WO2017016272A1 - Method, apparatus and system for processing virtual resource data - Google Patents

Abstract

Provided is a method for processing virtual resource data. The method comprises: sending a virtual resource transfer request; acquiring a first challenge code, which is generated by means of encryption using a public key of a client certificate, and a private key of the client certificate, and using the private key to decrypt the first challenge code; generating a first digital signature according to the decrypted first challenge code; and when the first digital signature is consistent with a second digital signature in a server, allowing virtual resource transfer. Further provided are an apparatus and system for processing virtual resource data.

Description

Method, device and system for processing virtual resource data

This application claims priority to Chinese Patent Application No. 201510455785.6, entitled "Processing, Apparatus and System for Processing Virtual Resource Data", filed on July 29, 2015, the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present invention belongs to the field of communications technologies, and in particular, to a method, device, and system for processing virtual resource data.

Background technique

With the continuous advancement of Internet technology, people are increasingly demanding the security of the Internet.

Taking the fast payment based on the client digital certificate as an example, at present, when a payment request is initiated, a partial key pair in the payment request is first digitally signed using the private key in the client digital certificate, and then the signed data is used as a The new field is submitted to the payment backend server along with other information in the payment request. After receiving the request, the background server decrypts the signature using the public key of the certificate. If the decryption is successful and the decrypted data is correct, it is considered correct by the user. Payment request. Since the private key of the client certificate is only available on the user's terminal device, it is difficult for others to fake the user's signature.

technical problem

When the user's payment request is processed in the background, the user's signature encrypted by the asymmetric encryption algorithm needs to be decrypted in real time, and the efficiency of the asymmetric encryption algorithm is relatively low. Public key encryption algorithm (RSA, RSA As an example, the algorithm has an encryption and decryption speed equivalent to about 1/1000 of the symmetric encryption algorithm of the same encryption strength. Under this design, the pressure exerted by the certificate user on the background server is obviously greater than that of the non-certificate user, and the operation efficiency is relatively low.

Technical solution

It is an object of the present invention to provide a method and apparatus for processing virtual resource data, which aims to reduce the load pressure of the server and improve the operating speed of the server.

To solve the above technical problem, the first aspect of the embodiments of the present invention provides:

A method for processing virtual resource data, including:

Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request;

And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate;

Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate;

Generating a first digital signature according to the decrypted first challenge code and the field information;

When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

The second aspect of the embodiments of the present invention provides:

A method for processing virtual resource data, including:

Receiving a transfer request of the virtual resource data, where the transfer request carries field information related to the request;

And sending, according to the transfer request, a preset first challenge code to the client, where the first challenge code is generated by using a public key of the client certificate;

Receiving a first digital signature sent by the client, the first digital signature is decrypted by the client by using a private key of the client certificate, and according to the decrypted first challenge code and the Field information is generated;

When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

The third aspect of the embodiments of the present invention provides:

A processing device for virtual resource data, comprising a processor, the processor is configured to:

Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request;

And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate;

Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate;

Generating a first digital signature according to the decrypted first challenge code and the field information;

When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

The fourth aspect of the embodiments of the present invention provides:

A processing device for virtual resource data, comprising a processor, the processor is configured to:

Receiving a transfer request of the virtual resource data, where the transfer request carries field information related to the request;

And sending, according to the transfer request, a preset first challenge code to the client, where the first challenge code is generated by using a public key of the client certificate;

Receiving a first digital signature sent by the client, the first digital signature is decrypted by the client by using a private key of the client certificate, and according to the decrypted first challenge code and the Field information is generated;

When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

The fifth aspect of the embodiments of the present invention provides:

A processing system for virtual resource data, comprising a client and a server, wherein the client is a processing device for virtual resource data provided by the third aspect, and the server is a processing device for virtual resource data provided by the fourth aspect.

Additionally, a storage medium having stored therein processor-executable instructions, wherein the processor-executable instructions are for causing the processor to:

Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request;

And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate;

Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate;

Generating a first digital signature according to the decrypted first challenge code and the field information;

When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

Beneficial effect

Compared with the prior art, in this embodiment, the server generates a challenge code for the user by using the public key in the client certificate in advance; the user decrypts the challenge code by using the private key of the client certificate when requesting the virtual resource transfer; and then according to the challenge after decryption The code and the field information related to the request generate a digital signature; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, the challenge of the public key cannot be encrypted. The code is decrypted so it cannot mimic the user's signature. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed.

DRAWINGS

The technical solutions and other advantageous effects of the present invention will be apparent from the following detailed description of embodiments of the invention.

1 is a schematic flowchart of a method for processing virtual resource data according to a first embodiment of the present invention;

2 is a schematic flowchart of a method for processing virtual resource data according to a second embodiment of the present invention;

3 is a schematic flowchart of a method for processing virtual resource data according to a third embodiment of the present invention;

4 is a schematic structural diagram of a device for processing virtual resource data according to a fourth embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a device for processing virtual resource data according to a fifth embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a system for processing virtual resource data according to a sixth embodiment of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Referring to the drawings, wherein like reference numerals refer to the same components, the principles of the invention are illustrated in the context of a suitable computing environment. The following description is based on the specific embodiments of the invention, which are not to be construed as limiting the invention.

In the following description, specific embodiments of the present invention will be described with reference to the steps and symbols that are executed by one or more computers, unless otherwise stated. Thus, these steps and operations will be referred to several times by a computer, and the computer execution referred to herein includes the operation of a computer processing unit that represents an electronic signal in data in a structured version. This operation converts the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise altered in a manner well known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of the present invention are described in the above text, which is not intended to be a limitation, and those skilled in the art will appreciate that the various steps and operations described below can also be implemented in hardware.

The principles of the present invention operate using many other general purpose or special purpose computing, communication environments, or configurations. Examples of well-known computing systems, environments, and configurations suitable for use with the present invention may include, but are not limited to, hand-held phones, personal computers, servers, multi-processor systems, microcomputer-based systems, mainframe computers, and A distributed computing environment, including any of the above systems or devices.

The term "module" as used herein may be taken to mean a software object that is executed on the computing system. The different components, modules, engines, and services described herein can be considered as implementation objects on the computing system. The apparatus and method described herein are preferably implemented in software, and may of course be implemented in hardware, all of which are within the scope of the present invention.

It should be understood that the order of the following embodiments is not limited by the embodiment number, that is, the non-optimal embodiment of the first embodiment may be set according to actual needs. For example, the first embodiment may be implemented as the second preferred embodiment. The third embodiment is implemented as a first preferred embodiment, and the like, and the descriptions of the first, second, and the like are merely for convenience of expression.

First embodiment

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a method for processing virtual resource data according to a first embodiment of the present invention. The method includes:

In step S101, a transfer request of virtual resource data is transmitted, and the transfer request carries field information related to the request.

It can be understood that the processing method of the virtual resource data can be run on a client, and the client can be a notebook computer or a tablet PC (Personal) Computers, mobile phones, and the like, which have a storage unit and are equipped with a microprocessor and have a computing capability, are not specifically limited in the present invention.

The request for the transfer of the virtual resource data in the embodiment of the present invention may include a mobile payment process, a chargeback process, a transfer process, and the like, which are not specifically limited herein.

In step S102, according to the transfer request, the first challenge code preset by the server is acquired, and the first challenge code is generated by encrypting the public key of the client certificate.

In step S103, the private key of the client certificate is obtained, and the first challenge code is decrypted by using the private key of the client certificate.

In step S104, a first digital signature is generated according to the decrypted first challenge code and the field information.

The step S102 to the step S104 may be specifically:

Understandably, A challenge code, also called a challenge password, refers to a set of encrypted passwords generated following a handshake authentication protocol, which is used to ensure that the user's real password is not leaked during transmission. The first challenge code in the embodiment of the present invention refers to a challenge code generated by the server after the public key of the client certificate is encrypted. It is easy to think that the “first” and “second” in this embodiment are only for distinguishing. The description does not constitute a limitation.

After obtaining the first challenge code of the server, the client decrypts the first challenge code by using a private key of the client certificate, and then generates a first digital signature according to the decrypted first challenge code and request related field information. Since the attacker does not have the client's client certificate, the first challenge code of the public key encryption cannot be decrypted, so the digital signature of the user cannot be imitated, and the transaction security is improved.

In step S105, when it is determined that the first digital signature is consistent with the second digital signature in the server, then the virtual resource transfer is allowed to be allowed.

Obtaining, by the server, the first digital signature generated by the client, comparing the first digital signature with a second digital signature generated by the server, and if the first digital signature is determined to be consistent with the second digital signature, accepting the client The virtual resource transfer request sent by the terminal, the client indicating to the user that the virtual resource transfer is allowed.

It can be seen from the foregoing that, in the method for processing virtual resource data provided by the embodiment, the server generates a challenge code for the user by using the public key in the client certificate in advance; and the user decrypts the challenge code by using the private key of the client certificate when requesting the virtual resource transfer; Generating a digital signature according to the decrypted challenge code and the field information related to the request; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, The challenge code for public key encryption is decrypted, so the user's signature cannot be mimicked. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed.

Second embodiment

Referring to FIG. 2, FIG. 2 is a schematic flowchart diagram of a method for processing virtual resource data according to a second embodiment of the present invention.

The embodiment provides a method for processing virtual resource data corresponding to the first embodiment. The method is based on running on a server, and the server receives a transfer request of the virtual resource sent by the client, and the virtual resource is The transfer request is processed; wherein the client may be a terminal computer having a storage unit and a microprocessor and having a computing capability, such as a notebook computer, a tablet PC, a mobile phone, etc.; the virtual resource data in the embodiment of the present invention The transfer request may include a mobile payment process, a chargeback process, a transfer process, and the like, which are not specifically limited herein.

The method includes:

In step S201, a transfer request of virtual resource data is received, and the transfer request carries field information related to the request.

In step S202, according to the transfer request, a preset first challenge code is sent to the client, and the first challenge code is generated by encrypting the public key of the client certificate.

In step S203, the first digital signature sent by the client is received, and the first digital signature is decrypted by the client by using a private key of the client certificate, and according to the decrypted first The challenge code and the field information are generated.

The step S201 and the step S203 may be specifically:

It can be understood that the challenge code, also called challenge password, refers to a set of encrypted passwords generated according to the handshake authentication protocol, and is used to ensure that the user's real password is not leaked during the transmission process. The first challenge code in the embodiment of the present invention refers to a challenge code generated by the server after being encrypted by using the public key of the client certificate.

After obtaining the first challenge code of the server, the client decrypts the first challenge code by using a private key of the client certificate, and then generates a first digital signature according to the decrypted first challenge code and request related field information. And sent to the server; because the attacker does not have the user's client certificate, the first challenge code of the public key encryption cannot be decrypted, so the digital signature of the user cannot be imitated, and the transaction security is improved.

In step S204, when it is determined that the first digital signature is consistent with the second digital signature in the server, then the virtual resource transfer is allowed to be allowed.

Obtaining, by the server, the first digital signature generated by the client, comparing the first digital signature with a second digital signature generated by the server, and if the first digital signature is determined to be consistent with the second digital signature, accepting the client The virtual resource transfer request sent by the terminal, the client indicating to the user that the virtual resource transfer is allowed.

It can be seen from the foregoing that, in the method for processing virtual resource data provided by the embodiment, the server generates a challenge code for the user by using the public key in the client certificate in advance; and the user decrypts the challenge code by using the private key of the client certificate when requesting the virtual resource transfer; Generating a digital signature according to the decrypted challenge code and the field information related to the request; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, The challenge code for public key encryption is decrypted, so the user's signature cannot be mimicked. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed.

Third embodiment

Referring to FIG. 3, FIG. 3 is a schematic flowchart diagram of a method for processing virtual resource data according to a third embodiment of the present invention. The method includes:

In step S301, the server receives user information;

In step S302, the server generates a corresponding second challenge code according to the user information, where the second challenge code carries a corresponding challenge code plaintext and a challenge code ciphertext;

In step S303, the server acquires a public key of the user client certificate indicated by the user information;

In step S304, the server encrypts the challenge code by using the public key of the client certificate, generates a first challenge code, and stores the challenge code plaintext and the challenge code ciphertext.

The step S301 to the step S304 may be specifically: the first challenge code preset in the server may be set before the virtual resource is transferred, and the first challenge code is generated after the server encrypts the public key of the client certificate.

It can be understood that, for the client, before transmitting the transfer request of the virtual resource, the user information is sent, so that the server performs processing according to the user information to generate a first challenge code, where the process includes: the server Acquiring, according to the second challenge code corresponding to the user information, a public key of the client certificate indicated by the user information, the server encrypting the second challenge code by using a public key of the client certificate, and generating First challenge code.

In step S305, the client sends a transfer request of virtual resource data, where the transfer request carries field information related to the request;

The request for the transfer of the virtual resource data in the embodiment of the present invention may include a mobile payment process, a chargeback process, a transfer process, and the like, which are not specifically limited herein.

In step S306, the server sends a preset first challenge code to the client according to the transfer request.

In step S307, the client obtains the private key of the client certificate, and decrypts the first challenge code by using the private key of the client certificate;

In step S308, the client generates a first digital signature according to the decrypted first challenge code and the field information.

The step S306 to the step S308 may be specifically:

Preferably, the client generates a first digital signature by using a one-way hash algorithm according to the decrypted first challenge code and the order number field in the field information.

After obtaining the first challenge code of the server, the client decrypts the first challenge code by using a private key of the client certificate, and then generates a first digital signature according to the decrypted first challenge code and request related field information. And sending the first digital signature and the field information to the server; since the attacker does not have the user's client certificate, the first challenge code of the public key encryption cannot be decrypted, so the digital signature of the user cannot be simulated, and the transaction is improved. safety.

In step S309, the server acquires the first digital signature and compares the first digital signature with a second digital signature in the server;

It can be understood that, after the server obtains the first digital signature and the field information, the same algorithm, such as the one-way hash algorithm, may be used to generate the second digital signature according to the challenge code plaintext and the field information; The server obtains the first digital signature generated by the client, compares the first digital signature with the second digital signature, obtains a comparison result, and sends the comparison result to the client.

For the client, the client receives the comparison result sent by the server, and the comparison result is generated by the server according to the challenge code plaintext and the field information to generate a second digital signature, and the first digital signature is The second digital signature is obtained by comparison.

In step S310, when it is determined that the first digital signature is consistent with the second digital signature in the server, then the virtual resource transfer is allowed to be allowed.

For the client, when the client determines that the first digital signature is consistent with the second digital signature according to the comparison result, it indicates that the virtual resource transfer is allowed.

In order to facilitate the understanding of the technical solution of the present invention, based on the foregoing embodiment, the following describes the processing method of the virtual resource data in a specific application scenario:

In this scenario, the virtual resource transfer specifically refers to the payment processing between the client and the server, where the server may be specifically a payment background server, and the client may be specifically a mobile phone;

The steps include:

Step S1: The client sends a payment request to the payment background server;

That is, the user clicks the payment after the client places the order, and triggers the payment request to the server.

Step S2: The payment background server receives the payment request, and returns a first challenge code encrypted by using a public key of the client certificate;

The payment background server detects the legality of the order, returns the first challenge code, and details of the order, supported payment methods, and the like.

Step S3: After receiving the first challenge code, the client pops up a payment confirmation interface for the user to confirm the correctness of the payment method and the order information.

The user clicks OK and proceeds to step S4.

Step S4: The client decrypts the first challenge code by using a private key in the client certificate, and then uses the MD5 algorithm to generate a signature field by using the MD5 algorithm in the decrypted first challenge code and the order number and the payment method selected by the user. Signstr (ie the first digital signature); then sends the SignStr along with the order number, payment method and other payment related information to the payment backend server.

Step S5: the payment background server uses the same algorithm of the client to generate the signature field (ie, the second digital signature) using the same algorithm of the challenge code and the order number, and compares and verifies the signature field sent by the client, and if the signature verification is passed, Then, according to the payment success can be directly returned to the client, or the user is required to check the payment password and the SMS verification code before completing the payment.

It can be seen from the foregoing that, in the method for processing virtual resource data provided by the embodiment, the server generates a challenge code for the user by using the public key in the client certificate in advance; and the user decrypts the challenge code by using the private key of the client certificate when requesting the virtual resource transfer; Generating a digital signature according to the decrypted challenge code and the field information related to the request; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, The challenge code for public key encryption is decrypted, so the user's signature cannot be mimicked. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed. Further, the business operation cost of the fast payment based on the client digital certificate is reduced.

Fourth embodiment

In order to facilitate the implementation of the method for processing the virtual resource data provided by the embodiment of the present invention, the embodiment of the present invention further provides an apparatus for processing the virtual resource data. The meaning of the noun is the same as the method for processing the virtual resource in the foregoing first embodiment. For specific implementation details, reference may be made to the description in the method embodiment.

Referring to FIG. 4, FIG. 4 is a schematic structural diagram of a virtual resource data processing apparatus according to an embodiment of the present invention, where the virtual resource data processing apparatus may be run on a client, and the client may be a notebook computer. The tablet PC, the mobile phone, and the like have a terminal unit having a storage unit and a microprocessor and having a computing capability, which is not specifically limited in the present invention.

As shown in FIG. 4, the processing device of the virtual resource data of the present invention may include a first sending module 401, a first obtaining module 402, a decrypting module 403, a first generating module 404, and a first indicating module 405.

The first sending module 401 is configured to send a virtual resource data transfer request, where the transfer request carries field information related to the request; the first obtaining module 402 is configured to obtain a server pre-requisite according to the transfer request. a first challenge code, wherein the first challenge code is generated by using a public key of the client certificate;

The decryption module 403 is configured to obtain a private key of the client certificate, and decrypt the first challenge code by using a private key of the client certificate; the first generating module 404 is configured to perform, according to the decrypted The first challenge code and the field information generate a first digital signature; the first indication module 405 is configured to: when the first digital signature is determined to be consistent with the second digital signature in the server, Virtual resource transfer.

Based on the processing device of the virtual resource data provided in FIG. 4, the following preferred settings can also be made:

The first generating module 404 is specifically configured to: generate a first digital signature by using a one-way hash algorithm according to the decrypted first challenge code and the order number field in the field information.

Further preferably, the device may further include: a second sending module, configured to send the first digital signature and the field information to a server; and a first receiving module, configured to receive a comparison result sent by the server, The comparison result is generated by the server according to the challenge code plaintext and the field information, and the first digital signature is compared with the second digital signature; based on the first The indicating module 405 is specifically configured to: when determining that the first digital signature is consistent with the second digital signature according to the comparison result, indicating that the virtual resource transfer is allowed.

It can be understood that, in the parts that are not detailed in this embodiment, reference may be made to the detailed description of the processing method for the virtual resource data in the foregoing first and third embodiments, and details are not described herein again.

As described above, the virtual resource data processing apparatus provided by the embodiment, the server generates the challenge code for the user by using the public key in the client certificate in advance; when the user requests the virtual resource transfer, the challenge code is decrypted by using the private key of the client certificate; Generating a digital signature according to the decrypted challenge code and the field information related to the request; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, The challenge code for public key encryption is decrypted, so the user's signature cannot be mimicked. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed.

Fifth embodiment

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of a device for processing virtual resource data according to an embodiment of the present disclosure, where the meaning of a noun is the same as the method for processing a virtual resource in the second embodiment, and specific implementation details may be referred to. Description in the method embodiment.

Preferably, the processing device of the virtual resource data includes a second receiving module 501, a third sending module 502, a third receiving module 503, and a second indicating module 504;

The second receiving module 501 is configured to receive a transfer request of the virtual resource data, where the transfer request carries the field information related to the request, and the third sending module 502 is configured to send the request to the client according to the transfer request. Sending a preset first challenge code, where the first challenge code is encrypted by using a public key of the client certificate;

The third receiving module 503 is configured to receive a first digital signature sent by the client, where the first digital signature is used by the client to decrypt the first challenge code by using a private key of the client certificate, and according to the Decoding the first challenge code and the field information generated; the second indication module 504, configured to: when the first digital signature is determined to be consistent with the second digital signature in the server, Virtual resource transfer.

Further, based on the processing device of the virtual resource data provided in FIG. 5, the following preferred settings may also be made:

Preferably, the device may further include: a fourth receiving module, configured to receive user information; and a second generating module, configured to generate a corresponding second challenge code according to the user information, where the second challenge code carries Corresponding challenge code plaintext and challenge code ciphertext; a second obtaining module, configured to acquire a public key of the user client certificate indicated by the user information; and an encryption storage module, configured to use the public key pair of the client certificate The challenge code is encrypted, a first challenge code is generated, and the challenge code plaintext and the challenge code ciphertext are stored.

Further preferably, the device may further include: a fifth receiving module, configured to receive the first digital signature and the field information sent by the client; and a third generating module, configured to use the challenge code to be a plaintext And generating, by the field information, a second digital signature; the comparing module is configured to compare the first digital signature with the second digital signature to obtain a comparison result; and the fourth sending module is configured to send the comparison result To the client.

It is to be understood that the detailed description of the processing method for the virtual resource data in the second and third embodiments above is not described in detail in the section which is not detailed in this embodiment.

As described above, the virtual resource data processing apparatus provided by the embodiment, the server generates the challenge code for the user by using the public key in the client certificate in advance; when the user requests the virtual resource transfer, the challenge code is decrypted by using the private key of the client certificate; Generating a digital signature according to the decrypted challenge code and the field information related to the request; the server confirms whether the virtual resource transfer request is legal by verifying the correctness of the digital signature generated by the client; since the attacker does not have the client's client certificate, The challenge code for public key encryption is decrypted, so the user's signature cannot be mimicked. The generated digital signature contains information related to the corresponding payment request, and the signature can only be used for the transaction, which ensures the security of the transaction; and, because the challenge code is set in advance, the server is brought to the server during the peak payment. The load pressure increases the server's operating speed.

Sixth embodiment

Referring to FIG. 6, FIG. 6 is a schematic structural diagram of a processing system of a virtual resource according to an embodiment of the present invention. The processing system of the virtual resource includes: a server 601 and a client 602, where the client 602 may be specifically The processing device for virtual resource data according to the fourth embodiment, wherein the server 601 is a processing device for virtual resource data according to the fifth embodiment.

The client 602 is configured to send a virtual resource data transfer request, where the transfer request carries field information related to the request; and according to the transfer request, acquire a first challenge code preset by the server, where the first challenge code is The public key of the client certificate is encrypted and generated; the private key of the client certificate is obtained, and the first challenge code is decrypted by using the private key of the client certificate; according to the decrypted first challenge code and the The field information generates a first digital signature; when it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed.

The server 601 is configured to receive a transfer request of the virtual resource data, where the transfer request carries the field information related to the request, and send, according to the transfer request, a preset first challenge code to the client, where the first challenge code is utilized. And generating, by the client, the first digital signature sent by the client, where the first digital signature is decrypted by the client by using the private key of the client certificate, and according to the The decrypted first challenge code and the field information are generated; when it is determined that the first digital signature is consistent with the second digital signature in the server, indicating that the virtual resource transfer is allowed.

In the above-mentioned embodiments, the descriptions of the various embodiments are different. For details that are not detailed in an embodiment, refer to the foregoing detailed description of the processing method for the virtual resource data, and details are not described herein again.

The processing device of the virtual resource data provided by the embodiment of the present invention, for example, a computer, a tablet computer, a mobile phone with a touch function, and the like, the processing device of the virtual resource data and the processing of the virtual resource data in the above embodiment The method belongs to the same concept, and any method provided in the embodiment of the method for processing the virtual resource data can be executed on the processing device of the virtual resource data, and the specific implementation process is described in the embodiment of the method for processing the virtual resource data. , will not repeat them here.

It should be noted that, in the processing method of the virtual resource data of the present invention, a common tester in the art can understand all or part of the process for implementing the processing method of the virtual resource data in the embodiment of the present invention, which can be obtained by a computer program. Controlling the related hardware to complete, the computer program may be stored in a computer readable storage medium, such as in a memory of the terminal, and executed by at least one processor in the terminal, and may include, for example, during execution. A flow of an embodiment of a method of processing virtual resource data. Wherein, the storage medium may be a magnetic disk, an optical disk, a read only memory (ROM, Read) Only Memory), random access memory (RAM, Random Access Memory), etc.

For the processing device of the virtual resource data in the embodiment of the present invention, each functional module may be integrated into one processing chip, or each module may exist physically separately, or two or more modules may be integrated into one module. in. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated module, if implemented in the form of a software functional module and sold or used as a standalone product, may also be stored in a computer readable storage medium, such as a read only memory, a magnetic disk or an optical disk, etc. .

The method and device for processing virtual resource data provided by the embodiments of the present invention are described in detail. The principles and implementation manners of the present invention are described in the specific examples. The description of the above embodiments is only for helping. The method of the present invention and its core idea are understood; at the same time, those skilled in the art, according to the idea of the present invention, will have some changes in the specific embodiments and application scopes. It is understood to be a limitation of the invention.

Claims (17)

A method for processing virtual resource data, comprising: Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request; And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate; Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate; Generating a first digital signature according to the decrypted first challenge code and the field information; When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed. The method for processing virtual resource data according to claim 1, wherein before the transmitting the virtual resource transfer request, the method further includes: Sending user information, so that the server performs processing according to the user information to generate a first challenge code, where the processing includes: the server acquiring the user information indication according to a second challenge code corresponding to the user information. a public key of the client certificate, the server encrypting the second challenge code by using a public key of the client certificate to generate a first challenge code. The method for processing virtual resource data according to claim 2, wherein after the generating the first digital signature according to the decrypted first challenge code and the field information, the method further includes: Transmitting the first digital signature and the field information to a server; Receiving a comparison result sent by the server, where the comparison result is generated by the server according to the challenge code plaintext and the field information, and comparing the first digital signature with the second digital signature. get; When it is determined that the first digital signature is consistent with the second digital signature in the server, indicating that the virtual resource transfer is permitted, including: determining, according to the comparison result, the first digital signature and the first When the two digital signatures are consistent, it indicates that the virtual resource transfer is allowed. The method for processing virtual resource data according to claim 1, wherein the generating the first digital signature according to the decrypted first challenge code and the field information comprises: A first digital signature is generated using a one-way hash algorithm based on the decrypted first challenge code and the order number field in the field information. A method for processing virtual resource data, comprising: Receiving a transfer request of the virtual resource data, where the transfer request carries field information related to the request; And sending, according to the transfer request, a preset first challenge code to the client, where the first challenge code is generated by using a public key of the client certificate; Receiving a first digital signature sent by the client, the first digital signature is decrypted by the client by using a private key of the client certificate, and according to the decrypted first challenge code and the Field information is generated; When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed. The method for processing virtual resource data according to claim 5, wherein before the receiving the transfer request of the virtual resource, the method further includes: Receiving user information; And generating, according to the user information, a corresponding second challenge code, where the second challenge code carries a corresponding challenge code plaintext and a challenge code ciphertext; Obtaining a public key of the user client certificate indicated by the user information; And encrypting the challenge code by using a public key of the client certificate, generating a first challenge code, and storing the challenge code plaintext and the challenge code ciphertext. The method for processing virtual resource data according to claim 6, wherein when determining that the first digital signature is consistent with a second digital signature in the server, indicating that the virtual resource is allowed to be transferred, Also includes: Receiving the first digital signature and the field information sent by the client; Generating a second digital signature by using the challenge code plaintext and the field information, and comparing the first digital signature with the second digital signature to obtain a comparison result; Send the comparison result to the client. A processing device for virtual resource data, comprising: a processor, wherein the processor is configured to: Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request; And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate; Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate; Generating a first digital signature according to the decrypted first challenge code and the field information; When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed. The processing device for virtual resource data according to claim 8, wherein the processor is configured to: Transmitting the first digital signature and the field information to a server; Receiving a comparison result sent by the server, where the comparison result is generated by the server according to the challenge code plaintext and the field information, and comparing the first digital signature with the second digital signature. get; When it is determined that the first digital signature is consistent with the second digital signature according to the comparison result, indicating that the virtual resource transfer is allowed. The processing device of the virtual resource data according to claim 8, wherein the processor is configured to: generate, according to the decrypted first challenge code and the order number field in the field information, using a one-way hash algorithm The first digital signature. A processing device for virtual resource data, comprising: a processor, wherein the processor is configured to: Receiving a transfer request of the virtual resource data, where the transfer request carries field information related to the request; And sending, according to the transfer request, a preset first challenge code to the client, where the first challenge code is generated by using a public key of the client certificate; Receiving a first digital signature sent by the client, the first digital signature is decrypted by the client by using a private key of the client certificate, and according to the decrypted first challenge code and the Field information is generated; When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed. The processing device for virtual resource data according to claim 11, wherein the processor is configured to: Receiving user information; And generating, according to the user information, a corresponding second challenge code, where the second challenge code carries a corresponding challenge code plaintext and a challenge code ciphertext; Obtaining a public key of the user client certificate indicated by the user information; And encrypting the challenge code by using a public key of the client certificate, generating a first challenge code, and storing the challenge code plaintext and the challenge code ciphertext. The processing device for virtual resource data according to claim 12, wherein the processor is configured to: Receiving the first digital signature and the field information sent by the client; Generating a second digital signature by using the challenge code plaintext and the field information; Comparing the first digital signature with the second digital signature to obtain a comparison result; Send the comparison result to the client. A storage medium having stored therein processor-executable instructions, wherein the processor-executable instructions are for causing a processor to: Sending a transfer request of virtual resource data, where the transfer request carries field information related to the request; And acquiring, according to the transfer request, a first challenge code preset by the server, where the first challenge code is generated by using a public key of the client certificate; Obtaining a private key of the client certificate, and decrypting the first challenge code by using a private key of the client certificate; Generating a first digital signature according to the decrypted first challenge code and the field information; When it is determined that the first digital signature is consistent with the second digital signature in the server, then indicating that the virtual resource transfer is allowed. The storage medium of claim 14 wherein the processor-executable instructions are for causing the processor to: Sending user information, so that the server performs processing according to the user information to generate a first challenge code, where the processing includes: the server acquiring the user information indication according to a second challenge code corresponding to the user information. a public key of the client certificate, the server encrypting the second challenge code by using a public key of the client certificate to generate a first challenge code. The storage medium of claim 15 wherein the processor-executable instructions are for causing the processor to: Transmitting the first digital signature and the field information to a server; Receiving a comparison result sent by the server, where the comparison result is generated by the server according to the challenge code plaintext and the field information, and comparing the first digital signature with the second digital signature. get; When it is determined that the first digital signature is consistent with the second digital signature in the server, indicating that the virtual resource transfer is permitted, including: determining, according to the comparison result, the first digital signature and the first When the two digital signatures are consistent, it indicates that the virtual resource transfer is allowed. The storage medium of claim 14 wherein the processor-executable instructions are for causing the processor to: A first digital signature is generated using a one-way hash algorithm based on the decrypted first challenge code and the order number field in the field information.