A certificate encryption storage, decryption reading method and device

Abstract

The present invention provides a certificate encryption storage, decryption reading method and device, including: determining a storage space, obtaining plaintext certificate data, and setting a preset random function, a preset obfuscation principle, and a preset default password; encrypting the plaintext certificate data to obtain a first hash value, and combining the plaintext certificate data and the first hash value to obtain an initial certificate ciphertext; obtaining a certificate key according to a preset random function and a preset default password; and obtaining a second hash value according to the preset default password, obfuscating the certificate key and the second hash value to obtain obfuscated data; inserting the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain a target certificate ciphertext, and storing the certificate ciphertext in the storage space. The present invention generates obfuscated data by using a preset random function, a preset obfuscation principle, and a preset default password, and then encrypts the initial certificate ciphertext according to the obfuscated data, thereby improving the security of plaintext certificate data storage.

Description

Technical Field

[0001] The present invention relates to the technical field of certificate storage, and in particular to a method and device for encrypting, storing, decrypting and reading a certificate. Background Art

[0002] The national cryptographic algorithm is a series of domestic cryptographic algorithms recognized by the State Cryptography Administration, also known as domestic commercial cryptographic algorithms, mainly including SM2, SM3, SM4, SM9, etc. Among them, the SM2 algorithm is a public key encryption algorithm based on elliptic curves, SM3 is a message digest algorithm, SM4 is a public symmetric encryption algorithm, and SM9 is an identity-based cryptographic algorithm. Trusted platform module (TPM) can be applied to computers, servers and other devices, and can also be applied to network devices such as routers or switches, which can play a role in ensuring the information security of devices.

[0003] The core of information security hardware is security chip and hardware security module (HSM). Security chip is also called secure element (SE), which is an integrated circuit with internal cryptographic algorithm and physical anti-attack design. Hardware security module (HSM) is a computer device used to protect and manage keys and sensitive data used by strong authentication systems and provide related cryptographic operations. It is the basic support for vehicle-side security solutions.

[0004] In the prior art, SM9 or SM3 is generally used to encrypt data on the security chip, and then the encrypted data is protected by a hardware security module. However, the software programs on the network device often store the password in plain text, and the data encryption process is relatively simple, and the security of the password is low.

[0005] Therefore, it is urgent to propose a certificate encryption storage, decryption reading method and device to solve the technical problem that the method of encrypting data through SM9 or SM3 in the prior art is relatively simple, resulting in low password security. Summary of the invention

[0006] In view of this, it is necessary to provide a certificate encryption storage, decryption reading method and device to solve the technical problem that the method of encrypting data through SM9 or SM3 in the prior art is relatively simple, resulting in low password security.

[0007] In a first aspect, the present invention provides a certificate encryption storage method, comprising:

[0008] Determine storage space, obtain plaintext certificate data, and set a preset random function, preset obfuscation principle, and preset default password;

[0009] Encrypting the plaintext certificate data according to the SM3 algorithm to obtain a first Hash value, and combining the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext;

[0010] Obtaining a certificate key according to the preset random function and the preset default password; and obtaining a second Hash value according to the preset default password, and obfuscating the certificate key and the second Hash value to obtain obfuscated data;

[0011] The obfuscated data is inserted into the initial certificate ciphertext according to the preset obfuscation principle to obtain a target certificate ciphertext, and the certificate ciphertext is stored in the storage space.

[0012] In some possible implementations, the combining the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext includes:

[0013] Extracting a preset number of byte data of the first hash value to obtain a third hash value;

[0014] The third hash value is added to the end of the plaintext certificate data to obtain the initial certificate ciphertext.

[0015] In some possible implementations, obtaining a certificate key according to the preset random function and the preset default password includes:

[0016] Generate a random number of a preset length according to the preset random function;

[0017] The number of repetitions is set, and a certificate key is generated according to the random number, the preset default password and the number of repetitions.

[0018] In some possible implementations, before obtaining the certificate key according to the preset random function and the preset default password, the method further includes:

[0019] Obtain the operation authority of the current operator, and determine whether the operation authority meets the preset encryption and decryption operation authority;

[0020] The obtaining of the certificate key according to the preset random function and the preset default password comprises:

[0021] In the case where the operation authority satisfies the preset encryption and decryption operation authority, a certificate key is obtained according to the preset random function and the preset default password.

[0022] In some possible implementations, the preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle.

[0023] In some possible implementations, inserting the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain the target certificate ciphertext includes:

[0024] Determining the data insertion obfuscation principle or the data logic operation obfuscation principle according to the last digit of the first Hash value;

[0025] The obfuscated data is inserted into the initial certificate ciphertext according to the data insertion obfuscation principle or the data logic operation obfuscation principle to obtain the target certificate ciphertext.

[0026] In a second aspect, the present invention provides a certificate decryption and reading method, comprising:

[0027] Obtain the target certificate ciphertext from the storage space, and set a preset random function, a preset obfuscation principle, and a preset default password;

[0028] Extracting the target certificate ciphertext according to the preset obfuscation principle to obtain obfuscated data, and deobfuscating the obfuscated data according to the preset random function and the preset default password to obtain a fourth Hash value;

[0029] Decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value;

[0030] Plain text certificate data is obtained according to the fourth Hash value and the fifth Hash value.

[0031] In some possible implementations, obtaining plaintext certificate data according to the fourth Hash value and the fifth Hash value includes:

[0032] Determine whether a previously preset number of byte data of the fourth hash value is consistent with a previously preset number of byte data of the fifth hash value;

[0033] If not, an empty plaintext certificate is returned;

[0034] If yes, the plaintext certificate data is obtained.

[0035] In a third aspect, the present invention further provides a certificate encryption storage device, comprising:

[0036] A data acquisition module is used to determine storage space, obtain plaintext certificate data, and set a preset random function, a preset obfuscation principle, and a preset default password;

[0037] A first encryption module, configured to encrypt the plaintext certificate data according to an SM3 algorithm to obtain a first Hash value, and to combine the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext;

[0038] A second encryption module is used to obtain a certificate key according to the preset random function and the preset default password; and obtain a second Hash value according to the preset default password, and obfuscate the certificate key and the second Hash value to obtain obfuscated data;

[0039] The ciphertext storage module is used to insert the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle, obtain the target certificate ciphertext, and store the certificate ciphertext in the storage space.

[0040] In some possible implementations, the second encryption module includes:

[0041] A data extraction submodule, used for extracting a preset number of bytes of data of the first hash value to obtain a third hash value;

[0042] The value adding submodule is used to add the third Hash value to the end of the plain text certificate data to obtain an initial certificate ciphertext.

[0043] In some possible implementations, the second encryption module further includes:

[0044] A random number generation submodule, used to generate a random number of a preset length according to the preset random function;

[0045] The key generation submodule is used to set the number of repetitions and generate a certificate key according to the random number, the preset default password and the number of repetitions.

[0046] In some possible implementations, the certificate encryption storage device further includes:

[0047] The authority judgment module is used to obtain the operation authority of the current operator and judge whether the operation authority meets the preset encryption and decryption operation authority;

[0048] The second encryption module also includes:

[0049] The encryption submodule is used to obtain a certificate key according to the preset random function and the preset default password when the operation authority meets the preset encryption and decryption operation authority.

[0050] In some possible implementations, the preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle.

[0051] In some possible implementations, the ciphertext storage submodule includes:

[0052] a tail number determination unit, used to determine the data insertion obfuscation principle or the data logic operation obfuscation principle according to the tail number of the first Hash value;

[0053] A data insertion unit is used to insert the obfuscated data into the initial certificate ciphertext according to the data insertion obfuscation principle or the data logic operation obfuscation principle to obtain a target certificate ciphertext.

[0054] In a fourth aspect, the present invention further provides a certificate decryption and reading device, comprising:

[0055] The ciphertext acquisition module is used to obtain the target certificate ciphertext from the storage space and set a preset random function, a preset obfuscation principle and a preset default password;

[0056] a first decryption module, configured to extract the target certificate ciphertext according to the preset obfuscation principle to obtain obfuscated data, and de-obfuscate the obfuscated data according to the preset random function and the preset default password to obtain a fourth Hash value;

[0057] A second decryption module, used to decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value;

[0058] The certificate determination module is used to obtain plain text certificate data according to the fourth Hash value and the fifth Hash value.

[0059] In some possible implementations, the certificate determination module includes:

[0060] The data judgment submodule is used to judge whether the previously preset number of byte data of the fourth hash value is consistent with the previously preset number of byte data of the fifth hash value; if not, return an empty plaintext certificate; if so, obtain plaintext certificate data.

[0061] In a fifth aspect, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the various steps of the above-mentioned certificate-based encryption storage method embodiment when executed by the processor.

[0062] In a sixth aspect, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various steps of the above-mentioned certificate-based encryption storage method embodiment are implemented.

[0063] The beneficial effects of adopting the above-mentioned embodiments are as follows: the certificate encryption storage method provided by the present invention determines the storage space, obtains the plaintext certificate data, and sets a preset random function, a preset obfuscation principle, and a preset default password; encrypts the plaintext certificate data according to the SM3 algorithm to obtain a first hash value, and combines the plaintext certificate data and the first hash value to obtain an initial certificate ciphertext; obtains a certificate key according to a preset random function and a preset default password; and obtains a second hash value according to the preset default password, obfuscates the certificate key and the second hash value to obtain obfuscated data; inserts the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain the target certificate ciphertext, and stores the certificate ciphertext in the storage space. The present invention can encrypt the plaintext certificate data through the SM3 algorithm to obtain the initial certificate ciphertext, and can also generate obfuscated data through a preset random function, a preset obfuscation principle, and a preset default password, and then can encrypt the initial certificate ciphertext according to the obfuscated data, thereby increasing the complexity of the encryption of the plaintext certificate data and improving the security of the storage of the plaintext certificate data. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 A schematic diagram of an embodiment of the method for encrypting and storing certificates provided by the present invention;

[0066] Figure 2 A schematic diagram of a flow chart of an embodiment of a certificate decryption and reading method provided by the present invention;

[0067] Figure 3 A schematic diagram of the structure of an embodiment of the certificate encryption storage device provided by the present invention;

[0068] Figure 4 A schematic diagram of the structure of an embodiment of a certificate decryption and reading device provided by the present invention;

[0069] Figure 5 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0071] Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0072] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0073] The embodiments of the present invention provide a method and device for encrypting and storing a certificate and decrypting and reading the certificate, which are described below respectively.

[0074] Figure 1 A schematic diagram of an embodiment of the certificate encryption storage method provided by the present invention is shown in FIG. Figure 1 As shown, the certificate encryption storage method includes:

[0075] S101, determine the storage space, obtain the plaintext certificate data, and set a preset random function, a preset obfuscation principle, and a preset default password;

[0076] S102, encrypting the plaintext certificate data according to the SM3 algorithm to obtain a first Hash value, and combining the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext;

[0077] S103, obtaining a certificate key according to a preset random function and a preset default password; and obtaining a second Hash value according to the preset default password, and obfuscating the certificate key and the second Hash value to obtain obfuscated data;

[0078] S104: insert the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain the target certificate ciphertext, and store the certificate ciphertext into the storage space.

[0079] Compared with the prior art, the certificate encryption storage method provided by the embodiment of the present invention determines the storage space, obtains the plaintext certificate data, and sets a preset random function, a preset obfuscation principle and a preset default password; encrypts the plaintext certificate data according to the SM3 algorithm to obtain a first hash value, and combines the plaintext certificate data and the first hash value to obtain an initial certificate ciphertext; obtains a certificate key according to a preset random function and a preset default password; and obtains a second hash value according to the preset default password, obfuscates the certificate key and the second hash value to obtain obfuscated data; inserts the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain the target certificate ciphertext, and stores the certificate ciphertext in the storage space. The present invention can encrypt the plaintext certificate data through the SM3 algorithm to obtain the initial certificate ciphertext, and can also generate obfuscated data through a preset random function, a preset obfuscation principle and a preset default password, and then can encrypt the initial certificate ciphertext according to the obfuscated data, thereby increasing the complexity of the encryption of the plaintext certificate data and improving the security of the storage of the plaintext certificate data.

[0080] It should be understood that the storage space in step S101 may be a dedicated space opened in the ROM area inside the MCU.

[0081] In a specific embodiment of the present invention, after obtaining the plaintext certificate data, the SM3 algorithm can be used to perform 64 rounds of iterative operations on the plaintext certificate data, and then a 32-byte HASH result, i.e., a first hash value, can be output. The preset random function, the preset obfuscation principle, and the preset default password can be improved contents of the SM4 algorithm. The preset method and the preset default password can be set according to the encryption process of the SM4 algorithm, and then a certificate key of the SM4 algorithm can be generated. The SHA256 algorithm can also be used to perform a hash operation on the preset default password in the configuration, so that 32 bytes of data can be generated and given to the second hash value, and then the certificate key can be obfuscated according to the generated 32-byte data to generate obfuscated data, wherein the operator can set the way to obfuscate the certificate key for the 32-byte data according to his own work experience and actual situation, for example, the certificate key and the second hash value can be obfuscated in the way of addition, subtraction, multiplication and division, or the certificate key can be placed in a certain area of ​​the second hash value, etc., so as to obtain obfuscated data; the specific processing process of the SM3 algorithm can be set according to the actual situation, and the embodiment of the present invention is not limited here.

[0082] It should be noted that: in order to encrypt the plaintext certificate data and the first Hash value, in some embodiments of the present invention, the plaintext certificate data and the first Hash value are combined to obtain the initial certificate ciphertext, including:

[0083] Extracting a preset number of bytes of data before the first hash value to obtain a third hash value;

[0084] The second hash value is added to the plaintext certificate data to obtain the initial certificate ciphertext.

[0085] In a specific embodiment of the present invention, the first hash value may be a 32-byte HASH result, and a preset number of bytes of data before the first hash value may be extracted, for example, the first 16 bytes of data may be extracted, and then the extracted third hash value may be obtained. The third hash value may also be added to the end of the plaintext certificate data to obtain the first plaintext certificate, that is, "plaintext certificate data + third hash value".

[0086] It should be noted that, in order to avoid operator errors, in some embodiments of the present invention, before obtaining the certificate key according to the preset random function and the preset default password, the following steps are further included:

[0087] Obtain the current operator's operating authority and determine whether the operating authority meets the preset encryption and decryption operating authority;

[0088] According to the preset random function and the preset default password, the certificate key is obtained, including:

[0089] When the operation authority meets the preset encryption and decryption operation authority, the certificate key is obtained according to the preset random function and the preset default password.

[0090] In a specific embodiment of the present invention, operation permissions can be set for operators. When the system detects that an operator is performing an operation, the operation permissions of the operator can be obtained. Then, based on the operator's operation permissions, it can be determined whether the operator meets the preset encryption and decryption operation permissions. If so, it means that the operator meets the requirements and can perform subsequent encryption processes. If not, it means that the permissions are insufficient and the operation cannot be performed.

[0091] It should be noted that, in order to increase the complexity of encryption, in some embodiments of the present invention, the certificate key is obtained according to a preset random function and a preset default password, including:

[0092] Generate a random number of preset length according to a preset random function;

[0093] Set the number of repetitions and generate a certificate key based on the random number, the preset default password, and the number of repetitions.

[0094] In a specific embodiment of the present invention, the SM4 algorithm may include a preset random function and a number of repetitions, that is, a preset random function, and the preset random function can randomly generate a random number of a preset length, wherein the preset length, the number of repetitions and the preset random function can be set according to actual conditions, and the embodiment of the present invention is not limited here. After obtaining the random number, the PBKDF2 algorithm can be used to generate a certificate key of the SM4 algorithm using the preset default password, the random number and the number of repetitions in the configuration, for example, PBKDF2 (P, S, c, dkLen), wherein P is the preset default password, S is the random number, c is the number of repetitions, dkLen is the specified byte length of the derived certificate key, the maximum of which is approximately (2^32-1)*hLen, and hLen is the preset length (byte length) of the random number.

[0095] In some embodiments of the present invention, the preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle.

[0096] In a specific embodiment of the present invention, the data insertion obfuscation principle is a rule for inserting obfuscated data into the initial certificate ciphertext without performing any operation on the obfuscated data, for example: inserting each bit of the obfuscated data into the initial certificate ciphertext in an interval manner.

[0097] In a specific embodiment of the present invention, the principle of data logic operation obfuscation is to perform logical operations such as addition, subtraction, multiplication and division on the obfuscated data, and then confuse the obfuscated data after the logical operation with the initial certificate ciphertext.

[0098] In some embodiments of the present invention, inserting obfuscated data into the initial certificate ciphertext according to a preset obfuscation principle to obtain the target certificate ciphertext includes:

[0099] Determine a data insertion obfuscation principle or a data logic operation obfuscation principle according to the last digit of the first hash value;

[0100] According to the data insertion obfuscation principle or the data logic operation obfuscation principle, the obfuscated data is inserted into the initial certificate ciphertext to obtain the target certificate ciphertext.

[0101] In a specific embodiment of the present invention, the preset obfuscation principle may include a data insertion obfuscation principle, and the data insertion obfuscation principle may be determined according to the last digit of the obfuscated data. For example, when the last digit is 1, a byte of obfuscated data may be inserted every other byte, thereby inserting the obfuscated data into the initial certificate ciphertext. If the last digit is 2, a byte of obfuscated data may be inserted every other byte, or a byte of multiple obfuscated data may be inserted every other byte. The data insertion obfuscation principle may also be a principle of directly inserting the obfuscated data into the initial certificate ciphertext after obtaining the obfuscated data. The specific data insertion obfuscation principle and the data logic operation obfuscation principle may be set according to actual conditions, and the embodiment of the present invention is not limited thereto.

[0102] The embodiment of the present invention encrypts plaintext certificate data through SM3 algorithm and SM4 algorithm, including the steps of setting a preset obfuscation principle, preset a default password, generating a random number and a number of repetitions, etc., which can effectively ensure the security of the certificate and prevent it from being destroyed or tampered with.

[0103] Figure 2 A flow chart of an embodiment of the certificate decryption and reading method provided by the present invention is as follows: Figure 2 As shown, the certificate decryption and reading method includes:

[0104] S201, obtaining the target certificate ciphertext from the storage space, and setting a preset random function, a preset obfuscation principle, and a preset default password;

[0105] S202, extracting the target certificate ciphertext according to a preset obfuscation principle to obtain obfuscated data, and deobfuscating the obfuscated data according to a preset random function and a preset default password to obtain a fourth Hash value;

[0106] S203, decrypting the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value;

[0107] S204. Obtain plain text certificate data according to the fourth Hash value and the fifth Hash value.

[0108] Compared with the prior art, the certificate decryption and reading method provided by the embodiment of the present invention obtains the target certificate ciphertext from the storage space, and sets a preset random function, a preset obfuscation principle and a preset default password; extracts the target certificate ciphertext according to the preset obfuscation principle to obtain obfuscated data, and reverses the obfuscated data according to the preset random function and the preset default password to obtain a fourth hash value; decrypts the target certificate ciphertext according to the SM3 algorithm to obtain a fifth hash value; obtains plaintext certificate data according to the fourth hash value and the fifth hash value. The present invention can generate obfuscated data through a preset random function, a preset obfuscation principle and a preset default password, and can also decrypt the plaintext certificate data through the SM3 algorithm, and then obtain the fourth hash value according to the obfuscated data, and obtain the fifth hash value according to the target certificate ciphertext, so that the plaintext certificate data can be obtained according to the fourth hash value and the fifth hash value, which increases the complexity of decryption of the plaintext certificate data and improves the security of storage of the plaintext certificate data.

[0109] It should be understood that: the main control program can obtain the certificate ciphertext encrypted and stored by the certificate encryption storage method from the storage space.

[0110] In a specific embodiment of the present invention, after obtaining the certificate ciphertext, the SM4 algorithm can be used to decrypt the certificate ciphertext, so as to obtain the "initial plaintext certificate + fourth hash value", and then the initial plaintext certificate and the fourth hash value can be obtained, wherein the decryption step of the SM4 algorithm is the inverse step of the encryption, and the specific steps are not limited in this embodiment of the present invention.

[0111] Further, after obtaining the initial plaintext certificate and the fourth hash value, the initial plaintext certificate may be decrypted using the SM3 algorithm to obtain a 32-byte hash value, ie, a fifth hash value.

[0112] In some embodiments of the present invention, obtaining plaintext certificate data according to the fourth Hash value and the fifth Hash value includes:

[0113] Determine whether a previously preset number of byte data of the fourth hash value is consistent with a previously preset number of byte data of the fifth hash value;

[0114] If not, an empty plaintext certificate is returned;

[0115] If yes, the plaintext certificate data is obtained.

[0116] In a specific embodiment of the present invention, after obtaining the fourth hash value and the fifth hash value, the previous preset number of byte data of the fourth hash value and the previous preset number of byte data of the fifth hash value can be extracted respectively, for example, the first 16 bytes of data of the fourth hash value and the first 16 bytes of data of the fifth hash value, and then it can be determined whether the first 16 bytes of data of the fourth hash value and the first 16 bytes of data of the fifth hash value are consistent. If so, it indicates that the decryption is successful and the plaintext certificate data can be returned. If not, it indicates that the password is wrong, the decryption fails, and an empty plaintext certificate is returned.

[0117] Furthermore, before using the SM4 algorithm to decrypt the certificate ciphertext, an obfuscation principle can be preset, so that the obfuscated data can be found from the certificate ciphertext according to the preset obfuscation principle, and then the SHA256 algorithm can be used to perform a hash operation on the preset default password to generate 32-byte data. A random number of a preset length can also be generated according to a preset random function, and then an inverse operation can be performed based on the random number, the obfuscated data and the 32-byte data, thereby obtaining the SM4 algorithm key, that is, the initial plaintext certificate and the fourth hash value.

[0118] The embodiment of the present invention can decrypt the certificate ciphertext stored in the storage space to obtain the plaintext certificate, thereby realizing the decryption process of the certificate ciphertext, without having to consider a chip with built-in secure storage space and functions or an external security chip, thereby reducing the cost of storing plaintext certificates.

[0119] In order to better implement the certificate encryption storage method in the embodiment of the present invention, based on the certificate encryption storage method, the embodiment of the present invention also provides a certificate encryption storage device, such as Figure 3 As shown, the certificate encryption storage device includes:

[0120] The data acquisition module 301 is used to determine the storage space, obtain the plain text certificate data, and set the preset random function, preset obfuscation principle and preset default password;

[0121] The first encryption module 302 is used to encrypt the plaintext certificate data according to the SM3 algorithm to obtain a first Hash value, and to combine the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext;

[0122] The second encryption module 303 is used to obtain a certificate key according to a preset random function and a preset default password; and obtain a second Hash value according to the preset default password, and obfuscate the certificate key and the second Hash value to obtain obfuscated data;

[0123] The ciphertext storage module 304 is used to insert obfuscated data into the initial certificate ciphertext according to a preset obfuscation principle, obtain the target certificate ciphertext, and store the certificate ciphertext into a storage space.

[0124] In some embodiments of the present invention, the second encryption module includes:

[0125] A data extraction submodule, used to extract a preset number of bytes of data before the first hash value to obtain a third hash value;

[0126] The value adding submodule is used to add the third hash value to the end of the plain text certificate data to obtain the initial certificate ciphertext.

[0127] In some embodiments of the present invention, the second encryption module further includes:

[0128] A random number generation submodule is used to generate a random number of a preset length according to a preset random function;

[0129] The key generation submodule is used to set the number of repetitions and generate a certificate key based on a random number, a preset default password and the number of repetitions.

[0130] In some embodiments of the present invention, the certificate encryption storage device further includes:

[0131] The authority judgment module is used to obtain the operation authority of the current operator and judge whether the operation authority meets the preset encryption and decryption operation authority;

[0132] The second encryption module also includes:

[0133] The encryption submodule is used to obtain the certificate key according to a preset random function and a preset default password when the operation authority meets the preset encryption and decryption operation authority.

[0134] In some embodiments of the present invention, the preset obfuscation principle includes a data obfuscation principle; and the second encryption module further includes:

[0135] The value insertion submodule is used to confuse the certificate key and the second hash value according to the data obfuscation principle to obtain obfuscated data.

[0136] In some embodiments of the present invention, the preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle.

[0137] In some possible implementations, the ciphertext storage submodule includes:

[0138] A tail number determination unit, used to determine a data insertion obfuscation principle or a data logic operation obfuscation principle according to the tail number of the first Hash value;

[0139] The data insertion unit is used to insert obfuscated data into the initial certificate ciphertext according to the data insertion obfuscation principle or the data logic operation obfuscation principle to obtain the target certificate ciphertext.

[0140] The certificate encryption storage device provided in the above embodiment can implement the technical solution described in the above certificate encryption storage method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above certificate encryption storage method embodiment, which will not be repeated here.

[0141] In order to better implement the certificate decryption and reading method in the embodiment of the present invention, based on the certificate decryption and reading method, the embodiment of the present invention also provides a certificate decryption and reading device, such as Figure 4 As shown, the certificate decryption and reading device includes:

[0142] The ciphertext acquisition module 401 is used to obtain the target certificate ciphertext from the storage space and set a preset random function, a preset obfuscation principle and a preset default password;

[0143] A first decryption module 402 is used to extract the target certificate ciphertext according to a preset obfuscation principle to obtain obfuscated data, and de-obfuscate the obfuscated data according to a preset random function and a preset default password to obtain a fourth Hash value;

[0144] A second decryption module 403, configured to decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value;

[0145] The certificate determination module 404 is configured to obtain plain text certificate data according to the fourth Hash value and the fifth Hash value.

[0146] In some embodiments of the present invention, the certificate determination module includes:

[0147] The data judgment submodule is used to judge whether the byte data of the previous preset number of the fourth hash value is consistent with the byte data of the previous preset number of the fifth hash value; if not, an empty plaintext certificate is returned; if so, the plaintext certificate data is obtained.

[0148] The certificate decryption and reading device provided in the above embodiment can implement the technical solution described in the above certificate decryption and reading method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above certificate decryption and reading method embodiment, which will not be repeated here.

[0149] like Figure 5 As shown, the present invention also provides an electronic device 500. The electronic device 500 includes a processor 501, a memory 502 and a display 503. Figure 5 Only some components of the electronic device 500 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0150] In some embodiments, the memory 502 may be an internal storage unit of the electronic device 500, such as a hard disk or memory of the electronic device 500. In other embodiments, the memory 502 may also be an external storage device of the electronic device 500, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 500.

[0151] Furthermore, the memory 502 may include both an internal storage unit of the electronic device 500 and an external storage device. The memory 502 is used to store application software installed in the electronic device 500 and various data.

[0152] In some embodiments, the processor 501 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 502, such as the certificate encryption storage method and the certificate decryption reading method of the present invention.

[0153] In some embodiments, the display 503 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 503 is used to display information on the electronic device 500 and to display a visual user interface. The components 501-503 of the electronic device 500 communicate with each other via a system bus.

[0154] In some embodiments of the present invention, when the processor 501 executes the certificate encryption storage program in the memory 502, the following steps may be implemented:

[0155] Determine storage space, obtain plaintext certificate data, and set a preset random function, preset obfuscation principle, and preset default password;

[0156] Encrypt the plaintext certificate data according to the SM3 algorithm to obtain a first Hash value, and combine the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext;

[0157] Obtain a certificate key according to a preset random function and a preset default password; and obtain a second Hash value according to the preset default password, and obfuscate the certificate key and the second Hash value to obtain obfuscated data;

[0158] According to the preset obfuscation principle, the obfuscated data is inserted into the initial certificate ciphertext to obtain the target certificate ciphertext, and the certificate ciphertext is stored in the storage space.

[0159] It should be understood that: when the processor 501 executes the certificate encryption storage program in the memory 502, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0160] In some embodiments of the present invention, when the processor 501 executes the certificate decryption and reading program in the memory 502, the following steps may be implemented:

[0161] Obtain the target certificate ciphertext from the storage space, and set a preset random function, a preset obfuscation principle, and a preset default password;

[0162] Extracting the target certificate ciphertext according to a preset obfuscation principle to obtain obfuscated data, and deobfuscating the obfuscated data according to a preset random function and a preset default password to obtain a fourth Hash value;

[0163] Decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth hash value;

[0164] The plain text certificate data is obtained according to the fourth Hash value and the fifth Hash value.

[0165] It should be understood that: when the processor 501 executes the certificate decryption and reading program in the memory 502, in addition to the above functions, other functions may also be implemented, and details may refer to the description of the corresponding method embodiments above.

[0166] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 500 mentioned, and the electronic device 500 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 500 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0167] Accordingly, an embodiment of the present application also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, it can implement the certificate encryption storage, decryption reading method steps or functions provided in the above-mentioned method embodiments.

[0168] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0169] The certificate encryption storage, decryption reading method and device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A certificate encryption storage method, characterized in that: include: Determine storage space, obtain plaintext certificate data, and set a preset random function, preset obfuscation principle, and preset default password; Encrypting the plaintext certificate data according to the SM3 algorithm to obtain a first Hash value, and combining the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext; Obtaining a certificate key according to the preset random function and the preset default password; and obtaining a second Hash value according to the preset default password, and obfuscating the certificate key and the second Hash value to obtain obfuscated data; Inserting the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain a target certificate ciphertext, and storing the certificate ciphertext in the storage space; The preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle; The step of inserting the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle to obtain the target certificate ciphertext includes: Determining the data insertion obfuscation principle or the data logic operation obfuscation principle according to the last digit of the first Hash value; The obfuscated data is inserted into the initial certificate ciphertext according to the data insertion obfuscation principle or the data logic operation obfuscation principle to obtain the target certificate ciphertext.

2. The certificate encryption storage method according to claim 1, characterized in that: The combining and processing the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext includes: Extracting a preset number of byte data of the first hash value to obtain a third hash value; The third hash value is added to the end of the plaintext certificate data to obtain the initial certificate ciphertext.

3. The certificate encryption storage method according to claim 1, characterized in that: The obtaining of the certificate key according to the preset random function and the preset default password comprises: Generate a random number of a preset length according to the preset random function; The number of repetitions is set, and a certificate key is generated according to the random number, the preset default password and the number of repetitions.

4. The certificate encryption storage method according to claim 1, characterized in that: Before obtaining the certificate key according to the preset random function and the preset default password, the method further includes: Obtain the operation authority of the current operator, and determine whether the operation authority meets the preset encryption and decryption operation authority; The obtaining of the certificate key according to the preset random function and the preset default password comprises: In the case where the operation authority satisfies the preset encryption and decryption operation authority, a certificate key is obtained according to the preset random function and the preset default password.

5. A certificate decryption and reading method, characterized in that: include: Obtain the target certificate ciphertext from the storage space, and set a preset random function, a preset obfuscation principle, and a preset default password; Extracting the target certificate ciphertext according to the preset obfuscation principle to obtain obfuscated data, and deobfuscating the obfuscated data according to the preset random function and the preset default password to obtain a fourth Hash value; Decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value; Obtaining plaintext certificate data according to the fourth Hash value and the fifth Hash value; The obtaining of plaintext certificate data according to the fourth Hash value and the fifth Hash value includes: Determine whether a previously preset number of byte data of the fourth hash value is consistent with a previously preset number of byte data of the fifth hash value; If not, an empty plaintext certificate is returned; If yes, the plaintext certificate data is obtained.

6. A certificate encryption storage device, characterized in that: include: A data acquisition module is used to determine storage space, obtain plaintext certificate data, and set a preset random function, a preset obfuscation principle, and a preset default password; A first encryption module, configured to encrypt the plaintext certificate data according to an SM3 algorithm to obtain a first Hash value, and to combine the plaintext certificate data and the first Hash value to obtain an initial certificate ciphertext; A second encryption module, used to obtain a certificate key according to the preset random function and the preset default password; and obtaining a second Hash value according to the preset default password, and obfuscating the certificate key and the second Hash value to obtain obfuscated data; A ciphertext storage module, used for inserting the obfuscated data into the initial certificate ciphertext according to the preset obfuscation principle, obtaining a target certificate ciphertext, and storing the certificate ciphertext in the storage space; The preset obfuscation principle is a data insertion obfuscation principle or a data logic operation obfuscation principle; The ciphertext storage module is also used to determine the data insertion obfuscation principle or the data logic operation obfuscation principle according to the last digit of the first hash value; insert the obfuscated data into the initial certificate ciphertext according to the data insertion obfuscation principle or the data logic operation obfuscation principle to obtain the target certificate ciphertext.

7. A certificate decryption and reading device, characterized in that: include: The ciphertext acquisition module is used to obtain the target certificate ciphertext from the storage space and set a preset random function, a preset obfuscation principle and a preset default password; a first decryption module, configured to extract the target certificate ciphertext according to the preset obfuscation principle to obtain obfuscated data, and de-obfuscate the obfuscated data according to the preset random function and the preset default password to obtain a fourth Hash value; A second decryption module, used to decrypt the target certificate ciphertext according to the SM3 algorithm to obtain a fifth Hash value; a certificate determination module, configured to obtain plaintext certificate data according to the fourth Hash value and the fifth Hash value; The certificate determination module is also used to determine whether the previous preset number of byte data of the fourth hash value is consistent with the previous preset number of byte data of the fifth hash value; if not, return an empty plaintext certificate; if so, obtain plaintext certificate data.

Images