WO2020019478A1

WO2020019478A1 - Communication data encryption method and apparatus

Info

Publication number: WO2020019478A1
Application number: PCT/CN2018/107638
Authority: WO
Inventors: 张驰
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-07-27
Filing date: 2018-09-26
Publication date: 2020-01-30
Also published as: CN109067739B; CN109067739A

Abstract

Disclosed in the present application is a communication data encryption method and apparatus. The method comprises: obtaining an access request to a target page initiated by a terminal device; in the case that a security plug-in is determined to exist in the terminal device according to the access request, obtaining first page data corresponding to the target page from a background server corresponding to the target page according to the access request, the security plug-in being used for encrypting or decrypting the data; encrypting the first page data in a first encryption mode agreed with the security plug-in to obtain second page data; and sending the second page data to the terminal device so that the terminal device decrypts the second page data by means of the security plug-in to obtain the first page data. The solution can prevent a tool for scanning a page such as a scanner and a crawler tool from directly obtaining page data, and avoid that the page data is obtained and tampered in a situation such as traffic hijacking.

Description

Communication data encryption method and device

This application claims priority from a Chinese patent application filed on July 27, 2018 with the Chinese Patent Office, application number 2018108525932, and application name "communication data encryption method and device", the entire contents of which are incorporated herein by reference.

Technical field

The present application relates to the field of communication technologies, and in particular, to a method and an apparatus for encrypting communication data.

Background technique

A website is an application that relies on web technology. Every information exchange in a website application involves a web client and a web server. Among them, the main task of the web client is to display information content to users. It uses html language and script programs. , CSS, plug-in technology, etc. to achieve the corresponding web page display; the web server provides business support for the web client, which specifically uses PHP, ASP, JSP and other technologies to achieve the corresponding functions. The interaction process between the web server and the web client is generally: the web client sends a request to the web server, and the web server returns the data (such as html code) corresponding to the request to the web client based on the request sent by the web client.

In order to improve the security of the website, certain encryption technology is generally used to encrypt some of the website's data. In some current encryption designs, the html code of the website is mainly encrypted to prevent the content structure of the website from being easily read. take. However, at present, there are still some interaction parameters between various functions of the website (such as user name and password submitted through the post form), which are transmitted in the form of clear text, facing the risk of being monitored, and the security of the website is not high enough.

Summary of the Invention

This application provides a communication data encryption method and device, which solves the problem of insufficient security of a website.

In a first aspect, a communication data encryption method is provided, including:

Obtaining an access request to a target page initiated by a terminal device;

When it is determined that a security plug-in exists in the terminal device according to the access request, the first page data corresponding to the target page is obtained from a background server corresponding to the target page according to the access request, and the security plug-in uses For encrypting or decrypting data;

Encrypting the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

Sending the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.

In a second aspect, a communication data encryption device is provided, including:

An access request obtaining module, configured to obtain an access request to a target page initiated by a terminal device;

A page data acquisition module, configured to obtain a first page corresponding to the target page from a background server corresponding to the target page according to the access request when it is determined that a security plug-in exists in the terminal device according to the access request Data, the security plug-in is used to encrypt or decrypt the data;

An encryption module, configured to encrypt the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

A page data sending module is configured to send the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.

According to a third aspect, another communication data encryption device is provided, including a processor, a memory, and a communication interface. The processor, the memory, and the communication interface are connected to each other. The communication interface is used to receive or send data. The memory The application program code for storing the communication data encryption device performing the above method, and the processor is configured to execute the method of the first aspect.

According to a fourth aspect, a computer storage medium is provided. The computer storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute the foregoing first aspect. method.

This technical solution can avoid that page scanning tools, such as scanners and crawling tools, directly obtain page data, and avoid page data being acquired and tampered in situations such as traffic hijacking.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic structural diagram of a website system according to an embodiment of the present application; FIG.

2 is a schematic flowchart of a communication data encryption method according to an embodiment of the present application;

3 is a schematic flowchart of another communication data encryption method according to an embodiment of the present application;

4 is a schematic structural diagram of a communication data encryption device according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of another communication data encryption device according to an embodiment of the present application.

detailed description

In the following, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

The technical solution of this application is applicable to a traditional website system that transmits data in plain text. The website system may include a website client and a website server. The website client is a user-facing client that provides services to users. The website client may be a general-purpose client, and the general-purpose client may provide services for multiple website servers, such as a browser; the website client may also be a specific client, and the specific client only uses To provide services for a specific website, such as a "Tencent Video" client. Generally, the website client runs on a user's terminal device. Among them, the terminal device includes, but is not limited to, a mobile phone, a computer, a tablet computer, an e-reader and other electronic devices with a website browsing function. The website server is used to manage and provide resources of the website system to the website client. The website server is used to provide various data to the website client so that the website client can display various pages to the user. The web server can consist of one or more servers. In the embodiment of the present application, an encryption server is added to a traditional website system that transmits data in plain text, and a security plug-in corresponding to the encryption server is developed. The security plug-in can be downloaded and installed in a terminal device, and the terminal device can use the security plug-in. The data is encrypted or decrypted, and the data sent by the website server to the website client and the data sent by the website client to the website server are encrypted by using an encryption server and a security plug-in to achieve the purpose of ensuring the security of the website. For example, the architecture of the website system in the embodiment of the present application may be as shown in FIG. 1. The website system includes a website client running on the terminal device 101, an encryption server 102, and a website server 103. The encryption server 102 is used for The data sent by the website server to the terminal device is encrypted and the data sent by the terminal device to the website server is encrypted. The terminal device also has a security plug-in installed, which is used to decrypt the data sent by the website server to the terminal device and decrypt the data The data sent by the terminal device to the website server is encrypted.

The method in the embodiment of the present application can be implemented on the system architecture shown in FIG. 1. The method in the embodiment of the present application is described below.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a communication data encryption method according to an embodiment of the present application. As shown in the figure, the method includes:

S201: The terminal device initiates an access request to the target page, and the encryption server obtains an access request to the target page.

Here, the terminal device initiates an access request to a target page through a website client running in the terminal device, and the target page is one of the pages of the website system. In the case where the website client is a general-purpose client, the target page can be one page of any website system that the user wants to access; in the case where the website client is a specific client, the target page is One page of the website system corresponding to the website client.

The target page corresponds to a uniform resource location (URL), the access request carries the URL, the URL points to an Internet protocol (IP) address, and the IP address is the address accessed by the access request.

In the embodiment of the present application, the IP address pointed to by the URL may have the following two designs:

In the first design, the IP address pointed to by the URL is the IP address of the encryption server. When the terminal device initiates an access request to the target page, the IP address obtained by the terminal device performing domain name resolution system (DNS) analysis on the URL is the IP address of the encryption server. The terminal device initiates an access request for the target page to the encryption server according to the IP address of the encryption server, and the encryption server obtains the access request for the target page in a received manner.

In the second design, the IP address pointed to by the URL is the IP address of the background server. When the terminal device initiates an access request to the target page, the IP address obtained by the terminal device parsing the URLDNS is the IP address of the background server. The terminal device initiates an access request to the target page to the background server according to the IP address of the background server, and the encryption server intercepts the access request to the target page by means of traffic hijacking to obtain the access request to the target page.

S202: The encryption server determines whether a security plug-in exists in the terminal device.

In the embodiment of the present application, the security plug-in may be a software program developed in conjunction with the encryption server, the security plug-in may communicate with the encryption server, and the security plug-in communicates with the encryption server to complete the encryption algorithm and encryption key used to encrypt the data, and Negotiation of the decryption algorithm and decryption key used to decrypt the data. The security plug-in may include a software program corresponding to an operation corresponding to one or more encryption algorithms. When the security plug-in negotiates with the encryption server the encryption algorithm and encryption key used to encrypt the data, the security plug-in can perform the corresponding operation of the encryption algorithm on the encryption key and the data that needs to be encrypted to the data that needs to be encrypted. Encrypt. When the security plug-in negotiates with the encryption server the decryption algorithm and decryption key used to decrypt the data, the security plug-in can perform the operation corresponding to the decryption algorithm on the decryption key and the data to be decrypted to the data that needs to be decrypted. Decrypt.

In a possible implementation manner, the encryption server may determine whether a security plug-in exists in the terminal device according to the access request to the target page, and the specific determination method may be as follows: the encryption server determines whether the access request to the target page is an encryption request ; If the access request is not an encryption request, it is determined that a security plug-in does not exist in the terminal device; if the access request is an encryption request, it is determined that a security plug-in exists in the terminal device.

In specific implementation, the encryption server may determine whether the data in the access request to the target page is plain text data to determine whether the access request to the target page is an encryption request. If at least part of the access request to the target page is If the data is not plain text data, the access request is determined to be an encryption request. If all data in the access request to the target page is clear text data, it is determined that the access request is not an encryption request.

When it is determined that a security plug-in exists in the terminal device, the encryption server may determine the identity of the terminal device according to the access request, determine the second decryption method agreed with the security plug-in in the terminal device according to the identity of the terminal device, and then adopt the second decryption method Decrypt the encryption request to obtain the original access request, and execute step S203.

Here, because the security plug-in exists in the terminal device, the encryption server can negotiate the encryption and decryption method of the access request with the security plug-in in the terminal device before the terminal device sends the access request to the target page, that is, the security plug-in is agreed to encrypt the access request. The encryption method used and the encryption server used to decrypt the access request.

In the embodiment of the present application, the encryption method may specifically include an encryption algorithm and an encryption key, and the decryption method may specifically include a decryption algorithm and a decryption key. The once-encrypted encryption algorithm and decryption algorithm are corresponding algorithms, and the once-encrypted encryption key. The decryption key is a key corresponding to each other. In some possible implementation manners, the operation corresponding to the encryption algorithm and the operation corresponding to the decryption algorithm are operations that perform the same logic. For example, the operation corresponding to the encryption algorithm and the operation corresponding to the decryption algorithm are hash operations; In other possible implementation manners, the operation corresponding to the encryption algorithm and the operation corresponding to the decryption algorithm are mutually inverse operations. If the encryption algorithm agreed by the encryption server and the security plug-in to encrypt the access request and the decryption algorithm to decrypt the access request are symmetric, the encryption key is the same as the decryption key. If the encryption algorithm agreed by the encryption server and the security plug-in to decrypt the access request and the decryption algorithm to decrypt the access request are asymmetric algorithms, the encryption key and the decryption key are a pair of public and private keys, where if the If the encryption key is a public key, the decryption key is a private key. If the encryption key is a private key, the decryption key is a public key.

Here, the identification of the terminal device may be the identification of the terminal device itself, such as the device identification of the terminal device, the IP address of the terminal device, or the identification information assigned to the terminal device by the encryption server, such as session information and cookie information. It is the identification information agreed upon when the encryption server and the security plug-in agree on the second decryption mode. Wherein, when the identification of the terminal device is the identification information agreed upon when the encryption server and the security plug-in agree on the second decryption method, when the security plug-in encrypts the access request and encrypts the access request using the agreed encryption method, the security plug-in Add the agreed identification information to the access request.

In specific implementation, the encryption server obtains the identity of the terminal device from the access request, and then, after determining the second decryption mode agreed with the security plug-in according to the identity of the terminal device, the decryption key corresponding to the second decryption mode An operation corresponding to the decryption algorithm corresponding to the second decryption method with the encrypted data in the access request is used to obtain the original access request.

When it is determined that the terminal device does not have a security plug-in, the encryption server executes step S209.

S203: The encryption server sends a resource acquisition request corresponding to the target page to the background server, and the background server receives a resource access request for the target page.

Here, the background server is the background server corresponding to the target page, that is, the background server of the website system containing the target page. The resource acquisition request corresponding to the target page is used to request the background server to return the first page data corresponding to the target page. When the first page data is run by the website client in the terminal device, the website client can display the target page.

In the embodiment of the present application, the encryption server sends the resource acquisition request corresponding to the target page to the background server in the following two cases:

In the first case, when the IP address pointed to by the URL carried in the access request for the target page is the first design described above, the IP address of the background server can be preset in the encryption server, and the IP of the background server can be set. The address is associated with the target access request. When the encryption server obtains the target access request, the resource of the page data corresponding to the target access request is determined on the background server according to the IP address associated with the target access request, so that the encryption server can The IP address corresponding to the target access request initiates a resource acquisition request corresponding to the target page to the background server. The target access request refers to an access request associated with the background server, that is, a related request of the website system.

For example, the domain name "pingan.com" corresponds to the IP address of the backend server in advance, and the IP address of the backend server is 192.168.11.32. When the encryption server receives the access request, the request carries the domain name "pingan.com" , For example, www.pingan.com/login, because this request carries "pingan.com", you can determine that the IP address of the back-end server corresponding to this request is 192.168.11.32, and the encryption server sends an IP address to 192.168. The background server of .11.32 initiates the resource request corresponding to the access request.

In the second case, when the IP address pointed to by the URL carried in the access request of the target page is the second design described above, after intercepting the access request to the target page, the encryption server may The carried URL performs DNS resolution to obtain the IP address of the background server, and the encryption server may initiate a resource acquisition request corresponding to the target page to the background server according to the IP address of the background server obtained through analysis. Specifically, the resource acquisition request corresponding to the target page may be the access request to the target page.

For example, the URL carried in the access request intercepted by the encryption server is www.pingan.com/login, and the encryption server parses the URL through DNS to obtain the IP address corresponding to the URL is 202.132.11.32. .11.32 The server initiates a resource request corresponding to the target page.

S204. The background server sends the first page data corresponding to the target page, and the encryption server obtains the first page data corresponding to the target page.

Here, the background server finds the website file corresponding to the target page from the website directory according to the resource acquisition request corresponding to the target page, obtains the first page data from the website file, and then sends the first page data.

In the embodiment of the present application, when the URL carried in the access request is the first design described above, the background server sends the first page data corresponding to the target page to the encryption server, and the encryption server obtains the target page corresponding by receiving The first page of data; in the case that the URL carried in the access request is the second design described above, the background server sends the first page of data corresponding to the target sending page to the terminal device, and the encryption server intercepts the data by means of traffic hijacking The first page data corresponding to the pair of target pages.

Optionally, if the URL carried in the access request is the first design described above, in a first possible implementation manner, the encryption server and the background server may communicate based on the HTTPS protocol. The encryption server may send a resource acquisition request corresponding to the target page to the background server based on the HTTPS protocol, and the encryption server may send the first page data corresponding to the target page to the encryption server based on the HTTPS protocol. In a second possible implementation manner, the encryption server can be accessed only by the encryption server, that is, the access server's access whitelist includes only the encryption server's IP address or MAC address, etc. to prove the encryption server. Identity information. In a secure manner, the communication security between the encryption server and the background server is ensured, which further enhances the security of the website system.

S205. The encryption server uses the first encryption method to encrypt the first page data to obtain the second page data.

Here, the first encryption method is an encryption method agreed by the server and the security plug-in in the terminal device before the first page data is encrypted. In some possible implementation manners, the encryption server and the security plug-in in the terminal device may periodically agree on an encryption and decryption manner. The first encryption method may specifically be an encryption method among the encryption and decryption methods that the security server and the terminal device ’s security plug-in agreed upon before encrypting the first page data. The specific content of the encryption method can be referred to the foregoing description, and is not repeated here.

Optionally, the first encryption method may have the following situations:

In the first case, the first encryption method is an encryption method agreed upon by the encryption server with the security plug-in in the terminal device after obtaining the first page data. After obtaining the first page data, the encryption server can negotiate the encryption and decryption method of the first page data with the security plug-in in the terminal device, that is, the encryption method used by the encryption server to encrypt the first page data and the security plug-in decryption are agreed. The first encryption method is the decryption method used for the first page data, and the encryption method adopted by the agreed encryption server to encrypt the first page data is the first encryption method.

In the second case, the first encryption method is an encryption method agreed by the encryption server with the security plug-in in the terminal device before the terminal device sends the access request to the target page. If the encryption server does not negotiate the encryption and decryption method of the first page data with the security plug-in in the terminal device after obtaining the first page data, the encryption server will communicate with the terminal device before the terminal device sends the access request for the target page. The encryption method in the encryption and decryption method agreed upon by the security plug-in in the server serves as the first encryption method.

In specific implementation, the encryption server performs an operation corresponding to the first encryption method on the encryption key corresponding to the first encryption method and the first page data to obtain the second page data.

S206. The encryption server sends the second page data to the terminal device, and the terminal device receives the second page data.

S207. The terminal device decrypts the second page data by using the security plug-in to obtain the first page data.

The security plug-in in the terminal device obtains the first page data by decrypting the second page data according to the decryption method agreed with the encryption server, and the decryption method corresponds to the first encryption method. The decryption method may be a decryption method among the encryption and decryption methods agreed upon by the security plug-in of the terminal device and the encryption server for the last time before the first page data is encrypted. For details of the decryption method, refer to the foregoing description, and details are not described herein again.

If the first encryption method is the first case described above, the decryption method is the decryption method agreed with the plug-in by the security plug-in of the terminal device after the encryption server obtains the first page data; if the first encryption method is the first description above In two cases, the decryption method is the decryption method agreed with the encryption server by the security plug-in of the terminal device before the terminal device sends the access request to the target page.

In specific implementation, the security plug-in in the terminal device performs the operation corresponding to the decryption method on the second page data and the decryption key corresponding to the decryption method to obtain the first page data.

S208. The terminal device displays the target page according to the first page data.

Specifically, the security plug-in of the terminal device sends the first page data to a website client in the terminal device, and the website client displays the target page according to the first page data.

S209: The encryption server sends the third page data to the terminal device, and the terminal device receives the third page data.

Here, the third page data is the page data corresponding to the download page corresponding to the security plug-in. The encryption server may obtain the third page data from the server that provides the security plug-in download service, and then sends the third page data to the terminal device. The server may be the encryption server, the background server, or another server.

Optionally, the encryption server may also directly obtain the security plug-in from a server providing a security plug-in download service, and then send the security plug-in to the terminal device, and the terminal device performs step S211 according to the security plug-in.

S210. The terminal device downloads the security plug-in from a download page corresponding to the security plug-in.

S211. The terminal device installs a security plug-in in the terminal device.

After the security plug-in is installed, the terminal device may execute step S201 to initiate an access request to the target page.

In the embodiment of the present application, since the page data is encrypted and decrypted by using an encryption server and a security plug-in respectively, the page data is transmitted in the form of ciphertext during the transmission process, which can avoid direct scanning by tools such as scanners and crawlers To page data, to avoid page data being fetched and tampered in situations such as traffic hijacking.

In the embodiment corresponding to FIG. 2 above, when a security plug-in is installed in the terminal device, the terminal device can obtain the original data of the website system, and the security plug-in is used to decrypt the page data received by the terminal device to obtain the original data. In some possible implementation manners, the security plug-in can also be used to encrypt the parameter information submitted by the terminal device to the background server. Participating in FIG. 3, FIG. 3 is a schematic flowchart of another communication data encryption method provided by an embodiment of the present application. This method is executed when a security plug-in is installed in a terminal device. The method includes:

S301. The terminal device acquires the second parameter input by the user through a parameter acquisition page.

In the embodiment of the present application, the parameter acquisition page refers to a page where a user can input data and submit, and the parameter acquisition page may specifically be a login page, a user information filling page, a user opinion submission page, and the like. The second parameter is the information entered by the user. The second parameter may be the user name, password, and verification code entered by the user through the login page. The second parameter may also be the name, gender, age, etc. that the user fills in through the user information page. The second parameter may also be a message or suggestion submitted by the user, and is not limited to the description here.

S302. The terminal device encrypts the second parameter by using the security plug-in to obtain the first parameter.

Here, the security plug-in of the terminal device encrypts the second parameter according to the encryption mode agreed with the encryption server to obtain the first parameter. The encryption method may be an encryption method among the encryption and decryption methods that the security plug-in of the terminal device and the encryption server agree on for the last time before the terminal device encrypts the first parameter. The specific content of the encryption method can be referred to the foregoing description, and is not repeated here.

In specific implementation, the security plug-in in the terminal device may perform a calculation corresponding to the encryption method on the second parameter and an encryption key corresponding to the agreed encryption method to obtain the first parameter.

S303. The terminal device initiates a parameter submission request, and the encryption server obtains the parameter submission request. The parameter submission request includes a first parameter.

Here, the parameter submission request carries a URL, the URL pointing to an IP address, and the IP address is the address of the parameter submission request submission parameter. The IP address pointed to by the URL is the same as the IP address pointed to by the URL carried in the access request. For specific implementations of the terminal device initiating the parameter submission request and the encryption server obtaining parameter submission request, reference may be made to the foregoing descriptions of the terminal device initiating the access request and the encryption server obtaining the access request, which will not be repeated here.

S304. The encryption server uses a first decryption method to decrypt the first parameter to obtain a second parameter.

Here, the first decryption method is the decryption method among the encryption and decryption methods that the security plug-in of the terminal device and the encryption server agree on for the last time before the terminal device encrypts the first parameter. For details of the decryption method, refer to the foregoing description, and details are not described herein again.

In specific implementation, the encryption server performs the operation corresponding to the first decryption method on the first parameter and the decryption key corresponding to the first decryption method to obtain the second parameter.

S305. The encryption server sends the second parameter to the background server, and the background server receives the second parameter.

In the embodiment of the present application, the sending of the second parameter by the encryption server to the background server is similar to the resource acquisition request corresponding to the target page sent by the encryption server to the background server. In one possible case, the encryption server may submit the request to determine the parameter according to the parameter. The IP address corresponding to the parameter submission request, and sends the second parameter to the background server according to the IP address corresponding to the parameter submission request; in another possible case, the encryption server parses the URL in the parameter submission request to obtain the background The IP address of the server, and then send the second parameter to the background service according to the parsed IP address.

S306. The background server sends the fourth page data according to the second parameter, and the encryption service obtains the fourth page data.

Here, for the manner in which the background server sends the fourth page data according to the second parameter and the encryption server obtains the third page data, refer to the foregoing step S204. The background server sends the first page data corresponding to the target page and the encryption server obtains the first page corresponding to the target page. The description of the data is not repeated here.

Optionally, in a case where the URL carried in the parameter submission request is the first design described above, in a first possible implementation manner, the encryption server and the background server may communicate based on the HTTPS protocol. The encryption server sends a second parameter to the background server based on the HTTPS protocol, and the encryption server sends the fourth page data to the encryption server based on the HTTPS protocol. In a second possible implementation manner, the access mode of the encryption server may be that only the encryption server is allowed to access. The security of the communication process between the encryption server and the background server is ensured by security means, which further enhances the security of the website system.

S307. The encryption server uses the second encryption method to encrypt the fourth page data to obtain the fifth page data.

S308. The encryption server sends the fifth page data to the terminal device, and the terminal device receives the fifth page data.

S309. The terminal device uses the security plug-in to decrypt the fifth page data to obtain the fourth page data.

S310: The terminal device displays a page corresponding to the fourth page data.

Here, the specific implementation of steps S307 to S310 is similar to the specific implementation of steps S204 to S207 described above, and reference may be made to the description of steps S204 to S207 described above, which will not be repeated here.

In the embodiment of the present application, the security plug-in and the encryption server in the terminal device respectively encrypt and decrypt the parameters obtained by the terminal device through the parameter acquisition page, so that these parameters are transmitted in the form of ciphertext during the transmission process, thereby avoiding these The parameters are acquired during the transmission process, ensuring the security and privacy of the parameters without changing the original website architecture.

The method of the embodiment of the present application is described above, and the apparatus of the embodiment of the present application is described below.

Referring to FIG. 4, FIG. 4 is a schematic structural diagram of a communication data encryption device according to an embodiment of the present application. The device 40 may be the encryption server or the encryption server in the embodiment shown in FIG. 1 or FIG. 2 to FIG. 3 described above. The device 40 includes:

An access request obtaining module 401, configured to obtain an access request for a target page initiated by a terminal device;

The page data acquisition module 402 is configured to, when it is determined that a security plug-in exists in the terminal device according to the access request, acquire a first corresponding to the target page from a background server corresponding to the target page according to the access request. Page data, the security plug-in is used to encrypt or decrypt the data;

An encryption module 403, configured to encrypt the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

A page data sending module 404 is configured to send the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.

In a possible design, the device 40 further includes:

A download page push module 405 is configured to send third page data to the terminal device when it is determined that a security plug-in does not exist in the terminal device according to the access request, so that the terminal device is protected from the security The download page corresponding to the plug-in downloads the security plug-in and installs it into the terminal device, and the third page data is page data corresponding to the download page.

In a possible design, the device 40 further includes:

The submission request obtaining module 406 is configured to obtain a parameter submission request initiated by the terminal device, where the parameter submission request includes a first parameter, and the first parameter is a second parameter encrypted by the terminal device through the security plug-in. The obtained parameter, the second parameter is a parameter obtained by the terminal device through a parameter acquisition page;

A decryption module 407, configured to decrypt the first parameter by using a first decryption method agreed with the security plug-in to obtain the second parameter;

The parameter sending module 408 is further configured to send the second parameter to the background server.

In a possible design, the page data obtaining module 402 is further configured to obtain fourth page data returned by the background server according to the second parameter;

The encryption module 403 is further configured to encrypt the fourth page data by using a second encryption method agreed with the security plug-in to obtain the fifth page data;

The page data sending module 404 is further configured to send the fifth page data to the terminal device, so that the terminal device decrypts the fifth page data through the security plug-in to obtain the fourth page data. .

In a possible design, the parameter sending module 408 is specifically configured to: send the second parameter to the background server based on a Secure Sockets Layer Hypertext Transfer HTTPS protocol;

The page data obtaining module 402 is configured to obtain the fourth page data returned by the background server based on the HTTPS protocol according to the second parameter.

In a possible design, the device further includes:

A judging module 409, configured to judge whether the access request is an encryption request;

If the access request is not an encryption request, the determining module 409 determines that a security plug-in does not exist in the terminal device;

If the access request is an encryption request, the determining module 409 determines that a security plug-in exists in the terminal device.

In a possible design, the page data acquisition module 402 is specifically configured to:

Determining the identity of the terminal device according to the access request;

Determining a second decryption mode agreed with the security plug-in according to the identifier of the terminal device;

The encryption server uses the second decryption method to decrypt the encryption request to obtain the original access request;

Obtaining the first page data corresponding to the target page from the background server corresponding to the target page according to the original access request.

It should be noted that, for the content not mentioned in the embodiment corresponding to FIG. 4, reference may be made to the description of the method embodiment, and details are not described herein again.

In the embodiment of the present application, it is possible to prevent a page scanning tool, such as a scanner and a crawler tool, from directly acquiring page data, and to prevent page data from being acquired and tampered in situations such as traffic hijacking.

Referring to FIG. 5, FIG. 5 is a schematic diagram of a composition structure of another communication data encryption device according to an embodiment of the present application. The device may be the encryption server or the encryption server in the embodiment shown in FIG. 1 or FIG. 2 to FIG. 3. As shown in the figure, the device 50 includes a processor 501, a memory 502, and a communication interface 503. The processor 501 is connected to the memory 502 and the communication interface 503. For example, the processor 501 may be connected to the memory 502 and the communication interface 503 through a bus.

The processor 501 is configured to support the communication data encryption device to perform a corresponding function of an encryption server in the communication data encryption method described in FIG. 2 to FIG. 3. The processor 501 may be a Central Processing Unit (CPU), a Network Processor (NP), a hardware chip, or any combination thereof. The above-mentioned hardware chip may be an Application-Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field programmable logic gate array (Field-Programmable Gate Array, FPGA), a universal array logic (Generic Array logic, GAL), or any combination thereof.

The memory 502 is used to store program code and the like. The memory 502 may include volatile memory (Volatile Memory, VM), such as Random Access Memory (RAM); the memory 502 may also include non-volatile memory (Non-Volatile Memory, NVM), such as read-only Read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 502 may also include a combination of the above types of memories. In the embodiment of the present application, the memory 502 is configured to store a communication data encryption program, a key, and the like.

The communication interface 503 is configured to send or receive data.

The processor 501 may call the program code to perform the following operations:

Obtaining, through the communication interface 503, an access request to the target page initiated by the terminal device;

When it is determined that a security plug-in exists in the terminal device according to the access request, the first page data corresponding to the target page is obtained from the background server corresponding to the target page through the communication interface 503 according to the access request. The security plug-in is used to encrypt or decrypt data;

Sending the second page data to the terminal device through the communication interface 503, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.

An embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by the computer, cause the computer to execute as described above. In the method according to the embodiment, the computer may be a part of the communication data encryption device mentioned above. For example, it is the processor 501 described above.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by using a computer program to instruct related hardware. The program can be stored in a computer-readable storage medium. The program When executed, the processes of the embodiments of the methods described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

The above disclosure is only the preferred embodiments of this application, and of course, the scope of rights of this application cannot be limited by this. Therefore, equivalent changes made according to the claims of this application still fall within the scope of this application.

Claims

A communication data encryption method, comprising:

Obtaining an access request to a target page initiated by a terminal device;

When it is determined that a security plug-in exists in the terminal device according to the access request, the first page data corresponding to the target page is obtained from a background server corresponding to the target page according to the access request, and the security plug-in uses For encrypting or decrypting data;

Encrypting the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

Sending the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.
The method according to claim 1, further comprising:

If it is determined that a security plug-in does not exist in the terminal device according to the access request, sending third page data to the terminal device, so that the terminal device downloads the download page A security plug-in is installed in the terminal device, and the third page data is page data corresponding to the download page.
The method according to claim 1 or 2, wherein after sending the second page data to the terminal device, the method further comprises:

Obtaining a parameter submission request initiated by the terminal device, where the parameter submission request includes a first parameter, where the first parameter is a parameter obtained by the terminal device encrypting a second parameter through the security plugin, and the second The parameter is a parameter obtained by the terminal device through a parameter acquisition page;

Decrypting the first parameter by using a first decryption method agreed with the security plug-in to obtain the second parameter;

Sending the second parameter to the background server.
The method according to claim 3, after sending the second parameter to the background server, further comprising:

Acquiring fourth page data returned by the background server according to the second parameter;

Encrypting the fourth page data by using a second encryption method agreed with the security plug-in to obtain fifth page data;

Sending the fifth page data to the terminal device, so that the terminal device decrypts the fifth page data through the security plug-in to obtain the fourth page data.
The method according to claim 4, wherein the sending the second parameter to the background server by the encryption server comprises:

Sending the second parameter to the background server based on the Secure Sockets Layer Hypertext Transfer HTTPS protocol;

The obtaining the fourth page data returned by the background server according to the second parameter includes:

Acquiring fourth page data returned by the background server based on the HTTPS protocol according to the second parameter.
The method according to claim 1 or 2, wherein after obtaining the access request for the target page initiated by the terminal device, further comprising:

Determining whether the access request is an encryption request;

If the access request is not an encryption request, determining that a security plug-in does not exist in the terminal device;

If the access request is an encryption request, it is determined that a security plug-in exists in the terminal device.
The method according to claim 6, wherein the acquiring the first page data corresponding to the target page from the background server corresponding to the target page according to the access request comprises:

Determining the identity of the terminal device according to the access request;

Determining a second decryption mode agreed with the security plug-in according to the identifier of the terminal device;

The encryption server uses the second decryption method to decrypt the encryption request to obtain the original access request;

Obtaining the first page data corresponding to the target page from the background server corresponding to the target page according to the original access request.
A communication data encryption device, comprising:

An access request obtaining module, configured to obtain an access request to a target page initiated by a terminal device;

A page data acquisition module, configured to obtain a first page corresponding to the target page from a background server corresponding to the target page according to the access request when it is determined that a security plug-in exists in the terminal device according to the access request Data, the security plug-in is used to encrypt or decrypt the data;

An encryption module, configured to encrypt the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

A page data sending module is configured to send the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.
The apparatus according to claim 8, further comprising:

Download a page push module, configured to send third page data to the terminal device if it is determined that a security plug-in does not exist in the terminal device according to the access request, so that the terminal device removes the security plug-in from the security plug-in The corresponding download page downloads the security plug-in and installs it into the terminal device, and the third page data is page data corresponding to the download page.
The device according to claim 8 or 9, wherein the device further comprises:

The submission request obtaining module is configured to obtain a parameter submission request initiated by the terminal device, where the parameter submission request includes a first parameter, where the first parameter is obtained by the terminal device encrypting a second parameter through the security plug-in. The second parameter is a parameter obtained by the terminal device through a parameter acquisition page;

A decryption module, configured to decrypt the first parameter by using a first decryption method agreed with the security plug-in to obtain the second parameter;

The parameter sending module is further configured to send the second parameter to the background server.
The device according to claim 10, wherein the page data obtaining module is further configured to obtain fourth page data returned by the background server according to the second parameter;

The encryption module is further configured to encrypt the fourth page data by using a second encryption method agreed with the security plug-in to obtain the fifth page data;

The page data sending module is further configured to send the fifth page data to the terminal device, so that the terminal device decrypts the fifth page data through the security plug-in to obtain the fourth page data.
The device according to claim 11, wherein the parameter sending module is specifically configured to send the second parameter to the background server based on a secure socket layer Hypertext Transfer HTTPS protocol;

The page data obtaining module is specifically configured to obtain fourth page data returned by the background server based on the HTTPS protocol according to the second parameter.
The device according to claim 8 or 9, wherein the device further comprises:

A judging module, configured to judge whether the access request is an encryption request;

If the access request is not an encryption request, the determining module determines that a security plug-in does not exist in the terminal device;

If the access request is an encryption request, the determining module determines that a security plug-in exists in the terminal device.
The apparatus according to claim 13, wherein the page data acquisition module is specifically configured to:

Determining the identity of the terminal device according to the access request;

Determining a second decryption mode agreed with the security plug-in according to the identifier of the terminal device;

The encryption server uses the second decryption method to decrypt the encryption request to obtain the original access request;

Obtaining the first page data corresponding to the target page from the background server corresponding to the target page according to the original access request.
A communication data encryption device includes a processor, a memory, and a communication interface. The processor, the memory, and the communication interface are connected to each other. The communication interface is used to send or receive data, and the memory is used to store program code. The processor is configured to call the program code and perform the following operations:

Obtaining an access request to a target page initiated by a terminal device;

When it is determined that a security plug-in exists in the terminal device according to the access request, the first page data corresponding to the target page is obtained from a background server corresponding to the target page according to the access request, and the security plug-in uses For encrypting or decrypting data;

Encrypting the first page data by using a first encryption method agreed with the security plug-in to obtain second page data;

Sending the second page data to the terminal device, so that the terminal device decrypts the second page data through the security plug-in to obtain the first page data.
The apparatus according to claim 15, wherein the processor is further configured to perform the following operations:

If it is determined that a security plug-in does not exist in the terminal device according to the access request, sending third page data to the terminal device, so that the terminal device downloads the download page corresponding to the security plug-in A security plug-in is installed in the terminal device, and the third page data is page data corresponding to the download page.
The apparatus according to claim 15 or 16, wherein the processor is further configured to perform the following operations:

Obtaining a parameter submission request initiated by the terminal device, where the parameter submission request includes a first parameter, where the first parameter is a parameter obtained by the terminal device encrypting a second parameter through the security plugin, and the second The parameter is a parameter obtained by the terminal device through a parameter acquisition page;

Decrypting the first parameter by using a first decryption method agreed with the security plug-in to obtain the second parameter;

Sending the second parameter to the background server.
The apparatus according to claim 17, wherein the processor is further configured to perform the following operations:

Acquiring fourth page data returned by the background server according to the second parameter;

Encrypting the fourth page data by using a second encryption method agreed with the security plug-in to obtain fifth page data;

Sending the fifth page data to the terminal device, so that the terminal device decrypts the fifth page data through the security plug-in to obtain the fourth page data.
The device according to claim 18, wherein the processor performing the operation of sending the second parameter to the background server by the encryption server comprises:

Sending the second parameter to the background server based on the Secure Sockets Layer Hypertext Transfer HTTPS protocol;

The obtaining the fourth page data returned by the background server according to the second parameter includes:

Acquiring fourth page data returned by the background server based on the HTTPS protocol according to the second parameter.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.