Disclosure of Invention
This section is intended to outline some aspects of embodiments of the application and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section as well as in the description of the application and in the title of the application, which may not be used to limit the scope of the application.
The present invention has been made in view of the above-described problems occurring in the prior art.
In order to solve the technical problems, the invention provides the following technical proposal that the symmetric encryption algorithm is utilized to encrypt the sensitive information input by the user in the shopping process, and the encrypted sensitive information of the user is stored in the temporary cache;
reading the encrypted user sensitive information, and sending the encrypted user sensitive information to a server through a secure transmission protocol for information integrity verification;
After verification is passed, the server invokes a decryption key corresponding to a symmetric encryption algorithm to decrypt the encrypted user sensitive information;
and the decrypted user sensitive information is transmitted to a data processing center through a secure transmission protocol.
As a preferable scheme of the information security transmission method based on the Internet, the user sensitive information at least comprises payment information, personal identity information, contact information, account information and position information.
As a preferred scheme of the internet-based information security transmission method, the user sensitive information is initialized by loading a symmetric encryption algorithm library to obtain an initial vector, and the generated secret key is utilized to execute the encryption operation of the symmetric encryption algorithm on the initial vector to generate encrypted information, namely the encrypted user sensitive information.
As a preferable scheme of the internet-based information security transmission method of the present invention, the encrypted information is stored in a temporary buffer in the form of an encrypted packet;
The encryption package at least comprises encryption data, an initial vector and encryption metadata, wherein the encryption data is encrypted real data, the initial vector is an initial vector used in an encryption process and used for ensuring that the same data are different in encryption result each time, and the encryption metadata is algorithm type and version information and used for identifying encryption algorithms and parameters used in decryption.
As a preferred scheme of the internet-based information security transmission method of the present invention, the information integrity verification is performed, including:
Reading the encrypted user sensitive information from the temporary cache of the client;
The encrypted user sensitive information is sent to a server by utilizing a secure transmission protocol;
Generating an information abstract on the encrypted user sensitive information at the client and the server by using a hash algorithm;
and comparing the information abstracts generated by the client and the server to verify the information integrity.
As a preferred scheme of the internet-based information security transmission method of the present invention, the information digest is a fixed length value obtained by irreversibly transforming the encrypted user-sensitive information, wherein:
when the fixed length values of the information summaries generated by the client and the server are consistent, the similarity of the client and the server is large, and the fact that the data are not tampered in the transmission process and verification is passed is indicated;
When the fixed length values of the information summaries generated by the client and the server are inconsistent, the two values have large difference, and the tampered data in the transmission process is indicated, and the verification is not passed.
As a preferable scheme of the internet-based information security transmission method of the present invention, the decryption is an inverse process of the encryption process.
The invention has the beneficial effects that:
1. The invention realizes the protection of the encrypted data in the transmission process through the secure transmission protocol (such as HTTPS or TLS) and prevents man-in-the-middle attack and data packet tampering, and meanwhile, the information integrity check ensures that the data is not modified or damaged in the transmission process, and the combination of the secure transmission protocol and the integrity check effectively improves the safety and the reliability in the data transmission process;
2. The invention improves the safety and the credibility of the data processing process by ensuring that the decryption operation is only carried out after the data integrity is verified;
3. The invention safely transmits the decrypted user sensitive information to the data processing center by using the safe transmission protocol again, ensures that the information is still protected in the transmission process even after the data is decrypted, prevents the data from being leaked and unauthorized access, ensures the safety of the whole data processing link and ensures the whole protection of the user sensitive information from the input to the final processing.
Detailed Description
So that the manner in which the above recited objects, features and advantages of the present invention can be understood in detail, a more particular description of the invention, briefly summarized above, may be had by reference to the embodiments, some of which are illustrated in the appended drawings.
All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention, but the present invention may be practiced in other ways other than those described herein, and persons skilled in the art will readily appreciate that the present invention is not limited to the specific embodiments disclosed below.
Example 1
According to an embodiment of the present invention, in combination with the flowchart shown in fig. 1, an internet-based information security transmission method specifically includes the following steps:
S1, encrypting sensitive information input by a user in a shopping process by utilizing a symmetric encryption algorithm, and storing the encrypted sensitive information of the user in a temporary cache;
s2, reading the encrypted user sensitive information, and sending the encrypted user sensitive information to a server through a secure transmission protocol to carry out information integrity verification;
s3, after verification, the server invokes a decryption key corresponding to the symmetric encryption algorithm to decrypt the encrypted user sensitive information;
and S4, transmitting the decrypted user sensitive information to a data processing center through a secure transmission protocol.
It should be noted that, the above steps ensure the security of the user sensitive information in the whole transmission and processing process by adopting the symmetric encryption algorithm and the secure transmission protocol.
Preferably, the embodiment of the invention effectively prevents information leakage and tampering, improves the safety and transmission reliability of user data, and ensures the high efficiency of the system and good experience of users while improving the information safety.
The practice and/or effect of certain examples of the invention are described in more detail below in conjunction with some preferred or alternative examples of the invention.
[ Encryption info ]
The user inputs sensitive information such as account information, personal identity information, address IP, credit card number at the shopping client;
the client performs data preprocessing on the input sensitive information, including blank character removal and error format removal, so as to ensure that the data information meets encryption requirements;
generating a unique symmetric encryption key by a symmetric encryption algorithm (such as AES encryption);
loading a symmetrical encryption algorithm library, and initializing encryption parameters to obtain an initial vector;
using the generated secret key and the initial vector to execute a symmetric encryption algorithm to encrypt the preprocessed user sensitive information;
and storing the encrypted user sensitive information in a temporary cache.
As an example, the temporary cache employs a secure storage mechanism to prevent unauthorized access.
By way of example, the encryption key is securely stored and managed, such as by a key management system, to ensure that the key is not compromised.
By way of example, selecting an applicable symmetric encryption algorithm for encryption, such as AES-256, the implementation may be represented by the following equation:
Wherein E is symmetrically encrypted user sensitive information, M i is preprocessed ith sensitive information, mu is all sensitive information, and an exponential function exp (x) is used for mapping the sensitive information to a high-dimensional space, increasing complexity and safety of the sensitive information, and a second derivative function The method is used for describing the change rate of information filtering, ensuring that sensitive information keeps consistency and stability in the encryption process, and third-order derivative functionFor further increasing the complexity of the information and preventing sensitive information from being restored or hacked during the encryption process.
The value range of the above formula is (- +and +) which indicates that highly complex and safe encryption processing is performed on the user sensitive information, when the value of E approaches 0, the encrypted information tends to be in an information-free state, so that information leakage is prevented, when the value of E approaches +, the information is highly encrypted, the security is high, and when the value of E approaches- +, the information is highly encrypted, the security is low.
In an alternative embodiment, the user sensitive information includes at least payment information, personal identity information, contact information, account information, and location information.
As an example, the payment information contains at least a credit card number, a validity period, a CVV code, and bank account information.
As an example, the personal identity information contains at least a name, an identification card number, a passport number, and a social security number.
As an example, the contact means contains at least a telephone number, an email box, and a receiving address.
As an example, the account information contains at least a user name, a password, a security question, and an answer.
As an example, the location information contains at least a location IP.
In an alternative embodiment, the encryption information is stored in a temporary buffer memory in the form of an encryption packet, wherein the encryption packet at least comprises encryption data, an initial vector and encryption metadata, the encryption data is real data after encryption, the initial vector is an initial vector used in the encryption process and used for ensuring that the same data has different encryption results each time, and the encryption metadata is algorithm type and version information and used for identifying encryption algorithms and parameters used in decryption.
Preferably, the step realizes the preliminary protection of the sensitive information of the user, prevents an unauthorized third party from acquiring or tampering with the information before data transmission, and ensures that the shopping experience of the user is not obviously affected in the encryption process due to the high efficiency of the symmetric encryption algorithm.
Preferably, the temporary buffer memory is used, so that the system can quickly respond to user operation, the response speed and user experience of the system are improved, and confidentiality and integrity of user sensitive information in the whole transmission link are ensured by encrypting the data before transmission.
[ Information integrity check ]
Reading encrypted user sensitive information from the temporary cache of the client;
the encrypted user sensitive information is sent to a server by utilizing a secure transmission protocol;
Generating information abstracts on the encrypted user sensitive information at the client and the server by utilizing a hash algorithm (such as SHA-256);
and comparing the information abstracts generated by the client and the server to verify the information integrity, wherein:
When the fixed length values of the information summaries generated by the client and the server are consistent, the similarity of the client and the server is large, the fact that the data are not tampered in the transmission process is indicated, and verification is passed;
When the fixed length values of the information summaries generated by the client and the server are inconsistent, the two values are large in difference, the fact that the data are tampered in the transmission process is indicated, and verification is not passed.
It should be noted that the information digest is a fixed length value obtained by performing irreversible transformation on encrypted user sensitive information, and is used for checking the integrity of the information.
As an example, the secure transport protocol may employ HTTPS, TLS to ensure that data during transport is not eavesdropped or tampered with.
As an example, the information integrity check may be implemented by:
Wherein E (x c, k) is symmetric encryption of the sensitive information x c of the client by using the key k, E (x s, k) is symmetric encryption of the sensitive information x s of the server by using the key k, H (x c, k)) is an information digest generated by the client by using a hash algorithm (e.g. SHA-256), and H (E (x s, k)) is an information digest generated by the server by using a hash algorithm (e.g. SHA-256).
The above formula verifies the integrity of the information by comparing the similarity of the information summaries generated by the server and the client.
It should be noted that, the value range of the above formula is [0,2], when the value approaches 2, it indicates that the information abstracts generated by the client and the server are more similar, the data is not tampered, and when the value approaches 0, it indicates that the information abstracts generated by the client and the server are more dissimilar, i.e. the difference is large, the data may be tampered in transmission.
In an alternative embodiment, in order to further improve security, replay attacks may be prevented by adding a timestamp and a sequence number to the information, and the server will verify the validity of the timestamp and sequence number, ensuring that the received data is up to date and not sent repeatedly.
The foregoing manner of adding the timestamp and the sequence number may be performed by using a manner and means in the prior art, which are not described in detail in this example.
[ Decrypting ]
The server retrieves the key and the corresponding symmetric decryption algorithm (corresponding to the encryption algorithm, such as AES) to decrypt the encrypted user sensitive information;
after decryption, the server performs the data integrity check again, ensuring that the decrypted data is not tampered inside the server.
Alternatively, the server may verify the legitimacy of the decrypted data, for example, to check whether the data format and content are in compliance with expectations.
As an example, decryption is the inverse of encryption processing, and if AES encryption is used, decryption will also use the decryption mode of AES, using the same key, the decryption process of which can be expressed by:
Wherein D (E, k) is a function of decrypting the encrypted information E using the key k, S (E) is a function of evaluating the security level of the encrypted information E, the higher the value thereof is, the more likely the data security is threatened, E -S(E) is an exponential decay factor for dynamically adjusting the weight of the decrypted data according to the security level of the data, and F (·) is a filter function for extracting and verifying the validity of the decrypted data.
It should be noted that x in the above formula is user sensitive information after final decryption and processing by a filtering function, which represents the processed security available information.
In an alternative embodiment, the output data x is further processed after decryption by introducing a filtering function, so that the validity of the output data is ensured, possible errors or non-compliance content is filtered, for example, whether the decrypted data meets a specific format or verification standard can be checked, and the safety and accuracy of data processing are further enhanced.
The embodiment of the invention also needs to explain that when the user sensitive information is processed, if the network interruption does not occur in the shopping process, the symmetric encryption algorithm is adopted to encrypt the user input sensitive information, the encrypted user sensitive information is stored in the temporary cache, the instant safety and usability of the user input information are ensured by locally caching the data, the basis is laid for the subsequent safe transmission and processing, the speed of the encryption process is ensured by the high efficiency of the symmetric encryption, the system response speed is improved by utilizing the accessibility of the temporary cache, and the shopping experience of the user is further ensured not to be influenced.
Further, if network interruption occurs in the shopping process, connection is reestablished through a secure transmission protocol, encrypted data in a cache is sent to a server for information integrity verification, the safety and the integrity of the data in the transmission process are ensured by adopting an HTTPS or TLS protocol, meanwhile, the data integrity is not affected by using a retransmission mechanism, after the network is recovered to be normal, the server receives and verifies the integrity of the transmitted data, and after the server is confirmed to be correct, a decryption key corresponding to a symmetric encryption algorithm is called for decryption, so that the data integrity is ensured, and meanwhile, the reliability and the safety of the data transmission are ensured.
Preferably, after the server passes the verification, the encrypted user sensitive information is decrypted, and the decryption key of the symmetric encryption algorithm is used for processing, so that the decryption process not only ensures that only the legal server can access the user sensitive information, but also decrypts after the integrity is verified, the safety and the reliability of the system are further improved, the decrypted user sensitive information is transmitted to the data processing center through a secure transmission protocol, and the safety of data in the transmission process is ensured.
It should be noted that the above embodiments are only for illustrating the technical solution of the present invention and not for limiting the same, and although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention may be modified or substituted without departing from the spirit and scope of the technical solution of the present invention, which is intended to be covered in the scope of the claims of the present invention.