CN115022027A - Data processing method, device, system, equipment and readable storage medium - Google Patents

Abstract

The present application discloses a data processing method, apparatus, system, device and readable storage medium in the field of computer technology. In this application, after the end with the negotiation center receives the negotiation message including the encryption algorithm set used by the end sent by the end without the negotiation center, it selects the encryption algorithm set that can be used by both ends and has the highest security priority. Target encryption algorithm; send the target encryption algorithm and the randomly selected key generation rule to the end without a negotiation center, and the end without a negotiation center uses the key generation rule to determine the key from the target string, and uses the target encryption The algorithm and key encrypt the data to obtain the data ciphertext, and send the data ciphertext to the end with the negotiation center. This application can guarantee the randomness of encryption algorithms and key generation rules, and improve the security of data during transmission. The data processing apparatus, system, device and readable storage medium provided by the present application also have the above technical effects.

Description

A data processing method, apparatus, system, device and readable storage medium

technical field

The present application relates to the field of computer technology, and in particular, to a data processing method, apparatus, system, device, and readable storage medium.

Background technique

Currently, the data that needs to be persistently stored is generally stored in the database, and these data inevitably need to be accessed. If there is no secure data transmission mechanism, illegal users may illegally steal data in the database. Therefore, the security of the data transmission channel between the client of the database and the local database is particularly important. Although the data transmitted between this client and the local database can currently be encrypted, the encryption key is easy to be stolen.

Therefore, how to improve the security of data transmission between two ends is a problem to be solved by those skilled in the art.

SUMMARY OF THE INVENTION

In view of this, the purpose of this application is to provide a data processing method, apparatus, system, device and readable storage medium, so as to improve the security of data transmission between two ends. Its specific plan is as follows:

In a first aspect, the present application provides a data processing method, which is applied to one end with a negotiation center, including:

receiving a negotiation message sent by the end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center;

Selecting the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the encryption algorithm set;

Randomly select a key generation rule, and send the target encryption algorithm and the key generation rule to the end without a negotiation center, so that the end without a negotiation center uses the key to generate The rule determines the key from the target string, encrypts the target data with the target encryption algorithm and the key to obtain a data ciphertext, and sends the data ciphertext to the end provided with the negotiation center.

Optionally, after the end without the negotiation center sends the data ciphertext to the end with the negotiation center, the method further includes:

Determine the key from the target string using the key generation rule;

Decrypt the data ciphertext by using the decryption algorithm corresponding to the key and the target encryption algorithm to obtain the target data;

processing the target data to obtain a processing result;

Encrypt the processing result with the target encryption algorithm and the key to obtain a result ciphertext, and send the resultant ciphertext to the end without a negotiation center.

Optionally, also include:

If the negotiation message sent by the end without the negotiation center is received again, select the encryption algorithm set included in the current negotiation message that can be used by the end with the negotiation center, has the highest security priority, and is compatible with all encryption algorithms. The encryption algorithm described in the target encryption algorithm is different.

Optionally, also include:

If there are more than one encryption algorithm selected, select one at random.

Optionally, also include:

Encrypt a new string with the key and the target encryption algorithm to obtain a string ciphertext, and send the string ciphertext to the end without a negotiation center, so that the end without a negotiation center Decrypt the character string ciphertext by using the key and the decryption algorithm corresponding to the target encryption algorithm to obtain the new character string, and use the key generation rule to determine a new key from the new character string.

Optionally, the new character string is submitted to the negotiation center by the user.

In a second aspect, the present application provides a data processing device, which is applied to one end with a negotiation center, including:

a receiving module, configured to receive a negotiation message sent by an end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center;

a selection module, configured to select a target encryption algorithm that can be used by the end provided with the negotiation center and has the highest security priority from the encryption algorithm set;

The synchronization module is used to randomly select a key generation rule, and send the target encryption algorithm and the key generation rule to the end without a negotiation center, so that the end without a negotiation center can use the The key generation rule determines the key from the target string, encrypts the target data with the target encryption algorithm and the key to obtain a data ciphertext, and sends the data ciphertext to the end with the negotiation center .

Optionally, also include:

Returning module, used for determining the key from the target string by using the key generation rule after the end without the negotiation center sends the data ciphertext to the end with the negotiation center ; Utilize the decryption algorithm corresponding to the key and the target encryption algorithm to decrypt the data ciphertext to obtain the target data; Process the target data to obtain a processing result; Use the target encryption algorithm and the encryption The key encrypts the processing result to obtain a result ciphertext, and sends the resultant ciphertext to the end without the negotiation center.

Optionally, also include:

The randomness guarantee module is configured to select, from the set of encryption algorithms included in the current negotiation message, which can be used by the end with the negotiation center, if the negotiation message sent by the end without the negotiation center is received again. The encryption algorithm with the highest priority and different from the target encryption algorithm.

Optionally, also include:

The key changing module is configured to encrypt a new character string with the key and the target encryption algorithm to obtain a character string ciphertext, and send the character string ciphertext to the end without a negotiation center, so that the The end that does not have a negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain the new string, and use the key generation rule to extract the new string from the new string. Determine the new key.

In a third aspect, the present application provides a data processing system, comprising: a first end and a second end, the first end or the second end is provided with a negotiation center, and the end provided with the negotiation center is used for performing the above The method of any one. The end with the negotiation center is specifically used to: receive the negotiation message sent by the end without the negotiation center; the negotiation message includes the encryption algorithm set used by the end without the negotiation center; Select the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the set; randomly select a key generation rule, and send the target encryption algorithm and the key generation rule to the One end with a negotiation center, so that the end without a negotiation center uses the key generation rule to determine the key from the target string, and encrypts the target data with the target encryption algorithm and the key to obtain Data cipher text, send the data cipher text to the end provided with the negotiation center.

Optionally, the end provided with the negotiation center is specifically used for: after the end without the negotiation center sends the data ciphertext to the end provided with the negotiation center, the method further includes: generating using the key The rule determines the key from the target string; decrypts the data ciphertext by using the key and a decryption algorithm corresponding to the target encryption algorithm to obtain the target data; processes the target data to obtain Processing result; encrypting the processing result with the target encryption algorithm and the key to obtain a result ciphertext, and sending the resultant ciphertext to the end without a negotiation center.

Optionally, the end with the negotiation center is specifically configured to: if the negotiation message sent by the end without the negotiation center is received again, select from the set of encryption algorithms included in the current negotiation message that can be One end of the negotiation center uses the encryption algorithm with the highest security priority and different from the target encryption algorithm.

Optionally, the end with the negotiation center is specifically used for: if there are multiple selected encryption algorithms, randomly select one.

Optionally, the end with the negotiation center is specifically used for: encrypting a new string with the key and the target encryption algorithm to obtain a string ciphertext, and sending the string ciphertext to the non-negotiating center. so that the end that does not have a negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain the new string, and use the encryption The key generation rule determines the new key from the new string.

In a fourth aspect, the present application provides an electronic device, comprising:

memory for storing computer programs;

A processor for executing the computer program to implement the data processing method disclosed above.

In a fifth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the data processing method disclosed above when executed by a processor.

It can be seen from the above solutions that the present application provides a data processing method, which is applied to an end with a negotiation center, including: receiving a negotiation message sent by an end without a negotiation center; the negotiation message includes the The set of encryption algorithms used by one end of the center; the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority is selected from the set of encryption algorithms; the key generation rule is randomly selected, and the target The encryption algorithm and the key generation rule are sent to the end without a negotiation center, so that the end without a negotiation center uses the key generation rule to determine the key from the target string, and uses The target encryption algorithm and the key encrypt the target data to obtain a data ciphertext, and the data ciphertext is sent to the end provided with the negotiation center.

It can be seen that, based on the negotiation center, the present application synchronizes the encryption algorithm and the key generation rule between the two ends that need to communicate, so that the two ends that need to communicate complete the synchronization of the encryption algorithm and the encryption key. Among them, the end with the negotiation center selects the target encryption algorithm that can be used by both ends and has the highest security priority from the set of encryption algorithms used by the end that does not have the negotiation center, which can not only complete the synchronization of encryption algorithms, but also The encryption security priority of the selected encryption algorithm is maintained at a high level, thereby improving the security of data transmission between the two. At the same time, the random selection of the key generation rule at the end with the negotiation center can ensure the randomness of the encryption key, thereby improving the security of the encryption key. It can be seen that the real encryption key is not transmitted between the two, but only the encryption algorithm and key generation rules are transmitted. Therefore, even if the third party steals the encryption algorithm and key generation rules, the third party cannot steal the communication between the two parties. The transmitted native data improves the security of the native data during transmission.

Correspondingly, a data processing apparatus, system, device and readable storage medium provided by the present application also have the above technical effects.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

1 is a flowchart of a data processing method disclosed in the application;

2 is a schematic flow chart of a channel establishment disclosed in the application;

3 is a schematic diagram of a data processing apparatus disclosed in the application;

4 is a schematic diagram of a data processing system disclosed in the application;

FIG. 5 is a schematic diagram of an electronic device disclosed in this application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

At present, the data that needs to be persistently stored is generally stored in the database, and these data inevitably need to be accessed. If there is no secure data transmission mechanism, illegal users may illegally steal data in the database. Therefore, the security of the data transmission channel between the client of the database and the local database is particularly important. Although the data transmitted between this client and the local database can currently be encrypted, the encryption key is easy to be stolen. To this end, the present application provides a data processing solution, which can improve the security of data transmission between two ends.

Referring to FIG. 1 , an embodiment of the present application discloses a data processing method, which is applied to one end with a negotiation center, including:

S101. Receive a negotiation message sent by the end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center.

In this embodiment, the end with the negotiation center may be the server, and then the end without the negotiation center is the client of the server. For example, one end with a negotiation center is a database, a distributed storage system, and so on. Of course, the negotiation center can also be set at the client, that is, the end with the negotiation center is the client, and the end without the negotiation center is the server of the client. A database is a "warehouse that organizes, stores and manages data according to data structures", and is a collection of large amounts of data that is organized, shared, and managed in a long-term computer.

The set of encryption algorithms used by the end without the negotiation center is specified by the user of the end. For example, the user at the end without the negotiation center specifies algorithms such as AES, DES, 3DES, Blowfish, IDEA, RC4, RC5, and RC6 to form an encryption algorithm set. In this embodiment, a symmetric encryption algorithm with less computation load is preferentially selected. In an example, the encryption algorithm set includes M algorithms by default, and the user is allowed to add, delete, or modify algorithms in the encryption algorithm set subsequently.

In the symmetric encryption algorithm, the sender of the data processes the plaintext and the encryption key together with a special encryption algorithm to turn it into a complex encrypted ciphertext and sends it out. In the original text, the ciphertext needs to be decrypted using the key used for encryption and the inverse algorithm of the same encryption algorithm, so that it can be returned to readable plaintext. In the symmetric encryption algorithm, only one key is used, and both the sender and the receiver use this key, which requires the decryptor to know the encryption key in advance. Therefore, the key synchronization is performed in this embodiment, that is, the encryption algorithm and the key generation rule are synchronized.

S102. Select a target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the encryption algorithm set.

Generally, the set of encryption algorithms supported and used by the end with the negotiation center is equal to the set of encryption algorithms used by the end without the negotiation center. The set of encryption algorithms used by the end without a negotiation center may also be a subset of the set of encryption algorithms supported by the end with a negotiation center. Of course, it may also happen that a certain encryption algorithm supported by the end without a negotiation center is not supported by the end with a negotiation center. In this case, the end with a negotiation center can be prompted to add the algorithm. For example: the user at the end with the negotiation center manually adds the algorithm at the end.

Wherein, this embodiment sets a security priority for each algorithm according to the security level of each algorithm. Suppose two security priorities are set: high (represented by label 1) and low (represented by label 2), and then each algorithm is labeled with the corresponding security priority. For example: label 1 for AES, DES, and 3DES, and label 2 for Blowfish and IDEA. The security priority label of each algorithm is configured by the user.

In an example, it is assumed that the set of encryption algorithms in the negotiation message sent by the end without the negotiation center is: AES, DES, 3DES, IDEA, and the set is a set of encryption algorithms supported by the end with the negotiation center. subset, it means that the algorithm with the highest security priority can be selected from the set. According to the security priority of the above example, "AES, DES, 3DES" are all high priorities. At this time, one of AES, DES, and 3DES is randomly selected as the target encryption algorithm to ensure the randomness of the encryption algorithm.

If the negotiation message sent by the end without the negotiation center is received again, the encryption algorithm set that can be used by the end with the negotiation center and has the highest security priority and is different from the target encryption algorithm is selected from the set of encryption algorithms included in the current negotiation message. Encryption Algorithm. This ensures that the encryption algorithm selected this time is different from the encryption algorithm selected last time, thereby ensuring the randomness of the encryption algorithm.

In a specific implementation manner, if there are multiple selected encryption algorithms, one is randomly selected.

S103. Randomly select a key generation rule, and send the target encryption algorithm and key generation rule to the end without a negotiation center, so that the end without a negotiation center can use the key generation rule to determine the encryption key from the target string. and encrypt the target data with the target encryption algorithm and the key to obtain the data ciphertext, and send the data ciphertext to the end with the negotiation center.

It should be noted that the end provided with the negotiation center includes a rule base, and the rule base includes a plurality of key generation rules, so the key generation rules can be randomly selected from the preset rule base. Exemplarily, the key generation rule may be: truncate the first N characters as the key, or truncate the last N characters as the key, or the like. After the two communicating parties obtain the key generation rules, both parties can determine the key from the target string. The target string can be the account + password used for access. During the first negotiation, both parties use the default string (such as account + password) as the target string.

Of course, the target string can be modified by the user at the end with the negotiation center. The modification process includes: the end with the negotiation center encrypts the new string with the key and the target encryption algorithm to obtain the ciphertext of the string, and sends the ciphertext of the string to The end without a negotiation center, so that the end without a negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain a new string. Determine the new key. In a specific implementation, the new character string is submitted to the negotiation center by the user at the end with the negotiation center. Among them, the new string is transmitted in the form of cipher text, which can ensure its security.

In a specific implementation manner, after the end without the negotiation center sends the data ciphertext to the end with the negotiation center, the method further includes: the end with the negotiation center uses the key generation rule to determine the key from the target string ; Decrypt the data ciphertext using the decryption algorithm corresponding to the key and the target encryption algorithm to obtain the target data; process the target data to obtain the processing result; use the target encryption algorithm and the key encryption processing result to obtain the result ciphertext, and send the result ciphertext to The end that does not have a negotiation center. Of course, the end with the negotiation center can also actively send data to the end without the negotiation center. The specific sending process is as follows: the end with the negotiation center uses the target encryption algorithm and key to encrypt the data to be sent to obtain the data ciphertext, and send Data ciphertext to the end that does not have a negotiation center.

It can be seen that, based on the negotiation center, in this embodiment, the two ends that need to communicate can synchronize the encryption algorithm and the key generation rule, so that the two ends that need to communicate can complete the synchronization of the encryption algorithm and the encryption key. Among them, the end with the negotiation center selects the target encryption algorithm that can be used by both ends and has the highest security priority from the set of encryption algorithms used by the end that does not have the negotiation center, which can not only complete the synchronization of encryption algorithms, but also The encryption security priority of the selected encryption algorithm is maintained at a high level, thereby improving the security of data transmission between the two. At the same time, the random selection of the key generation rule at the end with the negotiation center can ensure the randomness of the encryption key, thereby improving the security of the encryption key. It can be seen that the real encryption key is not transmitted between the two, but only the encryption algorithm and key generation rules are transmitted. Therefore, even if the third party steals the encryption algorithm and key generation rules, the third party cannot steal the communication between the two parties. The transmitted native data improves the security of the native data during transmission.

The following embodiments further introduce the present application by taking the communication between the database server and its client as an example.

First of all, we need to be clear that there are many types of databases, but they all have their own servers and clients. For communication between the two, a channel must be established first. For the client, we can understand it as the end that sends instructions to the server, and it does not store data. The server is the end that executes the instruction, and it needs to process and store the data.

Generally speaking, the client and server can be on the same host or on different hosts, which can be determined according to the specific business. Generally, a dedicated physical server can be used as a database server to store necessary data, and the database client is placed with its own business. Therefore, putting the client and server of the database on the same host does not make much sense, but it should be noted that the establishment of the channel does not pay attention to whether the client and the server are on the same host, as long as it is If the client and the server have data interaction, there must be a channel. Therefore, it is necessary to establish a transmission channel between the client and the server.

In order to ensure the security of data in the channel, this embodiment establishes a transmission channel between the server and the client according to the following scheme. For details, please refer to FIG. 2 . As shown in Figure 2, an abstract component is first added to the server as the negotiation center. When the client establishes a connection with the server, the client first "communicates" with the negotiation center. The main purpose of this "communication" is to tell the service Which symmetric encryption algorithms are supported by the terminal itself. After receiving some encryption algorithms sent by the client, the negotiation center can select the encryption algorithm with relatively high security and also supported by itself, and then generate the name of the selected encryption algorithm and the key randomly selected this time. The rules are sent to the client. After the client receives the key generation rules and encryption algorithm, it generates the key for this transmission, and the client can use the key and encryption algorithm to encrypt the data and send it, so far the encryption channel is successfully established.

Of course, since the negotiation center is in the server, the server must know the key generation rules and encryption algorithms. After receiving the encrypted data sent by the client, the server can decrypt it according to the encryption algorithm and key. The server decrypts and processes the decrypted results, and then encrypts the corresponding data processing results before sending them to the client. After the client receives the data ciphertext sent by the server, it decrypts it.

Among them, the negotiation center of the server has built-in many common symmetric encryption algorithms, such as: AES, DES, 3DES, Blowfish, IDEA, RC4, RC5, RC6, but not limited to this type of algorithm. The "communication" content between the client and the negotiation center is: negotiate the current key generation rules and the current encryption algorithm. Specifically, the default character is processed based on the key generation rule to obtain the current key. For example: the default string is: username + password. If the user name is username, the password is password. The default string is usernamepassword. Of course, the default character can also be configured to other characters, but both the client and the server need to know this character. Of course, the negotiation center does not have to be on the server side, but can also be on the client side. If it is on the client side, the implementation steps can be adjusted accordingly.

It should be noted that each time an encrypted connection channel is established, the selected key generation rules are not uniform. For example, the rule for a certain time can be the 2nd to 9th characters of the default characters, and the rule for the next time. In order to take the 1st, 2nd, 5th, 6th, and 9th characters, it can be seen that the key generation rule can be set randomly, and the key generation rule selected this time is different from the previous key generation rule.

The reason why the symmetric encryption algorithm is selected in this embodiment is that the encryption and decryption efficiency of the asymmetric encryption algorithm is low, and it is not applicable between the database server and the client. Because in the database application scenario, there is usually a lot of interaction between the server and the client, so the efficiency of asymmetric encryption cannot be accepted by the database access scenario. In this embodiment, by default, the character string used to determine the password is the user name plus the password, and of course, it can also be configured as other character strings.

It should be noted that the encryption policy library can be set in the negotiation center. In the encryption policy library, each encryption has a security priority set in advance. The encryption policy library can be presented according to the following structure:

1: AES, DES, 3DES;

2: Blowfish, IDEA;

Among them, 1 and 2 represent two different security priorities, and the smaller the number is, the priority is to select the encryption algorithm in this level. The algorithm corresponding to the priority here can be configured by the user.

It should be noted that the encryption algorithm selected by the same client and server during each negotiation may be different. For example, a client sends negotiation information that supports AES, DES, and 3DES, and then the server selects 3DES. For the next negotiation information sent by the client, the server selects AES, so that the algorithm at the same security level can be implemented. random selection.

Further, when the user wants to change the default string, it needs to be modified in the "Negotiation Center". After the modification is completed, the "Negotiation Center" will send a change command to the client. At this time, the new string will be encrypted by the currently negotiated key and encryption algorithm and then transmitted to the client, and the client will decrypt and get the new string to change the key. For example: the new string is username, the current target string is usernamepassword, and the new string is encrypted and transmitted to the client through the current key and the current encryption algorithm. After the client receives and decrypts the new string, it re-determines the encryption key from the new string userword based on the original key generation rule, and replies to the server with a notification message that the key has been changed. The next time the data is transferred, both parties will use the new key to encrypt the data. The previous usernamepassword will be discarded.

It can be seen that this embodiment establishes a transmission channel between the server and the client based on the negotiation center, synchronizes this key generation rule and this encryption algorithm in the process, and uses the key generation rule to determine encryption during data transmission. The key is encrypted, and data encryption is performed to prevent illegal users from obtaining original data by stealing, thereby ensuring the security of data during transmission.

The following describes a data processing apparatus provided by an embodiment of the present application, and a data processing apparatus described below and a data processing method described above can be referred to each other.

Referring to FIG. 3 , an embodiment of the present application discloses a data processing apparatus, which is applied to one end with a negotiation center, including:

A receiving module 301, configured to receive a negotiation message sent by an end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center;

A selection module 302, configured to select a target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the encryption algorithm set;

The synchronization module 303 is used to randomly select the key generation rule, and send the target encryption algorithm and the key generation rule to the end without the negotiation center, so that the end without the negotiation center uses the key generation rule to convert the target character from the target character. The key is determined in the string, and the target data is encrypted by the target encryption algorithm and the key to obtain the data ciphertext, and the data ciphertext is sent to the end with the negotiation center.

In a specific embodiment, it also includes:

The return module is used for the end without a negotiation center to send the data ciphertext to the end with a negotiation center, and then use the key generation rule to determine the key from the target string; use the key and the decryption algorithm corresponding to the target encryption algorithm Decrypt the data ciphertext to obtain the target data; process the target data to obtain the processing result; use the target encryption algorithm and the key encryption processing result to obtain the resultant ciphertext, and send the resultant ciphertext to the end without a negotiation center.

In a specific embodiment, it also includes:

The randomness guarantee module is used to select, from the set of encryption algorithms included in the current negotiation message, the end that can be used by the end with the negotiation center, the highest security priority, and the and an encryption algorithm that is different from the target encryption algorithm.

In a specific embodiment, it also includes:

The key change module is used to encrypt a new string with the key and the target encryption algorithm to obtain a string ciphertext, and send the string ciphertext to the end without a negotiation center, so that the end without a negotiation center can use the key The decryption algorithm corresponding to the target encryption algorithm decrypts the ciphertext of the string to obtain a new string, and uses the key generation rule to determine the new key from the new string.

For the more specific working process of each module and unit in this embodiment, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen that this embodiment provides a data processing device. Based on the negotiation center, the device synchronizes the encryption algorithm and the key generation rule between the two ends that need to communicate, so that the two ends that need to communicate complete the encryption algorithm and the encryption key. synchronization. Among them, the end with the negotiation center selects the target encryption algorithm that can be used by both ends and has the highest security priority from the set of encryption algorithms used by the end that does not have the negotiation center, which can not only complete the synchronization of encryption algorithms, but also The encryption security priority of the selected encryption algorithm is maintained at a high level, thereby improving the security of data transmission between the two. At the same time, the random selection of the key generation rule at the end with the negotiation center can ensure the randomness of the encryption key, thereby improving the security of the encryption key. It can be seen that the real encryption key is not transmitted between the two, but only the encryption algorithm and key generation rules are transmitted. Therefore, even if the third party steals the encryption algorithm and key generation rules, the third party cannot steal the communication between the two parties. The transmitted native data improves the security of the native data during transmission.

A data processing system provided by an embodiment of the present application is introduced below, and a data processing system described below and a data processing method and apparatus described above can be referred to each other.

Referring to FIG. 4 , an embodiment of the present application discloses a data processing system, including: a first end and a second end, the first end or the second end is provided with a negotiation center, and the end provided with the negotiation center is used to execute the above any of the methods. The end with the negotiation center is specifically used for: receiving the negotiation message sent by the end without the negotiation center; the negotiation message includes the encryption algorithm set used by the end without the negotiation center; The end with the negotiation center uses the target encryption algorithm with the highest security priority; randomly selects the key generation rules, and sends the target encryption algorithm and key generation rules to the end without the negotiation center, so that there is no negotiation center. The one end uses the key generation rule to determine the key from the target string, and uses the target encryption algorithm and the key to encrypt the target data to obtain the data ciphertext, and sends the data ciphertext to the end with the negotiation center.

In a specific embodiment, the end with the negotiation center is specifically used for: after the end without the negotiation center sends the data ciphertext to the end with the negotiation center, it also includes: using the key generation rule to generate the target character from the target character Determine the key in the string; use the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the data ciphertext to obtain the target data; process the target data to obtain the processing result; use the target encryption algorithm and the key encryption processing result to obtain the result ciphertext, Send the resulting ciphertext to the end that does not have a negotiation center.

In a specific implementation manner, the end with the negotiation center is specifically used for: if the negotiation message sent by the end without the negotiation center is received again, select from the encryption algorithm set included in the current negotiation message that can be set with the negotiation center. One end of the negotiation center uses the encryption algorithm with the highest security priority and different from the target encryption algorithm.

In a specific implementation manner, the end provided with the negotiation center is specifically used for: if there are multiple selected encryption algorithms, randomly select one.

In a specific embodiment, the end with the negotiation center is specifically used for: encrypting a new string with a key and a target encryption algorithm to obtain a string ciphertext, and sending the string ciphertext to the end without a negotiation center, to The end that does not have a negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain a new string, and use the key generation rule to determine the new key from the new string.

It can be seen that this embodiment provides a data processing device, the system can synchronize encryption algorithms and key generation rules between two ends that need to communicate, so that the two ends that need to communicate can synchronize encryption algorithms and encryption keys. Among them, the end with the negotiation center selects the target encryption algorithm that can be used by both ends and has the highest security priority from the set of encryption algorithms used by the end without the negotiation center, which can not only complete the synchronization of encryption algorithms, but also The encryption security priority of the selected encryption algorithm is maintained at a high level, thereby improving the security of data transmission between the two. At the same time, the random selection of the key generation rule at the end with the negotiation center can ensure the randomness of the encryption key, thereby improving the security of the encryption key. It can be seen that the real encryption key is not transmitted between the two, but only the encryption algorithm and key generation rules are transmitted. Therefore, even if the third party steals the encryption algorithm and key generation rules, the third party cannot steal the communication between the two parties. The transmitted native data improves the security of the native data during transmission.

An electronic device provided by an embodiment of the present application is introduced below. An electronic device described below and a data processing method and apparatus described above can be referred to each other.

Referring to FIG. 5 , an embodiment of the present application discloses an electronic device, including:

Memory 501, used to save computer programs;

The processor 502 is configured to execute the computer program to implement the method disclosed in any of the foregoing embodiments.

In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: receiving a negotiation message sent by the end without a negotiation center; the negotiation message includes the end without a negotiation center. The set of encryption algorithms used; select the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the set of encryption algorithms; randomly select the key generation rule, and send the target encryption algorithm and key generation rule to The end without a negotiation center enables the end without a negotiation center to determine the key from the target string using the key generation rule, and encrypt the target data with the target encryption algorithm and the key to obtain the data ciphertext, and send the data encrypted. Wenzhi has the end of the consultation center.

In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: determining the key from the target character string by using the key generation rule; using the key corresponding to the target encryption algorithm The decryption algorithm decrypts the data ciphertext to obtain the target data; processes the target data to obtain the processing result; uses the target encryption algorithm and the key encryption processing result to obtain the resultant ciphertext, and sends the resultant ciphertext to the end without a negotiation center.

In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: if the negotiation message sent by the end without the negotiation center is received again, the current negotiation message includes the following steps: From the encryption algorithm set, select the encryption algorithm that can be used by the end with the negotiation center, has the highest security priority, and is different from the target encryption algorithm.

In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: if there are multiple selected encryption algorithms, one is randomly selected.

In this embodiment, when the processor executes the computer program stored in the memory, the following steps may be specifically implemented: encrypting a new string with a key and a target encryption algorithm to obtain a string ciphertext, and sending the string ciphertext to The end without a negotiation center, so that the end without a negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain a new string. Determine the new key.

A readable storage medium provided by an embodiment of the present application is introduced below. A readable storage medium described below and a data processing method, apparatus, and device described above can be referred to each other.

A readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the data processing methods disclosed in the foregoing embodiments are implemented. For the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

In this embodiment, the computer program executed by the processor may specifically implement the following steps: receiving a negotiation message sent by the end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center; Select the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the encryption algorithm set; randomly select the key generation rule, and send the target encryption algorithm and key generation rule to the end without the negotiation center. One end, so that the end without the negotiation center uses the key generation rule to determine the key from the target string, and uses the target encryption algorithm and the key to encrypt the target data to obtain the data ciphertext, and sends the data ciphertext to the negotiation center. one end.

In this embodiment, the computer program executed by the processor may specifically implement the following steps: determining the key from the target character string by using the key generation rule; Decrypt to obtain the target data; process the target data to obtain the processing result; use the target encryption algorithm and the key to encrypt the processing result to obtain the resulting ciphertext, and send the resulting ciphertext to the end that does not have a negotiation center.

In this embodiment, the computer program executed by the processor may specifically implement the following steps: if the negotiation message sent by the end that does not have a negotiation center is received again, select a set of encryption algorithms that can be included in the current negotiation message. An encryption algorithm that is used by the side with the negotiation center, has the highest security priority, and is different from the target encryption algorithm.

In this embodiment, the computer program executed by the processor may specifically implement the following steps: if there are multiple selected encryption algorithms, randomly select one.

In this embodiment, the computer program executed by the processor may specifically implement the following steps: encrypting a new string with a key and a target encryption algorithm to obtain a string ciphertext, and sending the string ciphertext to a non-negotiating center One end, so that the end without the negotiation center uses the key and the decryption algorithm corresponding to the target encryption algorithm to decrypt the ciphertext of the string to obtain a new string, and use the key generation rule to determine the new key from the new string.

References in this application to "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used can be interchanged under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method or apparatus comprising a series of steps or elements is not necessarily limited to those steps or elements expressly listed , but may include other steps or elements not expressly listed or inherent to these processes, methods or apparatus.

It should be noted that the descriptions involving "first", "second", etc. in this application are only for the purpose of description, and should not be construed as indicating or implying their relative importance or implying the number of indicated technical features . Thus, a feature delimited with "first", "second" may expressly or implicitly include at least one of that feature. In addition, the technical solutions between the various embodiments can be combined with each other, but must be based on the realization by those of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of such technical solutions does not exist. , is not within the scope of protection claimed in this application.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. A software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other form of readable storage medium that is well known.

The principles and implementations of the present application are described herein by using specific examples. The descriptions of the above embodiments are only used to help understand the methods and core ideas of the present application. There will be changes in the specific implementation and application scope. To sum up, the content of this specification should not be construed as a limitation to the application.

Claims (10)

1. a data processing method, is characterized in that, is applied to be provided with one end of the negotiation center, comprising: receiving a negotiation message sent by the end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center; Selecting the target encryption algorithm that can be used by the end with the negotiation center and has the highest security priority from the encryption algorithm set; Randomly select a key generation rule, and send the target encryption algorithm and the key generation rule to the end without a negotiation center, so that the end without a negotiation center uses the key to generate The rule determines the key from the target string, encrypts the target data with the target encryption algorithm and the key to obtain a data ciphertext, and sends the data ciphertext to the end provided with the negotiation center. 2. The method according to claim 1, wherein after the end without a negotiation center sends the data ciphertext to the end with a negotiation center, the method further comprises: Determine the key from the target string using the key generation rule; Decrypt the data ciphertext by using the decryption algorithm corresponding to the key and the target encryption algorithm to obtain the target data; processing the target data to obtain a processing result; Encrypt the processing result with the target encryption algorithm and the key to obtain a result ciphertext, and send the resultant ciphertext to the end without a negotiation center. 3. The method of claim 1, further comprising: If the negotiation message sent by the end without the negotiation center is received again, select the encryption algorithm set included in the current negotiation message that can be used by the end with the negotiation center, has the highest security priority, and is compatible with all encryption algorithms. The encryption algorithm described in the target encryption algorithm is different. 4. The method of claim 3, further comprising: If there are more than one encryption algorithm selected, select one at random. 5. The method according to any one of claims 1 to 4, characterized in that, further comprising: Encrypt a new string with the key and the target encryption algorithm to obtain a string ciphertext, and send the string ciphertext to the end without a negotiation center, so that the end without a negotiation center Decrypt the character string ciphertext by using the key and the decryption algorithm corresponding to the target encryption algorithm to obtain the new character string, and use the key generation rule to determine a new key from the new character string. 6. The method of claim 5, wherein the new character string is submitted to the negotiation center by a user. 7. A data processing device, characterized in that it is applied to one end provided with a negotiation center, comprising: a receiving module, configured to receive a negotiation message sent by an end without a negotiation center; the negotiation message includes an encryption algorithm set used by the end without a negotiation center; a selection module, configured to select a target encryption algorithm that can be used by the end provided with the negotiation center and has the highest security priority from the encryption algorithm set; The synchronization module is used to randomly select a key generation rule, and send the target encryption algorithm and the key generation rule to the end without a negotiation center, so that the end without a negotiation center can use the The key generation rule determines the key from the target string, encrypts the target data with the target encryption algorithm and the key to obtain a data ciphertext, and sends the data ciphertext to the end with the negotiation center . 8. A data processing system, characterized in that it comprises: a first end and a second end, the first end or the second end is provided with a negotiation center, and the end provided with the negotiation center is used for performing the process as claimed in the claims The method of any one of 1 to 6. 9. An electronic device, characterized in that, comprising: memory for storing computer programs; A processor for executing the computer program to implement the method according to any one of claims 1 to 6. 10. A readable storage medium, characterized by being used for storing a computer program, wherein the computer program implements the method according to any one of claims 1 to 6 when the computer program is executed by a processor.

Images