A lightweight confidentiality method, device and electronic device for key information

Abstract

The present application discloses a lightweight confidentiality method, device and electronic device for key information, which relates to the field of information security technology. The confidentiality method is applied to a server, including: randomly generating a global code book; marking key information, obtaining the original ciphertext of the key information from the global code book according to the marked key information, and compressing the original ciphertext to generate a primary ciphertext; obtaining a secondary ciphertext from a secondary code book according to the primary ciphertext, and if the secondary ciphertext cannot be obtained, compressing the primary ciphertext again to generate a secondary ciphertext and storing it in the secondary cipher book, otherwise continuing with subsequent steps; introducing a randomly generated ciphertext factor into the secondary ciphertext to generate a final ciphertext of the key information, replacing the key information with the final ciphertext and sending it to the client with other relevant data information.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a lightweight confidentiality method, device and electronic equipment for key information. Background Art

[0002] Existing encryption technologies such as DES (Data Encryption Standard), AES (Advanced Encryption Standard), SM1 (Commercial Secret No. 1), RSA (asymmetric encryption), SM2 (Commercial Secret No. 2) and even desensitization can ensure the confidentiality of information and achieve a very high level of security.

[0003] The DES principle uses a 56-bit key and an additional 8-bit parity bit, resulting in a maximum block size of 64 bits. It is an iterative block cipher that utilizes a technique called Feistel, which divides the encrypted text block into two halves. A round robin function is applied to one half using a subkey, and the output is then XORed with the other half. The two halves are then swapped, and the process continues, but the final round does not swap. DES uses 16 rounds, employing four basic operations: XOR, permutation, substitution, and shift.

[0004] AES principle: Use a 128-bit, 192-bit, or 256-bit key, and then go through steps such as byte substitution (SubBytes), row shift (ShiftRows), column confusion (MixColumns), and round key addition (AddRoundKey) to finally form an encrypted ciphertext. Decryption is the inverse operation of the encryption step.

[0005] SM1 principle: Use a 128-bit key and an undisclosed algorithm for encryption and decryption.

[0006] RSA and SM2: Both are asymmetric encryption and decryption algorithms that use a pair of public and private keys through an extremely complex process to keep the content confidential. As long as the key is not lost, they are extremely secure, but they are usually not used directly to protect files.

[0007] Data desensitization: Display the first and last few digits of the data, and replace all other digits with "***" for external presentation. This can protect data more intuitively. This method is only convenient for presenting confidentiality but cannot be used for subsequent business.

[0008] The above encryption and decryption algorithms do not have obvious flaws in the security field. However, when encountering scenarios where data requests containing critical information are initiated in milliseconds, only the critical information needs to be kept confidential while other information does not need to be kept confidential, a quick response is required, and the confidential critical information needs to be involved in subsequent business operations, the above encryption and decryption algorithms will show disadvantages such as overly complex encryption and decryption processes, high CPU consumption, low efficiency, or unsuitability. Summary of the Invention

[0009] For scenarios where data requests containing critical information are initiated at the millisecond level, only the critical information needs to be kept confidential while other information is not confidential, and the transmitted confidential information needs to be involved in subsequent business and requires a quick response, this application proposes a lightweight confidentiality method, device and electronic device for critical information to reduce consumption and achieve millisecond-level response.

[0010] This application is implemented through the following technical solutions:

[0011] A lightweight confidentiality method for key information, the confidentiality method being applied to a server, comprising:

[0012] Randomly generate a global codebook; the global codebook is formed by randomly generating the position of existing characters in the codebook, and the position information is used as the ciphertext of the corresponding characters;

[0013] Marking key information, obtaining original ciphertext of the key information from the global codebook according to the marked key information, and compressing the original ciphertext to generate primary ciphertext;

[0014] Obtaining a secondary ciphertext from a secondary cipherbook based on the primary ciphertext; if the secondary ciphertext cannot be obtained, re-compressing the primary ciphertext to generate a secondary ciphertext and storing it in the secondary cipherbook; otherwise, continuing with subsequent steps; the secondary cipherbook is used to store pairs of key information and primary ciphertext, as well as pairs of primary ciphertext and secondary ciphertext;

[0015] A randomly generated ciphertext factor is introduced into the secondary ciphertext to generate a final ciphertext of the key information, and the key information is replaced with the final ciphertext and sent to the client together with other relevant data information.

[0016] In some implementations, the process of generating the original ciphertext of the key information includes:

[0017] The key information is split into n characters by character, represented as A1, A2...An, and the key information is represented as: A=A1A2...An;

[0018] According to the n characters after splitting, the ciphertext corresponding to each character is obtained from the global code book, where the ciphertext corresponding to A1, A2...An is B1, B2...Bn. The original ciphertext of the key information is generated according to the ciphertext of n characters, expressed as: B=B1B2...Bn.

[0019] In some implementations, the process of generating the primary ciphertext includes:

[0020] Obtaining from the original ciphertext the number o1 of leading zeros, the number o2 of trailing zeros, the smallest prime number p1, and the hexadecimal or 64-decimal number p2 of the largest prime number;

[0021] The primary ciphertext is obtained, which is expressed as: Bt=Eo1.o2.p1_p2, where E represents the ciphertext identifier.

[0022] In some embodiments, the process of generating and storing the secondary ciphertext includes:

[0023] Using a digest algorithm to compress the primary ciphertext again to generate a secondary ciphertext;

[0024] The primary ciphertext and the secondary ciphertext are stored as a pair in the secondary cipherbook, and the key information and the primary ciphertext are stored as a pair in the secondary cipherbook.

[0025] In some implementations, the process of generating the final ciphertext includes:

[0026] Adding a randomly generated ciphertext factor to the end of the secondary ciphertext to generate the final ciphertext;

[0027] The ciphertext factor represents a nanosecond timestamp.

[0028] Secondly, this application also proposes a lightweight confidentiality method for key information, which is applied to the client and includes:

[0029] Removing the ciphertext factor at the end of the key information ciphertext received from the server to obtain a secondary ciphertext, and obtaining the corresponding primary ciphertext and key information from the secondary codebook based on the secondary ciphertext; wherein the key information ciphertext sent by the server is generated using any implementation of the above-mentioned confidentiality method;

[0030] Performing inverse compression processing on the primary ciphertext to obtain original ciphertext, and obtaining key information from the global codebook based on the original ciphertext;

[0031] The key information obtained from the global code book is compared and verified with the key information obtained from the secondary code book. If they are the same, the subsequent business logic is carried out. If they are not the same, it is returned that the ciphertext is tampered with and the subsequent business logic is not carried out.

[0032] In some embodiments, the reverse compression process includes:

[0033] Get the hexadecimal or 64-base number of the largest prime number according to the underscore segmentation, convert it from hexadecimal or 64-base number to decimal, and get the smallest prime number;

[0034] Multiply the largest prime number and the smallest prime number in decimal to get the sequence P after removing the leading and trailing 0s;

[0035] The sequence P is padded with 0s at the front and back according to the character representing the number of leading and trailing 0s after the ciphertext is marked, and the original ciphertext is restored.

[0036] In a third aspect, the present application proposes a lightweight key information security device, including an encryption module applied to a server, the encryption module including:

[0037] An initialization unit, configured to randomly generate a global codebook; the global codebook is formed by randomly generating positions of existing characters in the codebook, with the position information serving as ciphertext for the corresponding characters;

[0038] a first compression unit, configured to mark key information, obtain original ciphertext of the key information from the global codebook according to the marked key information, and compress the original ciphertext to generate primary ciphertext;

[0039] a second compression unit, configured to obtain a secondary ciphertext from a secondary cipherbook based on the primary ciphertext, and if the secondary ciphertext cannot be obtained, to re-compress the primary ciphertext to generate a secondary ciphertext and store the secondary ciphertext in the secondary cipherbook; the secondary cipherbook is configured to store pairs of key information and primary ciphertext, and pairs of primary ciphertext and secondary ciphertext;

[0040] a salt adding unit, configured to introduce a randomly generated ciphertext factor into the secondary ciphertext to generate a final ciphertext of the key information;

[0041] And, a transmission unit, used to replace the key information with the final ciphertext and send it to the client together with other relevant data information.

[0042] In a fourth aspect, the present application proposes a lightweight key information security device, including a decryption module applied to a client, the decryption module including:

[0043] a receiving unit configured to remove the ciphertext factor at the end of the key information ciphertext received from the server to obtain a secondary ciphertext, and obtain the corresponding primary ciphertext and key information from the secondary codebook based on the secondary ciphertext; wherein the key information ciphertext sent by the server is generated using the above-mentioned security device;

[0044] an inverse compression unit, configured to perform inverse compression processing on the primary ciphertext to obtain an original ciphertext, and obtain key information from a global codebook based on the original ciphertext;

[0045] And, a verification unit is used to compare and verify the key information obtained from the global code book with the key information obtained from the secondary code book. If they are the same, subsequent business logic will be performed; if they are not the same, it will be returned that the ciphertext has been tampered with and subsequent business logic will not be performed.

[0046] In a fifth aspect, the present application proposes an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements any one of the above-mentioned embodiments of the confidentiality method when executing the computer program.

[0047] This application proposes a lightweight confidentiality method for key information, which relies only on equation operations (replacement or splicing), has lower operating power consumption and higher efficiency, can securely return information within a millimeter-level response time range, and meets the requirements of keeping key information confidential and non-key information public, and confidential key information can still participate in subsequent business.

[0048] Correspondingly, the lightweight key information confidentiality device and electronic device proposed in this application also have the same technical effects as mentioned above. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the embodiments of the present application, constitute a part of the present application, and do not constitute a limitation of the embodiments of the present application. In the drawings:

[0050] Figure 1 A flowchart of the confidentiality method proposed in this embodiment of the application;

[0051] Figure 2 This is a block diagram of the principle of the security device proposed in the embodiment of the present application;

[0052] Figure 3 This is a schematic diagram of the security system architecture proposed in the embodiment of the present application;

[0053] Figure 4 A schematic diagram of an electronic device proposed in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of a computer-readable storage medium proposed in an embodiment of the present application;

[0055] Reference numerals and corresponding component names:

[0056] 200-Security device, 201-Initialization unit, 202-First compression unit, 203-Second compression unit, 204-Salting unit, 205-Transmission unit, 206-Receiving unit, 207-Inverse compression unit, 208-Verification unit, 300-Security system, 301-Input device, 302-Output device, 303-Processor A, 304-Memory A, 400-Electronic device, 410-Memory B, 420-Processor B, 411-Computer program A, 500-Computer-readable storage medium, 511-Computer program B. DETAILED DESCRIPTION

[0057] Hereinafter, the terms "include" or "may include" as used in various embodiments of the present application indicate the presence of an invented function, operation, or element, and do not limit the addition of one or more functions, operations, or elements. In addition, as used in various embodiments of the present application, the terms "include," "have," and their cognates are intended only to indicate specific features, numbers, steps, operations, elements, components, or combinations of the foregoing, and should not be understood as excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations of the foregoing or the possibility of adding one or more features, numbers, steps, operations, elements, components, or combinations of the foregoing.

[0058] In various embodiments of the present application, the expression "or" or "at least one of A or / and B" includes any or all combinations of the words listed simultaneously. For example, the expression "A or B" or "at least one of A or / and B" may include A, may include B, or may include both A and B.

[0059] The expressions (such as "first", "second", etc.) used in the various embodiments of the present application may modify the various constituent elements in the various embodiments, but may not limit the corresponding constituent elements. For example, the above expressions do not limit the order and / or importance of the elements. The above expressions are only used to distinguish one element from other elements. For example, a first user device and a second user device indicate different user devices, although both are user devices. For example, without departing from the scope of the various embodiments of the present application, a first element may be referred to as a second element, and similarly, a second element may also be referred to as a first element.

[0060] It should be noted that when a component is described as being “connected” to another component, the first component may be directly connected to the second component, and a third component may be “connected” between the first and second components. Conversely, when a component is described as being “directly connected” to another component, it can be understood that there is no third component between the first and second components.

[0061] The terms used in the various embodiments of the application are only used to describe the purpose of specific embodiments and are not intended to limit the various embodiments of the application. As used herein, the singular form is intended to also include the plural form, unless the context clearly indicates otherwise. Unless otherwise limited, all terms used here (including technical terms and scientific terms) have the same meaning as the meaning generally understood by those of ordinary skill in the art of the application. The terms (such as the terms defined in the dictionary generally used) will be interpreted as having the same meaning as the contextual meaning in the relevant technical field and will not be interpreted as having idealized meaning or too formal meaning, unless clearly defined in the various embodiments of the application.

[0062] In order to make the objectives, technical solutions and advantages of this application more clear, the present application is further described in detail below in conjunction with examples and drawings. The schematic implementation methods of this application and their descriptions are only used to explain this application and are not intended to limit this application.

[0063] In scenarios where a request for data containing key information is initiated at the millisecond level, only the key information needs to be kept confidential while other information is not confidential, and a quick response is required, and the confidential key information needs to be involved in subsequent business operations (for example, the expert extraction result announcement scenario: expert extraction is a non-Internet environment, and it will not be announced immediately after the extraction is completed. Instead, it will be announced after the selected review experts enter the bidding. Within the first 10 minutes of the announcement, Internet users who pay attention to the review experts of this project will initiate a large number of rapid requests to query the review expert information of the project, requiring the server to respond at the millisecond level), existing encryption and decryption algorithms, such as DES, AES, SM1, RSA, SM2, etc., are too complex and have high CPU consumption, and are not suitable for the above scenario requirements. To this end, the embodiment of the present application proposes a lightweight confidentiality method for key information, such as Figure 1 As shown, the confidentiality method proposed in the embodiment of the present application includes an encryption part, which is usually executed on the server side and specifically includes the following steps:

[0064] Step 110: randomly generate a global codebook.

[0065] In step 110, a 99*99 codebook (9801 characters) is generated based on the range of characters that will be used, including but not limited to Chinese characters (approximately 3700), numbers (0-9), letters (case-sensitive 52), and characters (decimal point, dash, underscore, etc. 100). The global codebook generation rule is to randomly generate the positions of known characters in the 99*99 codebook during each initialization. This positional information serves as the ciphertext for the corresponding character. If any unknown characters are encountered, they are directly added to the end of the codebook to improve efficiency. Since unknown characters are extremely rare, the vast majority of the codebook is randomly generated, ensuring sufficient security. It should be understood that the generation of a 99*99 codebook is merely an example and does not limit the size of the codebook. The only requirement is that the generated codebook cover currently known and commonly used characters.

[0066] Step 120: Mark the key information, obtain the original ciphertext of the key information from the global codebook according to the marked key information, and compress the original ciphertext to generate a primary ciphertext.

[0067] In this step 120, the key information is taken as A, and then the characters are split into n characters, namely A1, A2...An. The position information of each character in the global code book (i.e., row and column coordinates) is taken as part of the ciphertext B. Then, corresponding to n characters, the position information of each character is obtained one by one from the global code book to form B1, B2...Bn. It can be understood that B1-Bn corresponds to A1-An one-to-one, then A=A1A2...An=B=B1, B2...Bn (the equal sign here means correspondence, not equality in the mathematical sense). From the comparison of the length of A1 and B1, the more keywords there are, the longer the original ciphertext B is. Therefore, the original ciphertext B needs to be compressed. The compression rule is: set the ciphertext identifier to E, the number of leading 0s is o1 (if there is none, the value is 0), the number of trailing 0s is o2 (if there is none, the value is 0), the smallest prime number is p1, the hexadecimal number (base 64) of the largest prime number is p2, and the compressed primary ciphertext Bt=Eo1.o2.p1_p2 is obtained. Since the original ciphertext B is composed of numbers from 00-99, the original ciphertext B excludes the leading and trailing 0s and completely conforms to the specification of a positive integer. The optional range of p1 is 1,2,3,5,7. In principle, 1 is not a prime number, but it should be counted in this range here. The largest prime number is the number that divides 7,5,3,2,1. Since the largest prime number may be very long, it needs to be converted to hexadecimal or base 64 to control the length.

[0068] For example, for the marked key information A=quote 20W.

[0069] The key information is disassembled into characters A1 = report, A2 = price, A3 = 2, A4 = 0, A5 = W. The position information corresponding to the above characters is obtained from the global password book as the ciphertext corresponding to the character, that is: A1 = report (row 3, column 5) → B1 = 0305, A2 = price (row 10, column 5) → B2 = 1005, A3 = 2 (row 56, column 25) → B3 = 5625, A4 = 0 (row 3, column 71) → B4 = 0371, A5 = W (row 80, column 0) → B5 = 8000.

[0070] Then the original ciphertext B = 03051005562503718000 is obtained; according to this original ciphertext, o1 (the number of leading 0s) can be obtained as 1, o2 (the number of trailing 0s) as 3, the smallest prime number as 2, and the largest prime number (encoded in hexadecimal) as 56B6FCB616113; according to the above compression rules, the primary ciphertext Bt = E1.3.2_56B6FCB616113 can be obtained.

[0071] Step 130: Obtain the secondary ciphertext from the secondary password book according to the primary ciphertext. If it cannot be obtained, re-compress the primary ciphertext to generate the secondary ciphertext and store it in the secondary password book. Otherwise, continue with the subsequent steps.

[0072] In this step 130, since the primary ciphertext Bt is still composed of multiple structures spliced together and the length is still uncontrollable, it needs to be re-compressed. In the embodiment of the present application, a digest algorithm, such as the MD5 algorithm, can be used to re-compress the primary ciphertext Bt to generate the secondary ciphertext Br.

[0073] To accelerate the rapid response of the same key information subsequently, the embodiment of the present application forms a secondary password book based on the key information and its corresponding primary ciphertext and secondary ciphertext. Specifically, the primary ciphertext Bt and the secondary cipher are stored in the secondary password book as a pair, and the key information A and the primary ciphertext Bt are stored in the secondary password book as a pair. It is only written into the secondary password book when the secondary ciphertext Br is initially formed. At other times, after obtaining the secondary ciphertext, it is first read from the secondary password book. If it is read (that is, the secondary ciphertext Br already exists in the secondary password book), if it cannot be read, it is then written into the secondary password book, thereby improving the processing efficiency.

[0074] Step 140: Introduce a randomly generated ciphertext factor into the secondary ciphertext to generate the final ciphertext of the key information, replace the key information with the final ciphertext and send it to the client together with other relevant data information.

[0075] In step 140, the secondary ciphertext is sufficiently short, but the secondary ciphertext is identical for identical key information. Directly returning the secondary ciphertext makes it easy for people to determine its business meaning based on data patterns. Therefore, the present embodiment also introduces a randomly generated ciphertext factor C based on the secondary ciphertext to salt the secondary ciphertext to generate the final ciphertext = BrC. This creates a technical effect where even for identical key information, the generated ciphertext is different each time, further improving information security. Alternatively, the present embodiment can generate a random number based on the current request, for example, if the current timestamp requires nanosecond accuracy.

[0076] Furthermore, the confidentiality method proposed in the embodiment of the present application also includes a decryption part, which is usually executed on the client (business processing end) and specifically includes the following steps:

[0077] In step 150, the ciphertext factor at the end of the key information ciphertext received from the server is removed to obtain a secondary ciphertext, and the corresponding primary ciphertext and key information are obtained from the secondary codebook according to the secondary ciphertext.

[0078] In this step 150, since the key information has been encrypted, the user does not know its actual meaning. If subsequent business is required, the ciphertext and other data information of the same business need to be transmitted to the user end, and the ciphertext factor at the end of the ciphertext is removed. For example, the 19-bit random timestamp (nanosecond level) at the end of the ciphertext is removed to obtain the secondary ciphertext.

[0079] Then, the primary ciphertext is obtained from the secondary codebook according to the secondary ciphertext, and the key information is obtained from the secondary codebook according to the primary ciphertext.

[0080] Step 160: Perform inverse compression processing on the primary ciphertext to obtain the original ciphertext, and obtain key information from the global codebook based on the original ciphertext.

[0081] In step 160, the reverse compression process includes: obtaining the largest prime number (p2) in hexadecimal or base 64 by segmentation using underscores, converting the hexadecimal or base 64 number to decimal, and obtaining the smallest prime number (p1). Then, by multiplying p1*p2 (decimal), the sequence P is obtained after removing the leading and trailing zeros. Sequence P is then padded with leading and trailing zeros based on the ciphertext identifiers (o1 and o2), thereby restoring the original ciphertext. The original ciphertext is segmented according to the data bits (4 bits) to obtain the ciphertext data corresponding to each character, and the corresponding key information is obtained using the global codebook.

[0082] In step 170, the key information obtained from the global code book is compared and verified with the key information obtained from the secondary code book. If they are the same, the subsequent business logic is carried out. If they are not the same, it is returned that the ciphertext is tampered with and the subsequent business logic is not carried out.

[0083] A millisecond-level request typically requires a response time within 30ms. In scenarios where large numbers of concurrent requests are made to obtain confidential information containing key information, the key information remaining confidential can still be used for subsequent business operations, and non-critical information is publicly available for easy reading, the confidentiality method proposed in this embodiment of the application is highly efficient and can securely return information within the response time. Furthermore, the confidentiality method proposed in this embodiment of the application relies solely on equation operations (replacement and concatenation), resulting in lower power consumption and greater efficiency during operation.

[0084] The confidentiality method proposed in this embodiment of the application is applicable to scenarios such as master key ID protection or phone number protection.

[0085] In applications built on relational databases, unique identifiers (IDs) are often used to uniquely identify business data. For example, an expert's basic information ID represents Expert A's name, ID, phone number, and other basic information. In subsequent transactions involving related business data, clients only see the business attribute data, but the unique identifier is also returned to the client and cannot be viewed directly. This unique identifier requires technical means to retrieve the expert's basic information. For example, when retrieving Expert A's basic information, the client sees Expert A's name, ID, phone number, and other information. The unique identifier is also transmitted to the client, but not displayed directly. Therefore, in some high-security applications, technical means are required to ensure that the ID displayed to the client and the database are consistent, without affecting subsequent business operations. Current primary key IDs include INT (range 1-2147483647), UUID (alphabet, numbers, and hyphens), and SNOW (a fixed-length, non-repeating string of numbers).

[0086] Phone number protection: Phone numbers are private information. This feature is used in applications where clients must be prevented from accessing the phone number while still allowing clients to contact the protected phone number. Phone numbers are 11 digits long.

[0087] Considering that asymmetric encryption algorithms such as RSA and SM2 require the use of public and private keys, which are usually not advisable in high-frequency access, and data desensitization cannot be restored for business purposes, the embodiment of the present application uses DES and AES algorithms as comparative examples of the confidentiality algorithms proposed in the embodiment of the present application, and performs encryption and decryption tests on conventional INT, SNOW, and UUID type information. The time consumption and the risk of information leakage due to server compromise are obtained after 1000 times, as shown in Table 1:

[0088] Table 1

[0089]

[0090] The test results of 1000 encryption and decryption tests of conventional INT, SNOW, and UUID type data using different confidentiality algorithms are obtained, as shown in Table 2.

[0091] Table 2

[0092]

[0093] According to the results in Table 1 and Table 2, it can be seen that the confidentiality method proposed in the embodiment of the present application has the advantages of being lighter and more efficient than the existing confidentiality algorithm. It is particularly suitable for some millisecond-level requests, and only key information needs to be kept confidential while other information is not confidential. The transmitted confidential information needs to participate in subsequent business and be able to respond quickly.

[0094] The present application also proposes a lightweight key information security device, such as Figure 2 As shown, the security device 200 includes an encryption module applied to the server, and the encryption module includes:

[0095] Initialization unit 201 is used to randomly generate a global codebook. The global codebook generation process is as described in step 110 above and will not be repeated here.

[0096] The first compression unit 202 is used to mark the key information, obtain the original ciphertext of the key information from the global codebook according to the marked key information, and compress the original ciphertext to generate the primary ciphertext. The primary ciphertext generation process is as described in step 120 above and will not be repeated here.

[0097] The second compression unit 203 obtains the secondary ciphertext from the secondary cipherbook based on the primary ciphertext. If the secondary ciphertext cannot be obtained, the second compression unit 203 re-compresses the primary ciphertext to generate the secondary ciphertext and stores it in the secondary cipherbook. The secondary ciphertext generation process is as described in step 130 above and will not be repeated here.

[0098] The salt adding unit 204 is used to introduce a randomly generated ciphertext factor into the secondary ciphertext to generate the final ciphertext of the key information. The final ciphertext generation process is as described in step 140 above and will not be repeated here.

[0099] And, the transmission unit 205 is used to replace the key information with the final ciphertext and send it to the client together with other relevant data information.

[0100] The security device 200 proposed in this embodiment of the application further includes a decryption module applied to the client, and the decryption module includes:

[0101] Receiving unit 206 is configured to remove the ciphertext factor from the end of the key information ciphertext received from transmitting unit 205 to obtain a secondary ciphertext, and then retrieve the corresponding primary ciphertext and key information from the secondary codebook based on the secondary ciphertext. The secondary ciphertext recovery process is as described in step 210 above and will not be repeated here.

[0102] The inverse compression unit 207 is used to perform inverse compression processing on the primary ciphertext to obtain the original ciphertext and obtain key information from the global codebook based on the original ciphertext. The inverse compression processing process is as described in step 220 above and will not be repeated here.

[0103] And, the verification unit 208 is used to compare and verify the key information obtained from the global code book with the key information obtained from the secondary code book. If they are the same, the subsequent business logic will be carried out. If they are not the same, it will be returned that the ciphertext has been tampered with and the subsequent business logic will not be carried out.

[0104] The present application also proposes a lightweight confidentiality system for key information, such as Figure 3 As shown, the security system 300 includes:

[0105] Input device 301, output device 302, processor A303 and memory A304; wherein the number of processor A303 and memory A304 can be one or more, Figure 3 The input device 301, the output device 302, the processor A303 and the memory A304 can be connected by a bus or other means. Figure 3 The bus connection is taken as an example.

[0106] Among them, by calling the operation instructions stored in the memory A304, the processor A303 is used to execute steps 110 to 140 described in the encryption part and / or steps 150 to 170 described in the decryption part in the above-mentioned confidentiality method.

[0107] Optionally, by calling the operation instructions stored in the memory A304, the processor A303 is also used to execute any implementation method in the corresponding embodiments of the above-mentioned confidentiality method.

[0108] The embodiment of the present application also provides an electronic device 400, such as Figure 4 As shown, the electronic device 400 includes: a memory B410, a processor B420, and a computer program A411 stored in the memory B410 and executable on the processor B420. When the processor B420 executes the computer program A411, steps 110 to 140 described in the encryption part and / or steps 150 to 170 described in the decryption part of the above-mentioned confidentiality method are implemented.

[0109] Optionally, when the processor B420 executes the computer program A411, any implementation method corresponding to the above-mentioned confidentiality method can be implemented.

[0110] It should be noted that the electronic device proposed in the embodiment of the present application is a device used to implement the above-mentioned confidentiality method. Therefore, based on the above-mentioned confidentiality method proposed in the embodiment of the present application, technical personnel in this field can understand the specific implementation methods of the electronic device in the embodiment of the present application and its various variations. Therefore, how the electronic device specifically implements the above-mentioned confidentiality method will not be introduced in detail here. As long as the electronic device used by technical personnel in this field to implement the above-mentioned confidentiality method falls within the scope of protection to be protected by this application.

[0111] The present application also provides a computer-readable storage medium 500, such as Figure 5 As shown, the computer-readable storage medium 500 stores a computer program B511, which, when executed by a processor, implements steps 110 to 140 described in the encryption part and / or steps 150 to 170 described in the decryption part of the above-mentioned confidentiality method.

[0112] Optionally, when the computer program B511 is executed by a processor, it can implement any implementation method in the embodiments corresponding to the above-mentioned confidentiality method.

[0113] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0118] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of this application. It should be understood that the above description is only the specific implementation methods of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application should be included in the scope of protection of this application.

Claims

1. A lightweight confidentiality method for key information, characterized in that: The confidentiality method is applied to the server, including: Randomly generate a global codebook; the global codebook is formed by randomly generating the position of existing characters in the codebook, and the position information is used as the ciphertext of the corresponding characters; Marking key information, obtaining original ciphertext of the key information from the global codebook according to the marked key information, and compressing the original ciphertext to generate primary ciphertext; Obtaining a secondary ciphertext from a secondary cipherbook based on the primary ciphertext; if the secondary ciphertext cannot be obtained, re-compressing the primary ciphertext to generate a secondary ciphertext and storing it in the secondary cipherbook; otherwise, continuing with subsequent steps; the secondary cipherbook is used to store pairs of key information and primary ciphertext, as well as pairs of primary ciphertext and secondary ciphertext; Introducing a randomly generated ciphertext factor into the secondary ciphertext to generate a final ciphertext of the key information, replacing the key information with the final ciphertext and sending it to the client along with other relevant data information; The generation process of the primary ciphertext includes: Obtaining from the original ciphertext the number o1 of leading zeros, the number o2 of trailing zeros, the smallest prime number p1, and the hexadecimal or 64-decimal number p2 of the largest prime number; The primary ciphertext is obtained, which is expressed as: Bt=Eo1.o2.p1_p2, where E represents the ciphertext identifier; The generation process of the secondary ciphertext includes: The primary ciphertext is compressed again using a digest algorithm to generate a secondary ciphertext.

2. A lightweight confidentiality method for key information according to claim 1, characterized in that: The process of generating the original ciphertext of the key information includes: The key information is split into n characters by character, represented as A1, A2...An, and the key information is represented as: A=A1A2...An; According to the n characters after splitting, the ciphertext corresponding to each character is obtained from the global code book, where the ciphertext corresponding to A1, A2...An is B1, B2...Bn. The original ciphertext of the key information is generated according to the ciphertext of n characters, expressed as: B=B1B2...Bn.

3. A lightweight confidentiality method for key information according to any one of claims 1-2, characterized in that: The secondary password book described in the present invention includes: The primary ciphertext and the secondary ciphertext are stored as a pair in the secondary cipherbook, and the key information and the primary ciphertext are stored as a pair in the secondary cipherbook.

4. A lightweight confidentiality method for key information according to claim 1, characterized in that: The process of generating the final ciphertext includes: Adding a randomly generated ciphertext factor to the end of the secondary ciphertext to generate the final ciphertext; The ciphertext factor represents a nanosecond timestamp.

5. A lightweight confidentiality method for key information, characterized in that: The confidentiality method is applied to the client, including: Removing the ciphertext factor at the end of the key information ciphertext received from the server to obtain a secondary ciphertext, and obtaining the corresponding primary ciphertext and key information from the secondary codebook based on the secondary ciphertext; wherein the key information ciphertext sent by the server is generated using the confidentiality method according to any one of claims 1 to 4; Performing inverse compression processing on the primary ciphertext to obtain original ciphertext, and obtaining key information from the global codebook based on the original ciphertext; Comparing and verifying the key information obtained from the global code book with the key information obtained from the secondary code book, and performing subsequent business logic if they are the same; otherwise, returning a message indicating that the ciphertext has been tampered with and not performing subsequent business logic; the reverse compression process includes: Get the hexadecimal or 64-base number of the largest prime number according to the underscore segmentation, convert it from hexadecimal or 64-base number to decimal, and get the smallest prime number; Multiply the largest prime number and the smallest prime number in decimal to get the sequence P after removing the leading and trailing 0s; The sequence P is padded with 0s at the front and back according to the character representing the number of leading and trailing 0s after the ciphertext is marked, and the original ciphertext is restored.

6. A lightweight key information security device, characterized in that: The encryption module includes: An initialization unit, configured to randomly generate a global codebook; the global codebook is formed by randomly generating positions of existing characters in the codebook, with the position information serving as ciphertext for the corresponding characters; a first compression unit, configured to mark key information, obtain original ciphertext of the key information from the global codebook according to the marked key information, and compress the original ciphertext to generate primary ciphertext; a second compression unit, configured to obtain a secondary ciphertext from a secondary cipherbook based on the primary ciphertext, and if the secondary ciphertext cannot be obtained, to re-compress the primary ciphertext to generate a secondary ciphertext and store the secondary ciphertext in the secondary cipherbook; the secondary cipherbook is configured to store pairs of key information and primary ciphertext, and pairs of primary ciphertext and secondary ciphertext; a salt adding unit, configured to introduce a randomly generated ciphertext factor into the secondary ciphertext to generate a final ciphertext of the key information; and a transmission unit, configured to replace the key information with the final ciphertext and send the final ciphertext and other relevant data information to the client; The generation process of the primary ciphertext includes: Obtaining from the original ciphertext the number o1 of leading zeros, the number o2 of trailing zeros, the smallest prime number p1, and the hexadecimal or 64-decimal number p2 of the largest prime number; The primary ciphertext is obtained, which is expressed as: Bt=Eo1.o2.p1_p2, where E represents the ciphertext identifier; The generation process of the secondary ciphertext includes: The primary ciphertext is compressed again using a digest algorithm to generate a secondary ciphertext.

7. A lightweight key information security device, characterized in that: The decryption module includes: a receiving unit, configured to remove the ciphertext factor bit at the end of the key information ciphertext received from the server to obtain a secondary ciphertext, and obtain the corresponding primary ciphertext and key information from the secondary codebook based on the secondary ciphertext; wherein the key information ciphertext sent by the server is generated using the security device according to claim 6; an inverse compression unit, configured to perform inverse compression processing on the primary ciphertext to obtain an original ciphertext, and obtain key information from a global codebook based on the original ciphertext; and a verification unit, configured to compare and verify the key information obtained from the global code book with the key information obtained from the secondary code book, and if they are the same, perform subsequent business logic; otherwise, return a message indicating that the ciphertext has been tampered with and do not perform subsequent business logic; The reverse compression process includes: Get the hexadecimal or 64-base number of the largest prime number according to the underscore segmentation, convert it from hexadecimal or 64-base number to decimal, and get the smallest prime number; Multiply the largest prime number and the smallest prime number in decimal to get the sequence P after removing the leading and trailing 0s; The sequence P is padded with 0s at the front and back according to the character representing the number of leading and trailing 0s after the ciphertext is marked, and the original ciphertext is restored.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the security method according to any one of claims 1 to 5 is implemented.

Images