CN117459931B - A data encryption method, system and storage medium - Google Patents

Abstract

The application relates to a data encryption method, a system and a storage medium, wherein the method comprises the steps that a mobile terminal obtains a dynamic password sent by a server; searching and connecting the matched relay equipment according to the dynamic password acquired by the mobile terminal, and periodically updating the dynamic password by the server and sending the dynamic password to the relay equipment; the mobile terminal sends the information to be encrypted to a server; the relay equipment sends preset encryption rules to the server, and different relay equipment is preset with corresponding different encryption rules; after receiving the information to be encrypted and the encryption rule, the server encrypts the information to be encrypted and generates printable label information; and sending the printable label information to the mobile terminal for printing and generating by the mobile terminal, wherein the relay equipment establishes short-distance connection with the mobile terminal. The application improves the reliability of the encryption process, and simultaneously ensures that the encryption process needs to be limited in a fixed range and can not be added into the encryption process through a mobile terminal at a different place.

Description

Data encryption method, system and storage medium

Technical Field

The present application relates to the field of data encryption, and in particular to a data encryption method, system and storage medium.

Background technique

Generally speaking, traditional data encryption performs corresponding encryption operations on data through mutual responses between terminal devices and servers, so that data uploaded from the terminal can be encrypted for subsequent use.

In some cases, when the encrypted result is a QR code or barcode label, it is possible to photograph the label with a mobile device and transmit it to a mobile device in a different location for corresponding operations. This two-way interaction can easily interfere with and affect the actual encryption process, which can easily lead to modification of the encryption result or leakage of the encryption process, affecting the reliability of the actual encryption.

Summary of the invention

In order to improve the reliability of the encryption process, the present application provides a data encryption method, system and storage medium.

In the first aspect, a data encryption method provided by the present application adopts the following technical solution:

A data encryption method, comprising:

The mobile terminal obtains the dynamic password sent by the server;

According to the dynamic password obtained by the mobile terminal, the server searches for and connects to a matching relay device, and the server periodically updates the dynamic password and sends it to the relay device;

The mobile terminal sends the information to be encrypted to the server;

The relay device sends a preset encryption rule to the server, and different relay devices are preset with corresponding different encryption rules;

After receiving the information to be encrypted and the encryption rules, the server encrypts the information to be encrypted and generates printable label information;

Send the printable label information to the mobile terminal for printing and generation by the mobile terminal,

Wherein, the relay device establishes a short-distance connection with the mobile terminal.

By adopting the above technical solution, under this design method, the connection between the server and the mobile terminal does not determine the encryption and decryption method of the information, but the encryption and decryption method of the information is determined by the relay device. At the same time, the relevant process also determines that the connection between the mobile terminal and the relay device also needs to decrypt the same dynamic password in the same way before the connection can be established. Only after the relay device and the mobile terminal have established a connection, the server can know the corresponding encryption rules and decryption rules to perform corresponding encryption and decryption operations. At the same time, due to the short-distance connection method between the mobile terminal and the relay device, the mobile terminal is also limited to the radiation range of the relay device. The mobile terminal has no way to encrypt and decrypt by sending tagged photos at a long distance. Therefore, the encryption and decryption steps of this method are highly regional and difficult to crack by third-party devices.

Preferably, the method for the mobile terminal to connect to the matching relay device includes:

The mobile terminal decrypts the dynamic password to obtain terminal matching information;

The relay device decrypts the dynamic password to obtain relay matching information;

The relay device modifies the device identifier, wherein the device identifier of the relay device has a preset expression field, and the expression field includes the relay matching information;

The mobile terminal searches for all device identifiers within a range to which a connection can be established, and attempts to establish a connection with a device corresponding to a device identifier containing relay matching information.

Preferably, the device identifier of the relay device is in a non-broadcast state, and the device identifier of the relay device is composed of at least relay matching information and timestamp information, and the timestamp information is determined by the moment when the relay device receives the dynamic password sent by the server;

The mobile terminal generates an addressing identifier according to the terminal matching information and the current time, and searches for a device identifier in a non-broadcast state within a search range according to the addressing identifier and connects.

By adopting the above technical solution, this state can hide the device identifier of the relay device, and it is not easy to reverse decrypt or connect without knowing the device identifier. This method of constructing the device identifier by combining relay matching information and timestamp information can also continuously change the device identifier of the relay device within a certain period of time, increasing the difficulty of decryption.

Preferably, the server has a preset sending logic at the moment of sending the dynamic password, and the preset sending logic is synchronized with the relay device and the mobile terminal;

When the relay device receives the dynamic password sent by the server, it obtains a timestamp at a receiving time before the current time in the sending logic as timestamp information;

When the mobile terminal obtains the dynamic password sent by the server, it obtains the timestamp of a receiving time before the current time in the sending logic as the timestamp information, and combines it with the terminal matching information to generate an addressing identifier.

Preferably, the server and the relay device communicate via data packets, and the data packets all include check bits, and the data encryption method further includes:

After receiving the data packet sent by the server, the relay device extracts the check code of the check bit in the data packet and performs verification;

When the verification is passed, the relay device parses the data packet;

Before the relay device sends the data packet to the server, the relay device randomly generates and records the verification code;

The relay device integrates the check code into the check digit of the data packet sent to the server.

By adopting the above technical solution, this method can effectively monitor whether the data has been changed or deciphered, thereby improving the security of data transmission.

Preferably, after the server updates the dynamic password and sends it to the relay device, the relay device receives the dynamic password and verifies the check digit;

When the check digit is verified, the dynamic password is decrypted;

Before the server updates the dynamic password, the relay device randomly generates a verification code and packages it with the update request instruction to generate a data packet;

The relay device sends the data packet to the server;

The server responds to the data packet sent by the relay device and splits the check digit to obtain the check code;

The server generates a dynamic password and integrates it with the obtained verification code to generate a data packet to be sent to the relay device.

Preferably, after the mobile terminal establishes a connection with the relay device, the relay device randomly generates a verification code and packages it with a preset encryption rule to generate a data packet;

The relay device sends the data packet to the server;

The server responds to the data packet sent by the relay device and splits the check digit to obtain the check code;

The server generates a successful reception instruction, and integrates it with the obtained verification code to generate a data packet to be sent to the relay device;

The relay device receives the data packet sent by the server and parses it to verify the check digit;

When the check digit is verified, the relay device stops the process and waits for the generation of the request update instruction;

When the relay device does not receive the data packet sent by the server within the preset time, it resends the data packet to the server.

In the second aspect, a data encryption system provided by the present application adopts the following technical solution:

A data encryption system, comprising:

The mobile terminal is used to send the information to be encrypted to the server, obtain the dynamic password sent by the server, and search and connect to the matching relay device according to the obtained dynamic password;

The relay device sends a preset encryption rule to the server after the mobile terminal is connected, and different relay devices are preset with corresponding different encryption rules;

The server is used to receive the information to be encrypted sent by the mobile terminal and the encryption rules sent by the relay device, and encrypt the information to be encrypted and generate printable label information; the server regularly updates the dynamic password and sends it to the relay device.

In a third aspect, the present application provides a computer storage medium capable of storing corresponding programs, using the following technical solution:

A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any of the above data encryption methods.

In summary, the present application includes at least one of the following beneficial technical effects:

The connection between the server and the mobile terminal does not determine the encryption and decryption methods of the information, but the relay device determines the encryption and decryption methods of the information. At the same time, the relevant process also determines that the connection between the mobile terminal and the relay device also needs to decrypt the same dynamic password in the same way before the connection can be established. Only after the relay device and the mobile terminal have established a connection, the server can know the corresponding encryption and decryption rules to perform the corresponding encryption and decryption operations;

The short-distance connection between the mobile terminal and the relay device also limits the mobile terminal to the radiation range of the relay device. The mobile terminal cannot encrypt and decrypt by sending tagged photos at a long distance;

The method of jointly constructing a device identifier using relay matching information and timestamp information can also continuously change the device identifier of the relay device within a certain period of time, thereby increasing the difficulty of deciphering.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flow chart of a data encryption method according to one embodiment of the present invention.

FIG. 2 is a schematic diagram of a flow chart of connection matching between a relay device and a mobile terminal according to one embodiment of the present invention.

FIG. 3 is a schematic diagram of a flow chart of a relay device and a server communicating via data packets according to one embodiment of the present invention.

FIG. 4 is a flow chart showing the communication between the server and the relay device through data packets when generating a dynamic password according to one embodiment of the present invention.

FIG. 5 is a flow chart of a relay device communicating with a server through data packets when sending a preset encryption rule to the server according to one embodiment of the present invention.

FIG. 6 is a flowchart of a decryption process according to one embodiment of the present invention.

Detailed ways

The present application is further described in detail below in conjunction with Figures 1-6.

The embodiment of the present application discloses a data encryption method, which realizes data encryption through mutual communication between a mobile terminal, a relay device and a server, wherein the server can be set up in the operator's computer room, and the mobile terminal can be a mobile device in the hands of a user (such as a handheld phone), or a removable device dedicated to data encryption, and such a removable device can be integrated with a printing module, so that the encryption result can be carried in the form of a printable label for subsequent use. The relay device is used to communicate with the server and the mobile terminal, and the server and the relay device can be connected through an established public network, and a short-range wireless connection can be established between the mobile terminal and the relay device by using Bluetooth or WiFi.

As a specific data encryption method, referring to FIG. 1 , the steps specifically include:

Step S100: The mobile terminal obtains the dynamic password sent by the server.

The dynamic password is generated by the dynamic password generator built into the server. It can be a string of keys randomly generated by a preset algorithm, or a string of fixed length randomly generated by a random number generation rule. Generally speaking, the dynamic password is specified to be eight or sixteen digits long.

After the mobile terminal establishes a connection with the server through the public network, it sends a request instruction to the server. After receiving the request instruction sent by the mobile terminal, the server sends the generated dynamic password to the mobile terminal. At this point, the mobile terminal obtains the dynamic password sent by the server.

When the mobile terminal is a handheld mobile device such as a mobile phone, the corresponding APP (mobile software) can be installed on the mobile terminal to run the corresponding program that interacts with the server and the relay device. For example, after opening the APP, the mobile terminal communicates with the server and establishes a long connection, and then obtains the dynamic password sent by the server. In the subsequent steps, various operations or processes initiated by the mobile terminal can also be promoted by setting up corresponding operation buttons on the APP to promote the corresponding process operation.

Step S200: searching and connecting to a matching relay device according to the dynamic password obtained by the mobile terminal, and the server periodically updates the dynamic password and sends it to the relay device.

After the server periodically updates the dynamic password, it will also send the dynamic password to the relay device, and the relay device will store the latest dynamic password sent by the server. At the same time, the dynamic passwords received by the relay device and the mobile terminal are the same, so the corresponding mobile terminal can be connected to the relay device by verifying the dynamic password, and the mobile terminal will not be connected to other devices.

As a specific implementation method of connection matching, referring to FIG. 2 , it specifically includes:

Step S210: The mobile terminal decrypts the dynamic password to obtain terminal matching information.

Step S220: The relay device decrypts the dynamic password to obtain relay matching information.

Among them, step S210 is the decryption of the dynamic password by the mobile terminal, and step S220 is the decryption of the dynamic password by the relay device, and the order of step S210 and step S220 can be changed according to the actual situation. Generally speaking, the decryption of the dynamic password by the relay device and the mobile terminal generally starts after receiving the dynamic password sent by the server, and since the relay device always maintains a long connection with the server, from the perspective of timing, the relay device often executes the corresponding decryption step first.

The decryption method of the dynamic password described here can be to execute a preset operation logic on the character string, such as inserting characters, executing corresponding logical operations, performing obfuscation and other operations. The operation logic can be set as needed here, and there is no actual need to limit it. However, it should be noted that the mobile terminal and the relay device must have the same decryption method for the dynamic password, and the decryption method needs to be preset in the mobile terminal and the relay device when configuring the file.

Step S230: the relay device modifies the device identifier, wherein the device identifier of the relay device has a preset expression field, and the expression field includes the relay matching information.

Among them, when the relay device is connected to the mobile terminal using WIFI, the device identifier represents the SSID, which represents the identification information that the device can be connected. When the relay device is connected to the mobile terminal using Bluetooth connection, the device identifier represents the Bluetooth device name of the relay device. The expression field represents the specific expression string of the device identifier. In one embodiment, the device identifier can be composed only of relay matching information. In another embodiment, the device identifier can be composed of relay matching information and a preset fixed field, such as AAA-BBBBBBBB, where AAA can be a preset fixed field, and BBBBBBBB is the string of relay matching information obtained by decrypting the dynamic password. In the present application, the generation time of the dynamic password can also be added as a timestamp to the generation of the device identifier, and the specific value of the timestamp information is determined by the moment when the relay device receives the dynamic password sent by the server.

The server has a preset logic in the process of generating a dynamic password. For example, the generation of two adjacent dynamic passwords is separated by a preset fixed time, and this preset logic is synchronized to the relay device and the mobile terminal. The relay device can determine the expression string of the timestamp information corresponding to the received dynamic password according to the preset logic. Specifically, the method includes:

Step S231: When the relay device receives the dynamic password sent by the server, it obtains a timestamp at a receiving time before the current time in the sending logic as timestamp information.

Among them, when the preset sending logic is known by the relay device, since the information sent by the server to the relay device will be delayed, and the time when the relay device receives the dynamic password will definitely be after the time when the server generates the dynamic password, the relay device can compare the current time with the preset sending logic, and use the timestamp of the moment before the current time in the sending logic as the timestamp information. The timestamp information here represents a string that can represent the moment. For example, 12:45 on December 22, 2020 can be represented by the string 202012221245, or in one way, only the hours and minutes of the day can be used to represent the string represented by the timestamp information, such as 1245.

Step S232: When the mobile terminal obtains the dynamic password sent by the server, it obtains the timestamp of a receiving time before the current time in the sending logic as timestamp information, and combines it with the terminal matching information to generate an addressing identifier.

Similarly, when the preset sending logic is known by the mobile terminal, since the information sent by the server to the mobile terminal will be delayed, and the moment when the mobile terminal receives the dynamic password will definitely be after the moment when the server generates the dynamic password, the mobile terminal can compare the current moment with the preset sending logic, and use the timestamp of the moment before the current moment in the sending logic as the timestamp information. Generally speaking, the timestamp information here needs to be represented in the same format as the relay device. For example, when the timestamp information of the relay device is in a string format, the timestamp information of the mobile interruption also needs to be in a string format.

Generally speaking, between two adjacent dynamic password update intervals, the timestamp information of the relay device and the timestamp information of the mobile terminal should be completely identical, so the addressing identifier generated in this way can accurately find the device identifier corresponding to the relay device.

Therefore, under this premise, the device identifier of the relay device can be in a non-broadcast state, so other terminal devices have no way to directly obtain the device identifier of the relay device, and therefore cannot reversely decipher related information through the device identifier of the relay device. On the contrary, after the mobile terminal that needs to establish a connection obtains the corresponding device identifier, it can still establish a connection with the corresponding relay device.

Step S240: The mobile terminal searches for all device identifiers within a range to which a connection can be established, and attempts to establish a connection with a device corresponding to a device identifier containing relay matching information.

The relay matching information may not only include the aforementioned timestamp information and relay matching information, but may also include other representative information such as geographic location information to constitute the relay matching information. At the same time, the relay device may have a preset password for the mobile terminal to connect. In this case, the preset password also needs to be known by the mobile terminal so that the mobile terminal and the relay device can establish a connection. Generally speaking, the search range of the mobile terminal is related to the broadcast radiation intensity of the relay device. The greater the intensity of the relay device, the farther the mobile terminal can search for the relay device.

Step S300: The mobile terminal sends the information to be encrypted to the server.

The information to be encrypted of the mobile terminal can be manually entered into the mobile terminal. The mobile terminal and the server are connected via a public network. The mobile terminal will enter the information to be encrypted into the mobile terminal through the public network.

Step S400: the relay device sends a preset encryption rule to the server, and different relay devices are preset with corresponding different encryption rules.

Among them, each relay device will pre-store an encryption rule, which is converted into a corresponding string and stored in the relay device. The relay device will send the corresponding string to the server in this step. After receiving the string information, the server will determine which encryption rule the relay device belongs to. Generally speaking, the encryption rule can be DES, 3DES, AES, RSA, DSA, SHA-1, MD5, etc., or it can be other encryption methods with custom rules. The string corresponding to each encryption rule can be matched by establishing a mapping table, and the corresponding encryption rule can be obtained through the corresponding string.

Step S500: After receiving the information to be encrypted and the encryption rules, the server encrypts the information to be encrypted and generates printable label information.

After step S400, the server learns the encryption rules sent by the relay device, and receives the information to be encrypted sent by the mobile terminal in step S300. The server encrypts the information to be encrypted using the corresponding encryption rules, and the encrypted printable label information is the encrypted ciphertext string obtained by encryption.

Step S600: Send the printable label information to the mobile terminal for printing by the mobile terminal.

After generating the printable label information, the server will send the printable label information to the mobile terminal, which may be integrated with a printing module. After receiving the printable label information, the mobile terminal converts it into information recognizable by the printing module for printing by the printing module. Generally speaking, the mobile terminal prints and generates a QR code label, and in some cases, a barcode label can also be printed and generated.

On this basis, the communication between the server and the relay device transmits the required information in the form of data packets. Among them, the data packet contains a corresponding check code as an identification bit. The check code is in the check bit of the data packet. The server only identifies the check bit in the received data packet and extracts the check code accordingly. In the subsequent operation process, the check code is re-integrated into the data packet sent to the relay device. The relay device has a check code unit for identifying, judging and generating the check code. It can be known whether the communication process between the relay device and the server is interfered with or deciphered. Refer to Figure 3, specifically:

Step S1: After receiving the data packet sent by the server, the relay device extracts the check code of the check bit in the data packet and performs verification.

Among them, the data packet at least includes a transmission bit for storing the data to be transmitted and a check bit for storing the check code. In one embodiment, the overall length of the data packet is fixed and the position of the check bit is fixed, so the length occupied by the check bit and the transmission bit is also fixed. In another embodiment, the length and position of the check bit are fixed, for example, in the first byte or the end byte of the data packet, and the remaining position is the corresponding transmission bit. Therefore, no matter which method is used, the relay device can directly extract the check code of the check bit in the data packet and verify the check code. Generally speaking, the check code verified here is the check code generated by the check code unit of the relay device in the previous time, and the verification process only needs to determine whether the two are consistent.

Step S2: When the verification is passed, the relay device parses the data packet.

Among them, verification passed means that the check code in the check bit is consistent with the check code generated last time, and parsing the data packet in this step refers to extracting relevant information corresponding to the transmission bit in the data packet.

Step S3: Before the relay device sends the data packet to the server, the relay device randomly generates and records the verification code.

The relay device will randomly generate a check code of a fixed length according to the preset length of the check code, and record the check code so that the check code can be checked and verified the next time the data packet sent by the server is received. In one embodiment, after the check code is randomly generated, the check code previously recorded in the relay device will be overwritten, so that the relay device always records only one check code.

Step S4: The relay device integrates the check code into the check digit of the data packet sent to the server.

Among them, integration refers to placing the corresponding data into the corresponding positions in the data packet. For example, the data to be sent will be filled into the transmission bit of the data packet, and the randomly generated check code will be filled into the check bit of the data packet. The positions of the check bit and the transmission bit follow the construction method of the data packet in step S1.

Based on this, in order to meet the cyclic communication between the server and the relay device, for the generation of dynamic passwords, before the server generates a dynamic password, the relay device generates a request update instruction at a fixed sending interval and sends it to the server. The server generates a dynamic password by responding to the request update instruction. Since the request update instruction of the relay device is sent at a prescribed interval, the update of the server's dynamic password also has a preset logic. When the relay device does not send encryption rules to the server, the communication between the server and the relay device can form a complete cycle.

Specifically, referring to FIG. 4 , the steps include:

Step S11: After the server updates the dynamic password and sends it to the relay device, the relay device receives the dynamic password and verifies the check digit.

Among them, in this step, the dynamic password is still sent to the relay device in the form of a data packet, and the relay device obtains the check code from the check bit by parsing the data packet, and the method of verifying the check code is the same as in step S1.

Step S12: When the check digit is verified, the dynamic password is decrypted.

Step S13: Before the server updates the dynamic password, the relay device randomly generates a verification code and packages it with the update request instruction to generate a data packet.

The request update instruction is a fixed string of characters. When the server receives the request update instruction, it will drive the corresponding module to generate a dynamic password. The relay device will generate the request update instruction under the preset generation logic, and the server will respond to the request update instruction to generate a dynamic password. Then the dynamic password can also be considered to be generated under the preset generation logic. Generally speaking, there is a fixed interval between the generation of two adjacent request update instructions.

Further, on this basis, the timestamp information required for the relay device to generate the device identifier mentioned in the aforementioned step can be determined according to the logic of the relay device generating the update request instruction.

Step S14: The relay device sends a data packet to the server.

Step S15: The server responds to the data packet sent by the relay device and splits the check digit to obtain a check code.

Among them, in this step, the check code obtained by splitting the check bit does not need to be verified, and it only needs to extract the character string of the check bit in the data packet to obtain the corresponding check code.

Step S16: The server generates a dynamic password and integrates it with the obtained verification code to generate a data packet to be sent to the relay device.

Among them, after completing step S16, a complete communication closed loop is formed in the generation of the dynamic password, and since the generation and sending of the dynamic password is in response to the generation of the request update instruction, the generation and sending of the request update instruction and the generation and sending of the dynamic password can be regarded as completed in a short time, and during this period the relay device will not send encryption rules to the server.

Therefore, it can be known that the relay device sends the encryption rules to the server between the communication closed loop moments of two adjacent dynamic passwords. Therefore, when the relay device sends the encryption rules to the server, the server also needs to return a data packet to the relay device so that the relay device can regenerate the verification code the next time it establishes a connection with the mobile terminal or generates a request update instruction. Specifically, referring to Figure 5, the steps for the complete relay device to send the encryption rules to the server include:

Step S21: After the mobile terminal establishes a connection with the relay device, the relay device randomly generates a verification code and packages it with a preset encryption rule to generate a data packet.

Step S22: The relay device sends a data packet to the server.

Step S23: The server responds to the data packet sent by the relay device and splits the check digit to obtain a check code.

Step S24: the server generates a successful reception instruction, and integrates it with the obtained verification code to generate a data packet to be sent to the relay device.

Among them, in one embodiment, the splitting of the data packet in step S23 can also obtain the content of the transmission bit. After determining that the content of the transmission bit is a preset encryption rule, the server responds and generates a successful reception instruction, and can also synchronously generate a successful reception instruction in the process of splitting the data packet. The successful reception instruction can be a string of preset character length and fixed content, for example, a string of eight bits all 1 to represent the successful reception instruction. If the data packet fails to be received or the parsing of the data packet fails, a failed reception instruction can be generated. Similarly, the failed reception instruction can be a string of eight bits all 0. The successful reception instruction and the failed reception instruction here are both integrated into the transmission bit of the data packet.

Step S25: The relay device receives the data packet sent by the server and parses it to verify the check digit.

Among them, in this step, the data packet can also be parsed synchronously and the data in the transmission bit can be checked, that is, it can be determined whether it is a reception success instruction or a reception failure instruction.

Step S26: When the check digit verification is passed and the reception success instruction is received, the relay device stops the process and waits for the generation of the update request instruction.

The relay device stopping the process means stopping and jumping out of the process of S21-S26, and then the relay device will prepare to generate a request update instruction at a corresponding time.

Step S27: When the relay device does not receive the data packet sent by the server within the preset time, it resends the data packet to the server.

If the relay device does not receive the data packet sent by the server within the preset time, there may be a packet loss situation, which may be that the relay device did not send it to the server, or the data sent by the server to the relay device was lost. At the same time, when the data packet received by the relay device contains a reception failure instruction, it will also resend the data packet to the server. Here, the data packet sent by the relay device to the server is the data packet generated in step S21.

In addition, in an embodiment of the present application, the data decryption process is initiated by a mobile terminal. After scanning the printed label, the mobile terminal obtains the encrypted data and triggers the relay device to send the decryption rules to the server through the connection with the relay device. Subsequently, the server decrypts the encrypted information by receiving the encrypted information sent by the mobile terminal and the decryption rules sent by the relay device and returns it to the mobile terminal.

Specifically, referring to FIG. 6 , the process includes:

Step S1000: The mobile terminal obtains the dynamic password sent by the server.

Similarly, for a mobile terminal that is a handheld mobile device such as a mobile phone, the dynamic password sent by the server is obtained by running an APP installed on the mobile terminal. The specific execution logic here is the same as the aforementioned step S100.

Step S2000: Search and connect to a matching relay device according to the dynamic password obtained by the mobile terminal.

Step S3000: The mobile terminal scans the tag to obtain the encrypted information and sends it to the server.

Among them, when the encrypted information is in the form of a QR code, the QR code can be scanned by a camera set on the mobile terminal to obtain the encrypted string as the encrypted information. When the encrypted information is in the form of a teasing code, the encrypted string can be obtained by a scanner set on the mobile terminal.

Step S4000: The relay device sends a preset decryption rule to the server.

Among them, each relay device has a decryption rule corresponding to the preset encryption rule, and the decryption rule is also recorded in the relay device in the form of a character string. When the server receives the character string representing the decryption rule sent by the relay device, it obtains the decryption rule mapped to the character string, so that the server can use this decryption rule to decrypt the encrypted information.

Step S5000: After receiving the encryption information and the decryption rules, the server decrypts the encrypted information and sends the decryption result to the mobile terminal.

Among them, the information interaction between the relay device and the server involved in steps S1000 to S5000 is transmitted to each other in the form of data packets, which complies with the steps in steps S1 to S4.

It can be seen that under this design, the connection between the server and the mobile terminal does not determine the encryption and decryption methods of the information, but the relay device determines the encryption and decryption methods of the information. At the same time, the relevant process also determines that the connection between the mobile terminal and the relay device also requires a certain encryption method to connect. Only after the relay device and the mobile terminal have established a connection, the server can know the corresponding encryption rules and decryption rules to perform the corresponding encryption and decryption operations. At the same time, due to the short-distance connection method between the mobile terminal and the relay device, the mobile terminal is also limited to the radiation range of the relay device. The mobile terminal has no way to encrypt and decrypt by sending tagged photos at a long distance. Therefore, the encryption and decryption steps of this method are highly regional and difficult to crack by third-party devices.

Generally speaking, this method is suitable for fixed places such as offices and shopping malls, and the relay equipment can also be hidden in independent devices such as gateways, ONUs, OLTs, and WIFI. Encryption and decryption operations can be performed correspondingly through mobile terminals in fixed areas.

Based on the same inventive concept, the embodiment of the present application also discloses a data encryption system, which is implemented based on a mobile terminal, a relay device and a server, and includes:

The mobile terminal is used to send the information to be encrypted to the server, obtain the dynamic password sent by the server, and search and connect to the matching relay device according to the obtained dynamic password.

The relay device sends the preset encryption rules to the server after the mobile terminal is connected, and different relay devices are preset with corresponding different encryption rules.

The server is used to receive the information to be encrypted sent by the mobile terminal and the encryption rules sent by the relay device, and encrypt the information to be encrypted and generate printable label information; the server regularly updates the dynamic password and sends it to the relay device.

Among them, the relay device establishes a short-distance connection with the mobile terminal.

For the disclosed data encryption system, the mobile terminal, the relay device and the server may also execute the steps described in the processes of FIG. 1 to FIG. 6 .

Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

An embodiment of the present invention further provides a computer-readable storage medium storing information that can be loaded and executed by a processor to implement the various steps described in the processes of FIG. 1 to FIG. 6 .

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

As described above, the above embodiments are only used to introduce the technical solution of the present application in detail, but the description of the above embodiments is only used to help understand the method and core idea of the present invention and should not be understood as limiting the present invention. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention.

Claims (8)

1. A data encryption method, comprising: The mobile terminal obtains the dynamic password sent by the server; According to the dynamic password obtained by the mobile terminal, the server searches for and connects to a matching relay device, and the server periodically updates the dynamic password and sends it to the relay device; After the mobile terminal establishes a connection with the relay device, the mobile terminal sends the information to be encrypted to the server; The relay device sends a preset encryption rule to the server, and different relay devices are preset with corresponding different encryption rules; After receiving the information to be encrypted and the encryption rules, the server encrypts the information to be encrypted and generates printable label information; Send the printable label information to the mobile terminal for printing and generation by the mobile terminal, Wherein, the relay device establishes a short-distance connection with the mobile terminal; The method for connecting the mobile terminal to the matching relay device includes: The mobile terminal decrypts the dynamic password to obtain terminal matching information; The relay device decrypts the dynamic password to obtain relay matching information; The relay device modifies the device identifier, wherein the device identifier of the relay device has a preset expression field, and the expression field includes the relay matching information; The mobile terminal searches for all device identifiers within a range to which a connection can be established, and attempts to establish a connection with a device corresponding to a device identifier containing relay matching information. 2. The data encryption method according to claim 1, characterized in that the device identifier of the relay device is in a non-broadcast state, and the device identifier of the relay device is composed of at least relay matching information and timestamp information, and the timestamp information is determined by the moment when the relay device receives the dynamic password sent by the server; The mobile terminal generates an addressing identifier according to the terminal matching information and the current time, and searches for a device identifier in a non-broadcast state within a search range according to the addressing identifier and connects. 3. The data encryption method according to claim 2, characterized in that the moment when the server sends the dynamic password has a preset sending logic, and the preset sending logic is synchronized with the relay device and the mobile terminal; When the relay device receives the dynamic password sent by the server, it obtains a timestamp at a receiving time before the current time in the sending logic as timestamp information; When the mobile terminal obtains the dynamic password sent by the server, it obtains the timestamp of a receiving time before the current time in the sending logic as the timestamp information, and combines it with the terminal matching information to generate an addressing identifier. 4. The data encryption method according to claim 1, characterized in that the server and the relay device communicate via data packets, and the data packets all include check bits, and the data encryption method further comprises: After receiving the data packet sent by the server, the relay device extracts the check code of the check bit in the data packet and performs verification; When the verification is passed, the relay device parses the data packet; Before the relay device sends the data packet to the server, the relay device randomly generates and records the verification code; The relay device integrates the check code into the check digit of the data packet sent to the server. 5. The data encryption method according to claim 4, characterized in that after the server updates the dynamic password and sends it to the relay device, the relay device receives the dynamic password and verifies the check digit; When the check digit is verified, the dynamic password is decrypted; Before the server updates the dynamic password, the relay device randomly generates a verification code and packages it with the update request instruction to generate a data packet; The relay device sends the data packet to the server; The server responds to the data packet sent by the relay device and splits the check digit to obtain the check code; The server generates a dynamic password and integrates it with the obtained verification code to generate a data packet to be sent to the relay device. 6. The data encryption method according to claim 5, characterized in that: After the mobile terminal establishes a connection with the relay device, the relay device randomly generates a verification code and packages it with a preset encryption rule to generate a data packet; The relay device sends the data packet to the server; The server responds to the data packet sent by the relay device and splits the check digit to obtain the check code; The server generates a successful reception instruction, and integrates it with the obtained verification code to generate a data packet to be sent to the relay device; The relay device receives the data packet sent by the server and parses it to verify the check digit; When the check digit verification passes and the reception success instruction is received, the relay device stops the process and waits for the generation of the request update instruction; When the relay device does not receive the data packet sent by the server within the preset time, it resends the data packet to the server. 7. A data encryption system, comprising: The mobile terminal is used to obtain the dynamic password sent by the server, and after the mobile terminal establishes a connection with the relay device, sends the information to be encrypted to the server, and searches for and connects to a matching relay device according to the obtained dynamic password; The relay device sends a preset encryption rule to the server after the mobile terminal is connected, and different relay devices are preset with corresponding different encryption rules; The server is used to receive the information to be encrypted sent by the mobile terminal and the encryption rules sent by the relay device, and encrypt the information to be encrypted and generate printable label information; the server regularly updates the dynamic password and sends it to the relay device; The relay device establishes a short-distance connection with the mobile terminal. The method for connecting the mobile terminal to the matching relay device includes: The mobile terminal decrypts the dynamic password to obtain terminal matching information; The relay device decrypts the dynamic password to obtain relay matching information; The relay device modifies the device identifier, wherein the device identifier of the relay device has a preset expression field, and the expression field includes the relay matching information; The mobile terminal searches for all device identifiers within a range to which a connection can be established, and attempts to establish a connection with a device corresponding to a device identifier containing relay matching information. 8. A computer-readable storage medium, characterized in that it stores a computer program that can be loaded by a processor and executes the method according to any one of claims 1 to 6.