Information encryption method, decryption method, device and electronic equipment

Abstract

This application discloses an information encryption method, decryption method, device, and electronic device, relating to the field of data encryption technology. The method comprises: obtaining first parameter information and second parameter information to be encrypted, wherein the first parameter information and the second parameter information are parameter information for the same task to be processed; generating a dynamic key based on the first parameter information; and encrypting the second parameter information based on the dynamic key to obtain ciphertext information. In this manner, if either the first parameter information or the second parameter information is replaced, the ciphertext information cannot be decrypted, thereby improving information security.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and more specifically, to an information encryption method, decryption method, device and electronic device. Background Art

[0002] With the rapid development of Internet technology, information security has become increasingly important. In practical applications, some task parameters of pending tasks are sensitive information that needs to be encrypted. However, existing encryption methods are relatively insecure. Summary of the Invention

[0003] This application proposes an information encryption method, a decryption method, a device and an electronic device to improve the above-mentioned problems.

[0004] On the one hand, an embodiment of the present application provides an information encryption method, including: obtaining first parameter information and second parameter information to be encrypted, the first parameter information and the second parameter information being parameter information of the same task to be processed; generating a dynamic key based on the first parameter information; and encrypting the second parameter information based on the dynamic key to obtain ciphertext information.

[0005] On the one hand, an embodiment of the present application provides an information decryption method, including: receiving first parameter information and ciphertext information, the ciphertext information is encrypted second parameter information, the first parameter information and the second parameter information are parameter information of the same task to be processed; generating a dynamic key based on the first parameter information; decrypting the ciphertext information based on the dynamic key to obtain plaintext information.

[0006] Optionally, the information decryption method provided in the embodiment of the present application also includes: obtaining first verification information; after obtaining the plaintext information, generating second verification information based on the plaintext information; comparing whether the first verification information and the second verification information are consistent; if so, executing the task to be processed based on the plaintext information and the first parameter information.

[0007] In one aspect, embodiments of the present application provide an information encryption device comprising an information acquisition module, a key determination module, and an encryption module. The information acquisition module is configured to obtain first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are parameter information for the same task to be processed. The key determination module is configured to generate a dynamic key based on the first parameter information. The encryption module is configured to encrypt the second parameter information using the dynamic key to obtain ciphertext information.

[0008] Optionally, in the information encryption device provided in an embodiment of the present application, the first parameter information includes at least two task parameters. The information acquisition module generates a dynamic key based on the first parameter information by extracting at least part of the information from each task parameter in the first parameter information to obtain key information of a target length; and determining the key information of the target length as the dynamic key.

[0009] Optionally, in the information encryption device provided in an embodiment of the present application, the key determination module can also be used to: determine the target length based on the length of the second parameter information before the information acquisition module extracts at least part of the information from each task parameter of the first parameter information respectively.

[0010] Optionally, in the information encryption device provided in the embodiment of the present application, the encryption module can be specifically used to: perform superposition processing on the second parameter information and the dynamic key.

[0011] Optionally, in the information encryption device provided in the embodiment of the present application, the ciphertext information is the first ciphertext information. The encryption module may further be configured to: after encrypting the second parameter information based on the dynamic key, obtain a static key, and encrypt the first ciphertext information based on the static key to obtain the second ciphertext information.

[0012] Optionally, in the information encryption device provided in an embodiment of the present application, the encryption module obtains the static key by: obtaining the latest version of the static key. The encryption module encrypts the first ciphertext information based on the static key to obtain the second ciphertext information by: encrypting the first ciphertext information based on the latest version of the static key; obtaining key version information of the latest version of the static key; and concatenating the encrypted first ciphertext information and the key version information to obtain the second ciphertext information.

[0013] Optionally, in the information encryption device provided in the embodiment of the present application, the encryption module is further used to: convert the first ciphertext information into integer data before encrypting the first ciphertext information based on the static key.

[0014] Optionally, the information encryption device provided in the embodiment of the present application may further include a verification information generation module and a sending module. The verification information generation module is used to generate first verification information based on the second parameter information before the encryption module encrypts the second parameter information based on the dynamic key. The sending module is used to send the ciphertext information, the first parameter information and the first verification information to the task execution device after obtaining the ciphertext information. The task execution device is used to decrypt the ciphertext information to obtain the plaintext information, generate the second verification information based on the plaintext information, and execute the task to be processed based on the plaintext information and the first parameter information when the first verification information and the second verification information are consistent.

[0015] Optionally, in the information encryption device provided in the embodiment of the present application, the verification information generation module is specifically used to obtain at least one of the length of the second parameter information and the target position information of the second parameter information as the first verification information.

[0016] Optionally, in the information encryption device provided in the embodiment of the present application, the task to be processed is a transaction task, the second parameter information includes transaction account information, and the first parameter information includes transaction scenario information.

[0017] Optionally, in the information encryption device provided in an embodiment of the present application, the transaction scenario information includes the transaction amount, transaction order number, and transaction account type. The key determination module is specifically configured to: extract at least a portion of the transaction amount, transaction order number, and transaction account type, respectively, to obtain key information of a target length; and determine the key information of the target length as the dynamic key.

[0018] In one aspect, embodiments of the present application provide an information decryption device, comprising an information receiving module, a key determination module, and a decryption module. The information receiving module is configured to receive first parameter information and ciphertext information, wherein the ciphertext information is encrypted second parameter information, and the first and second parameter information are parameter information for the same task to be processed. The key determination module is configured to generate a dynamic key based on the first parameter information. The decryption module is configured to decrypt the ciphertext information based on the dynamic key to obtain plaintext information.

[0019] Optionally, the information decryption device provided in an embodiment of the present application further includes a verification information generation module and a validation module. The information acquisition module is further configured to obtain first verification information. The verification information generation module is configured to generate second verification information based on the plaintext information after the decryption module obtains the plaintext information. The validation module is configured to compare the first verification information with the second verification information to determine whether they are consistent. If so, the processing task is performed based on the plaintext information and the first parameter information.

[0020] In one aspect, an embodiment of the present application provides an electronic device comprising: one or more processors; a memory; and one or more programs. The one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to perform the above-described method.

[0021] On the one hand, an embodiment of the present application provides a computer-readable storage medium having program code stored thereon, which can be called by a processor to execute the above method.

[0022] The solution provided in this application generates a dynamic key based on the first parameter information of the task to be processed, and encrypts the second parameter information of the task to be processed based on this dynamic key to obtain ciphertext information. This establishes an association between the first parameter information and the dynamic key used to encrypt the second parameter information. If either the first parameter information or the second parameter information is replaced, the second parameter information will be unable to be successfully decrypted, making data tampering more difficult and thus improving data security.

[0023] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A schematic diagram of an application environment suitable for an embodiment of the present application is shown.

[0026] Figure 2 A flow chart of an information encryption method provided in an embodiment of the present application is shown.

[0027] Figure 3 Shown with Figure 2 Schematic diagram of the flow of the information decryption method corresponding to the information encryption method shown.

[0028] Figure 4 Shown Figure 2 A schematic flow chart of the information encryption method according to the embodiment is shown.

[0029] Figure 5 Shown Figure 3 A schematic flow chart of the information decryption method according to the illustrated embodiment.

[0030] Figure 6 Shown Figure 2 A schematic diagram of sub-steps of step S102 is shown.

[0031] Figure 7 A flow chart of an information encryption method provided in an embodiment of the present application is shown.

[0032] Figure 8 Shown with Figure 7 Schematic diagram of the flow of the information decryption method corresponding to the information encryption method shown.

[0033] Figure 9A flow chart of an information encryption method provided in an embodiment of the present application is shown.

[0034] Figure 10 Shown with Figure 9 Schematic diagram of the flow of the information decryption method corresponding to the information encryption method shown.

[0035] Figure 11 A schematic diagram of an application environment suitable for an embodiment of the present application is shown.

[0036] Figure 12 Shows the application Figure 11 The information encryption process in a specific example of the illustrated environment.

[0037] Figure 13 Shown with Figure 12 Corresponding information decryption process.

[0038] Figure 14 It is a block diagram of an electronic device for executing the information encryption method or information decryption method according to an embodiment of the present application.

[0039] Figure 15 A block diagram of an information encryption device provided in an embodiment of the present application is shown.

[0040] Figure 16 A block diagram of an information decryption device provided in an embodiment of the present application is shown.

[0041] Figure 17 It is a storage unit for storing or carrying program codes for implementing the information encryption method or information decryption method according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0043] With the rapid development of computer technology, electronic devices can be used to process a variety of tasks, which often have task parameters. In some scenarios, some of the task parameters are sensitive information. Before storing or transmitting this sensitive information, it is usually necessary to encrypt it.

[0044] For example, when a user needs to conduct a transaction with a specific bank account through a trading platform, he or she can enter the parameter information required for the transaction through the client corresponding to the trading platform, such as the account information of the specific bank account, the transaction amount, the type of information of the bank to which the specific bank account belongs, etc. The client sends the parameter information required for the transaction to the trading platform, and the trading platform can generate transaction task information (such as a transaction order, etc.) including the parameter information required for the transaction. Among them, once the account information in the transaction task information is replaced, it will cause financial losses to the user. Therefore, account information is sensitive information and needs to be encrypted. The trading platform usually encrypts the account information in the transaction task information before sending the transaction task information to the bank server to which the above-mentioned specific bank account belongs.

[0045] In some implementations, sensitive parameter information of pending tasks (e.g., account information in the aforementioned transaction task information) can be encrypted using algorithms such as the DES (Data Encryption Standard) algorithm, the 3DES (Triple DES) algorithm, and the AES (Advanced Encryption Standard) algorithm. The DES algorithm splits the encrypted information into 64-bit blocks and divides a 56-bit key into different cipher blocks for encrypting these blocks. 3DES is a mode of the DES algorithm that uses three 56-bit keys to encrypt data three times. These encryption algorithms primarily use a given key to directly encrypt sensitive information in one or more layers. By using this encryption method that focuses only on the sensitive information that needs to be encrypted, pending tasks can still be executed even if the sensitive information has been replaced, resulting in losses for the user. For example, in the above example, if the account information for a specific bank account is replaced, continuing the transaction will result in financial losses for the user.

[0046] After extensive research, the inventors have developed an information encryption method, decryption method, device, and electronic device that can make information tampering more difficult, thereby improving information security. These methods are described in detail below.

[0047] Please refer to Figure 1 , Figure 1 The following is a schematic diagram of an application environment suitable for use with an embodiment of the present application. The encryption execution device 100 is connected to a task execution device 200 via a network. The encryption execution device 100 can send task parameters for a pending task to the task execution device 200, and the task execution device 200 can execute the pending task based on the task parameters sent by the encryption execution device 100.

[0048] In this embodiment of the present application, the task parameters of the task to be processed are divided into two parts: sensitive information that needs to be encrypted and non-sensitive information that can be unencrypted. The encryption execution device 100 uses a dynamic key generated based on the non-sensitive information to encrypt the sensitive information to obtain ciphertext information, and then sends the ciphertext information and non-sensitive information to the task execution device 200.

[0049] Correspondingly, the task execution device 200 can generate a dynamic key based on the non-sensitive information to decrypt the ciphertext information and obtain the plaintext information. This way, only if the information tamperer successfully replaces all the task parameters of the pending task can the decrypted plaintext information be guaranteed to be consistent with the original sensitive information. Furthermore, only then can the task execution device 200 execute the pending task based on the tampered task parameters, making information tampering more difficult and thus achieving the purpose of improving information security.

[0050] In the embodiments of this application, encryption execution device 100 can be understood as an electronic device for executing an information encryption method, and task execution device 200 can be understood as an electronic device for processing pending tasks, that is, an electronic device for executing an information decryption method. It is understood that both encryption execution device 100 and task execution device 200 can be any electronic device with data processing capabilities, and this embodiment does not limit this.

[0051] Please refer to Figure 2 , Figure 2 This is a flow chart of an information encryption method provided in one embodiment of the present application. The method can be performed by Figure 1 The encryption execution device 100 shown in the figure executes the encryption method. The steps of the encryption method are described below.

[0052] S101, obtaining first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0053] In this embodiment, a pending task is a task that needs to be processed. A task can be a collection of processing operations required to achieve a specific purpose. For example, the collection of processing operations required to perform an identity verification on a specific application platform can be considered an information verification task. Another example is the collection of processing operations required to perform a transaction on a payment platform, which can be considered a transaction task. Another example is the collection of processing operations required to send a message on a social networking platform, which can be considered a message sending task. Another example is the collection of processing operations required to store data, which can be considered an information storage task.

[0054] It is understood that the processing operations involved in a task can be performed entirely by a single device or by different devices. For example, in some scenarios, the processing operations involved in a storage task can be performed solely by a storage server; in other scenarios, the processing operations involved in a storage task can be performed separately by the device that generates the data to be stored and the storage server. For another example, a transaction task used to implement a transaction between a payment platform and a bank account may involve processing operations by both the payment platform and the bank server to which the bank account belongs.

[0055] In this embodiment, a pending task may have at least two task parameters. For example, a pending transaction task may include the transaction amount, account information of the bank account involved in the transaction, account type of the bank account involved in the transaction, transaction task identification information (e.g., transaction order number), etc. For another example, a pending storage task may include the data to be stored, the storage address, etc.

[0056] The first parameter information may include at least one task parameter for the pending task, and the second parameter information may include at least one task parameter for the pending task. In other words, the first parameter information and the second parameter information contain the task parameters for the same pending task. It is worth noting that the term "same pending task" here refers to the same pending task, such as the aforementioned transaction task or identity verification task.

[0057] The task parameters in the second parameter information are parameters that require encryption. For example, in the aforementioned transaction task, the account information of the bank account involved in the transaction typically requires encryption and can be used as the second parameter information, while the remaining task parameters can be used as the first parameter information. For another example, in the aforementioned storage task, the data to be stored typically requires encryption and can be used as the second parameter information, while the storage address can be used as the first parameter information.

[0058] In this embodiment, there are multiple ways to obtain the first parameter information and the second parameter information of the task to be processed. In one optional way, the encryption execution device 100 can receive a task execution request, obtain each task parameter of the task to be processed from the task execution request, and determine the first parameter information and the second parameter information to be encrypted from each task parameter.

[0059] In another optional manner, the encryption execution device 100 can receive a task execution request, obtain a part of the task parameters of the task to be processed from the task execution request, generate another part of the task parameters of the task to be processed, and then determine the first parameter information and the second parameter information that needs to be encrypted from all the task parameters of the task to be processed.

[0060] In another alternative embodiment, the encryption execution device 100 can generate a pending task with at least two task parameters in response to an internal processing instruction. For example, when the encryption execution device 100 needs to store data on a remote storage server, it can generate a storage task and generate task parameters for the storage task. The encryption execution device can then determine the first parameter information and the second parameter information to be encrypted from the generated task parameters.

[0061] S102: Generate a dynamic key according to the first parameter information.

[0062] In this embodiment, the encryption execution device 100 can obtain a dynamic key generation rule and process the first parameter information according to the generation rule. The result of the processing can be used as the required dynamic key. In this way, the content of the dynamic key will be associated with the first parameter information and will vary with the first parameter information.

[0063] It is understood that the dynamic key generation rule can be flexibly configured, for example, to be any key generation algorithm or any data extraction rule, and this embodiment does not limit this. The dynamic key generation rule can be configured in the encryption execution device or stored in a specific storage device. When the encryption execution device 100 needs to execute the information encryption method of this embodiment, the generation rule is retrieved from the specific storage device.

[0064] S103: Encrypt the second parameter information based on the dynamic key to obtain ciphertext information.

[0065] In this embodiment, the encryption execution device 100 can encrypt the second parameter information based on the dynamic key in various ways. For example, the dynamic key and the second parameter information can be processed according to configured rules, and the result of the processing can be the ciphertext information. Another example is that the second parameter information can be encrypted using the dynamic key according to a configured encryption algorithm, and the result of the processing can be the ciphertext information. It should be understood that the aforementioned encryption methods are merely examples, and the encryption execution device 100 can also encrypt the second parameter information based on the dynamic key in other ways, which are not limited in this embodiment.

[0066] pass Figure 2 The process shown establishes an association between the ciphertext information and the first parameter information and the second parameter information of the task to be processed. For a party that maliciously tampers with the task parameters, it is necessary to successfully tamper with the first parameter information and the second parameter information at the same time to complete the task to be processed based on the tampered task parameters. This increases the difficulty of passing the verification after the information is tampered. In other words, it improves the verification security, thereby effectively improving the information security.

[0067] In this embodiment, after obtaining the ciphertext information, the encryption execution device 100 may process the ciphertext information in different ways depending on the specific application scenario.

[0068] In one scenario, the encryption execution device 100 and the task execution device 200 are the same device. In this case, the encryption execution device 100 can store the obtained ciphertext information together with the first parameter information so that when the pending task needs to be executed later, it can perform the corresponding decryption processing as the task execution device 200.

[0069] In another scenario, the encryption execution device 100 and the task execution device 200 are not the same device. In this case, the encryption execution device 100 can send the ciphertext information and the first parameter information to the task execution device 200, so that the task execution device 200 can perform the corresponding decryption processing when it needs to execute the pending task.

[0070] It can be understood that the decryption process is similar in the above two scenarios.

[0071] Please refer to Figure 3 , Figure 3 This embodiment provides an information decryption method, which can be applied to Figure 1 The task execution device 200 is shown. The steps included in the decryption method are described below.

[0072] S201, obtaining first parameter information and ciphertext information, where the ciphertext information is encrypted second parameter information, and the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0073] In this embodiment, as the application scenario changes, the manner in which the task execution device 200 obtains the first parameter information and the ciphertext information also changes.

[0074] In the scenario where the encryption execution device 100 and the task execution device 200 are the same device, the task execution device 200 can obtain the task parameters of the task to be processed from the device or the database corresponding to the device. The obtained task parameters include first parameter information and encrypted second parameter information (i.e., ciphertext information).

[0075] In a scenario where the encryption execution device 100 and the task execution device 200 are not the same device, the task execution device 200 can receive task parameters of the pending task sent by the encryption execution device 100, where the received task parameters include first parameter information and ciphertext information.

[0076] It is worth noting that for the detailed definitions and relationships between the ciphertext information, the first parameter information and the second parameter information, please refer to the above Figure 2The description of the steps shown will not be repeated here.

[0077] S202: Generate a dynamic key according to the first parameter information.

[0078] After obtaining the first parameter information, the task execution device 200 may obtain a generation rule for the dynamic key and process the first parameter information based on the generation rule. The obtained processing result is the dynamic key.

[0079] It will be appreciated that in this embodiment, the task execution device 200 and the encryption execution device 100 use the same generation rules for dynamic key configuration. Therefore, if the first parameter information, which serves as the basis for dynamic key generation, has not been tampered with, the dynamic keys generated by the task execution device 200 and the encryption execution device 100 should be identical.

[0080] S203: Decrypt the ciphertext information based on the dynamic key to obtain plaintext information.

[0081] During implementation, the task execution device 200 performs a decryption operation on the ciphertext information based on the dynamic key it generates, and the resulting operation result can be used as the plaintext information. If the dynamic key generated by the task execution device 200 is consistent with the dynamic key generated by the encryption execution device 100, and the second parameter information has not been tampered with, the resulting plaintext information will be consistent with the second parameter information, i.e., decryption will be successful.

[0082] If the first parameter information is tampered with, the dynamic key generated in S201 will be different from the dynamic key used by the encryption execution device, resulting in inconsistency between the plaintext information obtained in S203 and the second parameter information. Similarly, if any of the second parameter information is tampered with, the plaintext information obtained in S203 will also be inconsistent with the second parameter information.

[0083] Specifically, the decryption process of the ciphertext information by the task execution device 200 is the inverse of the encryption process of the second parameter information by the encryption execution device 100. For example, when the encryption execution device 100 offsets the second parameter information according to the dynamic key to obtain the ciphertext information, the task execution device 200 can offset the ciphertext information according to a vector whose magnitude is the same as the dynamic key and whose direction is opposite to the dynamic key to obtain the plaintext information.

[0084] Therefore, through Figure 3 In the process shown, if any one of the first parameter information and the second parameter information is replaced, decryption will not be successful.

[0085] In actual applications, after receiving the plaintext information, the task execution device 200 can verify the plaintext information to determine whether the decryption is successful. If the task execution device 200 determines that the decryption is successful, the plaintext information can be determined as the second parameter information, so that the task to be processed can be executed based on the plaintext information and the first parameter information.

[0086] Optionally, the task execution device 200 can perform verification by comparing whether the first verification information generated based on the second parameter information is consistent with the second verification information generated based on the plaintext information; if they are consistent, it means that the plaintext information has passed the verification, and it can be determined that the decryption is successful; if they are inconsistent, it means that the plaintext information has not passed the verification, and it can be determined that the decryption has failed.

[0087] The first verification information can be generated by encryption execution device 100 based on the second parameter information before encrypting the second parameter information. The second verification information can be generated by task execution device 200 based on the plaintext information after obtaining the plaintext information. Specifically, if encryption execution device 100 and task execution device 200 are the same device, both the first verification information and the second verification information are generated by that device.

[0088] In the scenario where the encryption execution device 100 and the task execution device 200 are not the same device, the information encryption method provided in this embodiment may further include: Figure 4 Steps S104 and S105 are shown.

[0089] S104: Generate first verification information according to the second parameter information.

[0090] In this embodiment, S104 is executed after S101 and before S103, and there is no restriction on the execution order with S102. For example, S104 can be executed in a certain order with S102, or can be executed in parallel with S102.

[0091] S105: After obtaining the ciphertext information, the ciphertext information, the first parameter information and the first verification information are sent to the task execution device.

[0092] Optionally, in this embodiment, the encryption execution device 100 can generate the first verification information based on the second parameter information in a variety of ways. For example, the second parameter information can be transformed according to the configured verification information generation rule, such as data bit shifting, superposition with given information, etc. For another example, the relevant information of the second parameter information can be directly obtained as the first verification information. The relevant information can be, for example, at least one of the length of the second parameter information, the target position information of the second parameter information, etc. The target position can be a fixed position in the second parameter information, such as the N (N is an integer greater than 0) data bits at the end, or the N data bits at the starting position. Correspondingly, the information of the target position of the second parameter information can be, for example, the N bits of data at the end of the second parameter information, the N bits of data at the starting position, etc.

[0093] In this embodiment, the task execution device 200 is used to decrypt the ciphertext information to obtain the plaintext information, generate the second verification information based on the plaintext information, and compare whether the first verification information and the second verification information are consistent. If the first verification information and the second verification information are consistent, the task to be processed is executed according to the plaintext information and the first parameter information. In detail, when it is necessary to verify the plaintext information, the information decryption method provided by this embodiment may also include Figure 5 S204-S208 shown.

[0094] S204: Obtain first verification information.

[0095] In this embodiment, when the encryption execution device 100 and the task execution device 200 are the same device, the task execution device 200 may obtain the first verification information from the task parameters of the to-be-processed task stored in the device.

[0096] In the case where the encryption execution device 100 and the task execution device 200 are not the same device, the task execution device 200 can receive the first verification information sent by the encryption execution device 100. It is understood that in this case, the first parameter information, the ciphertext information, and the first verification information can be sent to the task execution device 200 together. Accordingly, the task execution device 200 can obtain the first parameter information, the ciphertext information, and the first verification information through a single acquisition operation.

[0097] S205: After obtaining the plaintext information, generate second verification information according to the plaintext information.

[0098] The process of obtaining the plaintext information can be found in the detailed description of S201-S203 above. In this embodiment, the task execution device 200 generates the second verification information in the same manner as the encryption execution device 100 generates the first verification information. For details, please refer to the detailed implementation process of S104 above. Therefore, if no information tampering has occurred, the first and second verification information should contain the same content.

[0099] S206: Compare the first verification information and the second verification information to see if they are consistent. If so, execute S207; if not, execute S208.

[0100] Here, the first verification information and the second verification information are consistent, which means that the information contained in the first verification information and the second verification information is consistent. For example, when the first verification information and the second verification information both contain one type of information, if the information contained in both types of information is the same, then the two can be determined to be consistent. When the first verification information and the second verification information both contain multiple types of information, if the information contained in each type of information is the same, then the two can be determined to be consistent. If any information contained in the multiple types of information is different, then the two can be determined to be inconsistent.

[0101] S207: Execute the task to be processed according to the plaintext information and the first parameter information.

[0102] S208: Do not execute the pending task.

[0103] When it is determined that the first verification information and the second verification information are consistent, it can be determined that the decryption is successful, and thus it can be determined that the plaintext information and the second parameter information are the same. The task execution device can then execute the task to be processed according to the task parameters of the task to be processed (the first parameter information and the plaintext information that is the same as the second parameter information).

[0104] When it is determined that the first verification information and the second verification information are inconsistent, it can be determined that the decryption has failed, and thus it can be determined that the obtained plaintext information and the second parameter information are different, that is, the accurate task parameters of the task to be processed cannot be obtained, and the task to be processed will not be processed.

[0105] pass Figure 4 and Figure 5 The process shown can reduce the probability of pending tasks being executed when task parameters are tampered with, thereby further increasing the difficulty of information tampering and further improving information security.

[0106] Please also refer to Figure 2 and Figure 6 , the following will Figure 2 The steps of the information encryption method shown are further elaborated.

[0107] In the embodiment of the present application, the first parameter information may include at least two task parameters. Correspondingly, in order to associate each task parameter in the first parameter information with the encryption process, S102 may be performed by Figure 6 The process shown is implemented and described in detail as follows.

[0108] S102-1, extract at least part of the information from each task parameter of the first parameter information to obtain key information of a target length.

[0109] In this embodiment, the target information and the amount of information extracted by the task execution device 200 from each task parameter of the first parameter information can be the same or different, and are not limited thereto. Specifically, the specific information extracted from each task parameter of the first parameter information can be regarded as the target information.

[0110] In detail, the target information and the amount of target information are related to the generation rule of the dynamic key, and the size of the extracted target information and the amount of target information can be adjusted by changing the generation rule of the dynamic key.

[0111] In one example, the task execution device 200 can extract a fixed amount of target information from a fixed position of each task parameter of the first parameter information, and then compose all the extracted target information into key information. In another example, the task execution device 200 can randomly extract a fixed amount of target information from each task parameter of the first parameter information, and compose the key information. It can be understood that the way in which the task execution device 200 extracts target information from the first parameter information is not limited to the aforementioned example. For example, the task execution device 200 can also extract target information from a fixed position or a random position in each task parameter of the first parameter information in an increasing order of the amount of extracted information, and then compose the extracted information into key information. In the above example, the length of the composed key information can be understood as the target length.

[0112] S102-2: Determine the key information of the target length as the dynamic key.

[0113] After the extracted target information is combined into key information, the obtained key information can be used as the dynamic key.

[0114] pass Figure 6 The process shown can establish an association between each task parameter in the first parameter information and the dynamic key. In other words, it establishes an association between the encryption process of the second parameter information and each task parameter in the first parameter information.

[0115] In this embodiment, depending on the dynamic key generation rule adopted, the length of the key information obtained may be fixed or random. In other words, the target length may be a value that changes with the change of the first parameter information, or it may be a fixed value.

[0116] When the target length is a fixed value, the encryption execution device 100 can determine the target length before generating a dynamic key, and when a dynamic key needs to be generated, determine the target information to be extracted from each task parameter included in the first parameter information based on the determined target length and the dynamic key generation rule. There are multiple ways to determine the target length. In one optional method, the encryption execution device 100 can be configured with length information. When a dynamic key needs to be generated, the encryption execution device 100 can obtain the configured length information and determine the length indicated by the length information as the target length.

[0117] In another optional approach, the encryption execution device 100 can determine the target length based on the length of the second parameter information. For example, the length of the second parameter information can be processed according to a configured processing rule, and the resulting processing result can be used as the target length. For example, 1 / 2 of the length of the second parameter information can be used as the target length. In this way, the attribute information of the second parameter information can be further associated with the dynamic key, thereby further increasing the difficulty of information tampering and improving information security.

[0118] exist Figure 2 In S103, the second parameter information can be encrypted in a variety of ways. For example, the encryption execution device 100 can perform an encryption operation on the second parameter information using the dynamic key as an encryption key according to a configured encryption algorithm. The encryption algorithm can be, for example, any of the aforementioned DES, 3DES, and AES algorithms. Of course, the encryption algorithm used here can also be other algorithms, and this embodiment is not limited thereto. For example, DEA (Data Encryption Algorithm) can also be used.

[0119] For another example, the encryption execution device may perform computational processing on the second parameter information and the dynamic key according to a preset computational processing rule. In one optional approach, the encryption execution device may concatenate the second parameter information and the dynamic key. For example, the encryption execution device may separate the second parameter information into at least two first parts and the dynamic key into at least two second parts, and then concatenate the first parts and the second parts in a predetermined order to obtain the ciphertext information.

[0120] In another optional approach, the encryption execution device can perform a superposition process on the second parameter information and the dynamic key. If both the second parameter information and the dynamic key are considered vectors, the superposition process can be understood as performing an offset process on the second parameter information vector based on the dynamic key vector. The result of the superposition process (or offset process) can be used as the ciphertext information obtained in S103.

[0121] The length of the second parameter information can be avoided from being changed by superimposing the processing. In other words, in this case, the ciphertext information obtained in S103 has the same information length as the second parameter information. In this way, a fixed field can be used to store the ciphertext information, which is convenient for maintenance and management. For example, after the encryption execution device 100 needs to store the ciphertext information, the use of a fixed field for storage facilitates the encryption execution device 100 to search for the ciphertext information when it needs to execute the pending task. For another example, after the encryption execution device 100 sends the ciphertext information to the task execution device 200, the use of a fixed field for storage facilitates the task execution device 200 to extract the ciphertext information from the received message or message.

[0122] It can be understood that in this embodiment, the encryption execution device 100 is executed according to Figure 3 When the dynamic key is generated by the process shown in the figure, the task execution device 200 will also follow Figure 3 The process shown generates a dynamic key based on the obtained first parameter information, and uses the dynamic key to decrypt the ciphertext information.

[0123] Optionally, in order to further improve information security, when the second parameter information is encrypted based on the above-mentioned dynamic key, the encryption execution device may further encrypt the ciphertext information obtained in S103.

[0124] Please refer to Figure 7 , Figure 7 The following is a flow chart of an information encryption method according to an embodiment of the present application. The steps included in the encryption method are described below.

[0125] S301, obtaining first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0126] S302: Generate a dynamic key according to the first parameter information.

[0127] In this embodiment, the detailed implementation process of S301-S302 is similar to the above-mentioned S101-S102 and will not be repeated here.

[0128] S303: Generate first verification information according to the second parameter information.

[0129] The detailed implementation process of S303 is similar to that of S104 and will not be described in detail here. It is worth noting that, in this embodiment, there is no restriction on the execution order of S302 and S303. The two can be executed in a certain order or in parallel.

[0130] S304: Encrypt the second parameter information based on the dynamic key to obtain first ciphertext information.

[0131] In this embodiment, after obtaining the first verification information and the dynamic key, S304 can be executed. The detailed implementation process of S304 can refer to the relevant description of S103 and will not be repeated here. Correspondingly, the first ciphertext information obtained by S304 can be understood as the ciphertext information obtained in S103.

[0132] After obtaining the first ciphertext information, the encryption execution device may perform further encryption operations on the first ciphertext information through the following S305 - S306 to improve information security.

[0133] S305: Obtain a static key.

[0134] In this embodiment, the encryption execution device 100 may be in communication with a key management system, and may access the key management system to obtain a static key from the key management system when further encryption of the first ciphertext information is required.

[0135] Optionally, the key management system may store different static keys for different task execution devices. For example, the association between the device identification of the task execution device and the key may be stored. It can be understood that the association between any two or more information described herein may refer to a data record containing the two or more information. The device identification of the task execution device may be any information that can represent the identity of the task execution device, such as the MAC (Media Access Control) address of the task execution device, which may also be called an Ethernet address or a physical address; for example, it may be the IP (Internet Protocol) address of the task execution device. This embodiment has no limitation on this.

[0136] During implementation, the encryption execution device 100 may search and obtain the key corresponding to the device identification of the task execution device 200 of the task to be processed from the key management system according to the device identification of the task execution device 200 as the static key.

[0137] S306: Encrypt the first ciphertext information based on the static key to obtain second ciphertext information.

[0138] After obtaining the static key, the encryption execution device 100 may adopt the configured encryption algorithm and use the static key as the encryption key to perform an encryption operation on the first ciphertext information. The obtained encryption operation result is the second ciphertext information.

[0139] In S306, the encryption algorithm used by the encryption execution device may be a symmetric encryption algorithm, such as any one of the aforementioned DES algorithm, 3DES algorithm, AES algorithm, and DEA algorithm; or an asymmetric encryption algorithm, such as the RSA (Ron Rivest-Adi Shamir-Leonard Adleman) algorithm, DSA (Digital Signature Algorithm), and ECDSA (Elliptic Curve Digital Signature Algorithm). It is understood that a symmetric encryption algorithm refers to an encryption algorithm in which the encryption and decryption processes use the same key, while an asymmetric encryption algorithm refers to an encryption algorithm in which the encryption and decryption processes use different keys.

[0140] In an asymmetric encryption algorithm, there is a key pair consisting of a public key and a private key. Information encrypted with the public key can only be decrypted with the private key. Correspondingly, information encrypted with the private key can only be decrypted with the public key.

[0141] In this embodiment, when an asymmetric encryption algorithm is used, the key management system can store a public key and a private key corresponding to the public key for each device identifier of the task execution device. In one example, the encryption execution device can obtain the corresponding public key from the key management system based on the device identifier of the task execution device to be processed as the static key. Correspondingly, the task execution device will use the private key to decrypt the second ciphertext information. In another example, the encryption execution device can also use the private key to encrypt the first ciphertext information, and correspondingly, the task execution device will use the public key to decrypt the second ciphertext information.

[0142] It is worth noting that, when an encryption algorithm is used to encrypt the second parameter information in S304, the encryption algorithm used in S306 may be the same as or different from the encryption algorithm used in S304.

[0143] Optionally, to reduce the probability of the encryption algorithm being cracked, S304 and S306 can be implemented using different encryption algorithms. For example, S304 encrypts the second parameter information based on the configured operation processing rules, while S306 encrypts the first ciphertext information based on the 3DES algorithm. After S306 performs the encryption operation on the first ciphertext information, the encryption operation result obtained is the second ciphertext information.

[0144] After obtaining the second ciphertext, encryption execution device 100 processes the second ciphertext in a manner similar to the processing of the ciphertext obtained in S103 in the above-described embodiment. This embodiment describes this processing using the example of encryption execution device 100 and task execution device 200 being separate devices. In this case, encryption execution device 100 may also execute S307.

[0145] S307, sending the second ciphertext information, the first parameter information and the first verification information to the task execution device 200, the task execution device 200 is used to decrypt the first ciphertext information, obtain the plaintext information, generate the second verification information based on the plaintext information, and when the first verification information and the second verification information are consistent, execute the task to be processed according to the plaintext information and the first parameter information.

[0146] The detailed implementation process of S307 can refer to the above embodiment. Figure 4 and Figure 5 Specifically, during the implementation, the encryption execution device 100 may combine the second ciphertext information and the first verification information into a whole, and then send the whole together with the first parameter information to the task execution device 200 .

[0147] pass Figure 7 The process shown can further increase the difficulty of information tampering and improve information security.

[0148] In this embodiment, considering that the storage length of integer data in the device memory is usually fixed, the data length of the integer data before and after being processed by the encryption method usually does not change. Therefore, in order to keep the second ciphertext information at a fixed length for easy storage and management, in this embodiment, the encryption execution device may convert the first ciphertext information into integer data before executing S305.

[0149] In electronic devices, integer data can be divided into multiple types, for example, integer (int), long integer (longint), extra long integer (long long int), etc. The lengths of different types of integer data are different, for example, int data has 8 bytes, long int data has 16 bytes, and long long int data has 32 bytes. In practical applications, the first ciphertext information can be set to the corresponding type of integer data according to the length of the second parameter information in the specific application scenario. For example, in a transaction scenario, if the second parameter information is a bank card number, the first ciphertext information can be set to long long int data.

[0150] Please refer to Figure 8 , Figure 8 This is a flowchart of an information decryption method provided by this embodiment. The decryption method can be executed by the task execution device 200 to decrypt the received second ciphertext information.

[0151] S401, obtaining first parameter information, second ciphertext information and first verification information, where the second ciphertext information is encrypted second parameter information, and the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0152] S402: Obtain a static key.

[0153] In this embodiment, when the task execution device 200 obtains the second ciphertext information, it can query the corresponding key from the key management system according to its own device identification as a static key.

[0154] The static key obtained in S402 and the static key obtained in S305 may be the same or different. For example, when the encryption execution device 100 encrypts the first ciphertext information using a symmetric encryption algorithm, the static key obtained in S402 and the static key obtained in S304 are the same key. For another example, when the encryption execution device 100 encrypts the first ciphertext information using an asymmetric encryption algorithm, the static key obtained in S402 and the static key obtained in S304 belong to the same key pair, one of which is the public key in the key pair and the other is the private key in the key pair.

[0155] S403: Decrypt the second ciphertext information based on the static key to obtain the first ciphertext information.

[0156] The decryption process of the second ciphertext by the task execution device 200 is the inverse of the encryption process of the first ciphertext by the encryption execution device 100. During implementation, the task execution device 200 can invoke the decryption algorithm corresponding to the encryption algorithm used by the encryption execution device 100 for the first ciphertext, and use the static key to decrypt the second ciphertext. The decrypted result is the first ciphertext.

[0157] S404: Generate a dynamic key according to the first parameter information.

[0158] S405: Decrypt the first ciphertext information based on the dynamic key to obtain plaintext information.

[0159] S406: Generate second verification information based on the plaintext information, and compare the first verification information with the second verification information to see if they are consistent. If so, execute S407; if not, execute S408.

[0160] S407: Execute the task to be processed according to the plaintext information and the first parameter information.

[0161] S408: Do not execute the pending task.

[0162] In this embodiment, the detailed implementation process of S404-S405 is similar to that of S202-S203, and the detailed implementation process of S406-S408 is similar to that of S205-S208, which will not be repeated here.

[0163] pass Figure 8 The process shown here implements double encryption of the second parameter information of the task to be processed, establishing a link between one of the encryption layers and the first parameter information of the task to be processed. If either the first or second parameter information is tampered with, decryption will fail. This makes tampering with the information more difficult, thereby improving information security.

[0164] In practical applications, if a static key is leaked, it may need to be updated. In this case, ciphertext encrypted with the old key version cannot be decrypted with the updated key. To address this situation, a key management system can store version information for each static key. In other words, the key management system can store the association between the device identifier of the task execution device, the key, and the key version information.

[0165] For the above situation, please refer to Figure 9 , which exemplarily illustrates an information encryption method provided by an embodiment of the present application, which can be applied to Figure 1The encryption execution device 100 shown in FIG. 1 can encrypt the second parameter information using the encryption method when the key management system stores different versions of static keys. Detailed description is as follows.

[0166] S501 , obtaining first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0167] S502: Generate a dynamic key according to the first parameter information.

[0168] S503: Generate first verification information according to the second parameter information.

[0169] S504: Encrypt the second parameter information based on the dynamic key to obtain first ciphertext information.

[0170] In this embodiment, the detailed implementation process of S501-S504 is similar to the above-mentioned S301-S304, and will not be repeated here.

[0171] S505: Obtain the latest version of the static key.

[0172] In this embodiment, the key management system may provide a first interface for obtaining a key, wherein the interface parameter of the first interface may include a device identifier of a task execution device, and the first interface may be used to obtain the latest version of the key corresponding to the device identifier.

[0173] Exemplarily, during the implementation process, the encryption execution device 100 can determine the device identification of the task execution device based on the task to be processed, such as identification A1, and then call the first interface with the device identification A1 as the interface parameter, so as to generate and send a first key acquisition request carrying the device identification A1. The destination address of the first key acquisition request is the communication address of the key management system, so that it can be sent to the key management system. The key management system responds to the first key acquisition request, finds the first association relationship containing the device identification A1, and determines the target first association relationship with the latest key version information from each first association relationship, obtains the key in the target first association relationship and returns the key to the encryption execution device 100. The encryption execution device 100 can determine the key returned by the key management system as the latest version of the static key.

[0174] S506: Encrypt the first ciphertext information based on the latest version of the static key.

[0175] S507: Obtain key version information of the latest version of the static key.

[0176] S508: Concatenate the encrypted first ciphertext information and the key version information to obtain second ciphertext information.

[0177] The detailed process of the encryption execution device 100 encrypting the first ciphertext information based on the latest version of the static key is similar to the above-mentioned S306, and reference may be made to the relevant description of S306 above. However, in this embodiment, after the encryption execution device 100 performs the encryption operation through S505 to obtain the encryption operation result, the key version information of the latest version of the static key obtained is combined with the encryption operation result to form a whole, which is the second ciphertext information. Exemplarily, the encryption execution device 100 can splice the encryption operation result (i.e., the first ciphertext information encrypted through S506) with the key version information, and the splicing result is the second ciphertext information.

[0178] It is worth noting that the above S507 and S505 can be obtained through one acquisition request or through different acquisition requests, and this embodiment has no limitation on this.

[0179] The processing of the obtained second ciphertext information is similar to the processing of the ciphertext information obtained in S103 in the above embodiment. For example, if the encryption execution device and the task execution device are not the same device, the information encryption method provided in this embodiment can also execute S509 after S508.

[0180] S509: Send the second ciphertext information, the first parameter information and the first verification information to the task execution device.

[0181] Correspondingly, the task execution device 200 can perform decryption and verification on the second ciphertext information. Figure 9 The information encryption method shown can realize dynamic management of static keys on the basis of improving information security, so that the static key version can be flexibly updated when the static key is leaked.

[0182] Furthermore, in scenarios where the encryption execution device 100 and the task execution device 200 are different devices, the generated second ciphertext information needs to be transmitted over a network. In actual applications, the second ciphertext information may be data information rather than character information. In this case, before sending the first parameter information, the second ciphertext information, and the first verification information to the task execution device 200, the encryption execution device 100 may concatenate the three into a single message to be transmitted, and encode the message to be transmitted into character information, such as ASCII (American Standard Code for Information Interchange) information.

[0183] Exemplarily, the encryption execution device 100 may transcode the information to be transmitted using a Base64 (binary data is represented based on 64 printable characters) transcoding algorithm, thereby obtaining the information to be transmitted represented by printable characters.

[0184] It is worth noting that, when the encryption execution device 100 performs Base64 transcoding on the information to be transmitted, in addition to Figure 9 In addition to the method shown, the encryption execution device 100 can also obtain the second ciphertext information in other ways. For example, S508 can be implemented through the following process:

[0185] A first concatenation process is performed on the encrypted first ciphertext information and the first verification information, a result of the first concatenation process is encoded into character string information, and a second concatenation process is performed on the character string information and the key version information to obtain second ciphertext information.

[0186] The encoding of the result of the first splicing process can be achieved by using the aforementioned Base64 encoding algorithm.

[0187] In one optional approach, a portion of the first verification information can be obtained to participate in the first concatenation process. Specifically, the encryption execution device 100 can perform a first concatenation process on a portion of the first verification information and the encrypted first ciphertext information to obtain third ciphertext information; perform Base64 transcoding on the third ciphertext information to obtain fourth ciphertext information; and then perform a second concatenation process on the fourth ciphertext information and the key version information to obtain second ciphertext information. Correspondingly, in subsequent processes, the encryption execution device can send the second ciphertext information, the first parameter information, and another portion of the first verification information to the task execution device.

[0188] In another optional approach, the entire first verification information can participate in the first concatenation process. Specifically, the encryption execution device 100 can also perform a first concatenation process on the first verification information and the encrypted first ciphertext information to obtain fifth ciphertext information; and perform a second concatenation process on the fifth ciphertext information and the key version information to obtain second ciphertext information for transmission to the task execution device 200. Accordingly, in subsequent processes, the encryption execution device 100 only needs to send the second ciphertext information and the first parameter information to the task execution device; the first verification information will be sent to the task execution device 200 as part of the second ciphertext information.

[0189] In this embodiment, for Figure 9 The second ciphertext information obtained by the information encryption method shown can be obtained by Figure 10 Decryption is performed by combining the following process. Figure 10 , the information decryption method provided by this embodiment is described. The method may include the following steps.

[0190] S601, obtaining first parameter information and second ciphertext information, where the second ciphertext information is encrypted second parameter information, and the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0191] In this embodiment, the detailed implementation process of S601 is similar to S201 and S401 of the aforementioned embodiment. Specifically, as described above, in scenarios where encryption execution device 100 and task execution device 200 are the same device, encryption execution device 100 can function as task execution device 200 and obtain task parameters for the pending task from information stored on the device. In scenarios where encryption execution device 100 and task execution device 200 are different devices, task execution device 200 can receive task parameters sent by encryption execution device 100.

[0192] Regarding the task parameters obtained by the task execution device 200, in one possible embodiment, the obtained task parameters are the first parameter information, the second ciphertext information, and the first verification information. In another possible embodiment, the obtained task parameters may be transcoded string information, such as ASCII code information transcoded via Base64. In this case, the task execution device 200 may first decode the obtained string information using a Base64 decoding algorithm to obtain the original first parameter information, the second ciphertext information, and the first verification information.

[0193] S602: Extract key version information and the encrypted first ciphertext information from the second ciphertext information.

[0194] Referring to the above description of S508 , the second ciphertext is formed by concatenating the encrypted first ciphertext and the key version information. Accordingly, the task execution device 200 may store a concatenation rule for the first ciphertext and the key version information. By restoring the second ciphertext according to the concatenation rule, the encrypted first ciphertext and the key version information can be obtained.

[0195] S603: Acquire a static key corresponding to the key version information according to the key version information.

[0196] Exemplarily, the key management system may further provide a second interface, wherein interface parameters of the second interface may include the device identification and key version information of the task execution device 200 , and the second interface may be used to obtain the key corresponding to the device identification and key version information.

[0197] Exemplarily, during the implementation process, the task execution device 200 can call the second interface with the key version information (such as V1) obtained in S602 and the device identification of the device (such as A1 mentioned above) as interface parameters, so as to generate a second key acquisition request carrying the device identification A1 and the key version information V1. The destination address of the second key acquisition request is the communication address of the key management system, so that it can be sent to the key management system. The key management system can respond to the second key acquisition request, search for the second association relationship containing the device identification A1, and determine the target second association relationship that protects the key version information V1 from each second association relationship, and obtain and return the key in the target second association relationship. The task execution device 200 can determine the key returned by the key management system as a static key corresponding to the key version information.

[0198] S604: Decrypt the second ciphertext information based on the static key to obtain the first ciphertext information.

[0199] S605: Generate a dynamic key according to the first parameter information.

[0200] S606: Decrypt the first ciphertext information based on the dynamic key to obtain plaintext information.

[0201] S607: Generate second verification information based on the plaintext information, and compare the first verification information with the second verification information to see if they are consistent. If so, execute S608; if not, execute S609.

[0202] S608: Execute the task to be processed according to the plaintext information and the first parameter information.

[0203] S609: Do not execute the pending task.

[0204] In this embodiment, the detailed implementation process of S604-S609 is similar to that of S403-S408 in the aforementioned embodiment. For details, please refer to the relevant description above and will not be repeated here.

[0205] pass Figure 10 The information decryption method shown can, when a static key is leaked and updated to a new version, retrieve the old version key for decrypting the old version of ciphertext based on the key version information in the old version of ciphertext. In other words, the information decryption method provided by this embodiment can resolve the issue of being unable to decrypt old version ciphertext due to static key updates.

[0206] In order to enable those skilled in the art to more clearly understand the solutions of the embodiments of the present application, the methods of the above embodiments are described in detail below through specific examples.

[0207] As described above, in the embodiments of the present application, the pending task may be a transaction task. Accordingly, the second parameter information may be transaction account information, and the first parameter information may be transaction scenario information. The transaction scenario information can also be understood as contextual information of the transaction task. The transaction scenario information may include, for example, the transaction amount, transaction order number, and transaction account type.

[0208] The method of the above embodiment is described in detail below by taking an example of a transaction task in which a transaction task is to transfer money to a specific bank account through a payment platform.

[0209] Please refer to Figure 11 , Figure 11 A schematic diagram of the application environment for a transfer task is shown. A payment platform 1110 is connected to a bank server 1120 and a terminal device 1130 via a network. Terminal device 1130 is installed with a client 1131 for communicating with the payment platform. It is understood that client 1131 can be a payment client or other application client with payment functionality, such as a social application client, a shopping application client, or a content interaction application client with payment functionality. This embodiment is not limited to this.

[0210] In an embodiment of the present application, the payment platform 1110 may be a server corresponding to a client having a payment function, which may be deployed on a server, which may be a separate physical server or a cluster consisting of multiple physical servers.

[0211] Assume that user U2 accesses the transfer page on client 1111. After entering the target bank's bank card number, the target bank's bank type, and the transfer amount, user U2 clicks a tab on the transfer page indicating the initiation of the transfer task, such as "Confirm Transfer" or "Submit." The target bank's bank card number indicates the bank account to which the funds will flow. The target bank's corresponding bank server is 1120.

[0212] Based on the information input by user U2, client 1111 can generate a transfer request r1 including the target bank card number (card-id), bank type (type), and transfer amount (value). The source address of transfer request r1 is the communication address of terminal device 1130, and the destination address is the communication address of payment platform 1110. Transfer request r1 can be sent to payment platform 1110.

[0213] Payment platform 1110 receives transfer request r1 and generates a corresponding transfer order m1. Transfer order m1 includes the bank card number (card-id), bank type (type), and transfer amount (value). Furthermore, transfer order m1 includes an order number (n), which uniquely identifies transfer order m1.

[0214] In this example, the transfer order m1 can be used to represent a transfer task that needs to be executed by the bank server 1120. Therefore, the payment platform 1110 needs to submit the transfer order m1 to the bank server 1120 of the target bank, so that the bank server 1120 can execute the transfer task according to the transfer order m1, that is, transfer the funds of value to the bank card number card-id. Among them, the payment platform 1110 needs to transmit the transfer order m1 to the bank server 1120 through the network. During the transmission process, the bank card number card-id is an important collection information. Once it is replaced, it will cause a transfer error, thereby causing financial losses to the user. Therefore, the payment platform 1110 can encrypt the target bank card number card-id through the information encryption method provided in the embodiment of the present application. Among them, the server where the payment platform 1110 is located can be understood as Figure 1 The encryption execution device 100 shown in FIG. Figure 12 The encryption process of the payment platform 1110 is described in detail.

[0215] S001, the payment platform 1110 obtains the order number n, transfer amount value, bank type type and bank card number card-id from the transfer order, determines the order number n, transfer amount value and bank type type as the first parameter information, and determines the bank card number card-id as the second parameter information to be encrypted.

[0216] In this example, the bank card number card-id as the second parameter information and the order number n, transfer amount value, and bank type type as the first parameter information all belong to the transfer task represented by the transfer order m1.

[0217] S002, determining the length of the bank card number card-id as len, and determining the target length iv-len of the dynamic key as len / 2.

[0218] S003. According to the generation rules configured for the dynamic key, for each piece of information in the order number n, transfer amount value, and bank type type, extract one bit of data from every 8 bits of the information, and concatenate the extracted data together in sequence to obtain a dynamic key iv with a length of len / 2.

[0219] S004, obtaining the last digit end-id and length len of the bank card number card-iv as first verification information.

[0220] S005 , using the dynamic key iv and the bank card number card-id as a vector, performing offset processing on the bank card number card-id based on the dynamic key iv to obtain the first ciphertext information card-iv1.

[0221] S006: Convert the first ciphertext information card-iv1 from a character string type to a long long int type.

[0222] S006 ensures that the length of the first ciphertext remains unchanged before and after encryption, facilitating the use of fixed fields for storing encrypted bank card numbers. In practical applications, a large number of transactions must be processed, and correspondingly, a large number of ciphertext bank card numbers must be stored. Using fixed fields to store encrypted bank card numbers significantly reduces the difficulty of data maintenance and management.

[0223] S007, using the communication address of the bank server 200 as an interface parameter, calling the first interface of the key management system to obtain the latest version of the static key and its key version information.

[0224] S008 : Perform 3DES encryption on the first ciphertext information card-iv1 of the long long int type based on the latest version of the static key to obtain the encrypted first ciphertext information card-iv1′.

[0225] S009: Concatenate the encrypted first ciphertext information card-iv' and the length len of the bank card number card-id to obtain third ciphertext information card-iv3.

[0226] S010: Perform Base64 transcoding on the third ciphertext card-iv3 to obtain fourth ciphertext card-iv4.

[0227] S011: Concatenate the fourth ciphertext information card-iv4 and the key version information to obtain the second ciphertext information card-iv2.

[0228] S012, sending the second ciphertext information card-iv2, the last digit end-id of the bank card number card-id, and the order number n, transfer amount value and bank type type as the first parameter information to the bank server 1120.

[0229] Correspondingly, after receiving the second ciphertext information card-iv2 and the first parameter information, the bank server 1120 can Figure 13The bank server 1120 can be understood as Figure 1 The decryption process of the task execution device 200 and the bank server 1120 is described in detail as follows.

[0230] S013, the bank server 1120 receives the second ciphertext information card-iv2, the first parameter information and the tail number end-id.

[0231] The first parameter information includes the order number n, transfer amount value, and bank type type in the transfer order m1, and the second ciphertext information card-iv2 is the encrypted bank card number card-id in the transfer order m1.

[0232] S014: Restore the second ciphertext information card-iv2 to key version information and fourth ciphertext information card-iv4.

[0233] S015: Perform Base64 decoding on the fourth ciphertext information card-iv4 to obtain the third ciphertext information card-iv3.

[0234] S016: Restore the encrypted first ciphertext card-iv1′ and the length len of the bank card number card-id from the third ciphertext card-iv3 according to the configured concatenation rule.

[0235] S017, using the key version information and the communication address of the bank server 1120 as interface parameters, calling the second interface of the key management system to obtain the corresponding static key.

[0236] S018: Decrypt the encrypted first ciphertext information card-iv1′ based on the static key to obtain the first ciphertext information card-iv1.

[0237] S019: Determine the target length of the dynamic key as len / 2 based on the length len of the bank card number card-id.

[0238] S020, according to the configured dynamic key generation rules, extract 8 bits of data from the order number n, transfer amount value and bank type type in the received first parameter information respectively, and splice the extracted data together in sequence to obtain a dynamic key iv with a length of len / 2.

[0239] S021: Decrypt the first ciphertext information card-iv1 based on the dynamic key iv to obtain the plaintext information card-id'.

[0240] S022: Verify whether each bit of the plain text information card-id' is a number.

[0241] S023, obtain the length and last digit of the plaintext information card-id' as second verification information, compare the length of the plaintext information card-id' with the length of the bank card number card-id to see if they are consistent, and compare the last digit of the plaintext information card-id' with the last digit end-id of the bank card number card-id to see if they are consistent.

[0242] S024: If the verification result in S022 is yes and both comparison results in S023 are yes, it can be determined that the plain text information card-id' and the bank card number card-id are consistent.

[0243] S025: Execute the transfer task based on the plaintext information card-id', order number n, transfer amount value, and bank type type, and transfer funds of amount value1 to the account with bank card number card-id' in bank type type1.

[0244] In other examples, the encryption execution device 100 and the task execution device 200 may be the same device. For example, when a user logs in to a public device through his or her user account, the public device can use the data to be stored input by the user as the second parameter information and the user account, data input time, etc. as the first parameter information, and adopt the information encryption method provided in the embodiment of the present application to encrypt the data to be stored. Correspondingly, when it is necessary to read the data to be stored, the encrypted data to be stored can be decrypted using the information decryption method provided in the embodiment of the present application, and when the decryption is successful, the data to be stored can be displayed to the user. In this example, the task to be processed can be understood as an access task, that is, a task consisting of a storage operation and a read operation.

[0245] It can be understood that the information encryption method and information decryption method provided in the embodiments of the present application can also be applied to other scenarios, and the present application has no limitation on this.

[0246] Please refer to Figure 14 , Figure 14 This is a schematic diagram of the architecture of an electronic device provided in an embodiment of the present application. The electronic device 1400 can be used to execute at least one of the information encryption method and the information decryption method provided in an embodiment of the present application. For example, it can be the encryption execution device 100 or the task execution device 200 described above. The electronic device 1400 can be any device with data processing capabilities, such as a personal computer, a laptop computer, a smart terminal, a server, etc., and this embodiment does not limit this.

[0247] The electronic device 1400 includes one or more of the following components: a processor 1410, a memory 1420, and one or more programs, wherein the one or more programs may be stored in the memory 1420 and configured to be executed by the one or more processors 1410, the one or more programs configured to execute the methods described below.

[0248] The processor 1410 may include one or more processing cores. It utilizes various interfaces and circuits to connect various components within the electronic device 1400. By running or executing instructions, programs, code sets, or instruction sets stored in the memory 140, and accessing data stored in the memory 1420, the processor 1410 performs various functions and processes data for the electronic device 1400. Optionally, the processor 1410 may be implemented using at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 1410 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem handles wireless communications. It is understood that the modem may not be integrated into the processor 1410 and may be implemented separately via a communications chip.

[0249] The memory 1420 may include a random access memory (RAM) or a read-only memory (ROM). The memory 1420 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 1420 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, network communication, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the electronic device 1400 during use (such as first parameter information and second parameter information of a task to be processed), etc.

[0250] See also Figure 15 , which shows a structural block diagram of an information encryption device provided by an embodiment of the present application, the device 1500 can be applied to Figure 14The electronic device 1400 is shown. The apparatus 1500 may be a computer program (including program code) running on a computer device, for example, an application software; the apparatus may be used to perform the corresponding steps of the method provided in the embodiments of the present application. The apparatus 1500 may include: an information acquisition module 1510, a key determination module 1520, and an encryption module 1530.

[0251] The information obtaining module 1510 is used to obtain first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0252] The key determination module 1520 is configured to generate a dynamic key according to the first parameter information.

[0253] Optionally, the first parameter information includes at least two task parameters. In this case, the key determination module 1520 can be specifically configured to: extract at least part of the information from each task parameter in the first parameter information to obtain key information of a target length; and determine the key information of the target length as the dynamic key.

[0254] Optionally, the key determination module 1520 may be further configured to: determine the target length according to the length of the second parameter information before extracting at least part of the information from each task parameter of the first parameter information.

[0255] The encryption module 1530 is configured to encrypt the second parameter information based on the dynamic key to obtain ciphertext information.

[0256] Optionally, the encryption module 1530 may be specifically configured to perform superposition processing on the second parameter information and the dynamic key.

[0257] Optionally, the ciphertext information may be first ciphertext information. In this case, the key determination module 1520 may further be configured to: obtain a static key after encrypting the second parameter information based on the dynamic key. The encryption module 1530 may further be configured to: encrypt the first ciphertext information based on the static key to obtain second ciphertext information.

[0258] Optionally, the obtained static key may be the latest version of the static key. Accordingly, the encryption module 1530 encrypts the first ciphertext information based on the static key to obtain the second ciphertext information by: encrypting the first ciphertext information based on the latest version of the static key; obtaining key version information of the latest version of the static key; and concatenating the encrypted first ciphertext information with the key version information to obtain the second ciphertext information.

[0259] Optionally, the encryption device 1500 may further include a verification information generation module. The verification information generation module is configured to generate first verification information according to the second parameter information before the encryption module 1530 encrypts the second parameter information based on the dynamic key.

[0260] For the generated first verification information, in an optional manner, the encryption module 1530 splices the encrypted first ciphertext information and the key version information to obtain the second ciphertext information by: performing a first splicing process on the encrypted first ciphertext information and the first verification information; encoding the result of the first splicing process into string information; performing a second splicing process on the string information and the key version information to obtain the second ciphertext information.

[0261] In another optional embodiment, the encryption device 1500 may further include a sending module. The sending module may be configured to, after obtaining the ciphertext information, send the ciphertext information, the first parameter information, and the first verification information to the task execution device, generate the second verification information based on the plaintext information, and execute the pending task based on the plaintext information and the first parameter information when the first verification information and the second verification information are consistent.

[0262] Optionally, the encryption module 1530 may be further configured to: convert the first ciphertext information into integer data before encrypting the first ciphertext information based on the static key.

[0263] Optionally, the verification information generation module may generate the first verification information in the following manner: obtaining at least one of the length of the second parameter information and information of the target position of the second parameter information as the first verification information.

[0264] Optionally, the task to be processed may be a transaction task. The second parameter information may include transaction account information, and the first parameter information may include transaction scenario information of the transaction task.

[0265] Optionally, the transaction scenario information may include the transaction amount, transaction number, and transaction account type. Accordingly, key determination module 1520 may generate a dynamic key by extracting at least part of the transaction amount, transaction number, and transaction account type to obtain key information of a target length; and determining the key information of the target length as the dynamic key.

[0266] Please refer to Figure 16 , which shows a block diagram of an information decryption device provided by an embodiment of the present application, the device 1600 can be applied to Figure 14The electronic device 1400 is shown. The apparatus 1600 may be a computer program (including program code) running on a computer device, for example, an application software; the apparatus may be used to perform the corresponding steps of the method provided in the embodiments of the present application. The apparatus 1600 may include: an information acquisition module 1610, a key determination module 1620, and a decryption module 1630.

[0267] The information obtaining module 1610 is used to obtain first parameter information and ciphertext information, where the ciphertext information is encrypted second parameter information, and the first parameter information and the second parameter information are parameter information of the same task to be processed.

[0268] The key determination module 1620 is configured to generate a dynamic key according to the first parameter information.

[0269] The decryption module 1630 is configured to decrypt the ciphertext information based on the dynamic key to obtain plaintext information.

[0270] Optionally, the information obtaining module 1610 may also be used to obtain first verification information.

[0271] The apparatus 1600 may further include a verification information generation module and a verification module. The verification information generation module is configured to generate second verification information according to the plaintext information after obtaining the plaintext information.

[0272] The verification module is used to: compare whether the first verification information and the second verification information are consistent; if so, execute the task to be processed according to the plaintext information and the first parameter information.

[0273] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0274] In several embodiments provided in this application, the coupling or direct coupling or communication connection between the modules shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0275] In addition, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules.

[0276] Please refer to Figure 17, which shows a block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable medium 1700 stores program code, which can be called by a processor to execute the method described in the above method embodiment.

[0277] Computer-readable storage medium 1700 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Alternatively, computer-readable storage medium 1700 may include a non-transitory computer-readable storage medium. Computer-readable storage medium 1700 has storage space for program code 1710 for executing any of the method steps described above. This program code can be read from or written to one or more computer program products. Program code 1710 may be compressed, for example, in a suitable form.

[0278] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An information encryption method, characterized in that: include: Obtaining first parameter information and second parameter information to be encrypted, where the first parameter information and the second parameter information are two parts of parameter information of the same task to be processed; the first parameter information is non-sensitive information in the parameter information of the task to be processed, and the second parameter information is sensitive information in the parameter information of the task to be processed; determining a target length based on the length of the second parameter information; Generate a dynamic key of the target length according to the first parameter information; Encrypting the second parameter information based on the dynamic key to obtain first ciphertext information; Encrypting the first ciphertext information based on the latest version of the static key; Obtain key version information of the latest version of the static key; The encrypted first ciphertext information and the key version information are concatenated to obtain second ciphertext information.

2. The method according to claim 1, characterized in that The first parameter information includes at least two task parameters, and generating the dynamic key of the target length according to the first parameter information includes: Extracting at least part of the information from each task parameter of the first parameter information to obtain key information of a target length; The key information of the target length is determined as the dynamic key.

3. The method according to claim 1 or 2, characterized in that The encrypting the second parameter information based on the dynamic key includes: The second parameter information and the dynamic key are superimposed.

4. The method according to claim 1 or 2, characterized in that Before encrypting the first ciphertext information based on the latest version of the static key, the method further includes: Convert the first ciphertext information into integer data.

5. The method according to claim 1 or 2, characterized in that The method further comprises: generating first verification information according to the second parameter information; After obtaining the ciphertext information, the ciphertext information, the first parameter information and the first verification information are sent to the task execution device. The task execution device is used to decrypt the ciphertext information, obtain plaintext information, generate second verification information based on the plaintext information, and when the first verification information and the second verification information are consistent, execute the task to be processed according to the plaintext information and the first parameter information.

6. The method according to claim 5, characterized in that The generating first verification information according to the first parameter information includes: At least one of the length of the second parameter information and the target position information of the second parameter information is obtained as the first verification information.

7. The method according to claim 1, characterized in that The task to be processed is a transaction task, the second parameter information includes transaction account information, the first parameter information includes transaction scenario information of the transaction task, and the transaction scenario information includes transaction amount, transaction order number, and transaction account type; generating a dynamic key based on the first parameter information includes: Extracting at least part of the information from the transaction amount, the transaction order number, and the transaction account type respectively to obtain key information of a target length; The key information of the target length is determined as the dynamic key.

8. A method for decrypting information, characterized in that: include: Obtain first parameter information and second ciphertext information; Extracting key version information and the encrypted first ciphertext information from the second ciphertext information; Obtaining a static key corresponding to the key version information; Decrypting the encrypted first ciphertext information based on the static key to obtain the first ciphertext information; The first ciphertext information is the encrypted second parameter information; The first parameter information and the second parameter are two parts of the parameter information of the same task to be processed; the first parameter information is non-sensitive information in the parameter information of the task to be processed, and the second parameter information is sensitive information in the parameter information of the task to be processed; determining a target length based on the length of the second parameter information; Generate a dynamic key of the target length according to the first parameter information; The first ciphertext information is decrypted based on the dynamic key to obtain plaintext information.

9. An information encryption device, characterized in that: include: an information acquisition module, configured to obtain first parameter information and second parameter information to be encrypted, wherein the first parameter information and the second parameter information are two parts of parameter information of the same task to be processed; the first parameter information is non-sensitive information in the parameter information of the task to be processed, and the second parameter information is sensitive information in the parameter information of the task to be processed; A key determination module, configured to determine a target length based on the length of the second parameter information; Generate a dynamic key of the target length according to the first parameter information; an encryption module, configured to encrypt the second parameter information based on the dynamic key to obtain first ciphertext information; Encrypting the first ciphertext information based on the latest version of the static key; Obtain key version information of the latest version of the static key; and concatenate the encrypted first ciphertext information and the key version information to obtain second ciphertext information.

10. An information decryption device, characterized in that: include: An information acquisition module, configured to obtain first parameter information and second ciphertext information; Extracting key version information and the encrypted first ciphertext information from the second ciphertext information; Obtaining a static key corresponding to the key version information; Decrypting the encrypted first ciphertext information based on the static key to obtain the first ciphertext information; The first ciphertext information is the encrypted second parameter information; The first parameter information and the second parameter are parameter information of the same task to be processed; The first parameter information is non-sensitive information in the parameter information of the task to be processed, and the second parameter information is sensitive information in the parameter information of the task to be processed; A key determination module, configured to determine a target length based on the length of the second parameter information; Generate a dynamic key of the target length according to the first parameter information; A decryption module is used to decrypt the first ciphertext information based on the dynamic key to obtain plaintext information.

11. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores program code, which can be called by a processor to execute the method according to any one of claims 1 to 8.

Images