WO2019242163A1

WO2019242163A1 - Data security verification method, apparatus and system, and computer device and storage medium

Info

Publication number: WO2019242163A1
Application number: PCT/CN2018/109490
Authority: WO
Inventors: 何兵
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-06-22
Filing date: 2018-10-09
Publication date: 2019-12-26
Also published as: CN108848094B; CN108848094A

Abstract

Disclosed are a data security verification method, apparatus and system, and a computer device and a storage medium. The method comprises: generating a public key and private key pair by means of an asymmetric encryption algorithm; sending a first request comprising the public key to a server end so as to acquire second encrypted data returned by the server, wherein the second encrypted data is obtained by encrypting first encrypted data using the public key, and the first encrypted data is obtained by encrypting generated data by the server end by means of a message digest algorithm; decrypting the received second encrypted data using the private key so as to obtain the first encrypted data; sending a second request to the server end so as to acquire the generated data of the server end; receiving the generated data and encrypting same by means of the message digest algorithm so as to obtain third encrypted data; and according to the first encrypted data and the third encrypted data, verifying whether the received generated data is secure.

Description

Data security verification method, device, system, computer equipment and storage medium

This application claims the priority of a Chinese patent application filed on June 22, 2018 with the Chinese Patent Office, application number 201810649623.X, and the invention name "Data Security Verification Method, Device, System, Computer Equipment, and Storage Medium", which The entire contents are incorporated herein by reference.

Technical field

The present application relates to the field of data processing technology, and in particular, to a method, device, system, computer equipment, and storage medium for data security verification.

Background technique

Many existing applications use the Hybird framework, which is a hybrid framework. Hybrid framework applications allow developers to embed HTML applications in a native container, combining the advantages of native applications and HTML applications. At present, the application of the Hybrid framework is often delivered through the network when updating HTML page resources and related resources, that is, the terminal where the application is located downloads the update package through the network, or the server sends the update package to the application through the network. Terminal. An application usually has many updates. If it is updated, a hacker intercepts the update package, injects other things into the update package, and sends it to the terminal. This involves resource security issues.

Application content

The embodiments of the present application provide a data security verification method, device, system, computer equipment, and storage medium, which can improve data security.

In a first aspect, an embodiment of the present application provides a data security verification method, which is applied to a terminal. The method includes:

If it is detected that the conditions for obtaining data generated by the server are met, a pair of public and private keys are generated by an asymmetric encryption algorithm; a first request is sent to the server, wherein the first request includes the public key, and the The first request is used to obtain first encrypted data on the server side, where the first encrypted data is obtained by the server side by encrypting the generated data through a message digest algorithm; receiving the second encrypted data returned by the server side, where The second encrypted data is obtained by the server side using the public key to encrypt the first encrypted data; using the private key to decrypt the received second encrypted data to obtain the first encrypted data; Sending a second request to the server, the second request is used to obtain the generated data on the server; receive the generated data returned by the server; and encrypt the generated data by the message digest algorithm, To obtain third encrypted data; verify the received generated data according to the first encrypted data and the third encrypted data Is it safe.

In a second aspect, an embodiment of the present application further provides a data security verification method, which is applied to a server side, and the method includes:

If the generated data is detected, the generated data is encrypted by a message digest algorithm to obtain the first encrypted data; a first request sent by the terminal where the application is located, wherein the first request includes the terminal using asymmetric encryption The public key generated by the algorithm, the first request is used to obtain the first encrypted data; the first encrypted data is encrypted using the public key to obtain the second encrypted data; and the second encrypted data is sent to the terminal To enable the terminal to decrypt the second encrypted data to obtain the first encrypted data by using the private key generated by the asymmetric encryption algorithm; receive a second request sent by the terminal, wherein the second request Configured to obtain the generated data; send the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain third encrypted data, and according to the The first encrypted data and the third encrypted data to verify whether the generated data is secure.

According to a third aspect, an embodiment of the present application provides a data security verification device. The device includes a unit for executing a data security verification method according to the first aspect, or includes a unit for executing the second aspect. Corresponding unit of a data security verification method.

In a fourth aspect, an embodiment of the present application provides a data security verification system, including a server end and at least one terminal, where the terminal is used to execute the data security verification method described in the first aspect, and the server end is used to execute A data security verification method according to the above second aspect.

In a fifth aspect, an embodiment of the present application provides a computer device, where the computer device includes a memory and a processor connected to the memory;

The memory is configured to store a computer program, and the processor is configured to run the computer program stored in the memory to perform the data security verification method according to the first aspect, or to perform the data security verification according to the second aspect. method.

According to a sixth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, the foregoing is implemented. The data security verification method according to the first aspect, or implements the data security verification method according to the second aspect.

In this embodiment of the present application, a pair of public and private keys are generated by using an asymmetric encryption algorithm, and the public key is sent to the server, so that the server encrypts the first encrypted data according to the public key to obtain the second encrypted data, where The first encrypted data is obtained by the server-side detection of the generated data, and the generated data is encrypted by using a message digest algorithm. When the terminal receives the second encrypted data, it uses the private key to decrypt to obtain the first encrypted data. Based on the received generated data, the third encrypted data is obtained by encryption using the same message digest algorithm, and whether the generated data is safe is verified based on the third encrypted data and the first encrypted data. Because the first encrypted data encrypted by the message digest algorithm cannot be decrypted, at the same time, the server uses the public key of the asymmetric encryption algorithm to encrypt the first encrypted data, obtains the second encrypted data, and sends it to the terminal. Only the terminal with the private key can decrypt the first Two encrypted data data to obtain the first encrypted data. In the embodiment of the present application, since the first encrypted data obtained by the decryption is accurate, the first encrypted data and the third encrypted data obtained by the decryption can be used to verify whether the obtained generated data is safe, and the data security is improved. .

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a sequence diagram of a data security verification system provided by an embodiment of the present application;

2 is a schematic flowchart of a data security verification method according to an embodiment of the present application;

3 is a schematic diagram of a sub-process of a data security verification method according to an embodiment of the present application;

4 is a schematic diagram of another sub-process of a data security verification method according to an embodiment of the present application;

5 is a schematic flowchart of a data security verification method according to another embodiment of the present application;

6 is a schematic diagram of a sub-process of a data security verification method according to another embodiment of the present application;

7 is a schematic block diagram of a data security verification device according to an embodiment of the present application;

8 is a schematic block diagram of a condition detection unit according to an embodiment of the present application;

9 is a schematic block diagram of a verification unit according to an embodiment of the present application;

10 is a schematic block diagram of a data security verification device according to another embodiment of the present application;

FIG. 11 is a schematic block diagram of a computer device according to an embodiment of the present application.

detailed description

In the following, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.

It should be understood that the server-side generated data mentioned in the embodiments of the present application may be any type of any data that communicates with the terminal, and the generated data is generated by the server. In the following, in order to facilitate understanding of the solution in the embodiment of the present application, the generated data is an application program update package as an example for description.

FIG. 1 is a sequence diagram of a data verification system provided by an embodiment of the present application. The data verification system includes a server and at least one terminal. The terminal includes, but is not limited to, electronic devices with communication functions such as smart phones, tablet computers, notebook computers, desktop computers, personal digital assistants, and wearable devices. The server may be an independent server or a server cluster composed of multiple servers, and the server communicates with the terminal to send data generated by the server to the terminal so that the terminal verifies whether the generated data received is Safety. If the generated data includes the generated application version update package, the corresponding terminal includes an application, and the server is a server corresponding to the application.

In FIG. 1, if the server detects the generated data, the generated data is encrypted by the message digest algorithm to obtain the first encrypted data; if the terminal detects that the conditions for obtaining the data generated by the server are met, the asymmetric encryption algorithm is used. Generate a pair of public and private keys; the terminal sends a first request to the server, where the first request includes a public key, the first request is used to obtain the first encrypted data of the server; the server receives the terminal and sends After the first request, the first encrypted data is encrypted by using the public key to obtain the second encrypted data; the second encrypted data is sent to the terminal; after the second encrypted data is received by the terminal, the private key is decrypted and received The second encrypted data obtained to obtain the first encrypted data; the terminal sends a second request to the server, the second request is used to obtain the generated data on the server side; the server sends the second request to the terminal after receiving the second request from the terminal The requested generated data; the terminal receives the generated data returned by the server and passes the generated data through the same message The digest algorithm performs encryption to obtain the third encrypted data; and verifies whether the received generated data is secure according to the first encrypted data and the third encrypted data.

Because the first encrypted data encrypted by the message digest algorithm cannot be decrypted, at the same time, the server uses the public key of the asymmetric encryption algorithm to encrypt the first encrypted data, obtains the second encrypted data, and sends it to the terminal. Only the terminal with the private key can decrypt the first Two encrypted data data to obtain the first encrypted data. The embodiment of the present application makes the first encrypted data obtained by decryption accurate. The terminal then uses the same message digest algorithm to encrypt the generated data to obtain third encrypted data. Based on the third encrypted data and the first encrypted data, whether the generated data obtained is safe can be verified, and the data security is improved.

In the following, the steps of the data security verification method are described in detail from the perspective of a terminal and a server.

FIG. 2 is a schematic flowchart of a data security verification method according to an embodiment of the present application. The method is applied in a terminal. The method includes the following steps S201-S208.

S201. If it is detected that the conditions for obtaining the data generated by the server are met, a pair of public key and private key is generated through an asymmetric encryption algorithm.

Among them, the asymmetric encryption algorithm generates a pair of secret keys during use, namely a public key and a private key. The public key is used for encryption, and the private key can be used for decryption. Asymmetric algorithms such as the RSA algorithm.

Before step S201, the data security verification method further includes: if an acquisition instruction is received, detecting whether a condition for acquiring data generated by the server is met.

In an embodiment, if the generated data includes the generated application version update package, as shown in FIG. 3, the step of detecting whether the conditions for obtaining the data generated by the server are met includes the following steps S301-S306.

S301. Send a version number request to the server to receive the application version number returned by the server according to the version number request.

S302. Obtain the current version number of the application. That is to obtain the current version number of the application in the terminal.

S303: Determine whether the application program needs to be updated according to the version number of the application program returned by the server and the obtained current version number of the application program. If no version update is required, it is determined that the conditions for obtaining data generated by the server are not met.

Among them, the version number of the application program is incremented, and each time the application program is updated, the version number is incremented. Specifically, step S303 includes: determining whether the version number of the application program returned by the server is greater than the current version number of the obtained application program; if the version number of the application program returned by the server side is greater than the current version number of the application program, determining whether the application program needs to be performed Version update; if the version number of the application program returned by the server is not greater than the current version number of the obtained application program, it is determined that the application program does not need to be updated.

S304. If the application requires a version update, send the current operating environment data of the terminal where the application is located to the server, so that the server can determine whether the terminal meets the conditions for obtaining the application version update package according to the operating environment data and meets the requirements on the terminal. Under certain conditions, a confirmation message is sent to the terminal.

Among them, the terminal's current operating environment data includes network environment, hardware environment, power, etc. The network environment includes whether the terminal is currently using a WIFI network or traffic, and if the terminal is using a WIFI network, it corresponds to the network speed of the WIFI network. The hardware environment includes the remaining amount or occupancy of the hardware involved in the terminal, such as memory, hard disk, and CPU. Specifically, the server determines whether the terminal satisfies the conditions for obtaining the application version update package according to the running environment data, and please refer to the corresponding description in the server embodiment. It should be noted that before sending the running environment data to the server, the terminal and the server need to pre-negotiate whether the corresponding terminal satisfies the condition for obtaining the application version update package, such as whether the terminal meets the requirements for obtaining the application version update package. The condition is represented by parameter A. There are two corresponding values of A, which can be represented by yes and no respectively. For example, yes is used to meet the conditions for obtaining the application version update package, and no is used to indicate that the conditions for obtaining the application version update package are not met; yes may also be used to indicate that the The condition for obtaining the application version update package, non-yes means that the condition for obtaining the application version update package is not met; it can also be 0 or 1, for example, if 1 is used to meet the conditions for obtaining the application version update package, 0 is not satisfied Get the conditions for the application version update package, etc. You can also use other numbers, letters, text, and so on.

S305: Detect whether a confirmation message returned by the server is received. Specifically, the terminal receives the corresponding parameter and value returned by the server, and analyzes the corresponding parameter and value according to the result of pre-negotiation in order to know the true meaning of the parameter and value. If the terminal meets the conditions for obtaining the application version update package with parameter A, while 1 represents the conditions for obtaining the application version update package, and 0 indicates that the conditions for obtaining the application version update package are not met, then the server receives A, and A = 1, it is determined that the confirmation information returned by the server is received.

S306. If the confirmation information returned by the server is received, it is confirmed that the conditions for acquiring the data generated by the server are met.

In some embodiments, regardless of whether the server determines that the terminal meets the conditions for obtaining the application version update package or does not meet the conditions for obtaining the application version update package, the corresponding confirmation information is sent to the terminal. After receiving the confirmation information returned by the server, the detection terminal parses the corresponding parameters and values, and determines whether the conditions for obtaining the data generated by the server are met according to the corresponding parameters and values.

S202. A first request is sent to the server, where the first request includes the public key, and the first request is used to obtain first encrypted data of the server, where the first encrypted data is a server-side pass message digest. The algorithm encrypts the generated data.

The main feature of the message digest algorithm is that the encryption process does not require a key, and the encrypted data cannot be decrypted. Only the same plaintext data (data that needs to be encrypted) can be obtained through the same message digest algorithm to obtain the same ciphertext ( Encrypted data). If the server detects the generated data, it encrypts the generated data through a message digest algorithm to obtain the first encrypted data. The terminal sends a first request to the server. The first request includes a public key generated by an asymmetric encryption algorithm, and the first request is used to request the first encrypted data on the server side. Among them, the message digest algorithm can use the MD5 algorithm.

S203. Receive second encrypted data returned by the server, where the second encrypted data is obtained by the server using the public key to encrypt the first encrypted data.

The server sends the second encrypted data obtained by encrypting the first encrypted data with the public key to the terminal, and the terminal receives the second encrypted data returned by the server. The second encrypted data is calculated by using the public key of the first encrypted data. Since the private key is on the terminal that sends the request, only the terminal that sent the request can decrypt the second encrypted data with the private key, and After receiving the second encrypted data, other terminals cannot decrypt it.

S204. Use the private key to decrypt the received second encrypted data to obtain the first encrypted data.

The terminal decrypts the received second encrypted data by using the private key to obtain the first encrypted data. Because only the terminal that sent the request can decrypt the second encrypted data, it can prevent others from receiving the second encrypted data by mistake (even after receiving the second encrypted data, other terminals cannot decrypt because they have no secret key). At the same time, because the first encrypted data obtained after decryption is calculated by the message digest algorithm, it is almost difficult or impossible to decrypt. Therefore, the private key and digest algorithm in the asymmetric encryption algorithm can ensure that the first encrypted data obtained by the terminal after decryption is accurate and true.

S205. Send a second request to the server, where the second request is used to obtain the generated data on the server.

S206. Receive the generated data returned by the server.

S207: Encrypt the generated data through the same message digest algorithm to obtain third encrypted data. It should be noted that the message digest algorithm in this step is the same as the message digest algorithm in step 2. Like the MD5 algorithm.

It should be noted that after the terminal obtains the second encrypted data and decrypts it to obtain the first encrypted data, and the terminal obtains the generated data and encrypts it to obtain the third encrypted data, there is no difference between the steps involved, that is, step S205- S207, and then perform steps S202-S204; you may also perform steps S202-S204 first, and then perform steps S205-S207.

S208. Verify whether the received generated data is secure according to the first encrypted data and the third encrypted data.

In this embodiment, as shown in FIG. 4, step S208 includes the following steps S401-S403.

S401. Compare the first encrypted data with the third encrypted data.

S402. Determine whether the first encrypted data and the third encrypted data are the same according to the comparison result.

S403. If the first encrypted data is the same as the third encrypted data, determine that the received generated data is secure. The received generated data is determined to be safe for further operations, such as determining the security of the version update package corresponding to the application, and using the version update package to update the application.

S404. If the first encrypted data is different from the third encrypted data, determine that the received generated data is not secure, and prompt. Such as prompting whether to delete or antivirus.

Because the message digest algorithm only needs to input the same plaintext data (data that needs to be encrypted) and go through the same message digest algorithm to get the same ciphertext (encrypted data). Therefore, if the generated data received by the terminal is changed, after the same message digest algorithm, the third encrypted data will change accordingly. Therefore, the third encrypted data and the first encrypted data are compared and judged. If the data is the same, it can be known whether the received generated data has been changed, that is, whether it has been modified by a hacker or the like. If the third encrypted data is the same as the first encrypted data, it is determined that the received generated data is secure and has not been modified. If the third encrypted data is not the same as the first encrypted data, it is determined that the received generated data is not the same generated data, and there may be a case where it is modified, then a prompt is given. In this way, the generated data can be verified to ensure the security of the received generated data.

FIG. 5 is a schematic flowchart of a data security verification method according to another embodiment of the present application. This method runs on the server. The method includes the following steps S501-S506.

S501. If the generated data is detected, the generated data is encrypted by using a message digest algorithm to obtain first encrypted data.

If the corresponding application is an application, then detecting the generated data means detecting that a new version update package is generated for the application. If a new version update package is generated, the version update package is encrypted by using a message digest algorithm to obtain first encrypted data. Data encrypted using the message digest algorithm cannot be decrypted. It should be noted that the message digest algorithm used here is the same algorithm used in the terminal.

S502. Receive a first request sent by a terminal where an application is located, where the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain the first encrypted data.

S503. Use the public key to encrypt the first encrypted data to obtain second encrypted data.

S504. Send the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data.

The asymmetric encryption algorithm will generate a pair of secret keys during use, that is, the public key and the private key. The public key is used for encryption, and the private key can be used for decryption. The second encrypted data is calculated by using the public key of the first encrypted data. Since the private key is on the terminal that sends the request, only the terminal that sent the request can decrypt it with the private key. After receiving the second encrypted data, the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data. Since the first encrypted data is calculated by the message digest algorithm, it cannot be decrypted. Therefore, the asymmetric encryption algorithm and the digest algorithm can ensure that the first encrypted data obtained by the terminal after decryption is accurate and true.

S505. Receive a second request sent by the terminal, where the second request is used to obtain the generated data.

S506: Send the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain third encrypted data, and according to the first encrypted data and the The third data is encrypted to verify whether the generated data is secure.

The terminal can verify whether the generated data is secure by decrypting the accurate and authentic first encrypted data and the third encrypted data obtained by encrypting the received generated data by using the same message digest algorithm. The verification of the generated data is achieved to ensure the security of the received generated data.

It should be noted that the server encrypts the first encrypted data with the public key after generating the first encrypted data and sends the second encrypted data to the terminal according to the first request, and sends the generated data to the terminal according to the second request. The sequence of steps is related to the sequence of specific requests sent by the terminal. If the terminal sends a request to obtain the first encrypted data first, then execute the steps corresponding to sending the second encrypted data to the terminal, and then execute the steps corresponding to sending the generated data to the terminal. If the terminal sends a request to obtain the generated data first, , Then the steps corresponding to sending the generated data to the terminal are performed first, and then the steps corresponding to sending the second encrypted data to the terminal are performed. Finally, the terminal is caused to use the same message digest algorithm to encrypt the generated data to obtain the third encrypted data, and verify whether the generated data is secure according to the first encrypted data and the third encrypted data.

In one embodiment, the generated data includes a generated application version update package. Before receiving the first request sent by the terminal where the application is located, the method for data security verification running on the server side further includes: determining whether the terminal meets the conditions for obtaining the application version update package and, if it is determined that the terminal meets the conditions, The terminal sends confirmation information, so that the terminal confirms, based on the received confirmation information sent by the server end, that a condition for acquiring data generated by the server end is satisfied. In an embodiment, as shown in FIG. 6, the determining whether the terminal meets a condition for obtaining the application version update package and sending a confirmation message to the terminal when it is determined that the terminal meets the condition, so that all the The step of confirming that the terminal detects that the condition for acquiring the data generated by the server is met according to the received confirmation information sent by the server includes the following steps S601-S603.

S601. Send the application version number to the terminal according to the version number request sent by the terminal, so that the terminal determines the application program according to the application version number and the obtained current version number of the application program. Whether a version update is required.

S602. If a version update is required, determine whether the terminal meets a condition for obtaining the application version update package according to the received operating environment data sent by the terminal.

The operating environment data sent by the terminal includes a network environment, a hardware environment, and power. The network environment includes whether the terminal is currently using a WIFI network or traffic, and if a WIFI network is used, it corresponds to the network speed of the WIFI network. The hardware environment includes the remaining amount or occupancy of the hardware involved in the terminal, such as memory, hard disk, and CPU.

The determining whether the terminal meets the conditions for acquiring the application version update package according to the received operating environment data sent by the terminal includes determining whether the current network environment of the terminal where the application is located is using a WIFI network or traffic. ; If the current network environment of the terminal where the application is located uses traffic, determine that the terminal does not meet the conditions for obtaining the application version update package; if the current network environment of the terminal where the application is located uses a WIFI network, determine whether the current power of the terminal is greater than predicted The amount of power consumed by the installed version update package; if the current power of the terminal is less than or equal to the estimated power of the installed version update package; determine that the terminal does not meet the conditions for obtaining the application version update package; if the current power of the terminal is greater than the predicted installed version The power consumed by the update package to determine whether the remaining hardware resources involved in the hardware environment of the terminal where the application is located are greater than the preset hardware resources or whether the hardware resource occupancy is greater than the preset hardware occupancy; if the hardware environment of the terminal where the application is located involves Hardware The source remaining amount is not greater than the preset hardware resource amount or the hardware resource occupancy rate is not greater than the preset hardware occupancy rate, and it is determined that the terminal does not meet the conditions for obtaining an application version update package; if the hardware resource remaining amount involved in the hardware environment of the terminal where the application is located Get the current network speed of the WIFI network if it is greater than the preset hardware resource amount or the hardware resource occupancy rate is greater than the preset hardware occupancy rate; if the network speed of the WIFI network is greater than the preset network speed, determine that the terminal meets the conditions for obtaining the application version update package; If the network speed of the WIFI network is not greater than the preset network speed, it is determined that the terminal does not meet the conditions for obtaining an application program update package.

The preset amount of hardware resources includes the sum of the amount of hardware resources that can ensure the normal operation of the terminal and the amount of resources involved in the size of the version update data. Understandably, if the remaining amount of hardware resources involved in the terminal hardware environment is not sufficient to update the version of the application or to update the version of the application will affect the normal operation of the terminal, then it is determined that the terminal does not meet the requirements for obtaining the application version Conditions for updating packages. When determining whether the conditions are met, the network speed of the WIFI network is taken into consideration, which excludes the situation where the WIFI network is unstable and the WIFI network signal is very weak. In other embodiments, whether the terminal meets the conditions for obtaining the application version update package may be determined by combining other factors, and other determination methods may be used to determine whether the terminal meets the conditions for obtaining the application version update package.

Among them, whether the terminal meets the version update conditions is determined by the server, because other factors and other determination methods are taken into consideration, and the corresponding determination code is placed on the server side, which can easily increase the impact of other factors and other determination methods. Conducive to the further expansion and improvement of the program.

S603. If it is determined that the terminal meets a condition for obtaining the application version update package, send determination information to the terminal, so that the terminal confirms that the acquisition is satisfied based on the confirmation information sent by the server. Conditions for server-generated data. Specifically, the terminal sends parameters and values corresponding to the conditions for determining whether to obtain the application version update package, so that the terminal can analyze the specific meaning of the received parameters and values according to the received parameters and values.

In some embodiments, regardless of whether the server determines that the terminal meets the conditions for obtaining the application version update package or does not meet the conditions for obtaining the application version update package, the corresponding confirmation information is sent to the terminal.

The embodiment of the invention also provides a data security verification system, which includes the data security verification method described in any one of the above embodiments running on a terminal and the data security verification method described in any one of the embodiments running on a server . Specifically, please refer to the content of the corresponding embodiments above, and details are not described herein again.

FIG. 7 is a schematic block diagram of a data security verification device according to an embodiment of the present application. The device includes a unit corresponding to a method for performing data security verification of the terminal, and the device is configured in the terminal. As shown in FIG. 7, the device 70 includes a key generation unit 701, a first request unit 702, an encrypted data receiving unit 703, a private key decryption unit 704, a second request unit 705, a generated data receiving unit 706, and a first digest encryption Unit 707 and verification unit 708.

The key generation unit 701 is configured to generate a pair of a public key and a private key by using an asymmetric encryption algorithm if it is detected that the conditions for obtaining data generated by the server are met.

A first requesting unit 702 is configured to send a first request to a server, where the first request includes the public key, and the first request is used to obtain first encrypted data on the server, where the first encrypted data It is obtained by the server by encrypting the generated data through the message digest algorithm.

The encrypted data receiving unit 703 is configured to receive the second encrypted data returned by the server, where the second encrypted data is obtained by the server using the public key to encrypt the first encrypted data.

A private key decryption unit 704 is configured to decrypt the received second encrypted data by using the private key to obtain the first encrypted data.

The second request unit 705 is configured to send a second request to the server, where the second request is used to obtain the generated data on the server.

The generating data receiving unit 706 is configured to receive the generated data returned by the server.

The first digest encryption unit 707 is configured to encrypt the generated data by using a same message digest algorithm to obtain third encrypted data.

The verification unit 708 is configured to verify whether the received generated data is secure according to the first encrypted data and the third encrypted data.

In an embodiment, the data security verification device running in the terminal further includes a condition detection unit 80. As shown in FIG. 8, the condition detection unit 80 includes: a version number requesting unit 801, a version number obtaining unit 802, a version update determination unit 803, an environment data sending unit 804, and a condition reception determination unit 805.

A version number requesting unit 801, configured to send a version number request to the server to receive the application version number returned by the server according to the version number request;

A version number obtaining unit 802, configured to obtain a current version number of the application program;

A version update determining unit 803, configured to determine whether the application requires a version update according to the application version number returned by the server and the obtained current version number of the application;

The environment data sending unit 804 is configured to send the current running environment data of the terminal where the application is located to the server if the application needs to be updated, so that the server can determine whether the terminal meets the requirements of obtaining the Describe the conditions of the application version update package and send confirmation information to the terminal if the terminal meets the conditions;

The conditional access determination unit 805 is configured to detect whether the confirmation information returned by the server is received, and if the confirmation information returned by the server is received, confirm that the condition for acquiring the data generated by the server is met.

In an embodiment, as shown in FIG. 9, the verification unit 708 includes a comparison unit 901, a comparison determination unit 902, and a security verification unit 903.

A comparison unit 901, configured to compare the first encrypted data with the third encrypted data;

A comparison determining unit 902, configured to determine whether the first encrypted data and the third encrypted data are the same according to a comparison result;

A security verification unit 903, configured to determine that the generated data received is secure if the first encrypted data and the third encrypted data are the same;

The security verification unit 903 is further configured to determine that the generated data received is not secure if the first encrypted data and the third encrypted data are different.

FIG. 10 is a schematic block diagram of a data security verification device according to an embodiment of the present application. The device includes a unit corresponding to a method for performing the above-mentioned server-side data security verification method, and the device is configured in the server. As shown in FIG. 10, the device 100 includes a second digest encryption unit 101, a first request reception unit 102, a public key encryption unit 103, an encrypted data transmission unit 104, a second request reception unit 105, and a generated data transmission unit 106.

A second digest encryption unit 101, configured to: if the generated data is detected, encrypt the generated data by using a message digest algorithm to obtain the first encrypted data;

A first request receiving unit 102 is configured to receive a first request sent by a terminal where an application is located, where the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain a first key An encrypted data;

A public key encryption unit 103, configured to encrypt the first encrypted data by using the public key to obtain second encrypted data;

The encrypted data sending unit 104 is configured to send the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

A second request receiving unit 105, configured to receive a second request sent by the terminal, where the second request is used to obtain the generated data;

A generating data sending unit 106 is configured to send the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain third encrypted data, and according to the first An encrypted data and the third encrypted data to verify whether the generated data is secure.

In one embodiment, the data security verification device running on the server side further includes: a condition determination unit. The condition determining unit includes a version number sending unit, an update condition determining unit, and a determining data sending unit. among them,

A version number sending unit, configured to send the application version number to the terminal according to the version number request sent by the terminal, so that the terminal according to the application version number and the current version number of the application obtained Determining whether the application needs to be updated;

An update condition determining unit, configured to determine whether the terminal meets a condition for acquiring the application version update package according to the received operating environment data sent by the terminal if a version update is required;

A determination data sending unit, configured to, if it is determined that the terminal meets a condition for obtaining the application version update package, send determination information to the terminal, so that the terminal is based on the received confirmation information sent by the server end, Confirm that the conditions for obtaining data generated by the server are met.

It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above data security device and each unit can refer to the corresponding description in the foregoing method embodiments. For the convenience and brevity of description, it will not be repeated To repeat.

The above apparatus may be implemented in the form of a computer program, and the computer program may be run on a computer device as shown in FIG. 11.

FIG. 11 is a schematic block diagram of a computer device according to an embodiment of the present application. In this embodiment, the device 110 may be a terminal device such as a mobile phone, a laptop computer, a tablet computer, and a desktop computer. The device 110 includes a processor 112, a memory, and a network interface 113 connected through a system bus 111. The memory may include a non-volatile storage medium 114 and an internal memory 115.

The non-volatile storage medium 114 can store an operating system 1141 and a computer program 1142. When the computer program 1142 stored in the non-volatile storage medium is executed by the processor 112, the data security verification method implemented by the terminal can be implemented, as shown in Figs. 2, 3, and 4. The processor 112 is used to provide computing and control capabilities to support the operation of the entire device 110. The internal memory 115 provides an environment for running a computer program in a non-volatile storage medium. When the computer program is executed by the processor 112, the processor 112 can cause the processor 112 to execute data as shown in FIG. 2, FIG. 3, and FIG. 4 described above. Security verification methods. The network interface 113 is used for network communication, such as receiving messages. Those skilled in the art can understand that the structure shown in FIG. 11 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the device 110 to which the solution of the present application is applied. Include more or fewer parts than shown in the figure, or combine certain parts, or have a different arrangement of parts.

The processor 112 is configured to run a computer program stored in a memory to implement any embodiment of the data security verification method implemented by the foregoing terminal.

Another embodiment of the present application also provides a schematic block diagram of a computer device. In this embodiment, the device is a server. Please refer to FIG. 11 for details. The computer device includes the same structure as the computer device shown in FIG. 11. This computer device is different from the computer device shown in FIG. 11 in that when the computer program stored in the non-volatile storage medium in the computer device is executed by the processor 112, the data security verification method implemented on the server side can be implemented, such as Figures 5 and 6 show.

The processor 112 is configured to run a computer program stored in a memory to implement any embodiment of the data security verification method implemented on the server side.

It should be understood that, in the embodiment of the present application, the processor 112 may be a central processing unit (CPU), and the processor may also be another general-purpose processor or a digital signal processor (DSP). , Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, To implement any embodiment of the data security verification method implemented by the foregoing terminal.

In another embodiment of the present application, a computer-readable storage medium is also provided. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions are executed by a processor. To implement any embodiment of the data security verification method implemented on the server.

The storage medium includes a computer-readable storage medium, and the computer-readable storage medium includes a non-volatile computer-readable storage medium. The computer-readable storage medium may be an internal storage unit of the terminal or the server according to any of the foregoing embodiments, such as a hard disk or a memory of the terminal or the server. The computer-readable storage medium may also be an external storage device of the terminal or server, such as a plug-in hard disk, a Smart Media Card (SMC), and a secure digital (Secure Digital) , SD) card, etc. Further, the computer-readable storage medium may further include both an internal storage unit of the terminal or the server and an external storage device.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus, device, and method may be implemented in other manners. For example, the device embodiments described above are only schematic, and the division of the units is only a logical function division. In actual implementation, there may be another division manner. Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific work process performed by the processor on the devices, devices, units, and storage media described above can refer to the corresponding processes in the foregoing method embodiments. This is not repeated here. The above is only a specific implementation of this application, but the scope of protection of this application is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements should be covered by the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

A data security verification method applied to a terminal, wherein the method includes:

If it is detected that the conditions for obtaining data generated by the server are met, a pair of public and private keys are generated through an asymmetric encryption algorithm;

A first request is sent to the server, where the first request includes the public key, and the first request is used to obtain the first encrypted data of the server, where the first encrypted data is Obtained by encrypting the generated data;

Receiving the second encrypted data returned by the server, wherein the second encrypted data is obtained by the server encrypting the first encrypted data by using the public key;

Decrypting the received second encrypted data by using the private key to obtain the first encrypted data;

Sending a second request to the server, where the second request is used to obtain the generated data on the server;

Receiving the generated data returned by the server;

Encrypting the generated data by using the message digest algorithm to obtain third encrypted data;

Verifying whether the generated data received is secure according to the first encrypted data and the third encrypted data.
The method according to claim 1, wherein the verifying whether the generated data received is secure based on the first encrypted data and the third encrypted data comprises:

Comparing the first encrypted data with the third encrypted data;

Determining whether the first encrypted data and the third encrypted data are the same according to a comparison result;

If the first encrypted data and the third encrypted data are the same, determining that the generated data received is safe;

If the first encrypted data and the third encrypted data are different, it is determined that the generated data received is not secure.
The method according to claim 1, wherein before detecting that the conditions for acquiring data generated by the server are met, the method further comprises: if an acquisition instruction is received, detecting whether the conditions for acquiring data generated by the server are met .
The method according to claim 3, wherein the generated data comprises a generated application version update package, and the detecting whether the condition for obtaining the server-generated data is met comprises:

Sending a version number request to the server to receive the application version number returned by the server according to the version number request;

Obtaining the current version number of the application;

Determining whether the application requires a version update according to the application version number returned by the server and the obtained current version number of the application;

If the application needs to be updated, send the current operating environment data of the terminal where the application is located to the server, so that the server can determine whether the terminal meets the conditions for obtaining the application version update package according to the operating environment data And sending confirmation information to the terminal if the terminal meets the conditions;

Detecting whether the confirmation information returned by the server is received;

If the confirmation information returned by the server is received, it is confirmed that the conditions for obtaining the data generated by the server are met.
A data security verification method applied to a server side, wherein the method includes:

If the generated data is detected, the generated data is encrypted by a message digest algorithm to obtain the first encrypted data;

Receiving a first request sent by a terminal where an application is located, wherein the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain first encrypted data;

Encrypting the first encrypted data by using the public key to obtain second encrypted data;

Sending the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

Receiving a second request sent by the terminal, where the second request is used to obtain the generated data;

Sending the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain a third encrypted data, and according to the first encrypted data and the third encrypted data The data is encrypted to verify that the generated data is secure.
The method according to claim 5, wherein the generated data comprises a generated application version update package, and before the receiving a first request sent by a terminal where the application is located, the method further comprises: determining the Whether the terminal meets the conditions for obtaining the application version update package and sends a confirmation message to the terminal if it is determined that the terminal meets the conditions, so that the terminal confirms detection based on the confirmation information sent by the server To meet the conditions to obtain the data generated by the server.
A data security verification device includes:

A secret key generating unit, configured to generate a pair of a public key and a private key through an asymmetric encryption algorithm if it is detected that the conditions for obtaining data generated by the server are met;

A first request unit, configured to send a first request to a server, wherein the first request includes the public key, and the first request is used to obtain first encrypted data on the server, where the first encrypted data is The server end encrypts the generated data by using a message digest algorithm;

An encrypted data receiving unit configured to receive the second encrypted data returned by the server, wherein the second encrypted data is obtained by the server encrypting the first encrypted data by using the public key;

A private key decryption unit, configured to decrypt the received second encrypted data by using the private key to obtain the first encrypted data;

A second request unit, configured to send a second request to the server, where the second request is used to obtain the generated data on the server;

A generating data receiving unit, configured to receive the generated data returned by the server;

A first digest encryption unit, configured to encrypt the generated data by using the message digest algorithm to obtain third encrypted data;

A verification unit, configured to verify whether the generated data received is safe according to the first encrypted data and the third encrypted data.
The data security verification device according to claim 7, wherein the verification unit comprises:

A comparison unit, configured to compare the first encrypted data with the third encrypted data;

A comparison determining unit, configured to determine whether the first encrypted data and the third encrypted data are the same according to a comparison result;

A security verification unit, configured to determine that the generated data received is secure if the first encrypted data and the third encrypted data are the same;

The security verification unit is further configured to determine that the generated data received is not secure if the first encrypted data and the third encrypted data are different.
A data security verification device includes:

A second digest encryption unit, configured to: if the generated data is detected, encrypt the generated data by using a message digest algorithm to obtain the first encrypted data;

A first request receiving unit, configured to receive a first request sent by a terminal where an application is located, wherein the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain a first Encrypted data

A public key encryption unit, configured to encrypt the first encrypted data by using the public key to obtain second encrypted data;

An encrypted data sending unit, configured to send the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

A second request receiving unit, configured to receive a second request sent by the terminal, where the second request is used to obtain the generated data;

A generating data sending unit, configured to send the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain third encrypted data, and according to the first The encrypted data and the third encrypted data are used to verify whether the generated data is secure.
A data security verification system includes a server and at least one terminal, where the terminal is configured to perform the following steps:

If it is detected that the conditions for obtaining data generated by the server are met, a pair of public and private keys are generated through an asymmetric encryption algorithm;

A first request is sent to the server, where the first request includes the public key, and the first request is used to obtain the first encrypted data of the server, where the first encrypted data is Obtained by encrypting the generated data;

Receiving the second encrypted data returned by the server, wherein the second encrypted data is obtained by the server encrypting the first encrypted data by using the public key;

Decrypting the received second encrypted data by using the private key to obtain the first encrypted data;

Sending a second request to the server, where the second request is used to obtain the generated data on the server;

Receiving the generated data returned by the server;

Encrypting the generated data by using the message digest algorithm to obtain third encrypted data;

Verifying whether the generated data received is secure according to the first encrypted data and the third encrypted data.

The server is used to perform the following steps:

If the generated data is detected, the generated data is encrypted by a message digest algorithm to obtain the first encrypted data;

Receiving a first request sent by a terminal where an application is located, wherein the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain first encrypted data;

Encrypting the first encrypted data by using the public key to obtain second encrypted data;

Sending the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

Receiving a second request sent by the terminal, where the second request is used to obtain the generated data;

Sending the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain a third encrypted data, and according to the first encrypted data and the third encrypted data The data is encrypted to verify that the generated data is secure.
A computer device includes a memory and a processor connected to the memory; wherein,

The memory is used to store a computer program; the processor is used to run the computer program stored in the memory to perform the following steps:

If it is detected that the conditions for obtaining data generated by the server are met, a pair of public and private keys are generated through an asymmetric encryption algorithm;

A first request is sent to the server, where the first request includes the public key, and the first request is used to obtain the first encrypted data of the server, where the first encrypted data is Obtained by encrypting the generated data;

Receiving the second encrypted data returned by the server, wherein the second encrypted data is obtained by the server encrypting the first encrypted data by using the public key;

Decrypting the received second encrypted data by using the private key to obtain the first encrypted data;

Sending a second request to the server, where the second request is used to obtain the generated data on the server;

Receiving the generated data returned by the server;

Encrypting the generated data by using the message digest algorithm to obtain third encrypted data;

Verifying whether the generated data received is secure according to the first encrypted data and the third encrypted data.
The computer device according to claim 11, wherein, when the processor executes the step of verifying whether the generated data received is secure based on the first encrypted data and the third encrypted data, Perform the following steps:

Comparing the first encrypted data with the third encrypted data;

Determining whether the first encrypted data and the third encrypted data are the same according to a comparison result;

If the first encrypted data and the third encrypted data are the same, determining that the generated data received is safe;

If the first encrypted data and the third encrypted data are different, it is determined that the generated data received is not secure.
The computer device according to claim 11, wherein before executing the step of detecting that the conditions for obtaining data generated by the server are met, the processor further performs the following step: if an acquisition instruction is received, detecting whether the acquisition is satisfied Conditions for server-generated data.
The computer device according to claim 13, wherein the generated data includes a generated application version update package, and when the processor executes the step of detecting whether a condition for acquiring the server-generated data is met, Perform the following steps:

Sending a version number request to the server to receive the application version number returned by the server according to the version number request;

Obtaining the current version number of the application;

Determining whether the application requires a version update according to the application version number returned by the server and the obtained current version number of the application;

If the application needs to be updated, send the current operating environment data of the terminal where the application is located to the server, so that the server can determine whether the terminal meets the conditions for obtaining the application version update package according to the operating environment data And sending confirmation information to the terminal if the terminal meets the conditions;

Detecting whether the confirmation information returned by the server is received;

If the confirmation information returned by the server is received, it is confirmed that the conditions for obtaining the data generated by the server are met.
A computer device includes a memory and a processor connected to the memory; wherein,

The memory is used to store a computer program; the processor is used to run the computer program stored in the memory to perform the following steps:

If the generated data is detected, the generated data is encrypted by a message digest algorithm to obtain the first encrypted data;

Receiving a first request sent by a terminal where an application is located, wherein the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain first encrypted data;

Encrypting the first encrypted data by using the public key to obtain second encrypted data;

Sending the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

Receiving a second request sent by the terminal, where the second request is used to obtain the generated data;

Sending the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain a third encrypted data, and according to the first encrypted data and the third encrypted data The data is encrypted to verify that the generated data is secure.
The computer device according to claim 15, wherein the generated data includes a generated application version update package, and the processor further executes the step of receiving the first request sent by the terminal where the application is located, and Perform the following steps: determine whether the terminal meets the conditions for obtaining the application version update package and send a confirmation message to the terminal if it is determined that the terminal meets the conditions, so that the terminal is based on the received The confirmation information confirms that a condition that the data generated by the server is obtained is detected to be satisfied.
A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, where the computer program includes program instructions, and when the program instructions are executed by a processor, the following steps are implemented:

If it is detected that the conditions for obtaining data generated by the server are met, a pair of public and private keys are generated through an asymmetric encryption algorithm;

A first request is sent to the server, where the first request includes the public key, and the first request is used to obtain the first encrypted data of the server, where the first encrypted data is Obtained by encrypting the generated data;

Receiving the second encrypted data returned by the server, wherein the second encrypted data is obtained by the server encrypting the first encrypted data by using the public key;

Decrypting the received second encrypted data by using the private key to obtain the first encrypted data;

Sending a second request to the server, where the second request is used to obtain the generated data on the server;

Receiving the generated data returned by the server;

Encrypting the generated data by using the message digest algorithm to obtain third encrypted data;

Verifying whether the generated data received is secure according to the first encrypted data and the third encrypted data.
The computer-readable storage medium of claim 17, wherein the processor is executing the first encrypted data and the third encrypted data to verify whether the generated data is secure. When performing the steps, perform the following steps:

Comparing the first encrypted data with the third encrypted data;

Determining whether the first encrypted data and the third encrypted data are the same according to a comparison result;

If the first encrypted data and the third encrypted data are the same, determining that the generated data received is safe;

If the first encrypted data and the third encrypted data are different, it is determined that the generated data received is not secure.
The computer-readable storage medium according to claim 17, wherein before executing the step of detecting that the conditions for acquiring data generated by the server are met, the processor further performs the following steps: if an acquisition instruction is received, Check whether the conditions for obtaining data generated by the server are met.
A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, where the computer program includes program instructions, and when the program instructions are executed by a processor, the following steps are implemented:

If the generated data is detected, the generated data is encrypted by a message digest algorithm to obtain the first encrypted data;

Receiving a first request sent by a terminal where an application is located, wherein the first request includes a public key generated by the terminal using an asymmetric encryption algorithm, and the first request is used to obtain first encrypted data;

Encrypting the first encrypted data by using the public key to obtain second encrypted data;

Sending the second encrypted data to the terminal, so that the terminal decrypts the second encrypted data by using the private key generated by the asymmetric encryption algorithm to obtain the first encrypted data;

Receiving a second request sent by the terminal, where the second request is used to obtain the generated data;

Sending the generated data to the terminal, so that the terminal uses the message digest algorithm to encrypt the generated data to obtain a third encrypted data, and according to the first encrypted data and the third encrypted data The data is encrypted to verify that the generated data is secure.