WO2021022701A1

WO2021022701A1 - Information transmission method and apparatus, client terminal, server, and storage medium

Info

Publication number: WO2021022701A1
Application number: PCT/CN2019/116768
Authority: WO
Inventors: 林伟彬
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-08-08
Filing date: 2019-11-08
Publication date: 2021-02-11
Also published as: CN110460439A

Abstract

Provided in the present application is an information transmission method, the method using an RSA public key to encrypt login information when a user logs in to a service system and then transmitting same to a server, and implementing information transmission after confirmation information is encrypted with a first AES key and original packets of a service request are encrypted with a second AES key, thereby implementing information transmission using a method of combined asymmetric (RSA) and symmetric (AES) encryption. The symmetric encryption is beneficial for increasing the speed of information transmission, and the asymmetric encryption ensures high information security. Thus, key information (such as the login information) can be transmitted by means of asymmetric encryption, and non-key information (such as the confirmation information) can be transmitted by means of symmetric encryption, achieving the effect of increasing information transmission efficiency and improving information security. Also provided in the present application are an information transmission apparatus, a client terminal, a server, and a storage medium.

Description

Information transmission method, device, client, server and storage medium

This application requires priority to be submitted to the Chinese Patent Office on August 8, 2019. The application number is 201910729055.9. The application titled "Information Transmission Method, Device, Client, Server, and Storage Medium" is the priority of the Chinese patent application, all of which are approved The reference is incorporated in this application.

Technical field

This application relates to the field of computer technology, in particular to an information transmission method, device, client, server and storage medium.

Background technique

In the prior art, when information is transmitted in a network, the dual problems of slow transmission speed and low security are faced. Sometimes in order to take into account the speed of information transmission, the security of information transmission is ignored, and the transmission content is easily monitored by hackers; sometimes the transmission efficiency is ignored for the sake of high security, which brings a bad experience to users. In this way, it is impossible to ensure both security and transmission speed during information transmission.

Summary of the invention

In view of the above, it is necessary to propose an information transmission method, device, client, server, and storage medium for testing, which can solve the problem of security and transmission speed cannot be guaranteed during information transmission.

An information transmission method applied to a client, the client communicates with a server, and the method includes: sending request information to the server to obtain an RSA public key; receiving login information for accessing a business system, and generating a first An AES key; the login information and the first AES key are encrypted by the RSA public key, and the encrypted information is sent to the server, so that the server confirms that the login information is accurate Generate confirmation information and the second AES key; receive the encrypted confirmation information and the second AES key sent by the server; decrypt the encrypted confirmation information and the second AES key by the first AES key Obtain a second AES key; receive a service request for access to the service system; encrypt the original message of the service request by the second AES key, and send the encrypted original message to the server, The server generates a response message after processing the service request according to the original message.

An information transmission method applied to a server, the server communicates with a client, and the method includes: receiving request information sent by the client, and generating an RSA public key and an RSA private key; sending the RSA public key Key to the client; receive the login information and the first AES key encrypted by the RSA public key from the client; decrypt the login information and the first AES key by the RSA private key; confirm the Whether the login information is accurate; generate confirmation information and a second AES key when the login information is accurate; encrypt the confirmation information and the second AES key by the first AES key, and send the encrypted confirmation Information and the second AES key to the client; receive the original message of the service request encrypted by the second AES key, and generate a response message after processing the service request according to the original message; pass the second The AES key encrypts the response message, and sends the encrypted response message to the client.

An information transmission device, which runs in a client, and is connected to a server in communication. The device includes: a sending module for sending request information to the server to obtain an RSA public key; a receiving module for receiving Access the login information of the business system and generate the first AES key; the encryption module is used to encrypt the login information and the first AES key with the RSA public key, and send the encrypted information to the The server, which causes the server to generate confirmation information and a second AES key after confirming that the login information is accurate; the receiving module is also used to receive the encrypted confirmation information and the second AES key sent by the server; The decryption module is configured to decrypt the encrypted confirmation information and the second AES key using the first AES key to obtain a second AES key; the receiving module is also configured to receive access to the business system The service request; the encryption module is also used to encrypt the original message of the service request by the second AES key, and send the encrypted original message to the server, so that the server according to the The original message generates a response message after processing the service request.

An information transmission device runs in a server, and the server is in communication connection with a client. The device includes a receiving module for receiving request information sent by the client and generating an RSA public key and an RSA private key; The sending module is used to send the RSA public key to the client; the receiving module is also used to receive the login information encrypted by the RSA public key and the first AES key sent by the client; the decryption module, It is used to decrypt the login information and the first AES key by the RSA private key; the confirmation module is used to confirm whether the login information is accurate; the generation module is used to generate the confirmation information and the first AES key when the login information is accurate. Two AES key; an encryption module for encrypting the confirmation information and the second AES key by the first AES key, and sending the encrypted confirmation information and the second AES key to the client The receiving module is also configured to receive the original message of the service request encrypted by the second AES key, and generate a response message after processing the service request according to the original message; the sending module also uses Yu encrypts the response message with the second AES key, and sends the encrypted response message to the client.

A client, the client is in communication connection with a server, the client includes a processor and a memory, and the processor is configured to execute at least one computer-readable instruction stored in the memory to implement the following steps: send request information to The server obtains the RSA public key; receives the login information for accessing the business system and generates the first AES key; encrypts the login information and the first AES key by the RSA public key, and encrypts Send the information of, to the server, so that the server generates confirmation information and a second AES key after confirming that the login information is accurate; receives the encrypted confirmation information and the second AES key sent by the server; Use the first AES key to decrypt the encrypted confirmation information and the second AES key to obtain a second AES key; receive a service request for access to the service system; use the second AES key pair The original message of the service request is encrypted, and the encrypted original message is sent to the server, so that the server generates a response message after processing the service request according to the original message.

A server, the server is in communication connection with the client, the server includes a processor and a memory, and the processor is configured to execute at least one computer-readable instruction stored in the memory to implement the following steps: And generate the RSA public key and the RSA private key; send the RSA public key to the client; receive the login information and the first AES key encrypted by the RSA public key from the client; The RSA private key decrypts the login information and the first AES key; confirms whether the login information is accurate; generates confirmation information and a second AES key when the login information is accurate; encrypts by the first AES key The confirmation information and the second AES key, and send the encrypted confirmation information and the second AES key to the client; receive the original message of the service request encrypted by the second AES key, according to The original message generates a response message after processing the service request; encrypts the response message with a second AES key, and sends the encrypted response message to the client.

A non-volatile readable storage medium, the non-volatile readable storage medium stores at least one computer readable instruction, and when the at least one computer readable instruction is executed by a processor, the following steps are implemented: sending request information To the server to obtain the RSA public key; receive the login information for accessing the business system, and generate the first AES key; encrypt the login information and the first AES key by the RSA public key, and encrypt The latter information is sent to the server, so that the server generates confirmation information and a second AES key after confirming that the login information is accurate; receives the encrypted confirmation information and the second AES key sent by the server Decrypt the encrypted confirmation information and the second AES key by the first AES key to obtain the second AES key; receive the service request for access to the service system; pass the second AES key Encrypt the original message of the service request, and send the encrypted original message to the server, so that the server generates a response message after processing the service request according to the original message.

A non-volatile readable storage medium storing at least one computer readable instruction, and when the at least one computer readable instruction is executed by a processor, the following steps are implemented:

Receive request information sent by the client, and generate an RSA public key and an RSA private key; send the RSA public key to the client; receive the login information encrypted by the RSA public key and the first AES secret sent by the client Key; decrypt the login information and the first AES key by the RSA private key; confirm whether the login information is accurate; generate the confirmation information and the second AES key when the login information is accurate; pass the first The AES key encrypts the confirmation information and the second AES key, and sends the encrypted confirmation information and the second AES key to the client; receiving the original service request encrypted by the second AES key Message, generating a response message after processing the service request according to the original message; encrypting the response message with a second AES key, and sending the encrypted response message to the client.

It can be seen from the above technical solutions that the information transmission method, device, client, server, and storage medium provided by this application first transmit key information (such as login information) through asymmetric encryption, and then transfer non-key information (such as confirmation information). ) Transmission through symmetric encryption, to achieve the effect of improving information transmission efficiency and improving information security.

Description of the drawings

FIG. 1 is a diagram of the application environment architecture of the information transmission method provided in the first embodiment of the present application.

Fig. 2 is a flowchart of a method for information transmission provided in the second embodiment of the present application.

Fig. 3 is a flowchart of a method for information transmission provided in the third embodiment of the present application.

FIG. 4 is a structural diagram of an information transmission device provided by Embodiment 4 of the present application.

FIG. 5 is a structural diagram of an information transmission device provided in Embodiment 5 of the present application.

FIG. 6 is a schematic diagram of a client provided in Embodiment 6 of the present application.

FIG. 7 is a schematic diagram of a server provided by Embodiment 7 of the present application.

detailed description

Example one

Refer to FIG. 1, which is a structural diagram of the application environment of the information transmission method provided in Embodiment 1 of this application.

The information transmission method used for testing of this application is applied in the environment formed by the client 1 and the server 2. The client 1 and the server 2 are connected through a wired or wireless network communication. The wired network can be any type of traditional wired communication, such as the Internet and a local area network. The wireless network can be any type of traditional wireless communication, such as radio, wireless fidelity (Wireless Fidelity, WIFI), cellular, satellite, broadcast, etc.

The client 1 may include a personal computer (Personal Computer, PC), a personal digital assistant (Personal Digital Assistant, PDA), a wireless handheld device, a tablet computer (Tablet Computer), a smart phone, etc. The foregoing client 1 is merely an example, not an exhaustive list, and includes but is not limited to the foregoing terminal. The client 1 can interact with the user through a keyboard, a mouse, a remote control, a touch panel, or a voice control device.

In this embodiment, a business system is installed on the client 1, and when a user needs to perform business processing through the business system, the client 1 can send a business request to the server 2 through the business system. The server 2 may be a banking system server, such as a Ping An Banking system server.

The server 2 is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Its hardware includes, but is not limited to, a microprocessor, an application specific integrated circuit (application license Specific Integrated Circuit). , ASIC), programmable gate array (Field-Programmable Gate Array, FPGA), digital processor (Digital Signal Processor, DSP), embedded equipment, etc.

Example two

Fig. 2 is a flowchart of the information transmission method provided in the second embodiment of the present application.

In this embodiment, the information transmission method can be applied to the client. For the client that needs to transmit information, the function of multi-device management for testing provided by the method of this application can be directly integrated on the client. , Or run on the client in the form of a software development kit (SDK).

As shown in Figure 2, the information transmission method specifically includes the following steps. According to different needs, the order of the steps in the flowchart can be changed, and some steps can be omitted.

Step S21: Send the request information to the server to obtain the RSA public key.

In this embodiment, the client sends request information to the server, and the server generates an RSA public key and an RSA private key after receiving the request information, and sends the RSA public key to the Client.

In this embodiment, the RSA (Rivest Shamir Adleman) encryption technology is an asymmetric encryption algorithm that requires a pair of keys (a public key and a private key), the public key is used for encryption, and the private key is used for decryption. The key distribution of the RSA encryption technology is very convenient, and the user's public key can be disclosed like a telephone number, which is convenient to use. Each user only needs a pair of keys to realize confidential communication with any user in the network. The encryption principle of the RSA encryption technology is based on a one-way function. It is impossible for an illegal receiver to use the public key to calculate the secret key within a limited time, and the confidentiality is good. However, RSA encryption technology has the disadvantage of slow encryption speed.

In this embodiment, key information, such as login information for logging in to the business system, can be encrypted by RSA encryption technology.

Step S22: Receive login information for accessing the service system, and generate a first AES key.

In this embodiment, when the user accesses the business system in the client, the client receives the login information of the user to access the business system. The login information includes at least information such as account number and password. When the user logs in to the business system in the client, he needs to enter an account and password, and the account and password are key information for the user to access the business system.

However, in order to overcome the shortcomings of RSA encryption speed, key information can be encrypted by RSA and then transmitted, and non-key information can be encrypted by AES and then transmitted, thereby improving information transmission efficiency and improving information security.

The AES (Advanced Encryption Standard) is an advanced encryption standard and a symmetric encryption algorithm. The AES encryption algorithm process involves four operations, namely byte substitution, row shift, column confusion, and round key addition. The decryption process is the corresponding inverse operation. Since each operation is reversible, the plaintext can be recovered by decrypting in the reverse order. The AES has the advantage of fast encryption speed.

In this embodiment, the key information is encrypted by RSA encryption technology with high confidentiality to prevent the key information from being stolen during transmission. As for other non-critical information, it can be encrypted with the AES encryption algorithm to increase the encryption speed. Each time the user accesses the business system, the client will temporarily generate the first AES key. Each time a user logs in to verify the service system, the client randomly generates the first AES key. Therefore, the leakage of the first AES key can be prevented, and the security of information transmission can be improved.

Step S23: Encrypt the login information and the first AES key with the RSA public key, and send the encrypted information to the server, so that the server generates a confirmation after confirming that the login information is accurate Information and the second AES key. The server randomly generates the second AES key.

In network transmission, the login information (such as account number and password) is generally not allowed to be transmitted in plain text. Therefore, in this solution, the login information is encrypted by the RSA public key, and then the encrypted information is sent to the server. If the RSA-encrypted login information is stolen during the transmission process, because there is no corresponding RSA private key, the encrypted login information cannot be RSA decrypted, and the login information cannot be obtained.

After the server receives the login information and the first AES key encrypted by the RSA encryption algorithm sent by the client, it decrypts the encrypted login information and the first AES key by the corresponding RSA private key , To obtain the corresponding information before encryption (such as the first AES key and account number, password, etc.).

In one embodiment, after obtaining the decrypted login information (such as account password), the server verifies whether the user's identity meets the requirements by verifying whether the login information is accurate. When verifying that the login information is accurate, the server will generate the corresponding second AES key and confirmation information. Then use the first AES key previously received from the client to perform AES encryption (symmetric encryption) on the second AES key and confirmation information that needs to be returned to the client. The symmetric encryption process uses the same key.

It should be noted that the confirmation information is a piece of feedback information generated after verifying that the login information is accurate.

Specifically, the step for the server to verify whether the login information is accurate includes:

Compare whether the login information is consistent with the login information saved by the server;

When the login information is consistent with the login information saved by the server, confirm that the login information is accurate;

When the login information is inconsistent with the login information saved by the server, it is confirmed that the login information is inaccurate. The server also stores user information corresponding to the login information, and the user information can be returned to the client through the confirmation information. Therefore, the confirmation information may also include user information, for example, user name, department and other information.

Step S24: Receive the encrypted confirmation information and the second AES key sent by the server.

In this embodiment, after confirming that the login information is accurate, the server generates confirmation information and a second AES key, and then encrypts the confirmation information and the second AES key by the first AES key, And send the encrypted confirmation information and the second AES key to the client.

Step S25: Decrypt the encrypted confirmation information and the second AES key by the first AES key to obtain the second AES key.

In this embodiment, the client uses the first AES key to perform AES decryption, thereby obtaining the second AES key key and confirmation information returned from the server. Therefore, the information in the service request process is encrypted by the second AES key, so as to increase the information transmission speed.

The above steps S21-S25 can realize that when the user logs in to the business system, the key login information can be encrypted by RSA to ensure the security of the login information, and then the non-key confirmation information can be encrypted by AES to ensure both the client and the server The security of information transmission between the two can also take into account the efficiency of information transmission.

In the subsequent process of the user making a business request in the business system (such as steps S26-S28), the parameters in the business request process can be encrypted and transmitted only through the official AES encryption key generated by the server, avoiding slow encryption speed RSA encryption, which can greatly increase the speed of information transmission. The formal AES encryption key is generated by the server and can be changed at any time.

Step S26: Receive a service request for access to the service system.

In this embodiment, after the user safely logs in to the service system, the service request to the service system is started. For example, after logging in to Ping An Bank's system, a user executes a business request for checking balance.

In this embodiment, when the user makes a service request to the preset system at the client, the original message of the service request is encrypted by the second AES key, and the encrypted information is sent To the server. The service request is generally an http request, and the request parameters in the http request are transmitted in the form of URL or request body. However, due to the openness of http requests, request parameters are easily intercepted and tampered. Therefore, it is necessary to sign the request parameters, and then verify the request parameters at the request recipient (such as the server) to ensure that the two signatures are the same. After the verification is passed, the request processor can perform business logic processing. However, signing and verification can only solve the problem of parameter tampering during request transmission, and cannot solve the security problem of sensitive parameter transmission. Therefore, in this case, the original message of the service request is encrypted by the second AES key to ensure information security.

Specifically, the client generates a message digest from the original message text through a hash function, and then encrypts the digest with the second AES key, and what is obtained is the number corresponding to the original message signature. Generally speaking, the client will send the digital signature and the original message to the server together.

Preferably, when the client signs the original message, the validity of the signature can be set. For example, if the signature is set to check (signature verification) once, it becomes invalid, so even if the digital signature and the original message are stolen by an intermediary, it is impossible to initiate a request to the server again.

Step S27: Encrypt the original message of the service request by the second AES key, and send the encrypted original message to the server, so that the server processes the service request according to the original message. Generate a response message.

It is understandable that the server needs to verify the signature of the original message. The signature verification means that after the server obtains the original message and the digital signature, it uses the same hash function to generate digest A from the original message. In addition, the server uses the second AES key to perform digital signature After decryption, the digest B is obtained. By comparing whether A and B are the same, it can be known whether the original message has been tampered with.

Step S28: Receive the encrypted response message sent by the server, and decrypt the encrypted response message by using the second AES key to obtain the response message.

From the above steps S26-S28, it can be known that after the client finally receives the second AES key sent by the server, the server also has the second AES key. The network communication between the client and the server is to perform AES encryption and decryption on the information of the network module. In this process, the AES encryption and decryption can effectively ensure the security of the transmitted information. The signature and verification process in the network module is to ensure the integrity of the transmitted information and prevent tampering.

Example three

In this embodiment, the information transmission method can be applied to the server. For the server that needs information transmission, the information transmission function provided by the method of this application can be directly integrated on the server, or a software development tool The package (Software Development Kit, SDK) runs on the server.

As shown in FIG. 3, the information transmission method specifically includes the following steps. According to different needs, the order of the steps in the flowchart can be changed, and some steps can be omitted.

Step S31: Receive the request information sent by the client, and generate an RSA public key and an RSA private key.

In this embodiment, when the user needs to access the business system, the client can send request information to the server, and the server generates the RSA public key and the RSA private key after receiving the request information, And send the RSA public key to the client.

Step S32: Send the RSA public key to the client.

In this embodiment, the client receives the RSA public key sent by the server. When the user accesses the business system, the client receives the login information input by the user and generates a first AES key. The RSA public key is used to encrypt the login information and the first AES key.

Step S33: Receive the login information encrypted by the RSA public key and the first AES key sent by the client.

After the client encrypts the login information and the first AES key with the RSA public key, it sends the encrypted login information and the first AES key to the server.

In network transmission, the login information (such as account number and password) is generally not allowed to be transmitted in plain text. Therefore, in this solution, the login information is encrypted by the RSA public key, and then the encrypted information is sent to the server.

Step S34: Decrypt the login information and the first AES key by using the RSA private key.

The server decrypts the encrypted login information and the first AES key through the previously generated RSA private key to obtain the login information and the first AES key.

Step S35: Confirm whether the login information is accurate. When the login information is accurate, go to step S36; when the login information is inaccurate, go back to step S33.

After obtaining the decrypted login information (such as account password), the server verifies whether the user's identity meets the requirements by verifying whether the login information is accurate. When verifying that the login information is accurate, the server will generate the corresponding second AES key and confirmation information. Then use the first AES key previously received from the client to perform AES encryption (symmetric encryption) on the second AES key and confirmation information that needs to be returned to the client. The symmetric encryption process uses the same key.

In this embodiment, the confirmation information also includes user information, for example, user name, department, and other information.

Specifically, the step of verifying whether the login information is accurate by the server includes: comparing whether the login information is consistent with the login information saved by the server; when the login information is consistent with the login information saved by the server When they are consistent, confirm that the login information is accurate; when the login information is inconsistent with the login information saved by the server, confirm that the login information is inaccurate.

Step S36: Generate confirmation information and a second AES key when the login information is accurate.

The second AES key is used to encrypt the original message of the service request sent by the client, so that the service request can be encrypted and protected.

Step S37: Encrypt the confirmation information and the second AES key with the first AES key, and send the encrypted confirmation information and the second AES key to the client.

In this embodiment, after confirming that the login information is accurate, the server generates confirmation information and a second AES key, and then encrypts the confirmation information and the second AES key by the first AES key, And send the encrypted confirmation information and the second AES key to the client. As a result, the process for users to access the business system is completed.

In the subsequent process of the user making a service request to the service system, the service request can also be continuously encrypted to ensure the security of the service request. The parameters in the service request process can be encrypted and transmitted only through the official AES encryption key generated by the server, avoiding the use of RSA encryption with slow encryption speed, which can greatly improve the speed of information transmission. The formal AES encryption key is generated by the server and can be changed at any time.

Step S38: Receive the original message of the service request encrypted by the second AES key, and generate a response message after processing the service request according to the original message.

The client receives the service request for the service system, encrypts the original message of the service request by the second AES key, and sends the encrypted information to the server.

In this embodiment, when the user makes a service request to the service system at the client, the original message of the service request is encrypted by the second AES key, and the encrypted information is sent to Server. The service request is generally an http request, and the request parameters in the http request are transmitted in the form of URL or request body. However, due to the openness of http requests, request parameters are easily intercepted and tampered. Therefore, it is necessary to sign the request parameters, and then verify the request parameters at the request recipient (such as the server) to ensure that the two signatures are the same. After the verification is passed, the request processor can perform business logic processing. However, signature and verification can only solve the problem of parameter tampering during request transmission, and cannot solve the security problem of sensitive parameter transmission. Therefore, in this case, the original message of the service request is encrypted by the second AES key to ensure information security.

Step S39: Encrypt the response message by using the second AES key, and send the encrypted response message to the client.

In this embodiment, the server decrypts the encrypted information using the second AES key to obtain the original message, and executes service processing based on the original message, and generates a response message after the service processing is completed , Encrypt the response message with the second AES key, and send the encrypted response message to the client.

It is understandable that the server needs to verify the signature of the original message. The signature verification means that after the server obtains the original message and the digital signature, it uses the same hash function to generate digest A from the original message. In addition, the server uses the second AES key to perform digital signature After decryption, digest B is obtained, and by comparing whether A and B are the same, it can be known whether the original message has been tampered with.

It can be known from the above steps S38-S39 that after the client finally receives the second AES key sent by the server, the server also has the second AES key. The network communication between the client and the server is to perform AES encryption and decryption on the information of the network module. In this process, the AES encryption and decryption can effectively ensure the security of the transmitted information. The signature and verification process in the network module is to ensure the integrity of the transmitted information and prevent tampering.

In summary, the information transmission method described in the embodiment of the present application encrypts the login information when the user logs in to the business system through the RSA public key, and encrypts the confirmation information through the first AES key and the second AES key. Encryption mode of the original message requested by the encrypted service. Realize the combination of asymmetric (RSA) and symmetric (AES) encryption methods for information transmission. Therefore, the key information (such as login information) is transmitted through asymmetric encryption, and then the non-key information (such as confirmation information) is transmitted through symmetric encryption, so as to improve the efficiency of information transmission and the effect of improving information security.

Example four

Refer to FIG. 4, which is a structural diagram of an information transmission device provided in Embodiment 4 of the present application.

In some embodiments, the information transmission device 30 runs in the client. The client and the server are connected through a wired or wireless network communication. The information transmission device 30 may include multiple functional modules composed of program code segments. The program code of each program segment in the information transmission device 30 may be stored in the memory of the client and executed by the at least one processor to perform secure information transmission.

In this embodiment, the information transmission device 30 can be divided into multiple functional modules according to the functions it performs. The functional modules may include: a sending module 301, a receiving module 302, an encryption module 303, and a decryption module 304. The module referred to in this application refers to a series of computer-readable instruction segments that can be executed by at least one processor and can complete fixed functions, and are stored in a memory.

The sending module 301 is used to send request information to the server to obtain the RSA public key.

The receiving module 302 is configured to receive login information for accessing the service system, and generate a first AES key.

The encryption module 303 is configured to encrypt the login information and the first AES key using the RSA public key, and send the encrypted information to the server, so that the server confirms that the login information is accurate Generate confirmation information and the second AES key.

The receiving module 302 is also configured to receive the encrypted confirmation information and the second AES key sent by the server.

The decryption module 304 is configured to decrypt the encrypted confirmation information and the second AES key using the first AES key to obtain the second AES key.

The receiving module 302 is further configured to receive a service request for access to the service system.

The encryption module 303 is further configured to encrypt the original message of the service request using the second AES key, and send the encrypted original message to the server, so that the server processes the original message according to the original message. A response message is generated after the service request.

The decryption module 304 is further configured to receive the encrypted response message sent by the server, and decrypt the encrypted response message using the second AES key to obtain the response message.

To sum up, the information transmission device described in the embodiment of the present application encrypts the login information when the user logs in to the business system through the RSA public key, and encrypts the confirmation information through the first AES key and the second AES key. Encryption mode of the original message requested by the encrypted service. Realize the combination of asymmetric (RSA) and symmetric (AES) encryption methods for information transmission. Therefore, the key information (such as login information) is transmitted through asymmetric encryption, and then the non-key information (such as confirmation information) is transmitted through symmetric encryption, so as to improve the efficiency of information transmission and the effect of improving information security.

Example five

Refer to FIG. 5, which is a structural diagram of an information transmission device provided in Embodiment 5 of the present application.

In some embodiments, the information transmission device 40 runs in a server. The server and the client are connected through wired or wireless network communication. The information transmission device 40 may include multiple functional modules composed of program code segments. The program code of each program segment in the information transmission device 40 may be stored in the memory of the server and executed by the at least one processor to perform secure information transmission.

In this embodiment, the information transmission device 40 can be divided into multiple functional modules according to the functions it performs. The functional modules may include: a receiving module 401, a sending module 402, a decryption module 403, a confirmation module 404, a generation module 405, and an encryption module 406. The module referred to in this application refers to a series of computer-readable instruction segments that can be executed by at least one processor and can complete fixed functions, and are stored in a memory.

The receiving module 401 is configured to receive request information sent by the client, and generate an RSA public key and an RSA private key.

The sending module 402 is configured to send the RSA public key to the client.

The receiving module 401 is further configured to receive the login information encrypted by the RSA public key and the first AES key sent by the client.

The decryption module 403 is configured to decrypt the login information and the first AES key by using the RSA private key.

The confirmation module 404 is used to confirm whether the login information is accurate.

The generating module 405 is configured to generate confirmation information and a second AES key when the login information is accurate.

The encryption module 406 is configured to encrypt the confirmation information and the second AES key by using the first AES key, and send the encrypted confirmation information and the second AES key to the client.

The receiving module 401 is further configured to receive the original message of the service request encrypted by the second AES key, and generate a response message after processing the service request according to the original message.

The sending module 402 is further configured to encrypt the response message by using the second AES key, and send the encrypted response message to the client.

To sum up, the information transmission device described in the embodiment of the present application encrypts the login information when the user logs in to the business system through the RSA public key, and encrypts the confirmation information through the first AES key and the second AES key. Encryption mode of the original message requested by the encrypted service. Realize the use of asymmetric (RSA) and symmetric (AES) encryption methods for information transmission. Therefore, the key information (such as login information) is transmitted through asymmetric encryption, and then the non-key information (such as confirmation information) is transmitted through symmetric encryption, so as to achieve the effect of improving information transmission efficiency and improving information security.

Example Six

Refer to FIG. 6, which is a schematic structural diagram of a client provided in Embodiment 6 of this application. In a preferred embodiment of the present application, the client 1 includes a memory 11, at least one processor 12, computer-readable instructions 14 stored in the memory 11 and running on the at least one processor 12, and At least one communication bus 13.

Those skilled in the art should understand that the client shown in FIG. 6 may include more or less other hardware or software, or different component arrangements than shown.

In some embodiments, the client 1 is a terminal that can automatically perform numerical calculation and/or information processing according to pre-set or stored instructions. Its hardware includes but is not limited to a microprocessor, an application specific integrated circuit, Programmable gate arrays, digital processors and embedded devices, etc. The client 1 may also include client equipment, which includes, but is not limited to, any electronic product that can interact with the client through a keyboard, a mouse, a remote control, a touch panel, or a voice control device, for example, Personal computers, tablet computers, smart phones, digital cameras, etc.

It should be noted that the client 1 is only an example, and other existing or future electronic products that can be adapted to this application should also be included in the scope of protection of this application and included here by reference .

In some embodiments, the memory 11 is used to store program codes and various data, such as the information transmission device 30 installed in the client 1, and achieve high-speed and automatic completion during the operation of the client 1 Access to programs or data. The memory 11 includes Read-Only Memory (ROM), Programmable Read-Only Memory (PROM), and Erasable Programmable Read-Only Memory (EPROM) , One-time Programmable Read-Only Memory (OTPROM), Electronically-Erasable Programmable Read-Only Memory (EEPROM), CD-ROM (Compact Disc Read- Only Memory, CD-ROM) or other optical disk storage, magnetic disk storage, tape storage, or any other non-volatile readable storage medium that can be used to carry or store data.

In some embodiments, the at least one processor 12 may be composed of integrated circuits, for example, may be composed of a single packaged integrated circuit, or may be composed of multiple integrated circuits with the same function or different functions, including one Or a combination of multiple central processing units (CPU), microprocessors, digital processing chips, graphics processors, and various control chips. The at least one processor 12 is the control core (Control Unit) of the client 1, which uses various interfaces and lines to connect the various components of the entire client 1, and runs or executes programs stored in the memory 11 or Modules, and call data stored in the memory 11 to perform various functions of the client 1 and process data, for example, for the purpose of secure information transmission.

In some embodiments, the at least one communication bus 13 is configured to implement connection and communication between the memory 11 and the at least one processor 12 and the like.

Although not shown, the client 1 may also include a power source (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the at least one processor 12 through a power management device, thereby being implemented by the power management device Manage functions such as charging, discharging, and power management. The power supply may also include one or more DC or AC power supplies, recharging devices, power failure detection circuits, power converters or inverters, power supply status indicators and other arbitrary components. The client 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

The above-mentioned integrated unit implemented in the form of a software function module may be stored in a computer readable storage medium. The above-mentioned software function module is stored in a storage medium and includes several instructions to make a computer device (which may be a personal computer, a terminal, or a network device, etc.) or a processor execute the method described in each embodiment of the present application. section.

In a further embodiment, with reference to FIG. 4, the at least one processor 12 can execute the operating device of the client 1 and various installed applications (the information transmission device 30 described above), program codes, etc., For example, the various modules mentioned above.

The memory 11 stores computer-readable instructions, and the at least one processor 12 can call the computer-readable instructions stored in the memory 11 to perform related functions. For example, the various modules described in FIG. 4 are a series of computer-readable instructions stored in the memory 11 and executed by the at least one processor 12, so as to realize the functions of the various modules to achieve information security. The purpose of the transmission.

In an embodiment of the present application, the memory 11 stores multiple computer-readable instructions, and the multiple computer-readable instructions are executed by the at least one processor 12 to achieve the purpose of secure information transmission.

Specifically, for the specific implementation method of the at least one processor 12 on the foregoing instructions, reference may be made to the description of the relevant steps in the embodiment corresponding to FIG. 2, which is not repeated here.

Example Seven

Refer to FIG. 7, which is a schematic structural diagram of the server provided in the seventh embodiment of this application. In a preferred embodiment of the present application, the server 2 includes a memory 21, at least one processor 22, computer-readable instructions 24 stored in the memory 21 and running on the at least one processor 22, and At least one communication bus 23.

Those skilled in the art should understand that the server 2 shown in FIG. 7 may include more or less other hardware or software, or different component arrangements than shown.

In some embodiments, the server 2 is a terminal that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Its hardware includes but is not limited to a microprocessor, an application specific integrated circuit, Programmable gate arrays, digital processors and embedded devices, etc. The server 2 may also include client equipment, which includes, but is not limited to, any electronic product that can interact with the client through a keyboard, a mouse, a remote control, a touch panel, or a voice control device, for example, Personal computers, tablet computers, smart phones, digital cameras, etc.

It should be noted that the server 2 is only an example, and other existing or future electronic products that can be adapted to this application should also be included in the scope of protection of this application and included here by reference .

In some embodiments, the memory 21 is used to store program codes and various data, such as the information transmission device 40 installed in the server 2, and achieve high-speed and automatic completion during the operation of the server 2 Access to programs or data. The memory 21 includes a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), and an Erasable Programmable Read-Only Memory (EPROM). , One-time Programmable Read-Only Memory (OTPROM), Electronically-Erasable Programmable Read-Only Memory (EEPROM), CD-ROM (Compact Disc Read- Only Memory, CD-ROM) or other optical disk storage, magnetic disk storage, tape storage, or any other non-volatile readable storage medium that can be used to carry or store data.

In some embodiments, the at least one processor 22 may be composed of integrated circuits, for example, may be composed of a single packaged integrated circuit, or may be composed of multiple integrated circuits with the same function or different functions, including one Or a combination of multiple central processing units (CPU), microprocessors, digital processing chips, graphics processors, and various control chips. The at least one processor 22 is the control core (Control Unit) of the server 2, which uses various interfaces and lines to connect the various components of the entire server 2, by running or executing programs stored in the memory 21 or Modules, and call data stored in the memory 21 to perform various functions of the server 2 and process data, for example, for the purpose of secure information transmission.

In some embodiments, the at least one communication bus 23 is configured to implement connection and communication between the memory 21 and the at least one processor 22 and the like.

Although not shown, the server 2 may also include a power source (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the at least one processor 22 through a power management device, thereby being implemented by a power management device. Manage functions such as charging, discharging, and power management. The power supply may also include one or more DC or AC power supplies, recharging devices, power failure detection circuits, power converters or inverters, power supply status indicators and other arbitrary components. The server 2 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

In a further embodiment, with reference to FIG. 5, the at least one processor 22 can execute the operating device of the server 2 and various installed applications (the information transmission device 40 described above), program codes, etc., For example, the various modules mentioned above.

The memory 21 stores computer readable instructions, and the at least one processor 22 can call the computer readable instructions stored in the memory 21 to perform related functions. For example, each module described in FIG. 5 is a series of computer-readable instructions stored in the memory 21 and executed by the at least one processor 22, so as to realize the functions of the various modules to achieve information security. The purpose of the transmission.

In an embodiment of the present application, the memory 21 stores a plurality of computer readable instructions, and the plurality of computer readable instructions are executed by the at least one processor 22 to achieve the purpose of secure information transmission. Specifically, for the specific implementation method of the at least one processor 22 on the foregoing instructions, reference may be made to the description of the relevant steps in the embodiment corresponding to FIG. 3, which is not repeated here.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application and not to limit them. Although the application has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the application can be Make modifications or equivalent replacements without departing from the spirit and scope of the technical solution of the present application.

Claims

An information transmission method, applied to a client, and the client communicates with a server, and is characterized in that the method includes:

Send the request information to the server to obtain the RSA public key;

Receive login information for accessing the business system and generate the first AES key;

The login information and the first AES key are encrypted by the RSA public key, and the encrypted information is sent to the server, so that the server generates confirmation information after confirming that the login information is accurate And the second AES key;

Receiving the encrypted confirmation information and the second AES key sent by the server;

Decrypt the encrypted confirmation information and the second AES key by using the first AES key to obtain a second AES key;

Receiving a business request for access to the business system;

The original message of the service request is encrypted by the second AES key, and the encrypted original message is sent to the server, so that the server generates a response message after processing the service request according to the original message Text.
The method of claim 1, wherein the method further comprises:

Receiving the encrypted response message sent by the server, and decrypting the encrypted response message by using the second AES key to obtain the response message.
The method according to claim 1, wherein the step of encrypting the original message of the service request by the second AES key comprises:

Generating a message digest from the original message text through a hash function;

The digest is encrypted by the second AES key to obtain the digital signature corresponding to the original message.
An information transmission method applied to a server, where the server communicates with a client, and is characterized in that the method includes:

Receive request information sent by the client and generate RSA public key and RSA private key;

Sending the RSA public key to the client;

Receiving the login information encrypted by the RSA public key and the first AES key sent by the client;

Decrypt the login information and the first AES key by using the RSA private key;

Confirm whether the login information is accurate;

Generating confirmation information and a second AES key when the login information is accurate;

Encrypt the confirmation information and the second AES key by the first AES key, and send the encrypted confirmation information and the second AES key to the client;

Receiving the original message of the service request encrypted by the second AES key, and generating a response message after processing the service request according to the original message;

The response message is encrypted by the second AES key, and the encrypted response message is sent to the client.
The method according to claim 4, wherein the step of confirming whether the login information is accurate comprises:

Compare whether the login information is consistent with the login information saved by the server;

When the login information is consistent with the login information saved by the server, confirm that the login information is accurate;

When the login information is inconsistent with the login information saved by the server, it is confirmed that the login information is inaccurate.
An information transmission device, which runs in a client, and the client is in communication connection with the server, characterized in that the device includes:

The sending module is used to send request information to the server to obtain the RSA public key;

The receiving module is used to receive login information for accessing the business system and generate the first AES key;

The encryption module is used to encrypt the login information and the first AES key using the RSA public key, and send the encrypted information to the server, so that the server confirms that the login information is accurate Generate confirmation information and the second AES key;

The receiving module is further configured to receive the encrypted confirmation information and the second AES key sent by the server;

A decryption module, configured to decrypt the encrypted confirmation information and the second AES key using the first AES key to obtain a second AES key;

The receiving module is also used to receive a service request for access to the service system;

The encryption module is further configured to encrypt the original message of the service request using the second AES key, and send the encrypted original message to the server, so that the server processes the original message according to the original message A response message is generated after the service request.
8. The information transmission device of claim 6, wherein:

The receiving module is further configured to receive the encrypted response message sent by the server, and decrypt the encrypted response message using the second AES key to obtain the response message.
8. The information transmission device of claim 6, wherein:

The encryption module is also used to generate a message digest from the original message text through a hash function; and

The digest is encrypted by the second AES key to obtain the digital signature corresponding to the original message.
An information transmission device that runs in a server, and the server is in a communication connection with a client, and is characterized in that the device includes:

The receiving module is used to receive the request information sent by the client and generate RSA public key and RSA private key;

A sending module, configured to send the RSA public key to the client;

The receiving module is further configured to receive the login information and the first AES key encrypted by the RSA public key sent by the client;

A decryption module, configured to decrypt the login information and the first AES key through the RSA private key;

The confirmation module is used to confirm whether the login information is accurate;

A generating module, used for generating confirmation information and a second AES key when the login information is accurate;

An encryption module, configured to encrypt the confirmation information and the second AES key using the first AES key, and send the encrypted confirmation information and the second AES key to the client;

The receiving module is further configured to receive the original message of the service request encrypted by the second AES key, and generate a response message after processing the service request according to the original message;

The sending module is further configured to encrypt the response message with a second AES key, and send the encrypted response message to the client.
The information transmission device according to claim 9, wherein:

The confirmation module is also used to compare whether the login information is consistent with the login information saved by the server;

When the login information is consistent with the login information saved by the server, confirm that the login information is accurate;

When the login information is inconsistent with the login information saved by the server, it is confirmed that the login information is inaccurate.
A client, which is in communication connection with a server, characterized in that the client includes a processor and a memory, and the processor is configured to execute at least one computer-readable instruction stored in the memory to implement the following steps:

Send the request information to the server to obtain the RSA public key;

Receive login information for accessing the business system and generate the first AES key;

The login information and the first AES key are encrypted by the RSA public key, and the encrypted information is sent to the server, so that the server generates confirmation information after confirming that the login information is accurate And the second AES key;

Receiving the encrypted confirmation information and the second AES key sent by the server;

Decrypt the encrypted confirmation information and the second AES key by using the first AES key to obtain a second AES key;

Receiving a business request for access to the business system;

The original message of the service request is encrypted by the second AES key, and the encrypted original message is sent to the server, so that the server generates a response message after processing the service request according to the original message Text.
The client according to claim 11, wherein the processor further implements the following steps when the processor is configured to execute at least one computer-readable instruction stored in the memory:

Receiving the encrypted response message sent by the server, and decrypting the encrypted response message by using the second AES key to obtain the response message.
The client according to claim 11, wherein when the original message of the service request is encrypted by the second AES key, the processor executes the at least one computer-readable instruction To achieve the following steps:

Generating a message digest from the original message text through a hash function;

The digest is encrypted by the second AES key to obtain the digital signature corresponding to the original message.
A server, which is in communication connection with a client, is characterized in that the server includes a processor and a memory, and the processor is configured to execute at least one computer-readable instruction stored in the memory to implement the following steps:

Receive request information sent by the client and generate RSA public key and RSA private key;

Sending the RSA public key to the client;

Receiving the login information encrypted by the RSA public key and the first AES key sent by the client;

Decrypt the login information and the first AES key by using the RSA private key;

Confirm whether the login information is accurate;

Generating confirmation information and a second AES key when the login information is accurate;

Encrypt the confirmation information and the second AES key by the first AES key, and send the encrypted confirmation information and the second AES key to the client;

Receiving the original message of the service request encrypted by the second AES key, and generating a response message after processing the service request according to the original message;

The response message is encrypted by the second AES key, and the encrypted response message is sent to the client.
The server according to claim 14, wherein the processor executes the at least one computer-readable instruction to implement the following steps when confirming whether the login information is accurate:

Compare whether the login information is consistent with the login information saved by the server;

When the login information is consistent with the login information saved by the server, confirm that the login information is accurate;

When the login information is inconsistent with the login information saved by the server, it is confirmed that the login information is inaccurate.
A non-volatile readable storage medium, wherein the non-volatile readable storage medium stores at least one computer readable instruction, and the following steps are implemented when the at least one computer readable instruction is executed by a processor :

Send the request information to the server to obtain the RSA public key;

Receive login information for accessing the business system and generate the first AES key;

The login information and the first AES key are encrypted by the RSA public key, and the encrypted information is sent to the server, so that the server generates confirmation information after confirming that the login information is accurate And the second AES key;

Receiving the encrypted confirmation information and the second AES key sent by the server;

Decrypt the encrypted confirmation information and the second AES key by using the first AES key to obtain a second AES key;

Receiving a business request for access to the business system;

The original message of the service request is encrypted by the second AES key, and the encrypted original message is sent to the server, so that the server generates a response message after processing the service request according to the original message Text.
The storage medium of claim 16, wherein the at least one computer readable instruction is further used to implement the following steps when executed by the processor:

Receiving the encrypted response message sent by the server, and decrypting the encrypted response message by using the second AES key to obtain the response message.
The storage medium according to claim 16, wherein when the original message of the service request is encrypted by the second AES key, the at least one computer-readable instruction is executed by the processor Perform the following steps:

Generating a message digest from the original message text through a hash function;

The digest is encrypted by the second AES key to obtain the digital signature corresponding to the original message.
A non-volatile readable storage medium, wherein the non-volatile readable storage medium stores at least one computer readable instruction, and the following steps are implemented when the at least one computer readable instruction is executed by a processor :

Receive request information sent by the client and generate RSA public key and RSA private key;

Sending the RSA public key to the client;

Receiving the login information encrypted by the RSA public key and the first AES key sent by the client;

Decrypt the login information and the first AES key by using the RSA private key;

Confirm whether the login information is accurate;

Generating confirmation information and a second AES key when the login information is accurate;

Encrypt the confirmation information and the second AES key by the first AES key, and send the encrypted confirmation information and the second AES key to the client;

Receiving the original message of the service request encrypted by the second AES key, and generating a response message after processing the service request according to the original message;

The response message is encrypted by the second AES key, and the encrypted response message is sent to the client.
18. The storage medium of claim 19, wherein when the at least one computer-readable instruction is executed by the processor to confirm whether the login information is accurate, the following steps are implemented:

Compare whether the login information is consistent with the login information saved by the server;

When the login information is consistent with the login information saved by the server, confirm that the login information is accurate;

When the login information is inconsistent with the login information saved by the server, it is confirmed that the login information is inaccurate.