Encryption method, decryption method, word segmentation one-way encryption method, equipment and medium

Abstract

The invention relates to an encryption method, a decryption method, a word segmentation one-way encryption method, equipment and a medium. The method comprises the following steps: when plaintext service data is obtained, querying whether a memory stores a corresponding local service key or not; if it is queried that the memory does not store the corresponding local service key, signature verification information is generated, and the signature verification information and the master key identifier are sent to the master device; the signature verification information and the master key identifier are used for indicating that the master device generates a first ciphertext key based on a symmetric encryption algorithm and the master key identifier after verification based on the signature verification information and the master key identifier is passed, and generates a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information; receiving a first ciphertext key and a second ciphertext key sent by the master device, and encrypting the plaintext service data by using the second ciphertext key to obtain ciphertext service data; and outputting the ciphertext service data and the first ciphertext key. Therefore, the security level of data encryption storage can be improved, and the availability of a fuzzy query function is guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption, and in particular to an encryption method, a decryption method, a word segmentation one-way encryption method, a device and a medium. Background Art

[0002] With the requirements of national supervision and compliance, and data being an important asset of the company, it is necessary to encrypt data before storing it. However, in the process of data encryption, due to the imperfect design and non-standard implementation of existing technologies, data storage has security risks and reduced availability. For example: 1. Improper key storage. For example, if the key is directly stored in a configuration file or hard-coded, an attacker can obtain the key by decompiling the code, or if the plaintext key is directly placed in a file, the plaintext key has a high risk of being exposed due to its high readability.

[0003] 2. Low key strength. One is that the key space is limited due to insufficient key length, and the other is that the key is generated through insecure pseudo-random numbers. Both of these situations will lead to a decrease in key strength, resulting in a high probability of collision and greater vulnerability to exhaustive search, dictionary attack or rainbow table attack.

[0004] 3. The strength of the cryptographic algorithm used is low. For example, the MD5 and SHA1 hash algorithms are used to store user passwords and mobile phone numbers. These algorithms have been proven to have vulnerabilities in collision attacks. The security of sensitive data encrypted using these algorithms is greatly reduced.

[0005] 4. Reduced availability. After data encryption, the fuzzy query function of the data is unavailable. This is because after data encryption, the form and structure of the data will be significantly changed, making fuzzy query difficult.

[0006] In summary, in the prior art, there are risks such as key leakage, low key strength, and easy cracking of ciphertext in the process of key generation, storage, distribution and use, which directly affect the security of the entire system. Summary of the invention

[0007] Based on this, it is necessary to provide an encryption method, decryption method, word segmentation one-way encryption method, device and medium that can improve the security of data encryption in response to the above technical problems.

[0008] A data encryption method comprises the following steps: When obtaining plaintext business data, query whether the corresponding local business key is stored in the memory; the local business key includes a local plaintext key and a local ciphertext key; If the query finds that the corresponding local business key is not stored in the memory, a signature verification message is generated, and the signature verification message and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a first ciphertext key based on the symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on the asymmetric encryption algorithm and the signature verification message after verification based on the signature verification message and the master key identifier; the signature verification message carries an application identifier, a random number, a timestamp, a version number, and a signature information; Receiving a first ciphertext key and a second ciphertext key sent by the master device, and using the second ciphertext key to encrypt the plaintext service data to obtain the ciphertext service data; Output the encrypted business data and the first encrypted key.

[0009] In one embodiment, the steps are also included: If the corresponding local business key is found in the memory, determine whether the local business key is expired; If it is determined that the local business key has not expired, the plaintext business data is encrypted using the local plaintext key to obtain the ciphertext business data; Output ciphertext business data and local ciphertext key.

[0010] In one embodiment, the steps are also included: If it is determined that the local business key has expired, a signature verification message is generated, and the signature verification message and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on an asymmetric encryption algorithm and the signature verification message after verification based on the signature verification message and the master key identifier is passed; Receiving a first ciphertext key and a second ciphertext key sent by the master device, and using the second ciphertext key to encrypt the plaintext service data to obtain the ciphertext service data; Output the encrypted business data and the first encrypted key.

[0011] In one embodiment, the signature information is generated based on the following steps: Concatenate the application ID, random number, timestamp, and version number in order to generate a plain text signature. The plaintext signature text is processed based on the signature algorithm and the corresponding application key to generate signature information.

[0012] In one embodiment, after the step of receiving the first ciphertext key and the second ciphertext key sent by the master device, the step further includes: Obtain a private key corresponding to the asymmetric encryption algorithm, and decrypt the second ciphertext key based on the private key and the asymmetric encryption algorithm to obtain a plaintext key corresponding to the second ciphertext key; An expiration time is set for the plaintext key and the first ciphertext key, and the keys are stored to form a local plaintext key and a local ciphertext key respectively.

[0013] In one embodiment, the step of encrypting the plaintext business data using the second ciphertext key to obtain the ciphertext business data includes the following steps: Obtaining a plaintext key corresponding to the second ciphertext key, and performing string shift encryption on the plaintext key to obtain a plaintext business key; Encrypt the plaintext business data using a symmetric encryption algorithm and a plaintext business key to obtain initial ciphertext business data; The initial ciphertext business data is encrypted again through Caesar encryption to obtain the ciphertext business data.

[0014] A data encryption method comprises the following steps: The verification information and master key identifier sent by the receiving terminal; the verification information is generated when the terminal obtains plaintext business data and queries the memory for the corresponding local business key and generates the corresponding local business key after it is found that the memory is expired when the terminal obtains plaintext business data; the verification information carries the application identifier, random number, timestamp, version number and signature information; The signature verification information and the master key identifier are verified. After the signature verification information and the master key identifier are verified, a first ciphertext key is generated based on the symmetric encryption algorithm and the master key identifier, and a second ciphertext key is generated based on the asymmetric encryption algorithm and the signature verification information; The first ciphertext key and the second ciphertext key are sent to the terminal, so that the terminal uses the second ciphertext key to encrypt the plaintext business data, obtain the ciphertext business data, and output the ciphertext business data and the first ciphertext key.

[0015] In one embodiment, the step of verifying the signature verification information and the master key identifier includes the steps of: Verify whether the signature verification information is complete, whether the same ID as the application ID is stored locally, and whether the timestamp has timed out; Generate verification signature information based on the application identifier, random number, timestamp and version number, and compare the verification signature information with the signature information to see if they are consistent; Find the bound IP according to the application ID and compare the bound IP with the terminal IP to see if they are consistent; Find out whether there is a corresponding master key according to the master key identifier; If a corresponding master key exists, determine whether the corresponding master key is disabled.

[0016] In one embodiment, the steps of generating a first ciphertext key based on a symmetric encryption algorithm and a master key identifier, and generating a second ciphertext key based on an asymmetric encryption algorithm and signature verification information include the following steps: Generate an initial key through a key generator, and obtain a plaintext key after shift encryption of the initial key; Find the corresponding master key according to the master key identifier, and use the shift algorithm to obtain the final master key; Use a symmetric encryption algorithm, take the final master key as the encryption key, encrypt the plaintext key to obtain the initial ciphertext key, encode the initial ciphertext key with Base64, and then perform Caesar encryption to obtain the first ciphertext key; According to the application identifier, the corresponding asymmetric encryption algorithm public key is searched, and based on the asymmetric encryption algorithm public key, the plaintext key is encrypted using the asymmetric encryption algorithm to obtain a second ciphertext key.

[0017] A data encryption method comprises the following steps: When the terminal obtains plaintext business data, it queries whether the corresponding local business key is stored in the memory; If the terminal finds that the corresponding local business key is not stored in the memory, it generates signature verification information and sends the signature verification information and the master key identifier to the master device; After the master device passes the verification based on the signature information and the master key identification certificate, it generates the first ciphertext key based on the symmetric encryption algorithm and the master key identification, and generates the second ciphertext key based on the asymmetric encryption algorithm and the signature verification information; the signature verification information carries the application identification, random number, timestamp, version number and signature information; The master device sends the first ciphertext key and the second ciphertext key to the terminal, and the terminal encrypts the plaintext service data using the second ciphertext key to obtain the ciphertext service data; The terminal outputs the encrypted business data and the first encrypted key.

[0018] A data decryption method comprises the following steps: When the ciphertext service data and the first ciphertext key are obtained, query whether the corresponding local plaintext key is stored in the memory; If it is found that the corresponding local plaintext key is not stored in the memory, a signature verification message is generated, and the signature verification message, the first ciphertext key and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a plaintext key based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and to generate a second ciphertext key based on the asymmetric encryption algorithm and the plaintext key after verification based on the signature verification message and the master key identifier; the signature verification message carries an application identifier, a random number, a timestamp, a version number and signature information; Receive the second ciphertext key sent by the main device, use the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data.

[0019] A data decryption method comprises the following steps: The signature verification information, the first ciphertext key and the master key identifier sent by the receiving terminal; the signature verification information is generated after the terminal obtains the ciphertext business data and the first ciphertext key and queries the memory for the corresponding local plaintext key not being stored, or after the terminal obtains the ciphertext business data and the first ciphertext key and queries the memory for the corresponding local plaintext key being stored and determines that the local plaintext key has expired; the signature verification information carries the application identifier, random number, timestamp, version number and signature information; The signature verification information and the master key identifier are verified. After the signature verification information and the master key identifier are verified, a plaintext key is generated based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and a second ciphertext key is generated based on the asymmetric encryption algorithm and the plaintext key; The second ciphertext key is sent to the terminal, so that the terminal uses the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data.

[0020] A word segmentation one-way encryption method. When the plaintext word segmentation service data and word segmentation rules are obtained, query whether the corresponding local plaintext word segmentation key is stored in the memory through the first ciphertext word segmentation key; If it is found that the corresponding local plaintext word segmentation key is not stored in the memory, a signature verification message is generated, and the signature verification message, the first ciphertext word segmentation key and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a plaintext word segmentation key based on the symmetric encryption algorithm, the first ciphertext word segmentation key and the master key identifier, and to generate a second ciphertext word segmentation key based on the asymmetric encryption algorithm and the plaintext word segmentation key after verification based on the signature verification message and the master key identifier; the signature verification message carries an application identifier, a random number, a timestamp, a version number and a signature information; Receive the second ciphertext word segmentation key sent by the main device, encrypt the plaintext word segmentation business data using the word segmentation rule and the second ciphertext word segmentation key, obtain the ciphertext word segmentation business data, and output the ciphertext word segmentation business data.

[0021] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0022] A computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0023] One of the above technical solutions has the following advantages and beneficial effects: The data encryption method of this application includes the following steps: when obtaining plaintext business data, query whether the memory stores the corresponding local business key; if the memory does not store the corresponding local business key, generate signature verification information, and send the signature verification information and the master key identifier to the main device; the signature verification information and the master key identifier are used to indicate that the main device generates a first ciphertext key based on the symmetric encryption algorithm and the master key identifier, and generates a second ciphertext key based on the asymmetric encryption algorithm and the signature verification information after verification based on the signature verification information and the master key identifier; receive the first ciphertext key and the second ciphertext key sent by the main device, and use the second ciphertext key to encrypt the plaintext business data to obtain the ciphertext business data; output the ciphertext business data and the first ciphertext key. This application manages the entire life cycle of the key (generation, storage, use and encryption), uses different security strategies at different stages, and realizes the use of dynamic keys, secure storage of data, and fuzzy query of ciphertext. Specific strategies include separate key management, highly random complex key generation, multi-algorithm combination encryption, and key authority management, thereby improving the security level of data encryption storage and ensuring the availability of fuzzy query functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is an application environment diagram of the encryption method, decryption method and word segmentation one-way encryption method in the embodiments of the present application.

[0025] Figure 2 A flowchart of the terminal side of the data encryption method in the embodiment of the present application.

[0026] Figure 3 Another flowchart diagram of the terminal side of the data encryption method in the embodiment of the present application.

[0027] Figure 4 This is another flowchart of the terminal side of the data encryption method in the embodiment of the present application.

[0028] Figure 5 A flow chart of the main device side of the data encryption method in the embodiment of the present application.

[0029] Figure 6 A schematic diagram of the process of generating a ciphertext key on the master device side in an embodiment of the present application.

[0030] Figure 7 A flowchart of a terminal side of a data decryption method in an embodiment of the present application.

[0031] Figure 8 A flow chart of the main device side of the data decryption method in the embodiment of the present application.

[0032] Fig. 9 A flowchart of the terminal side of the word segmentation one-way encryption method in the embodiment of the present application.

[0033] Fig.10 A flow chart of the main device side of the word segmentation one-way encryption method in the embodiment of the present application.

[0034] Fig.11 Schematic diagram of the internal structure of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0036] The encryption method, decryption method and word segmentation one-way encryption method provided in this application can be applied to Figure 1 In the application environment shown in the figure, the terminal 102 communicates with the main device 104 through the network. The terminal is used by the developer, and its main functions are: data segmentation, data encryption and decryption, key acquisition, storage and destruction. The main device is used by the main management personnel, and its main functions are: authority control, key generation and distribution, key encryption and decryption.

[0037] In one embodiment, Figure 2 As shown, a data encryption method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps: Step S210: When plain text business data is obtained, query whether the memory stores the corresponding local business key.

[0038] The developer inputs plaintext business data into the terminal, where plaintext business data refers to data that is not encrypted and exists in original, readable form. For example, in the field of enterprise management, plaintext business data includes customer information, employee information, etc. In the field of financial business, plaintext business data includes bank account information, securities trading information, etc. In order to encrypt the plaintext business data, the terminal preferentially queries whether a local business key for encrypting the plaintext business data is stored in its memory. It should be noted that the local business key is stored in the terminal's memory and is used to encrypt the plaintext business data. The local business key includes a local plaintext key and a local ciphertext key. The local business key is set to have an expiration time, that is, if the expiration time is reached, the local business key will become invalid. In one example, the expiration time is 30 days.

[0039] Step S220, if it is found that the corresponding local business key is not stored in the memory, then the signature verification information is generated, and the signature verification information and the master key identifier are sent to the main device. If the local business key is not found in the terminal memory, the terminal cannot encrypt the plaintext business data, so the corresponding key is requested from the main device to encrypt the plaintext business data. In order to request the main device to generate the corresponding key, the terminal device generates the signature verification information. Among them, the signature verification information carries the application identifier, random number, timestamp, version number and signature information. Among them, the application identifier is an identifier used to uniquely identify an application. It plays a vital role in the development, release and management of applications. Just like everyone has their own unique ID number, the application identifier can distinguish different applications. A timestamp refers to a complete and verifiable data that can indicate that a piece of data existed before a certain time. It is usually a sequence of characters that uniquely identifies a certain moment in time. Simply put, it is like a "seal" stamped on time, recording the time information of a certain moment. The version number is a number used to identify a specific version of a product such as software, documents, and hardware. It is an identifier that allows developers, users, and various systems to distinguish between different versions. The version number is usually presented in a combination of numbers and characters. Signature information is a type of identification data used to verify identity, confirm data integrity, and provide non-repudiation. It is usually associated with a specific subject (such as an individual, organization, software, etc.), generated through a specific algorithm and key, and presented in a unique form. In one example, the length of the random number is 32.

[0040] In one example, signature information is generated based on the following steps: the application identifier, random number, timestamp and version number are sequentially concatenated to generate a plaintext signature text; the plaintext signature text is processed based on the signature algorithm and the corresponding application key to generate signature information. Among them, the signature algorithm is the HMAC-SHA256 signature algorithm. HMAC-SHA256 is a specific hash-based message authentication code (HMAC) algorithm, which is a message authentication code based on a key-based hash algorithm. It combines a key and a strong hash function, making it highly secure and difficult to be reverse cracked and tampered with, so the interface signature is implemented using the HMAC algorithm.

[0041] The mathematical formula of the HMAC algorithm is: HMAC(k,m)=H(k'⊕opad,H(k'⊕ipad,m)) H is a cryptographic hash function (such as MD5 or SHA-2), which can perform group cyclic compression on plaintext; k is a secret key; m is the message to be authenticated; k' is another key derived from the original key k (if k is shorter than the input block size of the hash function, it is padded to the right with zeros; if it is longer than the block size, k is hashed); ipad is padded internally (0x5C5C5C…5C5C, a hexadecimal constant); opad is padded externally (0x363636…3636, a hexadecimal constant).

[0042] The application key is configured by the developer on the terminal and is a key information used to protect the security of the application. It is like the "password" of the application, which is used to ensure that only authorized users, devices or services can access and use the specific functions or data of the application. Specifically, the plain text signature text uses the HMAC-SHA256 signature algorithm, using the application key as the encryption key, and finally generates the signature information.

[0043] In one example, the signature information: HMAC(\text{String}_i + \text{String}_d + \text{String}_t + \text{String}_v,m).

[0044] Among them, \text{String}_i represents the application identifier, \text{String}_d represents a random number, \text{String}_t represents a timestamp, \text{String}_v represents a version number, m represents an application key, and HMAC represents the HMAC-SHA256 algorithm.

[0045] The signature verification information and the master key identifier are used to instruct the master device to generate a first ciphertext key based on the symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on the asymmetric encryption algorithm and the signature verification information after the verification based on the signature verification information and the master key identifier is passed. It should be noted that this step will be applied to the method applied to Figure 1 The master device in the embodiment is described in detail, please refer to the method applied to Figure 1 An embodiment of a master device in.

[0046] Step S230, receiving the first ciphertext key and the second ciphertext key sent by the master device, and using the second ciphertext key to encrypt the plaintext business data to obtain the ciphertext business data. After the master device generates the first ciphertext key and the second ciphertext key, it sends the first ciphertext key and the second ciphertext key to the terminal, wherein the first ciphertext key is to allow developers to find other devices for persistent storage, and this key can only be decrypted by the master device. The second ciphertext key can only be decrypted by the terminal, and this key can only be stored in the terminal memory after decryption. The terminal uses the second ciphertext key to encrypt the plaintext business data.

[0047] In order to prepare for the encryption of plaintext business data, in one example, after the step of receiving the first ciphertext key and the second ciphertext key sent by the main device, the steps are also included: obtaining the private key corresponding to the asymmetric encryption algorithm, and decrypting the second ciphertext key based on the private key and the asymmetric encryption algorithm to obtain the plaintext key corresponding to the second ciphertext key; setting an expiration time for the plaintext key and the first ciphertext key, and storing them to form a local plaintext key and a local ciphertext key. Among them, the asymmetric encryption algorithm is the SM2 asymmetric encryption algorithm. In one example, the expiration time is 30 days. After the plaintext key and the first ciphertext key are stored, a local plaintext key and a local ciphertext key are formed accordingly.

[0048] In one embodiment, the step of encrypting the plaintext business data using the second ciphertext key to obtain the ciphertext business data includes the steps of: obtaining the plaintext key corresponding to the second ciphertext key, and performing string shift encryption on the plaintext key to obtain the plaintext business key; encrypting the plaintext business data using the symmetric encryption algorithm and the plaintext business key to obtain the initial ciphertext business data; and performing Caesar encryption on the initial ciphertext business data again to obtain the ciphertext business data. The symmetric encryption algorithm is the SM4 symmetric encryption algorithm.

[0049] Step S240: Output the encrypted business data and the first encrypted key. Output the encrypted business data and the first encrypted key to the developer, so that the developer can find another device to store them. The first encrypted key is used to decrypt the encrypted business data later.

[0050] In one example, if Figure 3 As shown, a data encryption method comprises the following steps: Step S310, when plaintext business data is obtained, query whether the memory stores the corresponding local business key; the local business key includes a local plaintext key and a local ciphertext key.

[0051] Step S320: If the corresponding local service key is found to be stored in the memory, it is determined whether the local service key is expired. It should be noted that expiration means that the storage time of the local service key in the terminal memory exceeds the expiration time.

[0052] Step S330: If it is determined that the local service key has not expired, the plaintext service data is encrypted using the local plaintext key to obtain the ciphertext service data. It should be noted that step S330 is the same as the encryption step of step S230 in the above embodiment, except that the example uses the local plaintext key.

[0053] Step S340, output the encrypted business data and the local encrypted key.

[0054] In one example, if Figure 4 As shown, a data encryption method also includes the steps of: Step S410, when plaintext business data is obtained, query whether the memory stores the corresponding local business key; the local business key includes a local plaintext key and a local ciphertext key.

[0055] Step S420: If it is found that the corresponding local service key is stored in the memory, it is determined whether the local service key is expired.

[0056] Step S430: If it is determined that the local business key has expired, then generate signature verification information, and send the signature verification information and the master key identifier to the master device. The signature verification information is used to instruct the master device to generate a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information after verification based on the signature verification information and the master key identifier.

[0057] Step S440: Receive the first ciphertext key and the second ciphertext key sent by the master device, and use the second ciphertext key to encrypt the plaintext business data to obtain the ciphertext business data.

[0058] Step S450, outputting the encrypted business data and the first encrypted key.

[0059] In one embodiment, Figure 5 As shown, a data encryption method is provided, which is applied to Figure 1 The following steps are taken as an example to illustrate the main device in the example: Step S510, receiving the signature verification information and master key identifier sent by the terminal. Among them, the main device is used for key generation, and the condition for triggering the main device to generate the key is that the main device receives the signature verification information and master key identifier sent by the terminal. Among them, the signature verification information is generated when the terminal obtains plaintext business data and queries the memory for the corresponding local business key and generates it after it does not store the corresponding local business key, or when the terminal obtains plaintext business data and queries the memory for the corresponding local business key and determines that the local business key has expired. The signature verification information carries an application identifier, a random number, a timestamp, a version number and a signature information. The master key identifier is a label or code used to uniquely identify the master key. The master key occupies a core position in many security systems such as encryption systems, and the master key identifier is like its "identity card number", which can help the system accurately locate and manage the master key among many keys. It should be noted that the generation of signature verification information by the terminal is different from the application of this method to Figure 1 The embodiment of the terminal in is the same as that of the embodiment of the present invention. For details, please refer to the aforementioned embodiment and will not be repeated here.

[0060] Step S520, verify the signature verification information and the master key identifier. After the signature verification information and the master key identifier are verified, a first ciphertext key is generated based on the symmetric encryption algorithm and the master key identifier, and a second ciphertext key is generated based on the asymmetric encryption algorithm and the signature verification information.

[0061] Authentication can ensure security. In an example, the steps of verifying the signature information and the master key identifier include the following steps: verifying whether the signature information is complete, verifying whether an identifier identical to the application identifier is stored locally, and verifying whether the timestamp has timed out; generating verification signature information based on the application identifier, random number, timestamp and version number, and comparing the verification signature information with the signature information to see if they are consistent; searching for a bound IP based on the application identifier, and comparing the bound IP with the terminal IP to see if they are consistent; searching for a corresponding master key based on the master key identifier; and if a corresponding master key exists, determining whether the corresponding master key is disabled.

[0062] Specifically, the main device verifies the signature verification information process: After the main device receives the signature verification information and the master key identifier, it first verifies the signature verification information of the terminal. If the verification fails, the request is rejected and the process ends. If the verification is successful, it verifies whether the IP address of the terminal is in the whitelist. If the IP whitelist verification fails, the request is rejected and the process ends. If the verification is successful, it continues to verify the master key identifier. If the verification fails, the request is rejected and the process ends. If all verifications are successful, it proceeds to generate the first ciphertext key and the second ciphertext key.

[0063] The rules for verifying signature information are as follows: 1. Verify whether the signature verification information is complete. Application ID, random number, timestamp, version number, and signature information are all indispensable. If they are missing, verification fails.

[0064] 2. Verify the application ID. Use the application ID passed in by the terminal to check whether this ID exists in the main device. If not, the verification fails.

[0065] 3. Get the timestamp again and compare it with the current time. If it exceeds the preset time (for example, 15 minutes), the verification fails.

[0066] 4. Obtain the application ID, random number, timestamp, and version number passed in by the terminal, and concatenate them in order into a plain text signature text. Then obtain the corresponding application key in the main device through the application ID, use the HMAC-SHA256 signature algorithm, and finally generate the verification signature information. Compare the verification signature information with the signature information passed in by the terminal. If they are different, the verification fails.

[0067] The IP address verification rules are as follows: obtain the application ID passed in by the terminal, find the IP bound to the main device based on the application ID, and compare it with the IP of the terminal. If they are different, the verification fails.

[0068] The master key verification rules are as follows: 1. Use the master key identifier passed in by the terminal to check whether the master key exists in the master device. If not, the verification fails.

[0069] 2. If this key exists, further verify whether the master key is disabled in the master device. If it is disabled, the verification fails.

[0070] In one example, if Figure 6 As shown, the steps of generating a first ciphertext key based on a symmetric encryption algorithm and a master key identifier, and generating a second ciphertext key based on an asymmetric encryption algorithm and signature verification information include the following steps: Step S610, an initial key is generated by a key generator, and the initial key is shift encrypted to obtain a plaintext key. In one example, the key generator is a key generator provided by JAVA language, which provides a high-quality random number generator inside, and generates high-quality random numbers through hardware and software entropy sources to ensure that the generated key is highly random and difficult to be guessed.

[0071] Step S620, searching for the corresponding master key according to the master key identifier, and performing a shift algorithm on the master key to obtain a final master key.

[0072] In the main device, a relational database is used to store some information. There are two tables in the relational database, one is the terminal table and the other is the key table. The terminal table records information such as application ID, application key, master key ID, version number, etc. The other key table is: master key ID, master key, SM2 encryption public key, etc. After verifying the terminal identity, first query the terminal table through the application ID. Compare the master key ID passed by the terminal with the master key ID found in the table to see if they are consistent. If they are consistent, query the key table through the master key ID to obtain the master key and the public key corresponding to the SM2 encryption algorithm.

[0073] The shift algorithm confuses the encryption key according to the offset. The obfuscation principle is to calculate the ciphertext character subscript according to the offset, and swap the parity bits of the character subscripts in the middle part after the key offset subscript and before the key end offset.

[0074] Step S630, using a symmetric encryption algorithm, taking the final master key as the encryption key, encrypting the plaintext key to obtain an initial ciphertext key, encoding the initial ciphertext key with Base64 and then performing Caesar encryption to obtain a first ciphertext key.

[0075] Among them, the symmetric encryption algorithm is the SM4 symmetric encryption algorithm: This encryption algorithm consists of 32 iterative operations and 1 reverse transformation R.

[0076] Suppose the plain text input is , the ciphertext output is , the round key is , The operation process of the encryption algorithm is as follows: (1) 32 iterations: (2) Reverse transformation: The Caesar cipher is a substitution cipher technique where all letters in the plaintext are replaced with the ciphertext after being offset backward (or forward) by a fixed number in the alphabet. For example, when the offset is 3, all letters A will be replaced with D, B will become E, and so on.

[0077] The encryption formula is: C=(P+k)\mod26. The offset is (k), and each letter (P) in the plaintext is encrypted into a ciphertext letter (C), where (P) and (C) are the positions of the letters in the alphabet (for example, A=0, B=1,…, Z=25).

[0078] Decryption formula: P=(Ck)\mod26.

[0079] By encrypting the ciphertext key with a combination of multiple algorithms, the impact of a single attack on a specific encryption algorithm on the key can be reduced, thereby increasing the security strength of the key.

[0080] Step S640, searching for the corresponding asymmetric encryption algorithm public key according to the application identifier, and encrypting the plaintext key using the asymmetric encryption algorithm based on the asymmetric encryption algorithm public key to obtain a second ciphertext key.

[0081] Among them, the asymmetric encryption algorithm is the SM2 asymmetric encryption algorithm. In order to ensure the security of the key when it is distributed, the plaintext key is encrypted using the SM2 asymmetric encryption algorithm. After the terminal obtains the second ciphertext key encrypted by the SM2 asymmetric encryption algorithm, it can use the private key of the SM2 asymmetric encryption algorithm to decrypt it. This step is mainly to prevent attackers from intercepting data packets in transmission, thereby causing key leakage.

[0082] SM2 encryption process: Suppose the message to be sent is a bit string M, and klen is the bit length of M.

[0083] In order to encrypt plaintext M, user A, as the encryptor, should implement the following operation steps: A1: Use a random number generator to generate a random number k∈[1,n-1]; A2: Calculate the elliptic curve point C1=[k]G=(x1,y1), ([k]G means k*G) and convert the data type of C1 into a bit string; A3: Calculate the elliptic curve point S=[h]PB. If S is a point at infinity, an error is reported and the program exits. A4: Calculate the elliptic curve point [k]PB=(x2,y2), and convert the data types of the coordinates x2 and y2 into bit strings; A5: Calculate t=KDF(x2∥y2,klen). If t is a string of all 0 bits, return to A1. A6: Calculate C2 = M⊕t; A7: Calculate C3 = Hash(x2∥M∥y2); A8: Output ciphertext C = C1∥C2∥C3.

[0084] SM2 decryption process: Let klen be the length in bits of C2 in the ciphertext.

[0085] To decrypt the ciphertext C=C1||C2||C3: B1: Extract the bit string C1 from C, convert the data type of C1 to a point on the elliptic curve, and verify whether C1 satisfies the elliptic curve equation. If not, an error is reported and the program exits. B2: Calculate the elliptic curve point S=[h]C1. If S is a point at infinity, an error is reported and the program exits. B3: Calculate [dB]C1=(x2,y2), and convert the data types of coordinates x2 and y2 into bit strings; B4: Calculate t=KDF(x2∥y2,klen). If t is a string of all 0 bits, report an error and exit. B5: Take the bit string C2 from C and calculate M′ = C2⊕t; B6: Calculate u=Hash(x2∥M′∥y2), extract the bit string C3 from C, and if u!=C3, report an error and exit; B7: Output plaintext M′.

[0086] Step S530, sending the first ciphertext key and the second ciphertext key to the terminal, so that the terminal uses the second ciphertext key to encrypt the plaintext business data, obtain the ciphertext business data, and output the ciphertext business data and the first ciphertext key. It should be noted that obtaining the ciphertext business data is similar to applying the method to Figure 1 The embodiment of the terminal in is the same as that of the embodiment of the present invention. For details, please refer to the aforementioned embodiment and will not be repeated here.

[0087] In one embodiment, a data encryption method is provided. Figure 1 The terminal and main device in the example are used to illustrate, including the following steps: When the terminal obtains plaintext business data, it queries whether the corresponding local business key is stored in the memory.

[0088] If the terminal finds that the corresponding local business key is not stored in the memory, it generates signature verification information and sends the signature verification information and the master key identification certificate to the main device.

[0089] After the master device verifies the signature information and passes the master key identification certificate, it generates a first ciphertext key based on the symmetric encryption algorithm and the master key identification, and generates a second ciphertext key based on the asymmetric encryption algorithm and the signature verification information; the signature verification information carries the application identification, random number, timestamp, version number and signature information.

[0090] The master device sends the first ciphertext key and the second ciphertext key to the terminal, and the terminal encrypts the plaintext business data using the second ciphertext key to obtain the ciphertext business data.

[0091] The terminal outputs the encrypted business data and the first encrypted key.

[0092] In this embodiment, the data encryption method further includes the steps of: If the terminal finds that the corresponding local service key is stored in the memory, it determines whether the local service key is expired.

[0093] If the terminal determines that the local business key has not expired, it uses the local plaintext key to encrypt the plaintext business data to obtain the ciphertext business data.

[0094] The terminal outputs the encrypted business data and the local encrypted key.

[0095] In this embodiment, the data encryption method further includes the steps of: If the terminal determines that the local service key has expired, it generates signature verification information and sends the signature verification information and the master key identifier to the master device.

[0096] After the master device verifies the signature information and passes the master key identification certificate, it generates a first ciphertext key based on the symmetric encryption algorithm and the master key identification, and generates a second ciphertext key based on the asymmetric encryption algorithm and the signature verification information; the signature verification information carries the application identification, random number, timestamp, version number and signature information.

[0097] The master device sends the first ciphertext key and the second ciphertext key to the terminal, and the terminal encrypts the plaintext business data using the second ciphertext key to obtain the ciphertext business data.

[0098] Output the encrypted business data and the first encrypted key.

[0099] It should be noted that the steps in this embodiment are similar to those in the method applied to Figure 1 Embodiments of the terminal and the method are applied to Figure 1 The implementation example of the main device in is the same as that of the main device in the embodiment, please refer to the previous implementation example for details, which will not be repeated here.

[0100] The data encryption method of this application includes the following steps: when obtaining plaintext business data, query whether the memory stores the corresponding local business key; if the memory does not store the corresponding local business key, generate signature verification information, and send the signature verification information and the master key identifier to the main device; the signature verification information and the master key identifier are used to indicate that the main device generates a first ciphertext key based on the symmetric encryption algorithm and the master key identifier, and generates a second ciphertext key based on the asymmetric encryption algorithm and the signature verification information after verification based on the signature verification information and the master key identifier; receive the first ciphertext key and the second ciphertext key sent by the main device, and use the second ciphertext key to encrypt the plaintext business data to obtain the ciphertext business data; output the ciphertext business data and the first ciphertext key. This application manages the entire life cycle of the key (generation, storage, use and encryption), uses different security strategies at different stages, and realizes the use of dynamic keys, secure storage of data, and fuzzy query of ciphertext. Specific strategies include separate key management, highly random complex key generation, multi-algorithm combination encryption, and key authority management, thereby improving the security level of data encryption storage and ensuring the availability of fuzzy query functions.

[0101] In one embodiment, Figure 7As shown, a data decryption method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps: Step S710, when the ciphertext business data and the first ciphertext key are obtained, query whether the memory stores the corresponding local plaintext key. Among them, the ciphertext business data and the first ciphertext key are output in step S240. In order to decrypt the ciphertext business data, the developer re-enters the ciphertext business data and the first ciphertext key into the terminal. As in the encryption process, the terminal preferentially queries whether the memory stores the corresponding local plaintext key. The specific steps are the same as the corresponding steps in the data encryption method of this application. For details, please refer to the various embodiments of the data encryption method of this application.

[0102] Step S720, if it is found that the corresponding local plaintext key is not stored in the memory, then generate the signature verification information, and send the signature verification information, the first ciphertext key and the master key identifier to the main device. Among them, the signature verification information and the master key identifier are used to indicate that the main device generates a plaintext key based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and generates a second ciphertext key based on the asymmetric encryption algorithm and the plaintext key after the verification based on the signature verification information and the master key identifier is passed; the signature verification information carries an application identifier, a random number, a timestamp, a version number and a signature information. The specific verification steps are the same as the corresponding steps in the data encryption method of this application. For details, please refer to the data encryption method embodiments of this application. The specific decryption steps correspond to the corresponding encryption steps in the data encryption method of this application. For details, please refer to the data encryption method embodiments of this application.

[0103] Step S730, receive the second ciphertext key sent by the main device, use the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data. In the process of decrypting the ciphertext business data, after the terminal receives the second ciphertext key transmitted by the main device, it first obtains the private key encrypted by the SM2 asymmetric encryption algorithm, and then uses the SM2 asymmetric encryption algorithm to decrypt the second ciphertext key to obtain its plaintext key. The plaintext key and the second ciphertext key passed in by the developer are stored in the memory together, and the expiration time is set. The data expiration time defaults to 30 days. First, the ciphertext business data is decrypted by Caesar to obtain the initial ciphertext business data, and then the plaintext key is shift-encrypted. Use the SM4 symmetric encryption algorithm, use the plaintext key after shift encryption as the algorithm key, decrypt the initial ciphertext business data, and obtain the final plaintext data and return it to the user.

[0104] Caesar decryption of ciphertext business data: In the corresponding encryption process, after the plaintext business data is encrypted, the ciphertext business data will be Caesar encrypted, so this step requires Caesar decryption of the ciphertext business data.

[0105] Plaintext key shift encryption: In the corresponding encryption process, the master device will perform shift encryption when generating the plaintext business key, so this step requires the plaintext business key to be subjected to the same shift encryption to obtain the real plaintext business key.

[0106] The specific ciphertext business data decryption steps correspond to the corresponding plaintext business data encryption steps in the data encryption method of this application. For details, please refer to the various embodiments of the data encryption method of this application.

[0107] In one example, the data decryption method further includes the steps of: If the corresponding local plaintext key is found in the memory, it is determined whether the local plaintext key is expired.

[0108] If it is determined that the local plaintext key has not expired, the ciphertext business data is decrypted using the local plaintext key to obtain the plaintext business data, and the plaintext business data is output.

[0109] In one example, the data decryption method further includes the steps of: If it is determined that the local plaintext key has expired, a signature verification message is generated, and the signature verification message, the first ciphertext key and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a plaintext key based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and to generate a second ciphertext key based on the asymmetric encryption algorithm and the plaintext key after verification based on the signature verification message and the master key identifier; the signature verification message carries an application identifier, a random number, a timestamp, a version number and signature information.

[0110] Receive the second ciphertext key sent by the main device, use the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data.

[0111] In one embodiment, Figure 8 As shown, a data decryption method is provided, which is applied to Figure 1 The following steps are taken as an example to illustrate the main device in the example: Step S810, receiving the signature verification information, the first ciphertext key and the master key identifier sent by the terminal. The signature verification information is generated after the terminal obtains the ciphertext business data and the first ciphertext key and queries the memory for the corresponding local plaintext key and generates after the terminal obtains the ciphertext business data and the first ciphertext key and queries the memory for the corresponding local plaintext key and determines that the local plaintext key has expired; the signature verification information carries the application identifier, random number, timestamp, version number and signature information. The specific steps are the same as the corresponding steps in the data encryption method of this application. For details, please refer to the various embodiments of the data encryption method of this application.

[0112] Step S820, verify the signature verification information and the master key identifier. After the signature verification information and the master key identifier are verified, a plaintext key is generated based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and a second ciphertext key is generated based on the asymmetric encryption algorithm and the plaintext key. The specific verification steps are the same as the corresponding steps in the data encryption method of this application. For details, please refer to the data encryption method embodiment of this application. The specific decryption steps correspond to the corresponding encryption steps in the data encryption method of this application. For details, please refer to the various embodiments of the data encryption method of this application.

[0113] First, obtain the first ciphertext key and master key identifier passed by the terminal. Obtain the initial master key through the master key identifier, and perform shift encryption on the initial master key to obtain the real master key. Then perform Caesar decryption and Base64 decoding on the first ciphertext key to obtain the ciphertext business key. Use the SM4 symmetric encryption algorithm, with the real master key as the algorithm key, to decrypt the ciphertext business key to obtain the plaintext business key.

[0114] The master device obtains the SM2 asymmetric encryption algorithm public key through the application identifier transmitted by the terminal, encrypts the plaintext service key using the SM2 asymmetric encryption algorithm to obtain the second ciphertext key, and transmits the second ciphertext key to the terminal.

[0115] Shift encryption of the master key: In the encryption process, when generating the ciphertext key, the master key, which serves as the algorithm key, is shift encrypted. This step is to cooperate with the encryption process.

[0116] SM4 Symmetric Encryption Algorithm - Decryption: The decryption transformation in this algorithm has the same structure as the encryption transformation, the only difference is the order in which the round keys are used. When decrypting, the round key sequence is: .

[0117] Caesar decryption and Base64 decoding of ciphertext business keys: In the encryption process, when the ciphertext key is generated, the encrypted initial ciphertext key is Bese64 encoded and Caesar encrypted, so this step is to configure Caesar encryption and Beas64 encoding in the encryption process.

[0118] SM2 asymmetric encryption algorithm for plaintext keys: To ensure the security of key distribution, public key encryption is used on the master device, and the terminal can use the private key to decrypt after receiving the second ciphertext key. This method can ensure the confidentiality of data transmission.

[0119] Step S830, sending the second ciphertext key to the terminal, so that the terminal uses the second ciphertext key to decrypt the ciphertext service data, obtain the plaintext service data, and output the plaintext service data. Figure 1 The steps of the terminal in are the same, please refer to the aforementioned embodiment for details.

[0120] In one embodiment, a data decryption method is provided, which is applied to Figure 1 The terminal and main device in the example are used to illustrate, including the following steps: When the terminal obtains the ciphertext service data and the first ciphertext key, it queries whether the corresponding local plaintext key is stored in the memory.

[0121] If the terminal finds that the corresponding local plaintext key is not stored in the memory, it generates signature verification information and sends the signature verification information, the first ciphertext key and the master key identifier to the main device.

[0122] After the master device passes the verification based on the signature verification information and the master key identifier, it generates a plaintext key based on the symmetric encryption algorithm, the first ciphertext key and the master key identifier, and generates a second ciphertext key based on the asymmetric encryption algorithm and the plaintext key; the signature verification information carries the application identifier, random number, timestamp, version number and signature information.

[0123] The master device sends the second ciphertext key to the terminal, and the terminal uses the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data.

[0124] In one embodiment, a word segmentation one-way encryption method is provided. The difference between the word segmentation one-way encryption method and the data encryption method is that the ciphertext business data obtained by the word segmentation one-way encryption method is irreversible, cannot be reversed after encryption, and word segmentation rules need to be used in the encryption process. The other steps are the same as the steps in the data encryption method of the present application. The detailed steps of the word segmentation one-way encryption method of the present application can refer to the corresponding steps in the data encryption method of the present application, and the embodiments of the word segmentation one-way encryption method of the present application will not be repeated.

[0125] In one embodiment, Fig. 9 As shown, a word segmentation one-way encryption method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps: Step S910, when the plaintext word segmentation business data and word segmentation rules are obtained, the first ciphertext word segmentation key is used to query whether the memory stores the corresponding local plaintext word segmentation key. Word segmentation is the process of dividing a continuous text sequence into meaningful words or vocabulary units according to certain rules. For example, if the word segmentation rules passed in by the developer are 1-3. The business data is abcdefg. Then the terminal will obtain the business data from the first leftmost position and take 3. The final word segmentation result is: abc. abc will be encrypted later.

[0126] Step S920: If it is found that the corresponding local plaintext segmentation key is not stored in the memory, then the signature verification information is generated, and the signature verification information, the first ciphertext segmentation key and the master key identifier are sent to the master device. The signature verification information and the master key identifier are used to instruct the master device to generate the plaintext segmentation key based on the symmetric encryption algorithm, the first ciphertext segmentation key and the master key identifier, and to generate the second ciphertext segmentation key based on the asymmetric encryption algorithm and the plaintext segmentation key after verification based on the signature verification information and the master key identifier. The signature verification information carries the application identifier, random number, timestamp, version number and signature information.

[0127] Step S930, receiving the second ciphertext word segmentation key sent by the master device, encrypting the plaintext word segmentation service data using the word segmentation rule and the second ciphertext word segmentation key, obtaining the ciphertext word segmentation service data, and outputting the ciphertext word segmentation service data.

[0128] In one embodiment, Fig.10 As shown, a data decryption method is provided, which is applied to Figure 1 The following steps are taken as an example to illustrate the main device in the example: Step S1010, receiving the signature verification information, the first ciphertext word segmentation key and the master key identifier sent by the terminal. The signature verification information is generated after the terminal obtains the plaintext word segmentation service data and the word segmentation rules and queries the memory for the corresponding local plaintext word segmentation key and generates after the terminal obtains the plaintext word segmentation service data and the word segmentation rules and queries the memory for the corresponding local plaintext word segmentation key and determines that the local plaintext word segmentation key has expired; the signature verification information carries the application identifier, random number, timestamp, version number and signature information.

[0129] Step S1020, after verification based on the signature verification information and the master key identifier, a plaintext word segmentation key is generated based on the symmetric encryption algorithm, the first ciphertext word segmentation key and the master key identifier, and a second ciphertext word segmentation key is generated based on the asymmetric encryption algorithm and the plaintext word segmentation key. First, obtain the first ciphertext word segmentation key and the master key identifier passed by the terminal. Obtain the initial master key through the master key identifier, and shift encrypt the initial master key to obtain the real master key. Then, the first ciphertext word segmentation key is subjected to Caesar decryption and Base64 decoding to obtain the ciphertext word segmentation key. Use the SM4 symmetric encryption algorithm, use the real master key as the algorithm key, decrypt the ciphertext word segmentation key to obtain the plaintext word segmentation key. Finally, the main device obtains the public key of the corresponding SM2 asymmetric encryption algorithm through the application identifier of the terminal, and uses the SM2 asymmetric encryption algorithm to encrypt the plaintext word segmentation key to obtain the ciphertext word segmentation key (encrypted by the SM2 asymmetric encryption algorithm).

[0130] Step S1030, sending the second ciphertext word segmentation key to the terminal, so that the terminal uses the word segmentation rule and the second ciphertext key to encrypt the plaintext word segmentation service data, obtain the ciphertext word segmentation service data, and output the ciphertext word segmentation service data.

[0131] This application also solves the following problems and has the following advantages: 1. The persistent storage of keys is stored in ciphertext form. The plaintext keys only exist in the memory. When the project / server is stopped, they are automatically destroyed to ensure the security of key storage to the greatest extent. In addition, the generation of keys and the decryption of ciphertext keys are placed on the main device, and the storage and use of keys are placed in the terminal. This key separation management method greatly avoids the risk of key loss due to irregular key storage.

[0132] 2. For key generation, a 1024-bit key is generated by the key generator provided by JAVA language. Its hardware and software entropy sources generate high-quality random numbers, plus a 1024-bit long key, to ensure the high randomness and complexity of the generated key. Avoid the security risks caused by the key being easy to crack due to insecure pseudo-random numbers or short keys.

[0133] 3. In the selection of algorithms, multiple algorithms are used for combined encryption. The SM4 symmetric encryption algorithm, also known as the national secret algorithm, is used in the main algorithm. Bese64 encoding is performed on the basis of the SM4 symmetric encryption algorithm, and Caesar encryption and custom offset are used to confuse the ciphertext. The advantage of using multiple algorithms for combined encryption is that it can resist attacks on specific algorithms and improve the security of the system.

[0134] SM4 is a symmetric encryption algorithm, also known as the national secret algorithm, developed by the China National Cryptography Administration and widely used in data protection in government, finance and other sensitive fields.

[0135] Base64 encoding is a common encoding method used to convert binary data into text format.

[0136] 4. By encrypting the business data after word segmentation, the availability of the fuzzy search function of the business is guaranteed. In addition, a one-way encryption algorithm is used in word segmentation encryption to make the ciphertext irreversible and ensure the security of the word segmentation ciphertext.

[0137] 5. The concept of temporary key is introduced in the present invention, which means that the key used to encrypt business data is dynamic. The default maximum usage period of each key is 30 days, and the key is regenerated for the terminal and the main device after 30 days. This avoids the problem that the same key may lead to the discovery of potential security weaknesses and maintains the security of the system.

[0138] 6. It has the function of key authority management. In the main device, the administrator can manage the terminal account and dynamically start and stop it, so that the terminal cannot request the main device to generate keys or decrypt keys, thereby improving the flexibility of key authority management in the face of emergencies.

[0139] 7. During the key distribution process, the terminal will interact with the main device. In order to ensure the security of the key distribution process, the main device interface uses the HMAC-SHA256 signature method and adds IP whitelist verification to intercept unauthorized access. For plaintext key transmission, the SM2 asymmetric encryption algorithm will be used to encrypt the plaintext key to maximize the security of the key during distribution.

[0140] SHA-256 is a hash algorithm used to convert input data of any length into a fixed-length 256-bit hash value. The SHA-256 algorithm is regarded as a secure and reliable hash algorithm in current cryptographic applications and is often used to replace less secure algorithms such as SHA-1 and MD5.

[0141] SM2 is an elliptic curve cryptographic algorithm developed by China. It is an asymmetric encryption algorithm suitable for secure communications such as digital signatures and key exchange. As a cryptographic algorithm independently developed by China, SM2 is of great significance in terms of security, efficiency and national standardization, and has been widely used and recognized in many application fields.

[0142] It should be understood that although Figures 2 to 10 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figures 2 to 10 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0143] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.11As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement an encryption method, a decryption method and a word segmentation one-way encryption method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0144] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0145] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps in the encryption method, decryption method and word segmentation one-way encryption method of the present application are implemented.

[0146] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the encryption method, decryption method and word segmentation one-way encryption method of the present application are implemented.

[0147] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0148] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0149] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A data encryption method, characterized in that: The following steps are involved: When obtaining plaintext business data, query whether the corresponding local business key is stored in the memory; The local service key includes a local plaintext key and a local ciphertext key; If it is found that the memory does not store the corresponding local business key, signature verification information is generated, and the signature verification information and the master key identifier are sent to the master device; the signature verification information and the master key identifier are used to instruct the master device to generate a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information after verification based on the signature verification information and the master key identifier is passed; The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; receiving the first ciphertext key and the second ciphertext key sent by the master device, and encrypting the plaintext service data using the second ciphertext key to obtain the ciphertext service data; Output the encrypted business data and the first encrypted key.

2. The data encryption method according to claim 1, characterized in that: Also includes the steps: If it is found that the memory stores the corresponding local service key, determining whether the local service key is expired; If it is determined that the local service key has not expired, encrypting the plaintext service data using the local plaintext key to obtain ciphertext service data; Output the encrypted business data and the local encrypted key.

3. The data encryption method according to claim 2, characterized in that: Also includes the steps: If it is determined that the local business key has expired, a signature verification message is generated, and the signature verification message and the master key identifier are sent to the master device; the signature verification message is used to instruct the master device to generate a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and to generate a second ciphertext key based on an asymmetric encryption algorithm and the signature verification message after verification based on the signature verification message and the master key identifier is passed; receiving the first ciphertext key and the second ciphertext key sent by the master device, and encrypting the plaintext service data using the second ciphertext key to obtain the ciphertext service data; Output the encrypted business data and the first encrypted key.

4. The data encryption method according to claim 1, characterized in that: The signature information is generated based on the following steps: Concatenate the application identifier, the random number, the timestamp, and the version number in order to generate a plain text signature text; The plaintext signature text is processed based on the signature algorithm and the corresponding application key to generate the signature information.

5. The data encryption method according to claim 1, characterized in that: After the step of receiving the first ciphertext key and the second ciphertext key sent by the master device, the method further includes the steps of: Obtaining a private key corresponding to the asymmetric encryption algorithm, and decrypting the second ciphertext key based on the private key and the asymmetric encryption algorithm to obtain a plaintext key corresponding to the second ciphertext key; An expiration time is set for the plaintext key and the first ciphertext key, and the keys are stored to form the local plaintext key and the local ciphertext key respectively.

6. The data encryption method according to any one of claims 1 to 5, characterized in that: The step of encrypting the plaintext business data using the second ciphertext key to obtain the ciphertext business data includes the following steps: Obtaining a plaintext key corresponding to the second ciphertext key, and performing string shift encryption on the plaintext key to obtain a plaintext business key; Encrypting the plaintext business data using a symmetric encryption algorithm and the plaintext business key to obtain initial ciphertext business data; The initial ciphertext business data is again subjected to Caesar encryption to obtain the ciphertext business data.

7. A data encryption method, characterized in that: The following steps are involved: The signature verification information and the master key identifier sent by the receiving terminal are generated when the terminal obtains plaintext business data and queries the memory for the corresponding local business key and generates the corresponding local business key after the terminal obtains plaintext business data and queries the memory for the corresponding local business key and determines that the local business key has expired. The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; Verifying the signature verification information and the master key identifier, and after the signature verification information and the master key identifier are verified, generating a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and generating a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information; The first ciphertext key and the second ciphertext key are sent to the terminal, so that the terminal uses the second ciphertext key to encrypt the plaintext business data, obtain ciphertext business data, and output the ciphertext business data and the first ciphertext key.

8. The data encryption method according to claim 7, characterized in that: The step of verifying the signature verification information and the master key identifier includes the following steps: Verify whether the signature verification information is complete, verify whether an identifier identical to the application identifier is stored locally, and verify whether the timestamp has timed out; Generate verification signature information based on the application identifier, the random number, the timestamp and the version number, and compare the verification signature information with the signature information to see if they are consistent; Find the bound IP according to the application identifier, and compare the bound IP with the terminal IP to see if they are consistent; Searching whether there is a corresponding master key according to the master key identifier; If the corresponding master key exists, determine whether the corresponding master key is disabled.

9. The data encryption method according to any one of claims 7 or 8, characterized in that: The step of generating a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and generating a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information comprises the following steps: Generate an initial key by a key generator, and obtain a plaintext key after shift encryption of the initial key; Find the corresponding master key according to the master key identifier, and obtain the final master key by applying a shift algorithm to the master key; Using a symmetric encryption algorithm, taking the final master key as the encryption key, encrypting the plaintext key to obtain an initial ciphertext key, encoding the initial ciphertext key with Base64 and then performing Caesar encryption to obtain the first ciphertext key; According to the application identifier, the corresponding asymmetric encryption algorithm public key is searched, and based on the asymmetric encryption algorithm public key, the plaintext key is encrypted using an asymmetric encryption algorithm to obtain the second ciphertext key.

10. A data encryption method, characterized in that: The following steps are involved: When the terminal obtains plaintext business data, it queries whether the corresponding local business key is stored in the memory; If the terminal finds that the memory does not store the corresponding local service key, it generates signature verification information and sends the signature verification information and the master key identifier to the main device; After the master key identifier is verified based on the signature verification information, the master device generates a first ciphertext key based on a symmetric encryption algorithm and the master key identifier, and generates a second ciphertext key based on an asymmetric encryption algorithm and the signature verification information; The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; The master device sends the first ciphertext key and the second ciphertext key to the terminal, and the terminal encrypts the plaintext service data using the second ciphertext key to obtain the ciphertext service data; The terminal outputs the ciphertext service data and the first ciphertext key.

11. A data decryption method, characterized in that: The following steps are involved: When the ciphertext service data and the first ciphertext key are obtained, query whether the corresponding local plaintext key is stored in the memory; If it is found that the memory does not store the corresponding local plaintext key, signature verification information is generated, and the signature verification information, the first ciphertext key and the master key identifier are sent to the master device; the signature verification information and the master key identifier are used to instruct the master device to generate a plaintext key based on a symmetric encryption algorithm, the first ciphertext key and the master key identifier, and to generate a second ciphertext key based on an asymmetric encryption algorithm and the plaintext key after verification based on the signature verification information and the master key identifier. The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; Receive the second ciphertext key sent by the master device, use the second ciphertext key to decrypt the ciphertext business data, obtain plaintext business data, and output the plaintext business data.

12. A data decryption method, characterized in that: The following steps are involved: The signature verification information, the first ciphertext key, and the master key identifier sent by the receiving terminal; the signature verification information is generated after the terminal obtains the ciphertext service data and the first ciphertext key and queries the memory for not storing the corresponding local plaintext key, or after the terminal obtains the ciphertext service data and the first ciphertext key and queries the memory for storing the corresponding local plaintext key and determines that the local plaintext key has expired; The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; Verifying the signature verification information and the master key identifier, and after the signature verification information and the master key identifier are verified, generating a plaintext key based on a symmetric encryption algorithm, the first ciphertext key and the master key identifier, and generating a second ciphertext key based on an asymmetric encryption algorithm and the plaintext key; The second ciphertext key is sent to the terminal, so that the terminal uses the second ciphertext key to decrypt the ciphertext business data, obtain the plaintext business data, and output the plaintext business data.

13. A word segmentation one-way encryption method, characterized in that: When the plaintext word segmentation service data and word segmentation rules are obtained, query whether the corresponding local plaintext word segmentation key is stored in the memory through the first ciphertext word segmentation key; If it is found that the memory does not store the corresponding local plaintext word segmentation key, a signature verification message is generated, and the signature verification message, the first ciphertext word segmentation key and the master key identifier are sent to the master device; the signature verification message and the master key identifier are used to instruct the master device to generate a plaintext word segmentation key based on a symmetric encryption algorithm, the first ciphertext word segmentation key and the master key identifier, and to generate a second ciphertext word segmentation key based on an asymmetric encryption algorithm and the plaintext word segmentation key after verification based on the signature verification message and the master key identifier. The signature verification information carries an application identifier, a random number, a timestamp, a version number, and signature information; Receive the second ciphertext word segmentation key sent by the master device, encrypt the plaintext word segmentation business data using the word segmentation rule and the second ciphertext word segmentation key, obtain the ciphertext word segmentation business data, and output the ciphertext word segmentation business data.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 13 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 13 are implemented.

Images