Intelligent encryption method, device and system for application sensitive data

Abstract

The invention relates to the technical field of data encryption, and discloses an intelligent encryption method, device and system for application sensitive data. Comprising the following steps: executing a secret key mixing operation of a static secret key and a dynamic secret key in a coding encryption environment to obtain a mixed secret key result, and further executing corresponding encryption and coding format conversion operation on target application data and the mixed secret key result, signature detection and integrity verification operations are executed in the operation decryption environment, and corresponding decryption and decoding format conversion operations are executed on the target format ciphertext data, so that the comprehensiveness and rationality of an intelligent encryption and decryption mode of the application sensitive data are improved; furthermore, the diversity, pertinence and independence of the encryption operation environment and the decryption operation environment of the application sensitive data are improved, so that the encryption and decryption accuracy and the encryption and decryption reliability of the application sensitive data are improved, and the use safety and the management reliability of the application sensitive data are further improved; and the management accuracy and management efficiency of the application sensitive data are improved.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to an intelligent encryption method, apparatus and system for application-sensitive data. Background Technology

[0002] With the rapid development of information technology and its deep penetration into various fields, sensitive application data has become an indispensable and highly critical information element in personal life, business operations, and even social services. Therefore, data encryption technology is the core means to ensure the security of sensitive application data.

[0003] Currently, encryption methods for sensitive application data mainly include user-defined passwords or system-generated encryption by replacing original class and method names with random characters during compilation. However, user-defined encryption is limited by individual cognitive limitations, leading to issues such as repetitive use and strong regularity, making it vulnerable to brute-force attacks or targeted attacks. While random character encryption increases code analysis complexity, professional attackers can still extract complete key information through string feature matching and constant pool analysis, resulting in low accuracy and reliability of sensitive application data encryption. Therefore, providing a new encryption method for sensitive application data to improve its accuracy and reliability is crucial. Summary of the Invention

[0004] This invention provides an intelligent encryption method, device, and system for application-sensitive data, which can improve the encryption accuracy and reliability of application-sensitive data, thereby improving the security of application-sensitive data use and the reliability of management.

[0005] To address the aforementioned technical problems, the first aspect of this invention discloses an intelligent encryption method for application-sensitive data. The method is applied to an electronic device with an installed application, and the electronic device is communicatively connected to a network-attached storage device (NAT). The electronic device can access target application data in the NAT through the application. The method includes: Based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters, the corresponding split architecture establishment operation is performed to obtain the target encryption split architecture, which includes a compilation encryption environment and a runtime decryption environment that meet the physical separation conditions; When target application data that needs to be compiled and encrypted is detected, in the encoding encryption environment, the static key and dynamic key of the target application data are determined, and the corresponding key mixing operation is performed on the static key and the dynamic key to obtain the mixed key result of the target application data; in the encoding encryption environment, the corresponding encryption and encoding format conversion operation is performed on the target application data and the mixed key result to obtain the target format ciphertext data; When a target application associated with the target application data is detected to be launched and loaded, in the running decryption environment, the target application is subjected to corresponding signature detection and integrity verification operations to obtain a verification result. When the verification result is used to indicate that the application verification is successful, in the running decryption environment, the target format ciphertext data corresponding to the pre-stored target application data is determined, and the target format ciphertext data is subjected to corresponding decryption and decoding format conversion operations to obtain a plaintext string conversion result.

[0006] As an optional implementation, in the first aspect of the present invention, performing corresponding encryption and encoding format conversion operations on the target application data and the hybrid key result to obtain target format ciphertext data includes: Based on the determined number of bytes in the data block, perform the corresponding data block partitioning operation on the target application data to obtain one or more data blocks; Determine the number of data blocks corresponding to all the data blocks, and determine the required number of encryption rounds for the target application data based on the number of data blocks; When the current encryption round of the target application data is less than or equal to the required encryption round, determine the cumulative variable corresponding to the current encryption round, and determine the round factor corresponding to the current encryption round based on the cumulative variable; determine the data block object to be encrypted corresponding to the current encryption round, and perform corresponding hybrid encryption operations on the data block object to be encrypted and the hybrid encryption result based on the round factor to obtain the encrypted byte array corresponding to the current encryption round; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is equal to the required encryption round number, the final encrypted byte array corresponding to the target application data is determined based on the encrypted byte array corresponding to the current encryption round; according to the determined storable string format, the corresponding encoding format conversion operation is performed on the final encrypted byte array to obtain the target format ciphertext data; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is less than the required number of encryption rounds, the encrypted byte array corresponding to the current encryption round is used as the new data block object to be encrypted corresponding to the current encryption round.

[0007] As an optional implementation, in the first aspect of the present invention, performing corresponding key mixing operations on the static key and the dynamic key to obtain a mixed key result for the target application data includes: Determine the length and sorting of the first character corresponding to the static key, and determine the length and sorting of the second character corresponding to the dynamic key; Based on the first character length, the first character sorting, the second character length, and the second character sorting, perform corresponding loop traversal and iterative alternating permutation operations on the static key and the dynamic key to obtain an alternating character sequence result, which serves as the hybrid key result for the target application data.

[0008] As an optional implementation, in the first aspect of the present invention, performing corresponding signature detection and integrity verification operations on the target application to obtain verification results includes: Perform corresponding digital signature traversal and signature byte array analysis operations on the target application to obtain the actual signature hash value of the target application and determine the expected signature hash value corresponding to the target application; Based on the actual signature hash value and the expected signature hash value, determine whether the target application meets the preset genuine integrity application conditions; When it is determined that the target application meets the conditions for genuine and complete application, based on the current application lifecycle, it is determined whether the target application meets the preset limit on the number of times it can be decrypted. When it is determined that the target application meets the decryption usage limit, the verification result is used to indicate that the application verification is successful. When it is determined that the target application does not meet the genuine integrity application conditions or when it is determined that the target application does not meet the decryption usage limit conditions, the verification result is used to indicate that the application verification has failed.

[0009] As an optional implementation, in the first aspect of the present invention, the method further includes: When the verification result indicates that the application verification has failed, the verification failure reason type of the target application is determined, and the process handling scheme of the target application is determined according to the verification failure reason type. According to the process handling scheme, corresponding application process handling operations are executed, including process adjustment operations or forced process termination operations.

[0010] As an optional implementation, in the first aspect of the present invention, after performing corresponding decryption and decoding format conversion operations on the target format ciphertext data to obtain a plaintext string conversion result, the method further includes: Based on the established local variable library, perform corresponding storage operations on the plaintext string conversion results; Based on the determined requirements, the operation information is executed, the plaintext string conversion result is obtained from the local variable library, and the corresponding usage operation is performed on the plaintext string conversion result; When it is detected that the plaintext string conversion result is already in use, the corresponding automatic cleanup operation is performed on the plaintext string conversion result in the local variable library.

[0011] As an optional implementation, in the first aspect of the present invention, the method further includes: When it is detected that the plaintext string conversion result is in a used state, it is determined whether the plaintext string conversion result meets the preset short-term necessary requirement condition; When it is determined that the plaintext string conversion result meets the short-term necessary requirement condition, the corresponding short-term pause and cleanup configuration operation is performed on the plaintext string conversion result in the local variable library; When it is determined that the plaintext string conversion result does not meet the short-term necessary requirement condition, the step of performing the corresponding automatic cleanup operation on the plaintext string conversion result in the local variable library is executed.

[0012] A second aspect of this invention discloses an intelligent encryption device for application-sensitive data. The device includes an electronic device on which an application program is installed, and the electronic device is communicatively connected to a network-attached storage device (NAT). The electronic device can access target application data in the NAT via the application program. The device includes: The environment establishment module is used to perform corresponding split architecture establishment operations based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters to obtain the target encryption split architecture, which includes a compilation encryption environment and a runtime decryption environment that meet the physical separation conditions. The compilation encryption module is used to, when detecting target application data that needs to be compiled and encrypted, determine the static key and dynamic key of the target application data in the encoding encryption environment, and perform corresponding key mixing operations on the static key and the dynamic key to obtain the mixed key result of the target application data; and perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result in the encoding encryption environment to obtain target format ciphertext data. The decryption module is used to perform corresponding signature detection and integrity verification operations on the target application in the decryption environment when the target application associated with the target application data is detected to start loading, and obtain the verification result; when the verification result is used to indicate that the application verification is successful, the target format ciphertext data corresponding to the pre-stored target application data is determined in the decryption environment, and corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data to obtain the plaintext string conversion result.

[0013] As an optional implementation, in the second aspect of the present invention, the compilation and encryption module performs corresponding encryption and encoding format conversion operations on the target application data and the hybrid key result to obtain target format ciphertext data in the following specific ways: Based on the determined number of bytes in the data block, perform the corresponding data block partitioning operation on the target application data to obtain one or more data blocks; Determine the number of data blocks corresponding to all the data blocks, and determine the required number of encryption rounds for the target application data based on the number of data blocks; When the current encryption round of the target application data is less than or equal to the required encryption round, determine the cumulative variable corresponding to the current encryption round, and determine the round factor corresponding to the current encryption round based on the cumulative variable; determine the data block object to be encrypted corresponding to the current encryption round, and perform corresponding hybrid encryption operations on the data block object to be encrypted and the hybrid encryption result based on the round factor to obtain the encrypted byte array corresponding to the current encryption round; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is equal to the required encryption round number, the final encrypted byte array corresponding to the target application data is determined based on the encrypted byte array corresponding to the current encryption round; according to the determined storable string format, the corresponding encoding format conversion operation is performed on the final encrypted byte array to obtain the target format ciphertext data; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is less than the required number of encryption rounds, the encrypted byte array corresponding to the current encryption round is used as the new data block object to be encrypted corresponding to the current encryption round.

[0014] As an optional implementation, in the second aspect of the present invention, the compilation encryption module performs a corresponding key mixing operation on the static key and the dynamic key to obtain the mixed key result of the target application data in the following specific ways: Determine the length and sorting of the first character corresponding to the static key, and determine the length and sorting of the second character corresponding to the dynamic key; Based on the first character length, the first character sorting, the second character length, and the second character sorting, perform corresponding loop traversal and iterative alternating permutation operations on the static key and the dynamic key to obtain an alternating character sequence result, which serves as the hybrid key result for the target application data.

[0015] As an optional implementation, in the second aspect of the present invention, the method by which the running decryption module performs corresponding signature detection and integrity verification operations on the target application to obtain the verification result specifically includes: Perform corresponding digital signature traversal and signature byte array analysis operations on the target application to obtain the actual signature hash value of the target application and determine the expected signature hash value corresponding to the target application; Based on the actual signature hash value and the expected signature hash value, determine whether the target application meets the preset genuine integrity application conditions; When it is determined that the target application meets the conditions for genuine and complete application, based on the current application lifecycle, it is determined whether the target application meets the preset limit on the number of times it can be decrypted. When it is determined that the target application meets the decryption usage limit, the verification result is used to indicate that the application verification is successful. When it is determined that the target application does not meet the genuine integrity application conditions or when it is determined that the target application does not meet the decryption usage limit conditions, the verification result is used to indicate that the application verification has failed.

[0016] As an optional implementation, in a second aspect of the invention, the apparatus further includes: The process processing module is used to determine the verification failure reason type of the target application when the verification result indicates that the application verification has failed, and to determine the process processing scheme of the target application based on the verification failure reason type; and to execute the corresponding application process processing operation according to the process processing scheme, wherein the application process processing operation includes process adjustment operation or process forced termination operation.

[0017] As an optional implementation, in a second aspect of the invention, the apparatus further includes: The plaintext processing module is used to perform corresponding decryption and decoding format conversion operations on the target format ciphertext data after the decryption module performs corresponding storage operations on the plaintext string conversion results based on a set local variable library; retrieve the plaintext string conversion results from the local variable library according to the determined requirement execution information and perform corresponding usage operations on the plaintext string conversion results; and perform corresponding automatic cleanup operations on the plaintext string conversion results in the local variable library when it is detected that the plaintext string conversion results are already in use.

[0018] As an optional implementation, in a second aspect of the present invention, the plaintext processing module is further configured to, when detecting that the plaintext string conversion result is in a used state, determine whether the plaintext string conversion result meets a preset short-term necessity requirement condition; when it is determined that the plaintext string conversion result meets the short-term necessity requirement condition, perform a corresponding short-term pause cleanup configuration operation on the plaintext string conversion result in the local variable library; and when it is determined that the plaintext string conversion result does not meet the short-term necessity requirement condition, perform the step of performing a corresponding automatic cleanup operation on the plaintext string conversion result in the local variable library.

[0019] A third aspect of the present invention discloses an electronic device, the electronic device comprising: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the intelligent encryption method for application-sensitive data disclosed in the first aspect of the present invention.

[0020] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute the intelligent encryption method for application-sensitive data disclosed in the first aspect of the present invention.

[0021] The fifth aspect of this invention discloses an intelligent encryption system for application-sensitive data, the system comprising the intelligent encryption device for application-sensitive data disclosed in the second aspect of this invention, and a network-attached storage device communicatively connected to the device; or, The system includes the electronic device disclosed in the third aspect of the present invention, and a network-attached storage device communicatively connected to the electronic device.

[0022] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: In this embodiment of the invention, based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters, a corresponding split architecture establishment operation is performed to obtain a target encryption split architecture. This target encryption split architecture includes a compilation encryption environment and a runtime decryption environment that satisfy physical separation conditions. When target application data requiring compilation encryption is detected, in the encoding encryption environment, the static key and dynamic key of the target application data are determined, and a corresponding key mixing operation is performed on the static key and the dynamic key to obtain a mixed key result for the target application data. In the encoding encryption environment, corresponding encryption and encoding format conversion operations are performed on the target application data and the mixed key result to obtain target format ciphertext data. When the target application associated with the target application data is detected to be starting up and loading, in the runtime decryption environment, corresponding signature detection and integrity verification operations are performed on the target application to obtain a verification result. When the verification result indicates successful application verification, in the runtime decryption environment, the target format ciphertext data corresponding to the pre-stored target application data is determined, and corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data to obtain a plaintext string conversion result. As can be seen, this invention can perform key mixing operations of static and dynamic keys in an encoding and encryption environment to obtain a mixed key result, and then perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result. In the decryption environment, it can perform signature detection and integrity verification operations, as well as perform corresponding decryption and decoding format conversion operations on the target format ciphertext data. This is beneficial to improving the comprehensiveness and rationality of intelligent encryption and decryption methods for application sensitive data, and further beneficial to improving the diversity, pertinence, and independence of the encryption and decryption operation environments for application sensitive data. This is beneficial to improving the accuracy and reliability of encryption and decryption of application sensitive data, and further beneficial to improving the security and reliability of application sensitive data use and management, and beneficial to improving the accuracy and efficiency of application sensitive data management. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating an intelligent encryption method for application-sensitive data disclosed in an embodiment of the present invention; Figure 2 This is a flowchart illustrating another intelligent encryption method for application-sensitive data disclosed in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an intelligent encryption device for application-sensitive data disclosed in an embodiment of the present invention; Figure 4 This is a schematic diagram of another intelligent encryption device for application-sensitive data disclosed in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the implementation process of an intelligent encryption system for application-sensitive data disclosed in an embodiment of the present invention; Figure 7 This is a schematic diagram of the architecture of an intelligent encryption system for application-sensitive data disclosed in an embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or end that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or ends.

[0027] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] This invention discloses an intelligent encryption method, apparatus, and system for application-sensitive data. It can perform key mixing operations of static and dynamic keys in an encoded encryption environment to obtain a hybrid key result, and then perform corresponding encryption and encoding format conversion operations on the target application data and the hybrid key result. In the decryption environment, it performs signature detection and integrity verification operations, as well as corresponding decryption and decoding format conversion operations on the target format ciphertext data. This improves the comprehensiveness and rationality of intelligent encryption and decryption methods for application-sensitive data, thereby enhancing the diversity, specificity, and independence of the encryption and decryption operation environments for application-sensitive data. This improves the accuracy and reliability of encryption and decryption, further enhancing the security and management reliability of application-sensitive data, and improving the accuracy and efficiency of application-sensitive data management. Detailed descriptions follow.

[0029] Example 1 Please see Figure 1 , Figure 1 This is a flowchart illustrating an intelligent encryption method for application-sensitive data disclosed in an embodiment of the present invention. Figure 1 The described method can be applied to electronic devices with installed applications, and the electronic devices are communicatively connected to network-attached storage devices. The electronic devices can access target application data in the network-attached storage devices through the applications. This invention is not limited in its embodiments. Figure 1 As shown, this intelligent encryption method for application-sensitive data includes the following operations: 101. Based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters, perform the corresponding split architecture establishment operation to obtain the target encryption split architecture, which includes a compilation encryption environment and a runtime decryption environment that meet the physical separation conditions.

[0030] Optionally, the encryption environment can be understood as a compile-time environment, such as the Gradle build layer. Further, a main controller module is established via the Gradle build script. This module is responsible for loading the encryption engine component and the key mixer component. The key system employs a dual-key configuration mechanism, which can include a manually replaceable static key and a dynamic key that changes automatically with each build. The system selects the key mode based on the build speed configuration, enabling the dynamic key during formal builds and using the static key during fast debug builds. The key mixer synthesizes the dynamic and static keys into the final encryption key (i.e., the mixed key result). A protected interface is provided externally. This interface receives the name and value of application-sensitive data (i.e., target application data), encrypts it using the XXTEA algorithm and the mixed key, converts the encryption result to Base64 encoding format, obtains the target format ciphertext data, and automatically injects it into the BuildConfig field of the Android build configuration. This embodiment of the invention is not limited to this.

[0031] Optionally, a decryption environment can be run, which can be understood as a runtime environment, such as the Java application layer. Further, a decryption interface class is established as a unified entry point for ciphertext decryption. This class provides static decryption methods, receives application context and encrypted data parameters, and internally calls the one-time decryption method of the environment checker, integrating integrity verification and decryption functions. A dedicated XXTEA decryption engine class is implemented, which is specifically responsible for the decryption algorithm implementation and provides a method for converting Base64 encoded ciphertext to plaintext strings. The decryption engine receives Base64 encoded encrypted data and a decryption key, performs Base64 decoding, XXTEA decryption algorithm, and UTF-8 character encoding conversion, and returns the original plaintext string. To ensure security, the runtime environment only contains the decryption algorithm implementation and does not contain any encryption function code; this embodiment of the invention does not impose limitations.

[0032] Optionally, the above-mentioned execution of the corresponding split architecture establishment operation may include completing the physical separation of the compile-time encryption environment and the runtime decryption environment, and establishing the protect interface and the decrypt interface. This embodiment of the invention does not limit this.

[0033] Optionally, the target encryption separation architecture and its specific applications can be found in, but are not limited to, the appendix to the instruction manual. Figure 7 The schematic diagram shown is for an intelligent encryption system for application-sensitive data. This embodiment of the invention is not limited to any particular type of system.

[0034] Optionally, security is enhanced: attackers cannot obtain complete encryption and decryption information in a single environment; reverse engineering difficulty: encryption logic is in the Gradle layer, and decryption logic is in the Java layer, increasing the analysis difficulty exponentially; quantification effect: compared with traditional solutions, the difficulty of obtaining keys is significantly increased, and this embodiment of the invention is not limited.

[0035] 102. When target application data that needs to be compiled and encrypted is detected, in the encoding and encryption environment, the static key and dynamic key of the target application data are determined, and the corresponding key mixing operation is performed on the static key and dynamic key to obtain the mixed key result of the target application data.

[0036] Optionally, the target application data may be sensitive data or other data of the target application. Furthermore, the target application may be Android or other applications, and this embodiment of the invention does not limit the scope of the data.

[0037] Optionally, the target application data can be detected through the protected interface in the target encryption separation architecture, but this embodiment of the invention does not limit this.

[0038] Optionally, based on the target encryption separation architecture, a hybrid algorithm of static and dynamic keys can be implemented to enhance key security through a character alternation combination mechanism. This embodiment of the invention is not limited to this.

[0039] Optional features include: key security: even if one of the keys is obtained, decryption cannot be completed; dynamic protection: different dynamic keys can be used for each build, and leakage of historical versions does not affect new versions; quantification effect: the complexity of key cracking is greatly improved, and a strategy of periodically changing keys is supported. This embodiment of the invention does not impose any limitations.

[0040] 103. In an encrypted environment, perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result to obtain the target format ciphertext data.

[0041] Optionally, based on the hybrid key result, a lightweight encryption algorithm, XXTEA, specifically adapted to the performance characteristics of mobile devices can be implemented. This embodiment of the invention does not limit the scope of the invention.

[0042] Optionally, based on the XXTEA encryption algorithm, a unified encryption protection mechanism is provided for various third-party SDK keys and application sensitive data, including third-party service integration key protection, application core sensitive data protection, and system integrity verification mechanism. Furthermore, third-party service integration key protection: based on the protect interface in the step-target encryption separation architecture and the XXTEA encryption capability, multiple types of third-party service access credentials are encrypted and protected through a unified protect interface. This embodiment of the invention is not limited to this.

[0043] Optionally, for cloud storage data synchronization services, the client identifier (in numeric string format) and client key (in Base64 encoded format) are protected; for mobile payment services, the application key (in 32-bit hexadecimal format) is protected; for network access services, including remote access services and VPN tunnel services, the application key and authentication certificate (in custom string format) are protected respectively. This embodiment of the invention does not impose any limitations.

[0044] Optionally, for the protection of application core sensitive data, based on encryption algorithms, the system also protects the application's own core sensitive data, including network communication signature keys (using Base64 encoding format), application unique identifiers (using custom mixed character format), and database encryption keys (using Salted encryption format). These sensitive data cover key security aspects such as application communication authentication with external systems, internal identity identification, and local data storage security. This embodiment of the invention does not limit these aspects.

[0045] Optionally, a system integrity verification mechanism is introduced: a system health check mechanism is introduced, which verifies the integrity and correctness of the entire encryption and decryption system by protecting specific test data against protect("Hi": "Nas"). This mechanism ensures that the encryption protection system always maintains normal functional status during deployment and operation, and can promptly detect system anomalies or tampering. This embodiment of the invention does not limit the scope of the mechanism.

[0046] Optionally, the XXTEA algorithm can be used to replace the traditional AES encryption, which is optimized for mobile devices: (1) Performance advantages: the encryption and decryption speed is significantly improved compared to AES, and the memory usage is greatly reduced; (2) Power saving: the power consumption of encryption operations on mobile devices is significantly reduced; (3) Strong compatibility: it supports all versions of Android 4.0+, without additional dependencies, and this embodiment of the invention does not limit it.

[0047] Optionally, by using a unified protect interface, compared with existing decentralized protection schemes: (1) Management efficiency: Any sensitive data can be protected with a single line of code, greatly improving development efficiency; (2) Protection coverage: Supports protection of various types of SDK keys and sensitive data; (3) Maintenance cost: The unified encryption strategy greatly reduces maintenance costs. This embodiment of the invention does not limit this.

[0048] 104. When the target application associated with the target application data is detected to start loading, the corresponding signature detection and integrity verification operations are performed on the target application in the running decryption environment to obtain the verification results.

[0049] Optionally, an APK digital signature verification mechanism can be integrated into the application sensitive data decryption process to ensure that only genuine applications whose integrity has not been compromised can be successfully decrypted. This embodiment of the invention does not impose any limitations on this.

[0050] Optionally, an integrity verification mechanism can be implemented to ensure that only genuine applications can decrypt sensitive data; however, this embodiment of the invention does not impose any limitations on this.

[0051] Optionally, compared with existing independent verification schemes, integrated APK signature verification has the following advantages: (1) Detection accuracy: It can completely detect when the APK has been re-signed or tampered with; (2) Response speed: It can immediately terminate the process after detecting tampering to prevent key leakage; (3) Transparent integration: The verification process is transparent to the business code and does not increase the development complexity. This embodiment of the invention does not limit this.

[0052] 105. When the verification result is used to indicate that the application verification is successful, in the running decryption environment, the target format ciphertext data corresponding to the pre-stored target application data is determined, and the corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data to obtain the plaintext string conversion result.

[0053] Optionally, the decryption key can be obtained through a key acquisition device and the corresponding XXTEA decryption engine can be called to complete the conversion of Base64 encoded ciphertext to plaintext string, and the plaintext string conversion result can be obtained. This embodiment of the invention does not limit the scope of the invention.

[0054] As can be seen, the intelligent encryption method for application-sensitive data described in this embodiment of the invention can perform key mixing operations of static and dynamic keys in the encoding encryption environment to obtain a mixed key result, and then perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result. In the running decryption environment, it performs signature detection and integrity verification operations, as well as corresponding decryption and decoding format conversion operations on the target format ciphertext data. This is beneficial to improving the comprehensiveness and rationality of intelligent encryption and decryption methods for application-sensitive data, and further beneficial to improving the diversity, pertinence, and independence of the encryption and decryption operation environments for application-sensitive data. This is beneficial to improving the accuracy and reliability of encryption and decryption of application-sensitive data, and further beneficial to improving the security and reliability of application-sensitive data use and management, and beneficial to improving the accuracy and efficiency of application-sensitive data management.

[0055] In an optional embodiment, the above-described encryption and encoding format conversion operations performed on the target application data and the hybrid key result to obtain target format ciphertext data may include: Based on the determined number of bytes in the data block, perform the corresponding data block partitioning operation on the target application data to obtain one or more data blocks; Determine the number of data blocks corresponding to all data blocks, and based on the number of data blocks, determine the required number of encryption rounds for the target application data; When the current encryption round of the target application data is less than or equal to the required encryption round, determine the cumulative variable corresponding to the current encryption round, and determine the round factor corresponding to the current encryption round based on the cumulative variable; determine the data block object to be encrypted corresponding to the current encryption round, and perform the corresponding hybrid encryption operation on the data block object to be encrypted and the hybrid encryption result based on the round factor to obtain the encrypted byte array corresponding to the current encryption round; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is equal to the required encryption round, determine the final encrypted byte array corresponding to the target application data based on the encrypted byte array corresponding to the current encryption round; and perform the corresponding encoding format conversion operation on the final encrypted byte array according to the determined storable string format to obtain the target format ciphertext data. After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is less than the required number of encryption rounds, the encrypted byte array corresponding to the current encryption round is used as the new data block object to be encrypted for the current encryption round.

[0056] Optionally, the data block object to be encrypted corresponding to the current encryption round can be understood as a historical encrypted byte array obtained by accumulating and mixing encryption in previous encryption rounds. This embodiment of the invention does not limit this.

[0057] Optionally, determining the final encrypted byte array corresponding to the target application data based on the encrypted byte array corresponding to the current encryption round may include: determining the encrypted byte array corresponding to the current encryption round as the final encrypted byte array corresponding to the target application data. This embodiment of the invention does not limit this.

[0058] Optionally, after using the encrypted byte array corresponding to the current encryption round as the new data block object to be encrypted corresponding to the current encryption round, the encrypted byte array determination operation is performed again based on the new current encryption round. This embodiment of the invention does not limit this.

[0059] Optionally, the target application data can be converted into a byte array, grouped into N bytes, and then converted into a 32-bit unsigned integer to obtain one or more data blocks. This embodiment of the invention does not limit the scope of the data.

[0060] Optionally, the total number of encryption rounds is calculated based on the number of data blocks in the target application data. In each round of encryption, the algorithm independently calculates the round factor of that round based on a cumulative variable, and then uses this unified round factor to perform mixed encryption operations on all data blocks in the round of encryption in sequence. A target application data will be divided into multiple data blocks, and each data block will be processed multiple times in multiple rounds of encryption. This embodiment of the invention does not limit the scope of the invention.

[0061] Optionally, based on the encryption engine component established in the target encryption-separated architecture, a compile-time encryption engine class is constructed. This engine is specifically designed to encrypt sensitive data during the Gradle build phase. The engine adopts the XXTEA algorithm, which is particularly suitable for resource-constrained mobile device environments. The algorithm uses a fixed Delta constant value of 0x9E3779B9 as the cumulative increment of encryption rounds. This value is designed based on the golden ratio to ensure the randomness and security of the encryption process. This embodiment of the invention does not limit this.

[0062] Optionally, based on the hybrid key result, the encryption engine provides a conversion interface from string to Base64 encoded ciphertext. First, the target application data and the hybrid key result are converted into byte arrays using an internal encryption algorithm. Then, a Base64 encoder is used to convert the encrypted byte data into a storable string format (i.e., target format ciphertext data). Further, the core encryption algorithm receives the target application data and the hybrid key result in the form of an integer array, calculates the data length, and verifies its validity. The number of encryption rounds is calculated based on the number of data blocks, and the number of iterations is determined using the formula "6 + 52 / (n + 1)" to balance encryption strength and performance overhead. This embodiment of the invention does not impose limitations on this.

[0063] Optionally, in each encryption round, the algorithm updates the sum value by accumulating increments and calculates the round factor e; it performs a hybrid operation on each element in the data array. The hybrid operation function MX implements complex bitwise XOR operations, including XOR of z shifted right by 5 bits and y shifted left by 2 bits, XOR of y shifted right by 3 bits and z shifted left by 4 bits, as well as multi-layer hybrid operations such as XOR of sum and y, and XOR of key selection and z; this hybrid mechanism ensures the non-linear characteristics and anti-analysis capabilities of the encryption process, making reverse engineering extremely difficult. This embodiment of the invention does not limit the scope of the invention.

[0064] As can be seen, this optional embodiment can improve the comprehensiveness and rationality of the target format ciphertext data determination method by performing data block partitioning operation, determining the round factor and the data block object to be encrypted based on the current encryption round, and then performing corresponding hybrid encryption operation to obtain the encrypted byte array, and performing corresponding encoding format conversion operation on the final encrypted byte array. This is beneficial to improving the encryption flexibility, encryption diversity and encryption targeting of the target application data, thereby improving the accuracy and reliability of the determined target format ciphertext data, and further improving the complexity of the key being cracked.

[0065] In another optional embodiment, the above-described key mixing operation on the static key and dynamic key to obtain the mixed key result of the target application data may include: Determine the length and order of the first character corresponding to the static key, and determine the length and order of the second character corresponding to the dynamic key; Based on the length and sorting of the first character, the length and sorting of the second character, perform corresponding loop traversal and iterative alternation operations on the static key and dynamic key to obtain the alternating character sequence result, which serves as the mixed key result for the target application data.

[0066] Optionally, based on the key mixer component corresponding to the target encryption separation architecture, a key mixer class is constructed to implement the alternating character combination algorithm of static key and dynamic key; further, the minimum length of the static key and dynamic key is first used as the mixing range, and a string builder is created to assemble the final key; by iterating through the minimum length range, the current position character of the first key (static key) and the corresponding position character of the second key (dynamic key) are appended in each iteration to form an alternating character sequence, and finally the mixed key string generated by alternating combination (i.e., the mixed key result) is returned. This embodiment of the invention is not limited.

[0067] Optionally, the above-described loop traversal and iterative alternation operation is performed on the static key and dynamic key. For example, taking the static key "STATIC_2024" and the dynamic key "BUILD_001" as an example, the mixing algorithm will generate the final key "SBTAUTIILCD_2002041". The mixing process alternates in position order: S (static), B (dynamic), T (static), U (dynamic), and so on, until all characters of the shorter key are used up, resulting in an alternating character sequence. This embodiment of the invention does not limit the scope of the problem.

[0068] As can be seen, this optional embodiment can determine the minimum length and character order of the static key and the dynamic key, and then perform loop traversal and iterative alternating permutation operations on the static key and the dynamic key to obtain the mixed key result. This is beneficial to improving the comprehensiveness and rationality of the mixed key result determination method, and thus to improving the accuracy and reliability of the determined mixed key result.

[0069] In another optional embodiment, the above-described signature detection and integrity verification operations performed on the target application to obtain the verification result may include: Perform corresponding digital signature traversal and signature byte array analysis operations on the target application to obtain the actual signature hash value of the target application and determine the expected signature hash value corresponding to the target application; Based on the actual signature hash value and the expected signature hash value, determine whether the target application meets the preset conditions for genuine and complete application. When it is determined that the target application meets the conditions for genuine and complete application, based on the current application lifecycle, it is determined whether the target application meets the preset limit on the number of times it can be decrypted. When it is determined that the target application meets the decryption usage limit, the verification result is used to indicate that the application verification was successful. When it is determined that the target application does not meet the conditions for genuine and complete application, or when it is determined that the target application does not meet the limit on the number of times it can be decrypted, the verification result is used to indicate that the application verification has failed.

[0070] Further optionally, the above determination of whether the target application meets the preset genuine integrity application conditions based on the actual signature hash value and the expected signature hash value may include: Determine whether the actual signature hash value matches the expected signature hash value; if the result is yes, determine that the target application meets the preset genuine integrity application conditions; if the result is no, determine that the target application does not meet the preset genuine integrity application conditions.

[0071] Further optionally, the above-mentioned determination of whether the target application meets the preset decryption usage limit based on the current application lifecycle may include: Determine the number of times the target application has been invoked based on the current application lifecycle; Determine whether the number of calls is greater than or equal to a preset call count threshold; if the result is yes, determine that the target application meets the preset decryption usage limit; if the result is no, determine that the target application does not meet the preset decryption usage limit.

[0072] Optionally, based on the running decryption environment and mixed key results in the target encryption-separated architecture, an environment checker class is constructed as a security gateway for the decryption process. This class adopts a one-time use restriction mechanism, which ensures that the decryption method can only be called once during the application lifecycle through an internal counter, preventing the security risks that may be caused by repeated decryption. Furthermore, the application signature integrity verification is performed first, and the actual decryption operation is only performed after the verification is passed. Finally, the decryption key is obtained through the key obtainer and the decryption engine is called to complete the conversion of Base64 encoded ciphertext to plaintext string. This embodiment of the invention is not limited.

[0073] Optionally, all digital signatures of the application are traversed and the actual signature hash value is calculated for the byte array of each signature to obtain the actual signature fingerprint of the current application. At the same time, the expected signature hash value corresponding to the target application is decrypted. This expected signature hash value has been encrypted and stored during the application construction. Further, the decryption key is reconstructed based on the key mixing mechanism, and the actual signature hash value of the current application is verified to be completely consistent with the expected signature hash value by string comparison. This embodiment of the invention does not limit the scope of the invention.

[0074] As can be seen, this optional embodiment can determine whether the conditions for genuine integrity application are met and whether the limit on the number of times decryption is used is met, and thus determine the verification result. This is beneficial to improving the comprehensiveness, rationality and progressiveness of the verification result determination method, and to improving the diversity and flexibility of the considerations used to determine the verification result. This is beneficial to improving the accuracy and reliability of the determined verification result, and thus to improving the accuracy and rationality of the execution of the decryption operation triggered based on the verification result.

[0075] In yet another alternative embodiment, the method may further include the following operations: When the verification result is used to indicate that the application verification failed, determine the verification failure reason type of the target application, and determine the process handling plan of the target application based on the verification failure reason type; According to the process handling scheme, perform the corresponding application process handling operations, which include process adjustment operations or forced process termination operations.

[0076] Optionally, if signature verification fails, it indicates that the application may have been repackaged, tampered with, or have other integrity issues. The system can immediately call the process termination method to forcibly terminate the current application process, preventing any subsequent decryption operations and access to sensitive data, thereby cutting off the attack path as soon as a security threat is detected. This embodiment of the invention does not limit this.

[0077] As can be seen, this optional embodiment can provide an application process processing method. When the verification result indicates that the application verification has failed, a process adjustment operation or a forced process termination operation is performed. This is beneficial to improving the comprehensiveness and rationality of the intelligent encryption method for application sensitive data, thereby improving the accuracy and reliability of the decryption process for application sensitive data, and improving the timeliness, efficiency and convenience of the decryption process for application sensitive data. It also helps to prevent the leakage of application sensitive data and keys and improve the security and protection of application sensitive data and keys.

[0078] Example 2 Please see Figure 2 , Figure 2 This is a flowchart illustrating another intelligent encryption method for application-sensitive data disclosed in an embodiment of the present invention. Figure 2 The described method can be applied to electronic devices with installed applications, and the electronic devices are communicatively connected to network-attached storage devices. The electronic devices can access target application data in the network-attached storage devices through the applications. This invention is not limited in its embodiments. Figure 2 As shown, this intelligent encryption method for application-sensitive data includes the following operations: 201. Based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters, perform the corresponding split architecture establishment operation to obtain the target encryption split architecture, which includes a compilation encryption environment and a runtime decryption environment that meet the physical separation conditions.

[0079] 202. When target application data that needs to be compiled and encrypted is detected, in the encoding encryption environment, the static key and dynamic key of the target application data are determined, and the corresponding key mixing operation is performed on the static key and dynamic key to obtain the mixed key result of the target application data; in the encoding encryption environment, the corresponding encryption and encoding format conversion operation is performed on the target application data and the mixed key result to obtain the target format ciphertext data.

[0080] 203. When the target application associated with the target application data is detected to be starting up and loading, in the running decryption environment, the corresponding signature detection and integrity verification operations are performed on the target application to obtain the verification result; when the verification result is used to indicate that the application verification is successful, in the running decryption environment, the target format ciphertext data corresponding to the pre-stored target application data is determined, and the corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data to obtain the plaintext string conversion result.

[0081] 204. Based on the set local variable library, perform the corresponding storage operation on the plaintext string conversion result.

[0082] Optionally, when it is necessary to access application sensitive data, the decryption interface in the target encryption-separated architecture can be called immediately at the point of use to obtain the plaintext string conversion result, and the plaintext string conversion result can be stored in a local variable. This embodiment of the invention does not limit this.

[0083] 205. Based on the determined requirements, execute the operation information, retrieve the plaintext string conversion result from the local variable library, and perform the corresponding usage operation on the plaintext string conversion result.

[0084] Optionally, the plaintext string conversion result can be stored in a local variable and immediately used for required operations (such as API calls, service binding, etc.). This embodiment of the invention does not impose any limitations on this.

[0085] 206. When it is detected that the plaintext string conversion result is already in use, perform the corresponding automatic cleanup operation on the plaintext string conversion result in the local variable library.

[0086] Optionally, after the plaintext string conversion result is used, the Java Virtual Machine's garbage collection mechanism can be used to automatically clear sensitive data in local variables. Furthermore, taking cloud storage device binding service as an example, the system decrypts the client identifier and client key in the device binding method and directly passes the plaintext string conversion result to the API service interface, avoiding any form of intermediate storage or caching. This embodiment of the invention does not impose any limitations.

[0087] Optionally, a flowchart of this solution can also be found in the appendix to the instruction manual. Figure 6 As shown, the embodiments of the present invention are not limited.

[0088] In this embodiment of the invention, for other descriptions of steps 201-206, please refer to the other detailed descriptions of steps 101-105 in Embodiment 1. These descriptions will not be repeated in this embodiment of the invention.

[0089] As can be seen, the embodiments of the present invention can perform key mixing operations of static and dynamic keys in an encoding and encryption environment to obtain a mixed key result, and then perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result. In the running decryption environment, signature detection and integrity verification operations are performed, as well as corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data. This is beneficial to improving the comprehensiveness and rationality of intelligent encryption and decryption methods for application sensitive data, thereby improving the diversity, specificity, and independence of the encryption and decryption operation environments for application sensitive data. This, in turn, is beneficial to improving the accuracy and reliability of encryption and decryption of application sensitive data, further improving the security and reliability of application sensitive data use, and improving the accuracy and efficiency of application sensitive data management. Furthermore, it can provide storage, retrieval, and automatic cleanup functions for a local variable library of plaintext string conversion results, which is beneficial to improving the comprehensiveness and integrity of intelligent encryption methods for application sensitive data. This, in turn, is beneficial to improving the specificity of application sensitive data storage, the timeliness of cleanup, the efficiency of cleanup, and the convenience of cleanup, thereby improving the security of application sensitive data and reducing security risks caused by manual memory management errors.

[0090] In an optional embodiment, the method may further include the following operations: When it is detected that the plaintext string conversion result is already in use, determine whether the plaintext string conversion result meets the preset short-term necessary requirement condition; When it is determined that the plaintext string conversion result meets the short-term necessity requirement, the corresponding short-term pause and cleanup configuration operation is performed on the plaintext string conversion result in the local variable library; When it is determined that the plaintext string conversion result does not meet the short-term necessary requirements, the corresponding automatic cleanup operation is performed on the plaintext string conversion result in the local variable library.

[0091] Optionally, the above-mentioned short-term pause cleanup configuration operation is used to set the plaintext string conversion results in the local variable library not to be cleaned up in the short term; furthermore, when the set pause cleanup period expires, it is automatically cleaned up immediately, or when the set pause cleanup period expires, the above-mentioned step of judging whether the plaintext string conversion results meet the preset short-term necessary requirements is executed again, and the embodiments of the present invention are not limited.

[0092] Optionally, the aforementioned short-term necessary requirement condition can be understood as whether the plaintext string conversion result needs to be used within a preset future time period, and this embodiment of the invention does not limit this.

[0093] As can be seen, this optional embodiment can match the corresponding plaintext string conversion result processing operation according to the short-term necessary requirements of the plaintext string conversion result. When the short-term necessary requirements are met, the plaintext string conversion result in the local variable library is temporarily suspended. This is beneficial to improving the diversity, flexibility and pertinence of the plaintext string conversion result processing method, thereby improving the processing accuracy and reliability of the plaintext string conversion result, and thus improving the accuracy and reliability of the cleaning and control of the plaintext string conversion result.

[0094] Example 3 Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an intelligent encryption device for application-sensitive data disclosed in an embodiment of the present invention. Figure 3 The described apparatus may include an electronic device, which has an application installed and is communicatively connected to a network-attached storage device. The electronic device can access target application data in the network-attached storage device through the application. This embodiment of the invention is not limited to this. Figure 3 As shown, the intelligent encryption device for application-sensitive data may include: The environment establishment module 301 is used to perform corresponding split architecture establishment operations based on the determined compilation encryption environment parameters and the determined runtime decryption environment parameters to obtain the target encryption split architecture, which includes a compilation encryption environment and a runtime decryption environment that meet the physical separation conditions.

[0095] The compilation encryption module 302 is used to determine the static key and dynamic key of the target application data in the encoding encryption environment when the target application data that needs to be compiled and encrypted is detected, and to perform corresponding key mixing operations on the static key and dynamic key to obtain the mixed key result of the target application data; in the encoding encryption environment, corresponding encryption and encoding format conversion operations are performed on the target application data and the mixed key result to obtain the target format ciphertext data.

[0096] The decryption module 303 is used to perform corresponding signature detection and integrity verification operations on the target application in the decryption environment when the target application associated with the target application data is detected to start loading, and obtain the verification result; when the verification result is used to indicate that the application verification is successful, the target format ciphertext data corresponding to the pre-stored target application data is determined in the decryption environment, and corresponding decryption and decoding format conversion operations are performed on the target format ciphertext data to obtain the plaintext string conversion result.

[0097] It is evident that implementation Figure 3 The described intelligent encryption device for application-sensitive data can perform key mixing operations of static and dynamic keys in the encoding encryption environment to obtain a mixed key result, and then perform corresponding encryption and encoding format conversion operations on the target application data and the mixed key result. In the running decryption environment, it performs signature detection and integrity verification operations, as well as corresponding decryption and decoding format conversion operations on the target format ciphertext data. This is beneficial to improving the comprehensiveness and rationality of intelligent encryption and decryption methods for application-sensitive data, thereby improving the diversity, pertinence, and independence of the encryption and decryption operation environments for application-sensitive data. This is beneficial to improving the accuracy and reliability of encryption and decryption of application-sensitive data, further improving the security and reliability of application-sensitive data use, and improving the accuracy and efficiency of application-sensitive data management.

[0098] In an optional embodiment, the compilation encryption module 302 performs corresponding encryption and encoding format conversion operations on the target application data and the mixed key result to obtain the target format ciphertext data. Specifically, this includes: Based on the determined number of bytes in the data block, perform the corresponding data block partitioning operation on the target application data to obtain one or more data blocks; Determine the number of data blocks corresponding to all data blocks, and based on the number of data blocks, determine the required number of encryption rounds for the target application data; When the current encryption round of the target application data is less than or equal to the required encryption round, determine the cumulative variable corresponding to the current encryption round, and determine the round factor corresponding to the current encryption round based on the cumulative variable; determine the data block object to be encrypted corresponding to the current encryption round, and perform the corresponding hybrid encryption operation on the data block object to be encrypted and the hybrid encryption result based on the round factor to obtain the encrypted byte array corresponding to the current encryption round; After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is equal to the required encryption round, determine the final encrypted byte array corresponding to the target application data based on the encrypted byte array corresponding to the current encryption round; and perform the corresponding encoding format conversion operation on the final encrypted byte array according to the determined storable string format to obtain the target format ciphertext data. After obtaining the encrypted byte array corresponding to the current encryption round, if the current encryption round is less than the required number of encryption rounds, the encrypted byte array corresponding to the current encryption round is used as the new data block object to be encrypted for the current encryption round.

[0099] It is evident that implementation Figure 4 The described device can perform a data block partitioning operation, determine the round factor and the data block object to be encrypted based on the current encryption round, and then perform a corresponding hybrid encryption operation to obtain an encrypted byte array. It can also perform a corresponding encoding format conversion operation on the final encrypted byte array. This is beneficial to improving the comprehensiveness and rationality of the method for determining the target format ciphertext data, thereby improving the encryption flexibility, encryption diversity and encryption targeting of the target application data. This is beneficial to improving the accuracy and reliability of the determined target format ciphertext data, and further beneficial to improving the complexity of the key being cracked.

[0100] In another optional embodiment, the compilation encryption module 302 performs corresponding key mixing operations on the static key and the dynamic key to obtain the mixed key result of the target application data in the following specific ways: Determine the length and order of the first character corresponding to the static key, and determine the length and order of the second character corresponding to the dynamic key; Based on the length and sorting of the first character, the length and sorting of the second character, perform corresponding loop traversal and iterative alternation operations on the static key and dynamic key to obtain the alternating character sequence result, which serves as the mixed key result for the target application data.

[0101] It is evident that implementation Figure 4The described apparatus can also determine the minimum length and character order of the static and dynamic keys, and then perform loop traversal and iterative alternation operations on the static and dynamic keys to obtain the hybrid key result. This helps to improve the comprehensiveness and rationality of the hybrid key result determination method, and thus helps to improve the accuracy and reliability of the determined hybrid key result.

[0102] In another optional embodiment, the decryption module 303 performs corresponding signature detection and integrity verification operations on the target application, and the verification result is obtained in the following ways: Perform corresponding digital signature traversal and signature byte array analysis operations on the target application to obtain the actual signature hash value of the target application and determine the expected signature hash value corresponding to the target application; Based on the actual signature hash value and the expected signature hash value, determine whether the target application meets the preset conditions for genuine and complete application. When it is determined that the target application meets the conditions for genuine and complete application, based on the current application lifecycle, it is determined whether the target application meets the preset limit on the number of times it can be decrypted. When it is determined that the target application meets the decryption usage limit, the verification result is used to indicate that the application verification was successful. When it is determined that the target application does not meet the conditions for genuine and complete application, or when it is determined that the target application does not meet the limit on the number of times it can be decrypted, the verification result is used to indicate that the application verification has failed.

[0103] It is evident that implementation Figure 4 The described device can also determine whether the conditions for genuine integrity application are met and whether the limit on the number of times decryption is used is met, and thus determine the verification result. This is conducive to improving the comprehensiveness, rationality and progressiveness of the verification result determination method, and to improving the diversity and flexibility of the considerations used to determine the verification result. This is conducive to improving the accuracy and reliability of the determined verification result, and thus to improving the accuracy and rationality of the execution of the decryption operation triggered based on the verification result.

[0104] In yet another alternative embodiment, such as Figure 4 As shown, the device may further include: The process processing module 304 is used to determine the verification failure reason type of the target application when the verification result indicates that the application verification has failed, and to determine the process processing scheme of the target application based on the verification failure reason type; and to execute the corresponding application process processing operation based on the process processing scheme, which includes process adjustment operation or process forced termination operation.

[0105] It is evident that implementation Figure 4The described device can also provide an application process processing method that performs process adjustment operations or forced process termination operations when the verification result indicates that the application verification has failed. This is beneficial to improving the comprehensiveness and rationality of the intelligent encryption method for application sensitive data, thereby improving the accuracy and reliability of the decryption process for application sensitive data, as well as the timeliness, efficiency, and convenience of the decryption process for application sensitive data. It also helps to prevent the leakage of application sensitive data and keys and improve the security and protection of application sensitive data and keys.

[0106] In yet another alternative embodiment, such as Figure 4 As shown, the device may further include: The plaintext processing module 305 is used to perform corresponding decryption and decoding format conversion operations on the target format ciphertext data after the decryption module 303 runs, and obtains the plaintext string conversion result. Based on the set local variable library, it performs corresponding storage operations on the plaintext string conversion result; according to the determined requirement execution operation information, it retrieves the plaintext string conversion result from the local variable library and performs corresponding usage operations on the plaintext string conversion result; when it is detected that the plaintext string conversion result is in a used state, it performs corresponding automatic cleanup operations on the plaintext string conversion result in the local variable library.

[0107] It is evident that implementation Figure 4 The described device can also provide storage, retrieval, and automatic cleanup functions for a local variable library of plaintext string conversion results. This is beneficial for improving the comprehensiveness and integrity of intelligent encryption methods for application sensitive data, thereby improving the targeting of application sensitive data storage, the timeliness of cleanup, the efficiency of cleanup, and the convenience of cleanup. This, in turn, helps to improve the security of application sensitive data and reduce security risks caused by manual memory management errors.

[0108] In another optional embodiment, the plaintext processing module 305 is further configured to, when detecting that the plaintext string conversion result is in a used state, determine whether the plaintext string conversion result meets the preset short-term necessity requirement condition; when it is determined that the plaintext string conversion result meets the short-term necessity requirement condition, perform a corresponding short-term pause cleanup configuration operation on the plaintext string conversion result in the local variable library; and when it is determined that the plaintext string conversion result does not meet the short-term necessity requirement condition, perform a corresponding automatic cleanup operation on the plaintext string conversion result in the local variable library.

[0109] It is evident that implementation Figure 4The described device can also match the corresponding plaintext string conversion result processing operation according to the short-term necessary requirements of the plaintext string conversion result. When the short-term necessary requirements are met, the plaintext string conversion result in the local variable library is temporarily suspended and cleaned. This is conducive to improving the diversity, flexibility and pertinence of the plaintext string conversion result processing method, and thus conducive to improving the processing accuracy and reliability of the plaintext string conversion result, thereby improving the accuracy and reliability of the cleaning and control of the plaintext string conversion result.

[0110] Example 4 Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention. Figure 5 The described electronic device may include a server, which may include a local server or a cloud server; however, this embodiment of the invention does not impose a limitation. Figure 5 As shown, the electronic device may include: Memory 401 storing executable program code; Processor 402 coupled to memory 401; Furthermore, it may also include an input interface 403 coupled to the processor 402 and an output interface 404; The processor 402 calls the executable program code stored in the memory 401 to execute the steps in the intelligent encryption method for application-sensitive data described in Embodiment 1 or Embodiment 2.

[0111] Example 5 This invention discloses a computer storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the intelligent encryption method for application-sensitive data described in Embodiment 1 or Embodiment 2.

[0112] Example 6 This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps in the intelligent encryption method for application-sensitive data described in Embodiment 1 or Embodiment 2.

[0113] Example 7 This invention discloses an intelligent encryption system for application-sensitive data. The system may include the intelligent encryption device for application-sensitive data described in Embodiment 3, and a network-attached storage device communicatively connected to the device; or... The system may include the electronic device described in Embodiment 4, and a network-attached storage device communicatively connected to the electronic device.

[0114] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0116] Finally, it should be noted that the intelligent encryption method, apparatus, and system for application-sensitive data disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent encryption method for application sensitive data, characterized in that, The method is applied to an electronic device installed with an application program, and the electronic device is communicatively connected with a network-attached storage device, the electronic device can access target application data in the network-attached storage device through the application program, and the method comprises the following steps: Based on the determined compilation encryption environment parameters and the determined running decryption environment parameters, a corresponding separated architecture establishment operation is performed to obtain a target encryption separated architecture, the target encryption separated architecture comprises a compilation encryption environment and a running decryption environment that meet a physical separation condition; When the target application data requiring compilation encryption is detected, in the coding encryption environment, the static key and the dynamic key of the target application data are determined, and a corresponding key mixing operation is performed on the static key and the dynamic key to obtain a mixed key result of the target application data; In the coding encryption environment, a corresponding encryption and coding format conversion operation is performed on the target application data and the mixed key result to obtain target format ciphertext data; When a target application startup load associated with the target application data is detected, in the running decryption environment, a corresponding signature detection and integrity verification operation is performed on the target application to obtain a verification result; When the verification result indicates that the application verification is successful, in the running decryption environment, the target format ciphertext data corresponding to the target application data stored in advance is determined, and a corresponding decryption and decoding format conversion operation is performed on the target format ciphertext data to obtain a plaintext string conversion result. 2.The method for intelligent encryption of application-sensitive data according to claim 1, characterized in that, The corresponding encryption and coding format conversion operation is performed on the target application data and the mixed key result to obtain target format ciphertext data, comprising: According to the determined data block division byte number, a corresponding data block division operation is performed on the target application data to obtain one or more data blocks; Determine the data block number corresponding to all the data blocks, and determine the required encryption round number of the target application data according to the data block number; When the current encryption round of the target application data is less than or equal to the required encryption round number, determine the cumulative variable corresponding to the current encryption round, and determine the round factor corresponding to the current encryption round according to the cumulative variable; determine the to-be-encrypted data block object corresponding to the current encryption round, and perform a corresponding mixed encryption operation on the to-be-encrypted data block object and the mixed encryption result according to the round factor to obtain an encryption byte array corresponding to the current encryption round; After obtaining the encryption byte array corresponding to the current encryption round, if the current encryption round is equal to the required encryption round number, the final encryption byte array corresponding to the target application data is determined according to the encryption byte array corresponding to the current encryption round; a corresponding coding format conversion operation is performed on the final encryption byte array according to the determined storable string format to obtain target format ciphertext data; After the encrypted byte array corresponding to the current encryption round is obtained, if the current encryption round is less than the required number of encryption rounds, the encrypted byte array corresponding to the current encryption round is taken as a to-be-encrypted data block object corresponding to a new current encryption round.

3. The intelligent encryption method for application-sensitive data according to claim 1 or 2, characterized in that, The method further comprises: determining a first character length and a first character order corresponding to the static key, and determining a second character length and a second character order corresponding to the dynamic key; performing a corresponding cyclic traversal and iterative permutation operation on the static key and the dynamic key according to the first character length, the first character order, the second character length, and the second character order, to obtain an alternating character sequence result as the mixed key result of the target application data. 4.The method for intelligent encryption of application-sensitive data according to claim 1, characterized in that, The method further comprises: performing a corresponding signature detection and integrity verification operation on the target application to obtain a verification result, including: performing a corresponding digital signature traversal and signature byte array analysis operation on the target application to obtain an actual signature hash value of the target application, and determining an expected signature hash value corresponding to the target application; determining whether the target application meets a preset genuine integrity application condition according to the actual signature hash value and the expected signature hash value; when it is determined that the target application meets the genuine integrity application condition, determining whether the target application meets a preset decryption usage limit condition based on a current application life cycle; when it is determined that the target application meets the decryption usage limit condition, determining that the verification result indicates that the application verification is successful; 5. The intelligent encryption method for application-sensitive data according to claim 1 or 4, characterized in that, when it is determined that the target application does not meet the genuine integrity application condition or when it is determined that the target application does not meet the decryption usage limit condition, determining that the verification result indicates that the application verification fails. The method further comprises: when the verification result indicates that the application verification fails, determining a verification failure reason type of the target application, and determining a process handling scheme of the target application according to the verification failure reason type; 6.The method for intelligent encryption of application-sensitive data according to claim 1, wherein, performing a corresponding application process handling operation according to the process handling scheme, the application process handling operation including a process adjustment operation or a process forced end operation. After the corresponding decryption and decoding format conversion operation is performed on the target format ciphertext data to obtain a plaintext string conversion result, the method further comprises: performing a corresponding storage operation on the plaintext string conversion result based on a set local variable library; according to the determined required execution operation information, obtaining the plaintext string conversion result from the local variable library and performing a corresponding use operation on the plaintext string conversion result; 7. The method for intelligent encryption of application sensitive data according to claim 6, wherein, when it is detected that the plaintext string conversion result is in a used state, performing a corresponding automatic cleaning operation on the plaintext string conversion result in the local variable library. The method further comprises: When it is detected that the plaintext string conversion result is in a used state, it is judged whether the plaintext string conversion result meets a preset short-term necessary requirement condition; When it is judged that the plaintext string conversion result meets the short-term necessary requirement condition, a corresponding short-term suspension cleaning configuration operation is performed on the plaintext string conversion result in the local variable library; When it is judged that the plaintext string conversion result does not meet the short-term necessary requirement condition, the step of performing a corresponding automatic cleaning operation on the plaintext string conversion result in the local variable library is executed.

8. An intelligent encryption device for application-sensitive data, characterized in that, The device includes an electronic device, the electronic device has an application program installed therein, and the electronic device is communicatively connected with a network-attached storage device, the electronic device can access target application data in the network-attached storage device through the application program, and the device includes: An environment establishing module is configured to perform a corresponding separated architecture establishing operation based on the determined compiling encryption environment parameter and the determined running decryption environment parameter, and obtain a target encryption separated architecture, wherein the target encryption separated architecture includes a compiling encryption environment and a running decryption environment that meet a physical separation condition; A compiling encryption module is configured to, when detecting that target application data needs to be compiled and encrypted, determine a static key and a dynamic key of the target application data in the coding encryption environment, perform a corresponding key mixing operation on the static key and the dynamic key, and obtain a mixed key result of the target application data; and perform a corresponding encryption and coding format conversion operation on the target application data and the mixed key result in the coding encryption environment, and obtain target format ciphertext data. A running decryption module is configured to, when detecting that a target application associated with the target application data is started and loaded, perform a corresponding signature detection and integrity verification operation on the target application in the running decryption environment, and obtain a verification result; when the verification result indicates that the application verification is successful, determine target format ciphertext data corresponding to the target application data stored in advance in the running decryption environment, and perform a corresponding decryption and decoding format conversion operation on the target format ciphertext data, and obtain a plaintext string conversion result.

9. An electronic device, comprising: The electronic device includes: a memory storing executable program codes; a processor coupled with the memory; the processor invokes the executable program codes stored in the memory to execute the intelligent encryption method for application sensitive data according to any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores computer instructions, which are invoked to execute the intelligent encryption method for application sensitive data according to any one of claims 1-7.

11. An intelligent encryption system for application sensitive data, characterized by, The system includes the intelligent encryption device for application sensitive data according to claim 8, and a network-attached storage device communicatively connected with the device; or The system includes the electronic device according to claim 9, and a network-attached storage device communicatively connected with the electronic device.

Images