CN115694800A - Data processing method, device, server and storage medium - Google Patents

Abstract

The embodiment of the application discloses a data processing method, a data processing device, a server and a storage medium, wherein the server obtains target data in a ciphertext form sent by a terminal; decrypting the second key in the form of the ciphertext in the second device by using the first key stored in the first device to obtain the second key in the form of the plaintext; decrypting the target key in the form of the ciphertext in the target configuration file by using the second key in the form of the plaintext to obtain the target key in the form of the plaintext; and decrypting the target data in the form of the ciphertext by using the target key in the form of the plaintext to obtain the target data in the form of the plaintext. In the application, the server side encrypts the target key for decrypting the target data and encrypts the key for encrypting the target key, and different decryption keys are stored at different positions, so that the security of the key is improved, the probability of cracking the data sent by the terminal is reduced, and the information security of a terminal user is ensured.

Description

Data processing method, device, server and storage medium

technical field

The present application relates to the technical field of data processing, and more specifically, to a data processing method, device, server and storage medium.

Background technique

At present, the key is used as a "key" to obtain other information, and is generally stored in the configuration file, so as to be called in real time during use. The configuration file is generally configured in a language that is easy to reverse compile. Once a hacker breaks through the server where the program is located, it is easy to decipher the key stored in the configuration file through reverse compilation, so that the deciphered key can be used to obtain other information of the end user, resulting in user information leakage. Therefore, how to ensure the security of end user information has become an urgent technical problem to be solved.

Contents of the invention

This application provides a data processing method, device, server, and storage medium, including the following technical solutions:

A data processing method for a server, the method comprising:

Obtain the target data in ciphertext form sent by the terminal;

Decrypting the second key in ciphertext form in the second device by using the first key stored in the first device to obtain the second key in plaintext form;

Deciphering the target key in ciphertext in the target configuration file by using the second key in plaintext to obtain the target key in plaintext;

The target data in ciphertext form is decrypted by using the target key in plaintext form to obtain the target data in plaintext form.

In the above method, preferably, the key used to encrypt the target data and the target key are asymmetric keys.

In the above method, preferably, the key for encrypting the second key and the first key are symmetric keys; and/or,

The key for encrypting the target key and the second key in plaintext form belong to symmetric keys.

In the above method, preferably, the first device and the second device are different.

In the above method, preferably, the first device and the second device are different databases.

In the above method, preferably, the first device and the second device are different service management platforms.

In the above method, preferably, one of the first device and the second device is a database, and the other is a service management platform.

A data processing device for a server, the device comprising:

Obtaining a module, configured to obtain target data in ciphertext form sent by the terminal;

The first decryption module is configured to use the first key stored in the first device to decrypt the second key in ciphertext form in the second device to obtain the second key in plaintext form;

The second decryption module is configured to use the second key in plaintext to decrypt the target key in ciphertext in the target configuration file to obtain the target key in plaintext;

The third decryption module is configured to use the target key in plain text to decrypt the target data in cipher text to obtain the target data in plain text.

A server comprising:

memory for storing programs;

A processor, configured to call and execute the program in the memory, and implement each step of the data processing method described in any one of the above items by executing the program.

A readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each step of the data processing method described in any one of the above items is realized.

It can be known from the above solution that, in the data processing method, device, server and storage medium provided by the present application, the server obtains the target data in cipher text form sent by the terminal; Decrypt the second key in ciphertext form to obtain the second key in plaintext form; use the second key in plaintext form to decrypt the target key in ciphertext form in the target configuration file to obtain the target key in plaintext form key; use the target key in plain text to decrypt the target data in cipher text to obtain the target data in plain text. In this application, the server side not only encrypts the target key used to decrypt the target data, but also encrypts the key used to encrypt the target key, and different decryption keys are stored in different locations , so as to improve the security of the key, reduce the probability of the data sent by the terminal being cracked, and ensure the information security of the terminal user.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

Fig. 1 is a kind of implementation flowchart of the data processing method that the embodiment of the present application provides;

FIG. 2 is a schematic structural diagram of a data processing device provided in an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a server provided by an embodiment of the present application.

The terms "first", "second", "third", "fourth", etc., if any, in the description and claims and the above drawings are used to distinguish similar parts and not necessarily to describe specific sequence or sequence. It should be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein can be practiced in sequences other than those illustrated herein.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The data processing method and device provided in the embodiments of the present application can be used in a server, where the server can be a single server, or a server cluster composed of multiple servers, or can be a cloud platform server.

As shown in Figure 1, an implementation flowchart of the data processing method provided in the embodiment of the present application may include:

Step S101: Obtain target data in ciphertext form sent by the terminal.

Optionally, the target data may be any data that needs to be encrypted as agreed between the terminal and the server. As an example, the server may be a server that provides business services, and the target data may be the login information that the terminal registered with the server in advance, such as account and password . When the terminal wants to log in to the target server, it can enter the account and password in the login page of the business system displayed on the terminal, and then trigger the generation of a login request, which carries the encrypted account and password, and the terminal sends the login request to the server. After receiving the login request, the server parses out the account and password in ciphertext form.

Step S102: Use the first key stored in the first device to decrypt the second key in ciphertext in the second device to obtain the second key in plaintext.

The first device and the second device are different devices.

As an example, the first device and the second device may be different databases. For example, the first device is a mysql database, and the second device is an oracle database.

As an example, the first device and the second device may be different service management platforms. For example, the first device is the Nacos service management platform, and the second device is the redis service management platform.

As an example, one of the first device and the second device is a database, and the other device is a service management platform. For example, the first device is a mysql database or an oracle database, and the second device is a Nacos service management platform or a redis service management platform; or, the first device is a Nacos service management platform or a redis service management platform, and the second device is a mysql database or oracle database.

Stored in the first device is the first key used to decrypt the second key in ciphertext. The first key is a key in plain text.

Stored in the second device is a second key used to decrypt the target key in ciphertext, and the second key is stored in ciphertext.

Step S103: Using the second key in plain text to decrypt the target key in cipher text in the target configuration file to obtain the target key in plain text.

The target configuration file stores a target key for decrypting target data in ciphertext, and the target key is stored in the target configuration file in ciphertext.

Step S104: using the target key in plain text to decrypt the target data in cipher text to obtain the target data in plain text.

From the above content, it can be known that in this application, the server sets three layers of keys for the target data, among which,

The first layer is the target key for decrypting the target data in ciphertext form;

The second layer is the second key for decrypting the target key in ciphertext form;

The third layer is the first key that decrypts the second key in ciphertext.

Taking the target data as an account and password as an example, after obtaining the account and password in plain text, the server can verify the account and password. If the verification passes, the terminal is allowed to log in to the business system; otherwise, the terminal is prohibited from logging in to the business system.

In the data processing method provided by this application, after the server obtains the target data in ciphertext form sent by the terminal, it uses the first key stored in the first device to decrypt the second key in ciphertext form in the second device to obtain The second key in plaintext form; use the second key in plaintext form to decrypt the target key in ciphertext form in the target configuration file to obtain the target key in plaintext form; use the target key in plaintext form to decrypt the target key in ciphertext form Decrypt the target data to get the target data in plain text. In this application, the server side not only encrypts the target key used to decrypt the target data, but also encrypts the key used to encrypt the target key, and different decryption keys are stored in different locations , so as to improve the security of the key, reduce the probability of the data sent by the terminal being cracked, and ensure the information security of the terminal user.

In an optional embodiment, the key used to encrypt the target data and the target key are asymmetric keys.

As an example, the key used to encrypt the target data in plaintext is the public key in the asymmetric key, and the target key used to decrypt the target data in ciphertext is the private key in the asymmetric key .

In an optional embodiment, the key for encrypting the second key and the first key are asymmetric keys.

As an example, the key used to encrypt the second key in plaintext belongs to the public key in the asymmetric key, and the first key used to decrypt the second key in ciphertext belongs to the asymmetric key. private key in the key.

In an optional embodiment, the key for encrypting the target key and the second key in plain text are symmetric keys.

As an example, the key used to encrypt the target key in plaintext belongs to the public key in the asymmetric key, and the second key used to decrypt the target key in ciphertext belongs to the asymmetric key private key.

This application found that if the three layers of encryption use asymmetric encryption, the decryption speed is relatively slow. In order to improve the decryption speed, both the second key and the target key can be encrypted with a symmetric key. Based on this,

In an optional embodiment, the key for encrypting the second key and the first key are symmetric keys. That is to say, the key used to encrypt the second key in plaintext and the first key used to decrypt the second key in ciphertext are the same key.

In an optional embodiment, the key for encrypting the target key and the second key in plain text are symmetric keys. That is to say, the key used to encrypt the target key in plaintext and the second key used to decrypt the target key in ciphertext are the same key.

In this application, the target data is encrypted with an asymmetric key, and both the target key and the second key are encrypted with a symmetric key, which improves the decryption speed while ensuring the security of the target data.

In an optional embodiment, the key used to encrypt the target data and the target key are symmetric keys. That is, the key used to encrypt target data in plaintext and the target key used to decrypt target data in ciphertext are the same key.

Correspondingly, the second key and the target key may be encrypted using a symmetric key or may be encrypted using an asymmetric key.

Corresponding to the method embodiment, the present application also provides a data processing device for a server. A schematic structural diagram of the data processing device provided in the embodiment of the present application is shown in FIG. 2 , which may include:

Obtaining module 201, first decryption module 202, second decryption module 203 and third decryption module 204; wherein,

The obtaining module 201 is used to obtain the target data in the form of ciphertext sent by the terminal;

The first decryption module 202 is configured to use the first key stored in the first device to decrypt the second key in ciphertext form in the second device to obtain the second key in plaintext form;

The second decryption module 203 is configured to use the second key in plaintext to decrypt the target key in ciphertext in the target configuration file to obtain the target key in plaintext;

The third decryption module 204 is configured to use the target key in plain text to decrypt the target data in cipher text to obtain target data in plain text.

The data processing device provided in the embodiment of the present application, after obtaining the target data in ciphertext form sent by the terminal, uses the first key stored in the first device to decrypt the second key in ciphertext form in the second device, Obtain the second key in plaintext form; use the second key in plaintext form to decrypt the target key in ciphertext form in the target configuration file to obtain the target key in plaintext form; use the target key in plaintext form to decrypt the ciphertext Decrypt the target data in plain text form to get the target data in plain text form. In this application, the server side not only encrypts the target key used to decrypt the target data, but also encrypts the key used to encrypt the target key, and different decryption keys are stored in different locations , so as to improve the security of the key, reduce the probability of the data sent by the terminal being cracked, and ensure the information security of the terminal user.

In an optional embodiment, the key used to encrypt the target data and the target key are asymmetric keys.

In an optional embodiment, the key for encrypting the second key and the first key are symmetric keys; and/or,

The key for encrypting the target key and the second key in plaintext form belong to symmetric keys.

In an optional embodiment, the first device and the second device are different.

In an optional embodiment, the first device and the second device are different databases.

In an optional embodiment, the first device and the second device are different service management platforms.

In an optional embodiment, one of the first device and the second device is a database, and the other is a service management platform.

Corresponding to the method embodiment, the present application also provides a server. A schematic structural diagram of the server is shown in FIG. 3 , which may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus4.

In the embodiment of the present application, there are at least one processor 1 , communication interface 2 , memory 3 , and communication bus 4 , and the processor 1 , communication interface 2 , and memory 3 communicate with each other through the communication bus 4 .

The processor 1 may be a central processing unit CPU, or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application.

The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

Wherein, the memory 3 stores a program, and the processor 1 can call the program stored in the memory 3, and the program is used for:

Obtain the target data in ciphertext form sent by the terminal;

Decrypting the second key in ciphertext form in the second device by using the first key stored in the first device to obtain the second key in plaintext form;

Deciphering the target key in ciphertext in the target configuration file by using the second key in plaintext to obtain the target key in plaintext;

The target data in ciphertext form is decrypted by using the target key in plaintext form to obtain the target data in plaintext form.

Optionally, the detailed functions and extended functions of the program can refer to the above description.

The embodiment of the present application also provides a storage medium, which can store a program suitable for execution by a processor, and the program is used for:

Obtain the target data in ciphertext form sent by the terminal;

Decrypting the second key in ciphertext form in the second device by using the first key stored in the first device to obtain the second key in plaintext form;

Deciphering the target key in ciphertext in the target configuration file by using the second key in plaintext to obtain the target key in plaintext;

The target data in ciphertext form is decrypted by using the target key in plaintext form to obtain the target data in plaintext form.

Optionally, the detailed functions and extended functions of the program can refer to the above description.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

It should be understood that in the embodiments of the present application, the subclaims, various embodiments, and features can be combined with each other to solve the foregoing technical problems.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. A data processing method for a server, wherein the method comprises: Obtain the target data in ciphertext form sent by the terminal; Decrypting the second key in ciphertext form in the second device by using the first key stored in the first device to obtain the second key in plaintext form; Deciphering the target key in ciphertext in the target configuration file by using the second key in plaintext to obtain the target key in plaintext; The target data in ciphertext form is decrypted by using the target key in plaintext form to obtain the target data in plaintext form. 2. The method according to claim 1, wherein the key used to encrypt the target data and the target key are asymmetric keys. 3. The method according to claim 1 or 2, wherein the key for encrypting the second key and the first key are symmetric keys; and/or, The key for encrypting the target key and the second key in plaintext form belong to symmetric keys. 4. The method of claim 1, wherein the first device and the second device are different. 5. The method according to claim 4, wherein the first device and the second device are different databases. 6. The method according to claim 4, wherein the first device and the second device are different service management platforms. 7. The method according to claim 4, wherein one of the first device and the second device is a database, and the other is a service management platform. 8. A data processing device for a server, wherein the device comprises: Obtaining a module, configured to obtain target data in ciphertext form sent by the terminal; The first decryption module is configured to use the first key stored in the first device to decrypt the second key in ciphertext form in the second device to obtain the second key in plaintext form; The second decryption module is configured to use the second key in plaintext to decrypt the target key in ciphertext in the target configuration file to obtain the target key in plaintext; The third decryption module is configured to use the target key in plain text to decrypt the target data in cipher text to obtain the target data in plain text. 9. A server, comprising: memory for storing programs; A processor, configured to call and execute the program in the memory, and realize each step of the data processing method according to any one of claims 1-7 by executing the program. 10. A readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each step of the data processing method according to any one of claims 1-7 is realized.

Images