary key;

[0041] Among them, the higher the priority of the requested data, the higher the complexity of the second encryption algorithm; the longer the key length of the temporary key, the higher the complexity of the second encryption algorithm.

[0042] The application is an installation-free application; the application runs in a security sandbox, and the method runs in a security sandbox; and the processing unit is further configured to:

[0043] Verify the network response request packet in the security sandbox;

[0044] If the network response request packet is successfully verified, the step of sending the network response request packet to the server is executed.

[0045] The verification includes any of the following: verifying the legitimacy of the certificate public key; verifying the standardization of the network response request packet;

[0046] Verifying the standardization of the network response request packet includes at least one of the following:

[0047] Verify whether the data in the network response request packet is encrypted. If it is determined that the data in the network response request packet is not encrypted, the network response request packet fails the standardization verification. If it is determined that the data in the network response request packet is encrypted, the network response request packet passes the standardization verification.

[0048] Verify whether the temporary encryption key is encrypted using the verified certificate public key. If so, determine that the network response request packet has passed the standardization verification. If not, determine that the network response request packet has failed the standardization verification.

[0049] Verify whether the format of the network response request packet is a preset format. If the format of the network response request packet is the preset format, determine that the standardization verification of the network response request packet has passed; if the format of the network response request packet is not the preset format, determine that the standardization verification of the network response request packet has failed; the preset format means that the header of the network response request packet is a temporary encryption key, the body is ciphertext, and the trailer is a message authentication code.

[0050] Random allocation means that a temporary key is allocated for each service request, and different temporary keys are allocated for different service requests.

[0051] The first encryption algorithm includes an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes at least one of the following: an elliptic curve public key cryptography algorithm, an asymmetric encryption algorithm based on the large number factorization problem, or a digital signature algorithm;

[0052] The second encryption algorithm includes a symmetric encryption algorithm, and the symmetric encryption algorithm includes at least one of the following: a block algorithm using key encryption, a block cipher algorithm, a triple data encryption algorithm, or an advanced encryption standard algorithm.

[0053] In one aspect, the present invention provides a data processing device, comprising:

[0054] The receiving unit is used to receive a network response request packet sent by the application; the network response request packet includes an encryption temporary key and a ciphertext;

[0055] a processing unit configured to decrypt the encrypted temporary key using the certificate private key, and if the encrypted temporary key is encrypted using the certificate public key preset in the source code of the application, decrypt the encrypted temporary key to obtain a temporary key randomly assigned to the service request of the application;

[0056] The processing unit is further configured to decrypt the ciphertext using the temporary key to obtain request data of the service request;

[0057] The processing unit is also used to respond to the business request based on the request data.

[0058] The temporary key includes a first subkey and a second subkey; the first subkey is used to decrypt the ciphertext; the network response request packet also includes a message authentication code; the processing unit is further used to:

[0059] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain an operational message authentication code;

[0060] Compare the calculated message authentication code with the message authentication code in the network response request packet for consistency;

[0061] If the consistency comparison passes, the step of decrypting the ciphertext using the temporary key according to the second encryption algorithm is executed to obtain the request data of the service request.

[0062] The processing unit is specifically used for:

[0063] Determining the service processing device corresponding to the service request based on the request data;

[0064] Forward the service request to the service processing device for service processing.

[0065] In one aspect, an embodiment of the present application provides a computer device, comprising:

[0066] a processor suitable for executing a computer program;

[0067] Computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned data processing method is implemented.

[0068] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is loaded by a processor and executes the above-mentioned data processing method.

[0069] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program or computer instructions, and when the computer program or computer instructions are executed by a processor, the above-mentioned data processing method is implemented.

[0070] In an embodiment of the present application, when a business request initiated by an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is then encrypted using the certificate public key to obtain an encrypted temporary key, and the request data of the business request is encrypted using the temporary key to obtain a ciphertext; a network response request packet is generated based on the encrypted temporary key and the ciphertext, and the network response request packet is sent to the server, where the network response request packet is used to request the server to respond to the business request. Through the above scheme, it can be known that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then use the certificate private key in the server to decrypt the temporary key used to decrypt the ciphertext. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without the need to generate and maintain a temporary key for each business request. This can reduce the data processing volume of the server to a certain extent and save the server's resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is secure enough, the ciphertext encrypted by the temporary key is also secure enough. Therefore, by encrypting the temporary key and the request data of the business request separately, the data security during data transmission can be well guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0072] FIG1a is an architecture diagram of a data processing system provided by an exemplary embodiment of the present application;

[0073] FIG1b is a schematic diagram of an encryption process provided by an exemplary embodiment of the present application;

[0074] FIG1c is a schematic diagram of a decryption process provided by an exemplary embodiment of the present application;

[0075] FIG2 is a flow chart of a data processing method provided by an exemplary embodiment of the present application;

[0076] FIG3 is a flow chart of a data processing method provided by another exemplary embodiment of the present application;

[0077] FIG4 is a flow chart of a data processing method provided by yet another exemplary embodiment of the present application;

[0078] FIG5 is a flow chart of a data processing method provided by another exemplary embodiment of the present application;

[0079] FIG6 is a schematic structural diagram of a data processing device provided by an exemplary embodiment of the present application;

[0080] FIG7 is a schematic structural diagram of a data processing device provided by another exemplary embodiment of the present application;

[0081] FIG8 is a schematic structural diagram of a computer device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0083] First, the relevant technical terms involved in the embodiments of this application are explained.

[0084] 1. Application

[0085] An application may refer to an APP (Application) corresponding to a server that provides local services to an object. In one implementation, an application may refer to an APP installed and running on a terminal device. Applications may include, but are not limited to, social applications, game applications, payment applications, and the like. In another implementation, the application may refer to an application that does not require installation (such as a mini-program). In yet another implementation, the application may be a website that provides local services to an object, such as a social networking site that provides social conversation functions for the object, a game website that provides game services to customers, and the like.

[0086] 2. Asymmetric encryption algorithm

[0087] An asymmetric encryption algorithm uses different keys for encryption and decryption. For example, when two communicating parties (such as a terminal device and a server) exchange data, they first exchange their public keys. The terminal device then uses the server's public key (i.e., the certificate's public key) to encrypt the data being exchanged. The server then decrypts the encrypted data using its own private key (i.e., the certificate's private key). Therefore, asymmetric encryption algorithms are also called public-key encryption algorithms.

[0088] Among them, asymmetric encryption algorithms may include but are not limited to: elliptic curve public key cryptography algorithm (SM2, a national secret algorithm), asymmetric encryption algorithm based on large number factorization problem (RSA, the first letters of the surnames of Ron Rivest, Adi Shamir and Leonard Adleman), and digital signature algorithm (DSA, Digital Signature Algorithm).

[0089] It should be understood that all asymmetric encryption algorithms can encrypt data to ensure data security, but different asymmetric encryption algorithms have different characteristics. For example, RSA encryption strength is weaker, but encryption and decryption speed is fast; SM2 encryption strength (i.e. encryption complexity) is stronger, but encryption and decryption speed is slow.

[0090] 3. Symmetric encryption algorithm

[0091] A symmetric encryption algorithm uses the same key for both encryption and decryption. For example, suppose two parties are exchanging (transmitting) data. One party can encrypt the data using key A, and the other party can decrypt the encrypted data using key A.

[0092] Among them, the symmetric encryption algorithm may include but is not limited to: a block algorithm using key encryption (DES, Data Encryption Standard), a block cipher algorithm (SM4, a national secret algorithm), a triple data encryption algorithm (DES3), and an advanced encryption standard algorithm (AES, advanced Encryption Standard).

[0093] It should be understood that all symmetric encryption algorithms can encrypt data, thereby ensuring data security. However, different symmetric encryption algorithms have different characteristics. For example, DES has a shorter key length, faster encryption speed, but weaker encryption strength; DES3 has a longer key length, slower encryption speed, but stronger encryption strength. AES has a longer key length, faster encryption speed, and higher encryption strength.

[0094] 4. Message Authentication Code

[0095] A message authentication code (MAC) is used to verify data integrity. This code is derived by performing a digest operation on the data using a key. By comparing the resulting MAC with the message authentication code in the data, the integrity of the data can be determined. If the resulting MAC is inconsistent with the data, the data is at risk of being tampered with. If the resulting MAC is consistent with the data, the data is confirmed to be intact and has not been tampered with.

[0096] 5. Security Sandbox

[0097] A security sandbox is a mechanism used to protect object privacy and system security. It confines applications to a closed runtime environment, preventing them from posing potential threats to the system and other applications. Furthermore, a security sandbox provides virtual hardware and software resources, such as the file system, network, and operating system, allowing applications to run within this virtual environment without any adverse effects on the computer system. If an application attempts to access resources outside the sandbox or perform dangerous operations, the sandbox intercepts these requests and takes appropriate security measures.

[0098] In an embodiment of the present application, data can be encrypted in a security sandbox to ensure security during the data encryption process; in addition, the network response request packet to be sent can also be verified in the security sandbox to ensure that the data in the network response request packet to be sent is encrypted data.

[0099] 6. Temporary Key

[0100] A temporary key is a key that is valid within a single service request. In other words, a temporary key has a validity period, which can be the time corresponding to a service request. Once the service request is responded to, the temporary key becomes invalid. A new temporary key will be assigned for the next service request.

[0101] In an embodiment of the present application, the temporary key may include a first subkey and a second subkey. The first subkey can be used to encrypt the request data of the business request, and the first subkey can also be called a symmetric key; the second subkey can be used to generate a message authentication code to verify the integrity of the data, and the second subkey can also be called a message authentication key.

[0102] The following is a brief introduction to common data encryption algorithms.

[0103] During data transmission, common data encryption algorithms include but are not limited to: asymmetric encryption algorithms, hybrid encryption schemes based on integrated key encryption schemes, encryption schemes based on key exchange protocols, etc. The following describes the data encryption process using the above data encryption algorithms:

[0104] (1) Asymmetric encryption algorithm: During data transmission, an asymmetric encryption algorithm can be directly used to encrypt data. Specifically, taking the SM2 algorithm defined by the National Security Algorithm as an example, encrypting data using an asymmetric encryption algorithm may include: first, generating a temporary elliptic curve point using an elliptic curve and a public key, then generating a derived key using a key derivation function, the elliptic curve point, and the length of the data, and then performing XOR processing on the derived key and the data to obtain the ciphertext.

[0105] (2) Hybrid encryption schemes include: Integrated Encryption Scheme (IES) and its elliptic curve integrate encrypt scheme (ECIES): During data transmission, a temporary asymmetric public key and secret key are first generated. Then, the temporary asymmetric public key and secret key are processed through the key agreement function (KA) to generate a master key. Then, the master key is derived through the key derivation function to generate a symmetric key and a message authentication key. Finally, the data is encrypted with the symmetric key to obtain a ciphertext, and a digest operation is performed on the ciphertext using the message authentication key to obtain a message authentication code.

[0106] (3) Encryption scheme based on key exchange protocol: The key exchange protocol (AKE, Authenticated Key Exchange) negotiates a temporary key through a series of key exchange processes. During the negotiation of the temporary key, a symmetric key is generated by combining the message digest algorithm and the key agreement algorithm. After the symmetric key is generated, when the communicating parties (such as the application and the server) establish an encrypted channel, the application and the server first complete the symmetric key exchange. That is, the application can send the symmetric key to the server, and the server can receive the symmetric key sent by the application. Ultimately, the application and the server will obtain the same symmetric key; the application can then use the symmetric key to encrypt the data, obtain the ciphertext, and send the ciphertext to the server.

[0107] Although the above data encryption algorithm can improve the data security during data transmission, it still has the following problems:

[0108] ① For asymmetric encryption algorithms, each time data is encrypted, an elliptic curve point must be calculated using an asymmetric encryption algorithm. This performance gap is significantly larger than that of symmetric algorithms. Performance here can include factors such as data encryption speed. For example, symmetric encryption algorithms are faster than asymmetric algorithms. Furthermore, when a key derivation function (KDF) expands an existing key, it can only guarantee the security of the original key length. This key length is limited by the asymmetric key length, making it less secure than symmetric encryption algorithms.

[0109] ② The key agreement function typically uses a scalar point product operation on an elliptic curve to generate a key. For example, in the Integrated Encryption Scheme (IES) and its elliptic curve variant (ECIES), a scalar point product operation interface using the elliptic curve secp256k1 (an elliptic curve based on an Fp (finite field)) is typically used to perform a scalar point product operation to obtain the master key. However, in national cryptographic algorithms, the underlying interfaces involving elliptic curves are often not exposed or encapsulated externally. Therefore, in actual development, it is impossible to implement the key agreement function using the elliptic curves allowed in national cryptographic algorithms.

[0110] ③ The key derivation function should generally use a key derivation algorithm that is resistant to brute force cracking, such as BLAKE3 (a cryptographic hash algorithm). The key derivation function in the integrated encryption scheme is the HKDF (HMAC-based key derivation function) algorithm based on HMAC (Hash-based Message Authentication Code)-SHA1. Currently, HKDF has limited effectiveness against brute force cracking algorithms accelerated by GPUs (Graphic Processing Units), and can easily be brute-forced to reveal symmetric keys, leading to data leaks. Furthermore, the national secret algorithm does not directly provide specifications for the key derivation function. In actual development, the encapsulated key derivation function cannot be used directly. Secondary development based on the SM3 (a national secret algorithm) digest algorithm is required, which requires additional work and security proof.

[0111] ④ When using the key exchange protocol, a protocol handshake is required. The handshake process often requires one or more round-trip requests to complete the symmetric key exchange, thereby increasing the amount of data that needs to be processed on the server side and the request delay. Schematically, in application scenarios (such as mini-programs), network request delays are often large and uncontrollable. If the key exchange protocol is used, the delay of the first request will increase. In addition, the server needs to maintain the correspondence between the negotiated key and the application, which will also increase the amount of data that needs to be processed on the server side and the request delay.

[0112] Based on this, an embodiment of the present application provides an end-to-end data processing solution, the general principle of which is as follows: when a business request initiated by an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is encrypted using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; the certificate private key corresponding to the certificate public key is stored in the server; the request data of the business request is encrypted using the temporary key to obtain a ciphertext; a network response request packet is generated based on the encrypted temporary key and the ciphertext, and the network response request packet is sent to the server, and the network response request packet is used to request the server to respond to the business request.

[0113] Through the above scheme, it can be known that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then use the certificate private key in the server to decrypt the temporary key used to decrypt the ciphertext. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without the need to generate and maintain a temporary key for each business request. This can reduce the data processing volume of the server to a certain extent and save the server's resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is secure enough, the ciphertext encrypted by the temporary key is also secure enough. Therefore, by encrypting the temporary key and the request data of the business request separately, the data security during data transmission can be well guaranteed.

[0114] Next, the data processing system provided in the embodiments of the present application is described.

[0115] Please refer to Figure 1a, which is an architectural diagram of a data processing system provided by an exemplary embodiment of the present application. As shown in Figure 1a, the data processing system may include a terminal device 101, a server 102, and a business processing device 103. The present application does not limit the number of terminal devices. Of course, the number of servers and the number of business processing devices may also be multiple, and the present application still does not limit the number of servers and business processing devices. The terminal device 101 in the data processing system can be directly or indirectly connected to the server 102 and the business processing device 103 respectively through wired or wireless communication, and the server 102 and the business processing device 103 can exchange information.

[0116] in:

[0117] Terminal device 101 runs an application, which can be a social application, a game application, an installation-free application, and so on. Terminal device 101 may include, but is not limited to, the following functions: ① Temporary key encryption function: using the certificate public key to encrypt the temporary key assigned to the service request to obtain an encrypted temporary key; ② Data encryption signature function: encrypting the request data (i.e., plaintext data) of the service request to obtain ciphertext, and signing the encrypted temporary key and ciphertext to be sent to ensure data integrity; signing in this context refers to the process of generating a message authentication code.

[0118] Furthermore, if the application is an installation-free application (also referred to as an applet or subprogram), as shown in Figure 1a, the terminal device 101 provides a secure sandbox for the application to ensure the security of the application or system. Terminal devices may include, but are not limited to, smartphones, tablets, laptops, desktop computers, smart speakers, smart watches, in-vehicle terminals, smart wearable devices, and the like.

[0119] The server 102 may be a server corresponding to the application program, providing technical support for the services provided by the application program. The server 102 includes but is not limited to the following functions: ① Encryption temporary key decryption function: decrypting the encryption temporary key to obtain a temporary key; ② Data signature verification and decryption function: verifying the signature of the received encryption temporary key and ciphertext with a signature, thereby determining whether the received data has been tampered with, and decrypting the ciphertext based on the temporary key to obtain the request data of the business request. ③ Business forwarding function: the server 102 may forward the business request for the application program to the business processing device 103. The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0120] The business processing device 103 can be used to provide business processing services for applications. Schematically, the business processing device 103 can respond to business requests for applications sent by the server 102 and provide business processing services for the applications. The business processing device 103 can be a terminal device or a server; terminal devices can include but are not limited to smartphones, tablets, laptops, desktop computers, smart speakers, smart watches, car terminals, smart wearable devices, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0121] In one embodiment, the data processing flow is described by taking the interaction between the terminal device 101, the server 102, and the service processing device 103 as an example. The data processing flow includes two parts: an application encryption phase and a server decryption phase.

[0122] 1) Application encryption stage

[0123] Please refer to Figure 1b, which is a schematic diagram of an encryption process provided for an exemplary embodiment of the present application; in Figure 1b, the application encryption stage mainly includes five steps: temporary key generation, temporary key encryption, request data encryption of business requests, message authentication code generation, and network response request packet generation.

[0124] ① Temporary key generation: When a service request for an application is detected, the application in the terminal device 101 can independently generate a temporary key OTP (One Time Password) for the service request. It should be understood that a temporary key is independently generated for each service request. The temporary key may include the first subkey K ENC and the second subkey K MAC .

[0125] ② Temporary key encryption: The application uses the certificate public key (P k ) Encrypt OTP to obtain the encryption temporary key E k In one implementation, the public key of the certificate (P k) The temporary key is encrypted to obtain an encrypted temporary key; in another implementation, the application is an installation-free application, which can run in a security sandbox. At this time, the OTP can be encrypted in the security sandbox using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key.

[0126] ③ Request data encryption for business requests: The application uses the first subkey K in the temporary key ENC The request data m of the service request is encrypted to obtain the ciphertext c. In one implementation, the first subkey K in the temporary key is used according to the second encryption algorithm (such as a symmetric encryption algorithm). ENC The request data m is encrypted to obtain a ciphertext; in another implementation, the request data m can be encrypted in a security sandbox using the first subkey in the temporary key according to the second encryption algorithm to obtain a ciphertext c.

[0127] ④ Message authentication code generation: The application in the terminal device 101 uses the second subkey in the temporary key to sign the ciphertext and the encrypted temporary key to obtain a message authentication code (Tag). The message authentication code may include a hash value. The so-called signature processing refers to the use of a message digest algorithm (such as the SM3 algorithm) to perform a digest operation on the ciphertext and the encrypted temporary key using the second subkey in the temporary key. In one implementation, the second subkey in the temporary key can be used in a secure sandbox to sign the ciphertext and the encrypted temporary key to obtain a message authentication code. The length of the message authentication code can be determined according to the message digest algorithm. Schematically, the message digest algorithm is the SM3 algorithm, and the length of the message authentication code can be 64 bits.

[0128] ⑤ Network response request packet generation: The application can generate a network response request packet based on the encrypted temporary key, ciphertext and message authentication code, and send the network response request packet to the server 102.

[0129] From the above encryption process, the application can encrypt the temporary key according to the first encryption algorithm and encrypt the request data according to the second encryption algorithm using the first subkey in the temporary key. This can ensure that the data in the network response request packet is not stolen by other devices during transmission, effectively ensuring the security of the data. Moreover, since the first encryption algorithm is different from the second encryption algorithm, the difficulty of simultaneously cracking the encrypted temporary key and ciphertext is further increased, further ensuring the security of the data. At the same time, by generating a temporary key, the problem of requiring additional work and security proof due to the need for secondary development based on the SM3 algorithm can be overcome. In addition, the network response request packet contains an encrypted temporary key, and there is no need to pre-establish an encrypted channel with the server to negotiate the temporary key, which can reduce the amount of data that the server needs to process and the request delay to a certain extent. In addition, the message authentication code can verify the integrity of the data in the network response request packet, thereby ensuring the integrity of the sent data and the integrity of the key.

[0130] 2) Server decryption stage

[0131] Please refer to Figure 1c, which is a schematic diagram of a decryption process provided by an exemplary embodiment of the present application. In Figure 1c, the server decryption phase includes four steps: private key decryption, message authentication code verification, ciphertext decryption, and service processing.

[0132] ① Private key decryption: After receiving the network response request packet sent by the application, the server 102 can use the certificate private key S k The encrypted temporary key E in the network response request packet k The certificate private key may be stored in a storage space of the server, and the server 102 may obtain the certificate private key from the storage space and decrypt the encrypted temporary key in the network response request packet using the certificate private key according to the first encryption algorithm to obtain the temporary key.

[0133] ② Message authentication code verification: Server 102 can perform integrity verification on the network response request packet. If the integrity verification of the network response request packet passes, step ③ is executed. If the integrity verification of the network response request packet fails, a prompt message is output, which is used to indicate that the data in the network response request packet has been tampered with.

[0134] As an implementation method, performing integrity verification on the network response request packet includes: a. using the second subkey in the temporary key to perform a digest operation on the encrypted temporary key and the ciphertext to obtain an operation message authentication code; b. performing a consistency comparison between the operation message authentication code and the message authentication code in the network response request packet; if the consistency comparison passes, it is determined that the integrity verification of the network response request packet passes; if the consistency comparison fails, it is determined that the integrity verification of the network response request packet fails.

[0135] ③ Ciphertext decryption: The server 102 may use the temporary key to decrypt the ciphertext to obtain the request data of the service request. In one implementation, the first subkey in the temporary key may be used to decrypt the ciphertext to obtain the request data.

[0136] ④ Business Processing: Server 102 responds to the business request based on the request data. Specifically, server 102 may determine the business processing device 103 corresponding to the business request based on the request data and forward the business request to the business processing device 103. Business processing device 103 may respond to the business request and perform the corresponding business processing.

[0137] From the above decryption process, we can see that before decrypting the ciphertext, the message authentication code in the network response request packet is verified to avoid the risk of attackers tampering with the network response request packet. In addition, since the terminal device directly sends the temporary key to the server, the server does not need to maintain the status of the temporary key. In other words, the temporary key will not be permanently stored on the server, which can prevent the key from being leaked and improve data security. At the same time, the first subkey is used to decrypt the ciphertext to achieve symmetric encryption, which can fully utilize the performance advantages of symmetric encryption. Even with the increase in data volume, there will be no significant performance impact, effectively protecting the server's resources from over-utilization.

[0138] It should be understood that the business requests in the embodiments of the present application may include but are not limited to: login requests, business query requests, payment requests, etc. When the business request is a login request, the request data of the business request includes object information, account information, etc. When the business request is a business query request, the request data of the business request may include data identification, data content, etc. When the business request is a payment request, the request data of the business request may include: payment account, balance information, order information, etc. Next, two specific scenarios are used to illustrate the data processing solution provided in the embodiments of the present application, wherein the first encryption algorithm includes the SM2 algorithm, the second encryption algorithm includes the SM4 algorithm, and the message digest algorithm includes the SM3 algorithm:

[0139] (1) Take the case where the business request is a login request, the request data of the business request includes the information of the object, and the business processing device is a login processing device (such as a login server) as an example. In this scenario, the data processing process includes: ① When the object wants to log in to the application, the login option of the application is triggered. At this time, the login request initiated by the application can be detected, and then the temporary key OTP1 randomly assigned to the login request is obtained. OTP1 includes the first subkey SM4 key and the second subkey SM3 key. ② The application encrypts OTP1 using the certificate public key according to the SM2 algorithm to obtain the encrypted temporary key. ③ The application encrypts the information of the object requested by the login request using the SM4 key according to the SM4 algorithm to obtain the ciphertext. ④ The SM3 key is used to perform a digest operation on the ciphertext and the encrypted temporary key to obtain the message authentication code. ⑤ Based on the encrypted temporary key, ciphertext and message authentication, a network response request packet is generated and sent to the server 102. ⑥ After receiving the network response request packet, the server can use the certificate private key to decrypt the encrypted temporary key to obtain OTP1. ⑦ The server performs a digest operation on the encrypted temporary key and the ciphertext using the SM3 key according to the SM3 algorithm to obtain the calculated message authentication code, and performs a consistency comparison between the calculated message authentication code and the message authentication code in the network response request packet. ⑧ When the consistency comparison passes, the server decrypts the ciphertext using the SM4 key according to the SM4 algorithm to obtain the information of the requested object. ⑨ Based on the object information, the server determines that the business processing device corresponding to the login request is the login server, and then forwards the login request to the login server. ⑩ The login server responds to the login request, obtains the object information, and returns the object information to the application, so that the application can log in to the application according to the object information.

[0140] (2) Take the business request as a payment request, the request data of the business request includes order information, and the business processing device is a payment processing device as an example. In this scenario, the data processing process includes: ① When the object makes a payment in the application, it can detect the payment request initiated by the application, and then obtain the temporary key OPT2 randomly assigned to the payment request, OPT2 includes the first subkey SM4 key and the second subkey SM3 key. ② According to the SM2 algorithm, OPT2 is encrypted using the certificate public key to obtain the encrypted temporary key. ③ According to the SM4 algorithm, the order information requested by the payment request is encrypted using the SM4 key to obtain the ciphertext. ④ According to the SM3 algorithm, the SM3 key is used to perform a digest operation on the ciphertext and the encrypted temporary key to obtain the message authentication code. ⑤ Based on the encrypted temporary key, ciphertext and message authentication code, a network response request packet is generated and sent to the server. ⑥ After receiving the network response request packet, the server can use the certificate private key to decrypt the encrypted temporary key to obtain OPT2. ⑦ The server performs a digest operation on the encrypted temporary key and the ciphertext using the SM3 key according to the SM3 algorithm to obtain the calculated message authentication code, and then performs a consistency comparison between the calculated message authentication code and the message authentication code in the network response request packet. ⑧ When the consistency comparison passes, the server decrypts the ciphertext using the SM4 key according to the SM4 algorithm to obtain the requested order information. ⑨ Based on the order information, the server determines that the business processing device corresponding to the payment request is the payment processing device, and then forwards the payment request to the payment processing device. ⑩ The payment processing device responds to the payment request, obtains the order information, and returns the order information to the application.

[0141] It is understandable that in the embodiments of the present application, when request data related to the object is involved, such as information related to the object, order information, etc., when the above embodiments of the present application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the object, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0142] In the embodiment of the present application, since the certificate private key is only stored in the server, the encrypted temporary key obtained by encrypting the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is secure enough, the ciphertext encrypted by the temporary key is also secure enough. Therefore, through the above data processing scheme, it is difficult for intermediate nodes (such as attackers) to crack the transmitted data, thereby ensuring the security and integrity of data transmission between the application and the server. In addition, when the first encryption algorithm, the second encryption algorithm and the message digest algorithm all adopt the national secret algorithm, the data can be completely encrypted by the national secret algorithm without the need to use other cryptographic primitives, thereby ensuring the autonomy and controllability of the entire data processing process.

[0143] Next, the data processing method provided in the embodiments of the present application is described.

[0144] Please refer to Figure 2, which is a flowchart of a data processing method provided by an exemplary embodiment of the present application. The data processing method can be executed by a terminal device, more specifically, by an application running on the terminal device. The data processing method may include the following steps S201-S205:

[0145] S201: When a service request initiated by an application is detected, a temporary key randomly assigned to the service request is obtained.

[0146] In one implementation, a service request may be initiated by a subject using a terminal device. For example, when a subject wishes to log in to an application, they may trigger a login option, at which point a login request initiated by the application is detected. In another implementation, a service request may be initiated by the application itself. For example, if the application is an information collection application, the service request may include a form request for requesting form information. When the application needs to display a form for collecting information, a form request initiated by the application is detected.

[0147] Among them, random allocation means: a temporary key is allocated for each service request, and different service requests have different temporary keys allocated. Schematically, a service request can be allocated a temporary key, and the next service request will be allocated other temporary keys, and the temporary keys allocated to these two service requests are different. In one implementation, the temporary keys randomly allocated to service requests may include: randomly allocating temporary keys to service requests through a random number generator, and the random number generator may be a CSPRNGs (Cryptographically Secure Pseudo-Random Number Generator) and the like. By using a random number generator, it is possible to generate keys without relying on key agreement functions and key derivation functions, which can overcome the problem in actual development that the key agreement function and key derivation function cannot be implemented using the elliptic curve allowed in the national secret algorithm, thereby reducing the amount of computation and security proof in the encryption process.

[0148] S202: Encrypt the temporary key using the certificate public key to obtain an encrypted temporary key.

[0149] Among them, the application can encrypt the temporary key using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key. The first encryption algorithm includes an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes at least one of the following: SM2 algorithm, RSA algorithm, DSA algorithm. The certificate public key can be set in the source code of the application, and the certificate private key corresponding to the certificate public key is stored in the server. For example, if the first encryption algorithm adopts the RSA algorithm, then the server can first obtain a pair of public and private keys (including the certificate public key and the certificate private key) through the RSA algorithm, the server saves the certificate private key, and broadcasts the certificate public key to the terminal device, wherein the certificate public key contains two numbers n and e, and the certificate private key contains two numbers n and d. The encryption process is that the application performs an exponential operation on the temporary key modulo n (that is, the encryption process using the certificate public key). The decryption process is that the server performs an exponential operation on the encrypted temporary key modulo n (that is, the decryption process using the certificate private key). The security of the RSA algorithm lies in the fact that it is difficult to calculate d from e and n in the certificate public key without knowing d in the certificate private key. Even if the certificate public key and the encrypted temporary key are known, the original temporary key cannot be decrypted without the certificate private key.

[0150] In one implementation, encrypting the temporary key using the certificate public key according to the first encryption algorithm to obtain the encrypted temporary key includes: asymmetrically encrypting the temporary key using the certificate public key according to an asymmetric encryption algorithm to obtain the encrypted temporary key. It should be understood that the length of the temporary key randomly assigned to the service request can be fixed. When the length of the temporary key is fixed, the time consumed by the asymmetric encryption algorithm is also controllable.

[0151] S203: Use the temporary key to encrypt the request data of the service request to obtain a ciphertext.

[0152] The application may encrypt the request data of the service request using a temporary key according to a second encryption algorithm to obtain ciphertext. The second encryption algorithm may include a symmetric encryption algorithm, including at least one of the following: a DES algorithm, a DES3 algorithm, an SM4 algorithm, and an AES algorithm. Step S203 may include symmetric encryption of the request data of the service request using the temporary key according to the symmetric encryption algorithm to obtain ciphertext. The ciphertext may be in a target format, such as binary, quaternary, or the like.

[0153] In principle, when the symmetric encryption algorithm includes the SM4 algorithm, the request data of the service request is symmetrically encrypted using a temporary key according to the symmetric encryption algorithm to obtain the ciphertext, including the following steps: ① Determine the data length of the request data of the service request; ② Determine whether the data length of the request data meets the length condition. If the data length of the request data meets the length condition, step ③ is executed; if the data length of the request data does not meet the length condition, step ⑥ is executed. The length condition can be set according to demand. In principle, the length condition is set to that the data length must meet an integer multiple of the packet length (such as if the packet length is 64 bits, then the data length must meet an integer multiple of 64). If the data length of the request data meets an integer multiple of the packet length, there is no need to perform padding processing on the request data, and step ③ is executed. If the data length of the request data does not meet an integer multiple of the packet length, the request data is padded, that is, step ⑥ is executed. ③ If the data length of the request data meets the length condition, the request data is grouped to obtain multiple groups. ④ Use the Cipher Block Chaining (CBC) mode in the SM4 algorithm to perform XOR processing on multiple groups and the initialization vector to obtain multiple XOR results. Among them, the initialization vector can be set according to needs. ⑤ Encrypt multiple XOR results to obtain multiple encrypted groups, and then assemble the multiple encrypted groups into ciphertext. ⑥ If the data length of the request data does not meet the length condition, the request data is padded with length according to the preset data padding rule to obtain the padded request data. ⑦ Group the padded request data to obtain multiple groups, and execute steps ④ and ⑤. Among them, the preset data padding rule can be PKCS7 (a syntax standard for encrypted messages).

[0154] It should be understood that when an application uses an asymmetric encryption algorithm to encrypt the temporary key and a symmetric encryption algorithm to encrypt the request data (i.e., the first encryption algorithm and the second encryption algorithm are different), it can achieve the security of asymmetric encryption while achieving the performance of symmetric encryption. Furthermore, because the first encryption algorithm and the second encryption algorithm are different, it is more difficult to simultaneously decrypt the temporary key and the ciphertext, further ensuring data security.

[0155] S204: Generate a network response request packet according to the encrypted temporary key and the ciphertext.

[0156] In a specific implementation, the encryption temporary key may be determined as a packet header, the ciphertext may be determined as a packet body, and the packet header and the packet body may be concatenated to form a network response request packet.

[0157] S205: Send a network response request packet to the server, where the network response request packet is used to request the server to respond to the service request.

[0158] In an embodiment of the present application, when a business request for an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is then encrypted using the certificate public key according to a first encryption algorithm to obtain an encrypted temporary key, and the request data of the business request is encrypted using the temporary key according to a second encryption algorithm to obtain a ciphertext; a network response request packet is generated based on the encrypted temporary key and the ciphertext, and the network response request packet is sent to the server, where the network response request packet is used to request the server to respond to the business request. Through the above scheme, different encryption algorithms can be used to encrypt the temporary key and the request data of the business request, thereby improving data security during data transmission. It can also be known that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then decrypt the temporary key used to decrypt the ciphertext using the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each business request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the business request separately, data security during data transmission can be well guaranteed.

[0159] Please refer to Figure 3, which is a flowchart of a data processing method provided by another exemplary embodiment of the present application. The data processing method can be executed by a terminal device, more specifically, by an application running on the terminal device. The data processing method may include the following steps S301-S306:

[0160] S301: When a service request initiated by an application is detected, a temporary key randomly allocated to the service request is obtained.

[0161] The temporary key includes a first subkey and a second subkey. The key length of the first subkey and the key length of the second subkey can be the same or different. Illustratively, the key length of the temporary key can be 256 bits, wherein the first subkey can be the first 128 bits of the temporary key, and the second subkey can be the last 128 bits of the temporary key.

[0162] S302: Encrypt the temporary key using the certificate public key according to a first encryption algorithm to obtain an encrypted temporary key.

[0163] S303: Encrypt the request data of the service request using the temporary key according to the second encryption algorithm to obtain a ciphertext.

[0164] As an implementation manner, the computer device may obtain the first subkey from the temporary key, and then encrypt the request data of the service request using the first subkey according to the second encryption algorithm to obtain a ciphertext.

[0165] S304: Use the second subkey in the temporary key to perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code.

[0166] Step S304 may include: performing a digest operation on the encrypted temporary key and the ciphertext using the second subkey according to a message digest algorithm to obtain a message authentication code. Message digest algorithms may include, but are not limited to, digital signature algorithms. Taking the digital signature algorithm as an example, the second subkey may be a key pair, i.e., a public key and a private key. The application may first perform a hash operation on the encrypted temporary key and the ciphertext. The resulting hash value may be called a digest. Hash operation algorithms may include SM3 (cryptographic hash algorithm) and MD5 (Message-Digest Algorithm). The hash value is then signed using the private key in the second subkey to obtain a message authentication code. Taking MD5 as an example, the MD5 code processes the input information (including the encrypted temporary key and the ciphertext) in 512-bit blocks, and each block is further divided into 16 32-bit subblocks. After a series of processing, the algorithm output consists of four 32-bit blocks. These four 32-bit blocks are concatenated to generate a 128-bit hash value (i.e., the resulting hash value). When the server subsequently obtains the second subkey, it can decrypt the message authentication code using the public key in the second subkey to obtain a hash value. It can then hash the obtained encrypted temporary key and ciphertext to obtain the hash value to be verified. If the hash value is the same as the hash value to be verified, the message authentication code has been successfully verified. Alternatively, the server can directly hash the obtained encrypted temporary key and ciphertext to obtain a hash value to be verified. It can then sign the hash value to be verified using the private key in the second subkey to obtain a calculated message authentication code. If the calculated message authentication code is the same as the obtained message authentication code, the message authentication code is also legal. Optionally, the message authentication code of the present application may not need to be calculated using the second subkey. For example, the application can directly perform a hash operation on the encrypted temporary key and the ciphertext, and use the operation result as the message authentication code. When the server subsequently obtains the message authentication code, the encrypted temporary key and the ciphertext, the server can directly perform a hash operation on the obtained encrypted temporary key and the ciphertext to obtain the calculated message authentication code. If the calculated message authentication code is the same as the obtained message authentication code, it also indicates that the message authentication code is legal.

[0167] It should be understood that the process of using the second subkey to perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code can also include: determining the data length of the request data, using the second subkey to perform a digest operation on the encrypted temporary key, the data length, the initialization vector and the ciphertext to obtain a message authentication code. The present application uses the second subkey to calculate the message authentication code corresponding to the encrypted temporary key and the ciphertext, which can ensure that the encrypted temporary key and the ciphertext obtained by the server are complete, that is, the server itself calculates the calculated message authentication code corresponding to the encrypted temporary key and the ciphertext through the second subkey. If the calculated message authentication code is the same as the message authentication code calculated by the application, it can be authenticated that the encrypted temporary key and the ciphertext received by the server are generated by the application, that is, it is considered that the encrypted temporary key and the ciphertext sent to the server are not tampered with and are complete, so that the temporary key and the request data of the service request further decrypted by the server are guaranteed to be correct and reliable.

[0168] S305: Encapsulate the encrypted temporary key, ciphertext, and message authentication code to form a network response request packet.

[0169] In one implementation, step S305 may include: determining the encrypted temporary key as a header, determining the ciphertext as a body, and determining the message authentication code as a trailer; and then concatenating the header, body, and trailer to form a network response request packet. Since the server first needs to decrypt the encrypted temporary key, placing the encrypted temporary key in the header allows the server to immediately obtain the encrypted temporary key in the header. In this way, the server can simultaneously decrypt the encrypted temporary key in the header while receiving the body, so that after receiving the body, the ciphertext in the body can be decrypted more quickly based on the decrypted temporary key. Similarly, since the server needs to first calculate the calculated message authentication code corresponding to the encrypted temporary key and the ciphertext, the message authentication code calculated by the application can be placed in the trailer. In this way, the server can simultaneously calculate the calculated message authentication code while receiving the trailer, so that after receiving the trailer, the running message authentication code can be more quickly compared with the message authentication code in the trailer. It can be seen that the data structure of the network response request packet of the present application allows the server to perform more reasonable synchronous processing during data reception, decryption and message authentication code verification, thereby improving the processing efficiency of the server.

[0170] S306: Send a network response request packet to the server, where the network response request packet is used to request the server to respond to the service request.

[0171] In an embodiment of the present application, when a business request for an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is then encrypted using the certificate public key according to a first encryption algorithm to obtain an encrypted temporary key, and the request data of the business request is encrypted using the temporary key according to a second encryption algorithm to obtain a ciphertext; the second subkey is then used to perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code, and the encrypted temporary key, ciphertext and message authentication code are encapsulated to form a network response request packet, and the network response request packet is sent to the server. Through the above scheme, different encryption algorithms can be used to encrypt the temporary key and the request data of the business request, thereby improving data security during data transmission. It can also be known that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then decrypt the temporary key used to decrypt the ciphertext using the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each business request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the business request separately, data security during data transmission can be well guaranteed. At the same time, the second sub-key is used to calculate the message authentication code corresponding to the encrypted temporary key and ciphertext, which can ensure that the encrypted temporary key and ciphertext obtained by the server are complete, that is, the server itself calculates the operation message authentication code corresponding to the encrypted temporary key and ciphertext through the second sub-key. If the operation message authentication code is the same as the message authentication code calculated by the application, it can be authenticated that the encrypted temporary key and ciphertext received by the server are generated by the application, that is, the encrypted temporary key and ciphertext sent to the server are not tampered with and are complete, so that the temporary key and service request data further decrypted by the server are correct and reliable.

[0172] The following is a supplementary introduction to some contents of the embodiments shown in FIG. 2 and FIG. 3 .

[0173] In one embodiment, the key length of the temporary key (OTP) can be set according to demand. When the temporary key is randomly assigned to the service request, the temporary key of the appropriate key length can be assigned based on the priority of the request data of the service request. As an implementation method, the priority of the request data is obtained, and the key length that matches the priority of the request data is obtained, wherein the higher the priority of the request data, the higher the importance of the request data, and the longer the matching key length. The longer the key length, the higher the security of the request data; then the temporary key is randomly assigned to the service request according to the matching key length. It can be seen that the present application can dynamically adjust the balance between security and processing efficiency, that is, when the priority of the request data becomes higher, higher security is required. At this time, the key length of the temporary key is increased to increase the difficulty of cracking. When the priority of the request data becomes lower, the problem of processing efficiency can be focused on. At this time, the key length of the temporary key is reduced to reduce the amount of calculation of the application and the server, thereby improving processing efficiency.

[0174] It should be understood that in the embodiment of the present application, the priority of the request data and the key length of the temporary key can also be obtained, and the second encryption algorithm can be selected based on one or more of the priority of the request data and the key length of the temporary key. Among them, the higher the priority of the request data, the higher the complexity of the second encryption algorithm; the longer the key length of the temporary key, the higher the complexity of the second encryption algorithm. The higher the complexity of the second encryption algorithm, the lower the probability of the request data being cracked after encryption, thereby better ensuring the security of the data. Similarly, when the priority of the request data becomes lower or the key length of the temporary key becomes shorter, the issue of processing efficiency can be considered. At this time, by reducing the complexity of the second encryption algorithm, the computing amount of the application and the server can be reduced, thereby improving the processing efficiency. It can be seen that the present application can dynamically adjust the balance between security and processing efficiency. Schematically, the priority of the request data is 3, indicating that the importance of the request data is relatively high. At this time, the DES3 algorithm with higher encryption complexity can be determined as the second encryption algorithm from the DES algorithm, SM4 algorithm and DES3 algorithm. Among them, encryption complexity can be determined based on factors such as the key length, block length, and number of encryption rounds of the encryption algorithm. That is, the higher the key length, block length (block length refers to the length of the data to be encrypted being divided into multiple blocks for processing), and the number of encryption rounds (for example, the round key is obtained by expanding the initial key, so the key used in each round of encryption is different, which increases the difficulty of cracking), the higher the corresponding encryption complexity will be, that is, the more secure the encryption algorithm will be. Alternatively, the longest exhaustive original text encryption times required to crack the ciphertext in the encryption algorithm can be used as the encryption complexity of the encryption algorithm. That is, the longer the longest exhaustive original text encryption times, the higher the encryption complexity, that is, the more secure the encryption algorithm will be.

[0175] The importance level may include the privacy level; a higher privacy level indicates a higher importance of the requested data. In this case, the specific method for determining the priority of the requested data includes determining the privacy level of the requested data and, based on the privacy level of the requested data, determining the priority of the requested data. For example, a corresponding relationship between the privacy level and the priority level can be set. For example, if the privacy level is 1-50, the priority level is 1; if the privacy level is 51-100, the priority level is 2. When the privacy level of the requested data is determined to be 60, the priority level of the requested data is determined to be 2 based on the corresponding relationship between the privacy level and the priority level.

[0176] In one embodiment, in addition to being a client installed in a terminal device, the application can also be an installation-free application. In this embodiment, the application can be run in a security sandbox provided by the terminal device, and the data processing method can be run in the security sandbox. At this time, the network response request packet can be verified in the security sandbox. If the network response request packet is successfully verified, the network response request packet is sent to the server (i.e., step S205 or step S306 is executed). If the network response request packet fails to be verified, a verification failure prompt message is directly output, and the verification failure prompt message is used to indicate that the network response request packet verification failed. The security sandbox can effectively isolate abnormal network response request packets. That is, when the network response request packet cannot be successfully verified in the security sandbox, the network response request packet that failed the verification (i.e., the abnormal network response request packet) will be isolated by the security sandbox, so that the abnormal network response request packet will not be sent to the server, which not only protects the security of the server, but also avoids the server from performing unnecessary decryption and verification of the abnormal network response request, and also saves network traffic.

[0177] The verification of the network response request packet in the security sandbox may include any of the following:

[0178] (1) Verifying the legitimacy of the certificate public key in the security sandbox. If the legitimacy verification of the certificate public key passes, it is determined that the verification of the network response request packet is successful. If the legitimacy verification of the certificate public key fails, it is determined that the verification of the network response request packet fails. Specifically, verifying the legitimacy of the certificate public key in the security sandbox means: verifying whether the certificate public key is a verified certificate public key. If the certificate public key is a verified certificate public key, it is determined that the legitimacy verification of the certificate public key passes. If the certificate public key is not a verified certificate public key, it is determined that the legitimacy verification of the certificate public key fails.

[0179] As an implementation method, the certificate public key is pre-uploaded before uploading the application source code. Therefore, the pre-uploaded certificate public key is verified in the security sandbox to see if it is consistent with the certificate public key in the application source code. If it is determined that the uploaded certificate public key is consistent with the certificate public key in the source code, the certificate public key verification is determined to have passed. If it is determined that the uploaded certificate public key is inconsistent with the certificate public key in the source code, the certificate public key verification is determined to have failed.

[0180] (2) Verify the standardization of the network response request packet in the security sandbox. If the standardization verification of the network response request packet passes, it is determined that the verification of the network response request packet is successful; if the standardization verification of the network response request packet fails, it is determined that the verification of the network response request packet fails.

[0181] Verifying the compliance of the network response request packet may include at least one of the following: ① Verifying whether the data in the network response request packet is encrypted. If it is determined that the data in the network response request packet is not encrypted, the compliance verification of the network response request packet fails. If it is determined that the data in the network response request packet is encrypted, the compliance verification of the network response request packet passes. ② Verifying whether the temporary encryption key is encrypted using a verified certificate public key. If the temporary encryption key is encrypted using a verified certificate public key, the compliance verification of the network response request packet passes. If the temporary encryption key is not encrypted using a verified certificate public key, the compliance verification of the network response request packet fails. ③ Verifying whether the format of the network response request packet is a preset format. Here, the preset format is, for example, a network response request packet with a header containing a temporary encryption key, a body containing ciphertext, and a trailer containing a message authentication code. If the format of the network response request packet is the preset format, the compliance verification of the network response request packet passes. If the format of the network response request packet is not the preset format, the compliance verification of the network response request packet fails.

[0182] (3) Verify the legitimacy of the certificate public key and the standardization of the network response request packet in the security sandbox. If the legitimacy verification of the certificate public key passes and the standardization verification of the network response request packet passes, then it is determined that the verification of the network response request packet is successful. If the legitimacy verification of the certificate public key fails or the standardization verification of the network response request packet fails, or the legitimacy verification of the certificate public key fails and the standardization verification of the network response request packet fails, then it is determined that the verification of the network response request packet fails.

[0183] In summary, data encryption within the security sandbox ensures data security to a certain extent. Furthermore, before sending the network response request packet, the network response request packet is verified within the security sandbox to ensure that the data in the network response request packet is encrypted and complies with the standard, further ensuring data security.

[0184] Next, the decryption process on the server side is explained.

[0185] Please refer to Figure 4, which is a flowchart of a data processing method provided by another exemplary embodiment of the present application. The data processing method can be executed by a server, which can be the server in the above-mentioned data processing system. The data processing method can include the following steps S401-S404:

[0186] S401: Receive a network response request packet sent by an application; the network response request packet includes an encrypted temporary key and ciphertext. The encrypted temporary key is obtained by encrypting the temporary key using the certificate public key on the terminal device, and the ciphertext is obtained by encrypting the service request data using the temporary key on the terminal device.

[0187] S402: Decrypt the encrypted temporary key using the certificate private key. If the encrypted temporary key is encrypted using the certificate public key preset in the source code of the application, decrypt the temporary key to obtain a temporary key randomly assigned to the service request of the application.

[0188] Specifically, the certificate private key can be obtained, and according to the first encryption algorithm, the encrypted temporary key can be decrypted using the certificate private key. If the decryption is successful, it means that the encrypted temporary key is encrypted by the certificate public key (the certificate public key is generated based on the certificate private key) preset in the source code of the application, that is, the temporary key can be decrypted.

[0189] S403: Decrypt the ciphertext using the temporary key to obtain request data of the service request.

[0190] The server may decrypt the ciphertext using the temporary key according to the second encryption algorithm to obtain the request data of the service request. The temporary key includes the first subkey. In one implementation, the server reads the packet body from the network response request packet to obtain the ciphertext, then obtains the first subkey from the temporary key and decrypts the ciphertext using the first subkey according to the second encryption algorithm to obtain the request data of the service request.

[0191] As an implementation method, the second encryption algorithm includes the SM4 algorithm, the ciphertext includes multiple encrypted groups, and the ciphertext is decrypted using the first subkey according to the second encryption algorithm to obtain the request data of the business request, including: decrypting the multiple encrypted groups to obtain multiple decrypted groups, and obtaining the initialization vector, and performing XOR processing on the multiple decrypted groups based on the initialization vector to obtain the request data of the business request.

[0192] S404: Based on the request data, respond to the service request.

[0193] In one implementation, responding to a service request based on the request data may include: determining, based on the request data, a service processing device corresponding to the service request, and forwarding the service request to the service processing device for service processing. Illustratively, the service request is a login request, and the request data is object information. Based on the request data, the server may determine that the service processing device corresponding to the service request is a login processing device, and the server may forward the service request to the login processing device for login processing.

[0194] It should be understood that after the business processing device performs business processing in response to the business request, in one implementation, the business processing device can directly return the business processing results to the application. In another implementation, the business processing device can return the business processing results to the server, and the server returns the business processing results to the application, so that the application responds based on the business processing results. Schematically, the login processing device can obtain object information based on the login request and directly return the object information to the application. Based on the object information, the application displays the application's functional interface, thereby completing the application login.

[0195] In an embodiment of the present application, a network response request packet sent by an application is received; the network response request packet includes an encrypted temporary key and a ciphertext; the encrypted temporary key is decrypted using a certificate private key according to a first encryption algorithm to obtain a temporary key randomly assigned to the application's business request; the ciphertext is decrypted using the temporary key according to a second encryption algorithm to obtain request data of the business request; and a response is performed on the business request based on the request data. It can be seen that during the data transmission process, by using different encryption algorithms to encrypt the temporary key and the request data of the business request respectively, the data security during the data transmission process can be improved; in addition, the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then use the certificate private key in the server to decrypt the temporary key used to decrypt the ciphertext. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each business request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the business request separately, the data security during the data transmission process can be well guaranteed.

[0196] Please refer to Figure 5, which is a flowchart of a data processing method provided by another exemplary embodiment of the present application. The data processing method can be executed by a server, which can be the server in the above-mentioned data processing system. The data processing method may include the following steps S501-S506:

[0197] S501: Receive a network response request packet sent by an application; the network response request packet includes an encrypted temporary key, ciphertext, and a message authentication code. The encrypted temporary key is obtained by encrypting the temporary key using the certificate public key of the terminal device, and the ciphertext is obtained by encrypting the service request data using the temporary key of the terminal device.

[0198] S502: Decrypt the encrypted temporary key using the certificate private key according to the first encryption algorithm to obtain a temporary key randomly assigned to the service request of the application program, where the temporary key includes a first subkey and a second subkey.

[0199] The network response request packet may include a header, a body, and a trailer. The server may read the header from the network response request packet to obtain the encrypted temporary key, and decrypt the encrypted temporary key using the certificate private key according to the first encryption algorithm to obtain the temporary key.

[0200] S503: Use the second subkey to perform a digest operation on the encrypted temporary key and the ciphertext to obtain a calculated message authentication code.

[0201] In one implementation, a digest operation can be performed on the temporary encryption key and the ciphertext using the second subkey according to a message digest algorithm to obtain a computational message authentication code. In another implementation, the network response request packet also includes a data length and an initialization vector. A digest operation can be performed on the temporary encryption key, the data length, the initialization vector, and the ciphertext using the second subkey according to a message digest algorithm to obtain a computational message authentication code.

[0202] S504: Perform consistency comparison between the calculated message authentication code and the message authentication code in the network response request packet.

[0203] Among them, the packet tail of the network response request packet contains a message authentication code. If the calculated message authentication code is consistent with the message authentication code in the packet tail, it means that the data in the network response request packet is complete and has not been tampered with, and step S505 is executed. If the calculated message authentication code is consistent with the message authentication code in the packet tail, it means that the data in the network response request packet has been tampered with, and a prompt message is returned to the terminal device. The prompt message is used to prompt that the data in the network response request packet is at risk of being tampered with. The present application uses the second subkey to calculate the message authentication code corresponding to the encrypted temporary key and the ciphertext, which can ensure that the encrypted temporary key and ciphertext obtained by the server are complete. That is, the server itself calculates the calculated message authentication code corresponding to the encrypted temporary key and the ciphertext using the second subkey. If the calculated message authentication code is the same as the message authentication code calculated by the application, it can be authenticated that the encrypted temporary key and ciphertext received by the server are generated by the application, that is, it is considered that the encrypted temporary key and ciphertext sent to the server are not tampered with and are complete, so that the temporary key and the request data of the service request further decrypted by the server are correct and reliable.

[0204] S505: If the consistency comparison passes, the ciphertext is decrypted using the temporary key according to the second encryption algorithm to obtain the request data of the service request.

[0205] As an implementation manner, the server may obtain the first subkey from the temporary key, and decrypt the ciphertext using the first subkey according to the second encryption algorithm to obtain the request data of the service request.

[0206] S506: Based on the request data, respond to the service request.

[0207] In an embodiment of the present application, a network response request packet sent by an application is received; the network response request packet includes an encrypted temporary key and a ciphertext. The encrypted temporary key is then decrypted using the certificate private key according to a first encryption algorithm to obtain a temporary key randomly assigned to the application's service request, wherein the temporary key includes a first subkey and a second subkey. A digest operation is then performed on the encrypted temporary key and the ciphertext using the second subkey to obtain a calculated message authentication code, and the calculated message authentication code is compared for consistency with the message authentication code in the network response request packet. If the consistency comparison passes, the ciphertext is decrypted using the temporary key according to the second encryption algorithm to obtain request data for the service request, and then a response is processed based on the request data. Before decrypting the ciphertext, the message authentication code in the network response request packet is verified to avoid the risk of attackers tampering with the network response request packet. Furthermore, since the terminal device directly sends the temporary key to the server, the server does not need to maintain the status of the temporary key. In other words, the temporary key is not stored on the server, which prevents key leakage and improves data security. At the same time, the same first subkey is used to decrypt the ciphertext to achieve symmetric encryption, which can fully utilize the performance advantages of symmetric encryption. Even with the increase in data volume, there will be no obvious performance impact, effectively protecting the server's resources from being over-utilized.

[0208] Next, the data processing device provided in the embodiments of the present application is described.

[0209] Please refer to Figure 6, which is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. The data processing device can be a computer program (including program code) in a computer device, for example, the data processing device can be an application software in the computer device; the data processing device can be used to execute some or all of the steps in the method embodiments shown in Figures 2 and 3. Referring to Figure 6, the data processing device includes the following units:

[0210] The processing unit 601 is configured to obtain a temporary key randomly assigned to a service request when a service request initiated by an application is detected;

[0211] The processing unit 601 is further configured to encrypt the temporary key using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; and the certificate private key corresponding to the certificate public key is stored in the server;

[0212] The processing unit 601 is further configured to encrypt the request data of the service request using the temporary key to obtain a ciphertext;

[0213] The processing unit 601 is further configured to generate a network response request packet according to the encryption temporary key and the ciphertext;

[0214] The sending unit 602 is configured to send a network response request packet to the server, where the network response request packet is used to request the server to respond to the service request.

[0215] The processing unit 601 is specifically configured to encrypt the temporary key using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key;

[0216] The processing unit 601 is specifically configured to encrypt the request data of the service request using a temporary key according to a second encryption algorithm to obtain a ciphertext; the first encryption algorithm is different from the second encryption algorithm.

[0217] Random allocation means that a temporary key is allocated for each service request, and different temporary keys are allocated for different service requests.

[0218] The certificate public key is set in the source code of the application; the certificate private key corresponding to the certificate public key is stored on the server;

[0219] The first encryption algorithm includes an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes at least one of the following: an elliptic curve public key cryptography algorithm, an asymmetric encryption algorithm based on the large number factorization problem, and a digital signature algorithm;

[0220] The second encryption algorithm includes a symmetric encryption algorithm, and the symmetric encryption algorithm includes at least one of the following: a block algorithm using key encryption, a block cipher algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

[0221] The temporary key includes the first subkey; the processing unit 601 is specifically configured to:

[0222] Obtaining a first subkey from the temporary key;

[0223] The request data of the service request is encrypted using the first subkey according to the second encryption algorithm to obtain a ciphertext.

[0224] The temporary key also includes a second subkey; the processing unit 601 is specifically configured to:

[0225] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code;

[0226] The encryption temporary key, ciphertext and message authentication code are encapsulated to form a network response request packet.

[0227] The processing unit 601 is specifically configured to:

[0228] The encryption temporary key is determined as the packet header, the ciphertext is determined as the packet body, and the message authentication code is determined as the packet tail;

[0229] The packet header, packet body and packet tail are spliced ​​together to form a network response request packet.

[0230] The processing unit 601 is further configured to:

[0231] Get the priority of the requested data;

[0232] Get the key length that matches the priority of the requested data;

[0233] Randomly assign temporary keys to service requests according to the matching key length;

[0234] The higher the priority of the requested data, the more important the requested data is, and the longer the matching key length is.

[0235] The processing unit 601 is further configured to:

[0236] Get the priority of the requested data and the key length of the temporary key;

[0237] determining a second encryption algorithm according to one or both of a priority of the request data and a key length of the temporary key;

[0238] Among them, the higher the priority of the requested data, the higher the complexity of the second encryption algorithm; the longer the key length of the temporary key, the higher the complexity of the second encryption algorithm.

[0239] The application is an installation-free application; the application runs in a security sandbox, and the method runs in a security sandbox; the processing unit 601 is further configured to:

[0240] Verify the network response request packet in the security sandbox;

[0241] If the network response request packet is successfully verified, the step of sending the network response request packet to the server is executed.

[0242] The verification includes any of the following: verifying the legitimacy of the certificate public key; verifying the standardization of the network response request packet;

[0243] Verifying the standardization of the network response request packet includes at least one of the following:

[0244] Verify whether the data in the network response request packet is encrypted. If it is determined that the data in the network response request packet is not encrypted, the network response request packet fails the standardization verification. If it is determined that the data in the network response request packet is encrypted, the network response request packet passes the standardization verification.

[0245] Verify whether the temporary encryption key is encrypted using the verified certificate public key. If so, determine that the network response request packet has passed the standardization verification. If not, determine that the network response request packet has failed the standardization verification.

[0246] Verify whether the format of the network response request packet is a preset format. If the format of the network response request packet is the preset format, determine that the standardization verification of the network response request packet has passed; if the format of the network response request packet is not the preset format, determine that the standardization verification of the network response request packet has failed; the preset format means that the header of the network response request packet is a temporary encryption key, the body is ciphertext, and the trailer is a message authentication code.

[0247] In an embodiment of the present application, when a business request for an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is then encrypted using the certificate public key according to a first encryption algorithm to obtain an encrypted temporary key, and the request data of the business request is encrypted using the temporary key according to a second encryption algorithm to obtain a ciphertext; a network response request packet is generated based on the encrypted temporary key and the ciphertext, and the network response request packet is sent to the server, where the network response request packet is used to request the server to respond to the business request. Through the above scheme, before data transmission, the temporary key and the request data of the service request can be encrypted using different encryption algorithms, thereby improving data security during the data transmission process. In addition, it can be seen that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application and then decrypt the temporary key used to decrypt the ciphertext using the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each service request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the service request separately, data security during the data transmission process can be well guaranteed.

[0248] Please refer to Figure 7, which is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. The data processing device can be a computer program (including program code) in a computer device, for example, the data processing device can be an application software in the computer device; the data processing device can be used to perform some or all of the steps in the method embodiments shown in Figures 4 and 5. Referring to Figure 7, the data processing device includes the following units:

[0249] The receiving unit 701 is configured to receive a network response request packet sent by an application; the network response request packet includes an encryption temporary key and a ciphertext;

[0250] Processing unit 702 is configured to decrypt the encrypted temporary key using the certificate private key. If the encrypted temporary key is encrypted using the certificate public key preset in the source code of the application, the decryption process obtains a temporary key randomly assigned to the service request of the application.

[0251] The processing unit 702 is further configured to decrypt the ciphertext using the temporary key to obtain request data of the service request;

[0252] The processing unit 702 is further configured to perform response processing on the service request based on the request data.

[0253] The temporary key includes a first subkey and a second subkey; the first subkey is used to decrypt the ciphertext; the network response request packet also includes a message authentication code; the processing unit 702 is further used to:

[0254] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain an operational message authentication code;

[0255] Compare the calculated message authentication code with the message authentication code in the network response request packet for consistency;

[0256] If the consistency comparison passes, the step of decrypting the ciphertext using the temporary key according to the second encryption algorithm is executed to obtain the request data of the service request.

[0257] The processing unit 702 is specifically configured to:

[0258] Determining the service processing device corresponding to the service request based on the request data;

[0259] Forward the service request to the service processing device for service processing.

[0260] In an embodiment of the present application, a network response request packet sent by an application is received; the network response request packet includes an encrypted temporary key and a ciphertext; the encrypted temporary key is decrypted using a certificate private key according to a first encryption algorithm to obtain a temporary key randomly assigned to the application's business request; the ciphertext is decrypted using the temporary key according to a second encryption algorithm to obtain request data of the business request; and a response is performed on the business request based on the request data. It can be seen that during the data transmission process, by using different encryption algorithms to encrypt the temporary key and the request data of the business request respectively, the data security during the data transmission process can be improved. In addition, it can be seen that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then decrypt the temporary key used to decrypt the ciphertext through the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each business request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the business request separately, the data security during the data transmission process can be well guaranteed.

[0261] Next, the computer device provided in the embodiments of the present application is described.

[0262] Furthermore, an embodiment of the present application provides a schematic diagram of the structure of a computer device, as shown in Figure 8 . The computer device may include a processor 801, an input device 802, an output device 803, and a memory 804. The processor 801, input device 802, output device 803, and memory 804 are connected via a bus. The memory 804 is used to store a computer program, which includes program instructions. The processor 801 is used to execute the program instructions stored in the memory 804.

[0263] In one embodiment, the computer device may be the aforementioned terminal device. In this embodiment, the processor 801 executes the following operations by running program instructions in the memory 804:

[0264] When a service request initiated by an application is detected, a temporary key randomly assigned to the service request is obtained;

[0265] The temporary key is encrypted using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; the certificate private key corresponding to the certificate public key is stored in the server;

[0266] The temporary key is used to encrypt the request data of the service request to obtain a ciphertext;

[0267] Generate a network response request packet based on the encrypted temporary key and the ciphertext, and send the network response request packet to the server. The network response request packet is used to request the server to respond to the service request.

[0268] When the processor 801 encrypts the temporary key using the certificate public key to obtain the encrypted temporary key, it may specifically perform the following steps:

[0269] Encrypting the temporary key using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key;

[0270] When the processor 801 encrypts the request data of the service request using the temporary key to obtain the ciphertext, it may specifically perform the following steps:

[0271] The request data of the service request is encrypted using a temporary key according to a second encryption algorithm to obtain a ciphertext; the first encryption algorithm is different from the second encryption algorithm.

[0272] Random allocation means that a temporary key is allocated for each service request, and different temporary keys are allocated for different service requests.

[0273] The certificate public key is set in the source code of the application; the certificate private key corresponding to the certificate public key is stored on the server;

[0274] The first encryption algorithm includes an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes at least one of the following: an elliptic curve public key cryptography algorithm, an asymmetric encryption algorithm based on the large number factorization problem, and a digital signature algorithm;

[0275] The second encryption algorithm includes a symmetric encryption algorithm, and the symmetric encryption algorithm includes at least one of the following: a block algorithm using key encryption, a block cipher algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

[0276] The temporary key includes the first subkey. When the processor 801 encrypts the request data of the service request using the temporary key according to the second encryption algorithm to obtain the ciphertext, the processor 801 may specifically perform the following steps:

[0277] Obtaining a first subkey from the temporary key;

[0278] The request data of the service request is encrypted using the first subkey according to the second encryption algorithm to obtain a ciphertext.

[0279] The temporary key also includes a second subkey. When the processor 801 generates a network response request packet according to the encrypted temporary key and the ciphertext, the processor 801 may specifically perform the following steps:

[0280] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain a message authentication code;

[0281] The encryption temporary key, ciphertext and message authentication code are encapsulated to form a network response request packet.

[0282] When the processor 801 encapsulates the encryption temporary key, ciphertext, and message authentication code to form a network response request packet, it may specifically perform the following steps:

[0283] The encryption temporary key is determined as the packet header, the ciphertext is determined as the packet body, and the message authentication code is determined as the packet tail;

[0284] The packet header, packet body and packet tail are spliced ​​together to form a network response request packet.

[0285] The processor 801 may further execute the following steps:

[0286] Get the priority of the requested data;

[0287] Get the key length that matches the priority of the requested data;

[0288] Randomly assign temporary keys to service requests according to the matching key length;

[0289] The higher the priority of the requested data, the more important the requested data is, and the longer the matching key length is.

[0290] The processor 801 may further execute the following steps:

[0291] Get the priority of the requested data and the key length of the temporary key;

[0292] determining a second encryption algorithm according to one or both of a priority of the request data and a key length of the temporary key;

[0293] Among them, the higher the priority of the requested data, the higher the complexity of the second encryption algorithm; the longer the key length of the temporary key, the higher the complexity of the second encryption algorithm.

[0294] The application is an installation-free application; the application runs in a security sandbox, and the method runs in the security sandbox; the processor 801 may further perform the following steps:

[0295] Verify the network response request packet in the security sandbox;

[0296] If the network response request packet is successfully verified, the step of sending the network response request packet to the server is executed.

[0297] The verification includes any of the following: verifying the legitimacy of the certificate public key; verifying the standardization of the network response request packet;

[0298] Verifying the standardization of the network response request packet includes at least one of the following:

[0299] Verify whether the data in the network response request packet is encrypted. If it is determined that the data in the network response request packet is not encrypted, the network response request packet fails the standardization verification. If it is determined that the data in the network response request packet is encrypted, the network response request packet passes the standardization verification.

[0300] Verify whether the temporary encryption key is encrypted using the verified certificate public key. If so, determine that the network response request packet has passed the standardization verification. If not, determine that the network response request packet has failed the standardization verification.

[0301] Verify whether the format of the network response request packet is a preset format. If the format of the network response request packet is the preset format, determine that the standardization verification of the network response request packet has passed; if the format of the network response request packet is not the preset format, determine that the standardization verification of the network response request packet has failed; the preset format means that the header of the network response request packet is a temporary encryption key, the body is ciphertext, and the trailer is a message authentication code.

[0302] In an embodiment of the present application, when a business request for an application is detected, a temporary key randomly assigned to the business request is obtained; the temporary key is then encrypted using the certificate public key according to a first encryption algorithm to obtain an encrypted temporary key, and the request data of the business request is encrypted using the temporary key according to a second encryption algorithm to obtain a ciphertext; a network response request packet is generated based on the encrypted temporary key and the ciphertext, and the network response request packet is sent to the server, where the network response request packet is used to request the server to respond to the business request. Through the above scheme, before data transmission, the temporary key and the request data of the service request can be encrypted using different encryption algorithms, thereby improving data security during the data transmission process. In addition, it can be seen that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application and then decrypt the temporary key used to decrypt the ciphertext using the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each service request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the service request separately, data security during the data transmission process can be well guaranteed.

[0303] In another embodiment, the computer device may be the aforementioned server. In this embodiment, the processor 801 executes the following operations by running program instructions in the memory 804:

[0304] Receive a network response request packet sent by an application; the network response request packet includes an encryption temporary key and ciphertext;

[0305] The encrypted temporary key is decrypted using the certificate private key. If the encrypted temporary key is encrypted using the certificate public key preset in the source code of the application, the decrypted temporary key is randomly assigned to the service request of the application.

[0306] Decrypt the ciphertext using the temporary key to obtain the request data of the business request;

[0307] Based on the request data, respond to the business request.

[0308] The temporary key includes a first subkey and a second subkey; the first subkey is used to decrypt the ciphertext; the network response request packet also includes a message authentication code; the processor 801 may further perform the following steps:

[0309] Using the second subkey, perform a digest operation on the encrypted temporary key and the ciphertext to obtain an operational message authentication code;

[0310] Compare the calculated message authentication code with the message authentication code in the network response request packet for consistency;

[0311] If the consistency comparison passes, the step of decrypting the ciphertext using the temporary key according to the second encryption algorithm is executed to obtain the request data of the service request.

[0312] The processor 801 may further perform the following steps when responding to the service request based on the request data:

[0313] Determining the service processing device corresponding to the service request based on the request data;

[0314] Forward the service request to the service processing device for service processing.

[0315] In an embodiment of the present application, a network response request packet sent by an application is received; the network response request packet includes an encrypted temporary key and a ciphertext; the encrypted temporary key is decrypted using a certificate private key according to a first encryption algorithm to obtain a temporary key randomly assigned to the application's business request; the ciphertext is decrypted using the temporary key according to a second encryption algorithm to obtain request data of the business request; and a response is performed on the business request based on the request data. It can be seen that during the data transmission process, by using different encryption algorithms to encrypt the temporary key and the request data of the business request respectively, the data security during the data transmission process can be improved. In addition, it can be seen that the server does not need to generate a temporary key or maintain the status of the temporary key. The server only needs to passively receive the encrypted temporary key sent by the application, and then decrypt the temporary key used to decrypt the ciphertext through the certificate private key in the server. It can be seen that the server only needs to generate a certificate public key and a corresponding certificate private key to achieve secure acquisition of the temporary key, without having to generate and maintain a temporary key for each business request. This can reduce the server's data processing volume to a certain extent and save server resource overhead. Moreover, since the certificate private key is only stored in the server, the encrypted temporary key encrypted by the certificate public key can only be decrypted by the server, so the security of the temporary key can be well guaranteed. Since the temporary key is sufficiently secure, the ciphertext encrypted by the temporary key is also sufficiently secure. Therefore, by encrypting the temporary key and the request data of the business request separately, the data security during the data transmission process can be well guaranteed.

[0316] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and a computer program is stored in the computer-readable storage medium, and the computer program includes program instructions. When the processor executes the above program instructions, it can execute the method in the embodiment corresponding to Figures 2 to 5 above, so it will not be described in detail here. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, the program instructions can be deployed on a computer device, or executed on multiple computer devices located at one location, or, executed on multiple computer devices distributed at multiple locations and interconnected by a communication network.

[0317] According to one aspect of the present application, a computer program product is provided, comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, enabling the computer device to perform the methods described in the embodiments corresponding to Figures 2-5 above. Therefore, these methods will not be described in detail herein.

[0318] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0319] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: include: When a service request initiated by an application is detected, a temporary key randomly assigned to the service request is obtained; The temporary key is encrypted using a certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; The certificate private key corresponding to the certificate public key is stored in the server; Using the temporary key to encrypt the request data of the service request to obtain a ciphertext; A network response request packet is generated according to the encryption temporary key and the ciphertext, and the network response request packet is sent to the server, where the network response request packet is used to request the server to respond to the service request.

2. The method according to claim 1, characterized in that The step of encrypting the temporary key with the certificate public key to obtain the encrypted temporary key includes: Encrypting the temporary key using the certificate public key according to the first encryption algorithm to obtain an encrypted temporary key; The using the temporary key to encrypt the request data of the service request to obtain a ciphertext includes: The request data of the service request is encrypted using a temporary key according to a second encryption algorithm to obtain a ciphertext; the first encryption algorithm is different from the second encryption algorithm.

3. The method according to claim 1 or 2, characterized in that The temporary key includes a first subkey; the request data of the service request is encrypted using the temporary key according to the second encryption algorithm to obtain a ciphertext, including: Obtaining the first subkey from the temporary key; The request data of the service request is encrypted using the first subkey according to a second encryption algorithm to obtain a ciphertext.

4. The method according to any one of claims 1 to 3, characterized in that The temporary key also includes a second subkey; and generating a network response request packet according to the encrypted temporary key and the ciphertext includes: Using the second subkey, performing a digest operation on the encryption temporary key and the ciphertext to obtain a message authentication code; The encryption temporary key, the ciphertext and the message authentication code are encapsulated to form a network response request packet.

5. The method according to any one of claims 1 to 4, characterized in that: The encapsulating the temporary encryption key, the ciphertext and the message authentication code to form a network response request packet includes: Determine the temporary encryption key as a packet header, determine the ciphertext as a packet body, and determine the message authentication code as a packet tail; The packet header, the packet body and the packet tail are concatenated to form the network response request packet.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtaining the priority of the request data; Acquire a key length that matches the priority of the request data; Randomly assigning a temporary key to the service request according to the matched key length; The higher the priority of the request data is, the more important the request data is, and the longer the length of the matching key is.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtaining the priority of the request data and the key length of the temporary key; Determining a second encryption algorithm according to one or both of the priority of the request data or the key length of the temporary key; Among them, the higher the priority of the requested data, the higher the complexity of the second encryption algorithm; the longer the key length of the temporary key, the higher the complexity of the second encryption algorithm.

8. The method according to any one of claims 1 to 7, characterized in that The application is an installation-free application; the application runs in a security sandbox; and the method further includes: Verifying the network response request packet in the security sandbox; If the verification of the network response request packet is successful, the step of sending the network response request packet to the server is executed.

9. The method according to any one of claims 1 to 8, characterized in that The verification includes any of the following: Verifying the legitimacy of the public key of the certificate; Verifying the standardization of the network response request packet; The checking of the standardization of the network response request packet includes at least one of the following: Verify whether the data in the network response request packet is encrypted; if it is determined that the data in the network response request packet is not encrypted, the network response request packet fails the compliance verification; if it is determined that the data in the network response request packet is encrypted, the network response request packet passes the compliance verification; Verify whether the temporary encryption key is encrypted using the verified certificate public key. If the temporary encryption key is encrypted using the verified certificate public key, determine that the network response request packet has passed the normative verification. If the temporary encryption key is not encrypted using the verified certificate public key, determine that the network response request packet has failed the normative verification. Verify whether the format of the network response request packet is a preset format; if the format of the network response request packet is the preset format, determine that the standardization check of the network response request packet has passed; if the format of the network response request packet is not the preset format, determine that the standardization check of the network response request packet has failed; the preset format means that the header of the network response request packet is the temporary encryption key, the body is the ciphertext, and the footer is the message authentication code.

10. The method according to any one of claims 1 to 9, characterized in that: The random allocation means that a temporary key is allocated for each service request, and different temporary keys are allocated for different service requests; The first encryption algorithm includes an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes at least one of the following: an elliptic curve public key cryptography algorithm, an asymmetric encryption algorithm based on a large number factorization problem, or a digital signature algorithm; The second encryption algorithm comprises a symmetric encryption algorithm, and the symmetric encryption algorithm comprises at least one of the following: a block algorithm using key encryption, a block cipher algorithm, a triple data encryption algorithm, or an advanced encryption standard algorithm.

11. A data processing method, characterized in that: include: Receive the network response request packet sent by the application; The network response request packet includes an encrypted temporary key and a ciphertext; Decrypting the encrypted temporary key using the certificate private key, if the encrypted temporary key is encrypted by the certificate public key preset in the source code of the application, decrypting to obtain a temporary key randomly assigned to the service request of the application; Decrypting the ciphertext using the temporary key to obtain request data of the service request; Based on the request data, a response process is performed on the service request.

12. The method according to claim 11, characterized in that The temporary key includes a first subkey and a second subkey; the first subkey is used to decrypt the ciphertext; the network response request packet also includes a message authentication code; the method also includes: Using the second subkey, performing a digest operation on the encryption temporary key and the ciphertext to obtain an operation message authentication code; Comparing the calculated message authentication code with the message authentication code in the network response request packet for consistency; If the consistency comparison passes, the step of using the temporary key to decrypt the ciphertext to obtain the request data of the business request is executed.

13. The method according to claim 11 or 12, characterized in that: The responding to the service request based on the request data includes: Determining a service processing device corresponding to the service request based on the request data; The service request is forwarded to the service processing device to perform service processing.

14. A data processing device, characterized in that: include: A processing unit, configured to, when detecting a service request initiated by an application, obtain a temporary key randomly assigned to the service request; The processing unit is further used to encrypt the temporary key using the certificate public key to obtain an encrypted temporary key; the certificate public key is preset in the source code of the application; the certificate private key corresponding to the certificate public key is stored in the server; The processing unit is further configured to encrypt the request data of the service request using the temporary key to obtain a ciphertext; The processing unit is further used to generate a network response request packet according to the encryption temporary key and the ciphertext; A sending unit is used to send the network response request packet to the server, where the network response request packet is used to request the server to respond to the service request.

15. A data processing device, characterized in that: include: A receiving unit, used for receiving a network response request packet sent by an application; The network response request packet includes an encrypted temporary key and a ciphertext; a processing unit, configured to decrypt the encrypted temporary key using a certificate private key, and if the encrypted temporary key is encrypted using a certificate public key preset in the source code of the application, decrypt the encrypted temporary key to obtain a temporary key randomly assigned to the service request of the application; The processing unit is further configured to use the temporary key to decrypt the ciphertext to obtain request data of the service request; The processing unit is further configured to perform response processing on the service request based on the request data.

16. A computer device, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the data processing method according to any one of claims 1 to 10 is executed, or the data processing method according to any one of claims 11 to 13 is executed.

17. A computer-readable storage medium, characterized in that: The computer storage medium stores a computer program, and when the computer program is executed by a processor, the data processing method according to any one of claims 1 to 10 is executed, or the data processing method according to any one of claims 11 to 13 is executed.

Images