System security encryption and decryption method, device, computer equipment and storage medium

Abstract

The embodiments of the present invention disclose a system security encryption and decryption method, apparatus, computer equipment, and storage medium. The method includes: obtaining a data processing request; determining whether the data processing request is a request for encrypted data; if the data processing request is a request for encrypted data, encrypting the original data according to the data processing request in combination with a key to obtain an encryption result; storing the encryption result in a configuration file; when a key update occurs, re-encrypting the original data corresponding to the encryption result according to the new key to update the encryption result; if the data processing request is not a request for encrypted data, reading the corresponding encryption result from the configuration file according to the data processing request; decrypting the encryption result to obtain a decryption result; and outputting the decryption result. By implementing the method of the embodiments of the present invention, it is possible to encrypt and decrypt the system data and update the key in real time to ensure the security of the data.

Description

Technical Field

[0001] The present invention relates to an encryption and decryption method, and more specifically to a system security encryption and decryption method, device, computer equipment and storage medium. Background Art

[0002] In Linux-based network devices, important device parameters, such as web login account password, WiFi account password, ssh / telnet account password, etc., are directly stored in plain text in the configuration file, which makes them easy to be hacked and even have administrator privileges obtained.

[0003] Therefore, it is necessary to design a new method to encrypt and decrypt the system data and update the key in real time to ensure the security of the data. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects of the prior art and provide a system security encryption and decryption method, device, computer equipment and storage medium.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a system security encryption and decryption method, comprising:

[0006] Obtain data processing requests;

[0007] Determining whether the data processing request is a request for encrypted data;

[0008] If the data processing request is a request for encrypting data, encrypting the original data according to the data processing request in combination with a key to obtain an encryption result;

[0009] Storing the encryption result in a configuration file;

[0010] When a key update occurs, the original data corresponding to the encryption result is re-encrypted according to the new key to update the encryption result;

[0011] If the data processing request is not a request for encrypting data, reading a corresponding encryption result from the configuration file according to the data processing request;

[0012] Decrypting the encryption result to obtain a decryption result;

[0013] The decryption result is output.

[0014] A further technical solution is: when a key update occurs, the original data corresponding to the encryption result is re-encrypted according to the new key to update the encryption result, including:

[0015] When a key update occurs, obtain the new key;

[0016] Read the encryption result that needs to be updated from the configuration file;

[0017] Re-encrypting the encryption result that needs to be updated with the new key to obtain a new encryption result;

[0018] Storing the new encryption result in a temporary storage area;

[0019] Re-encrypting the encryption result in the configuration file according to the new key, and storing the encrypted ciphertext in a temporary storage area;

[0020] The ciphertext in the temporary storage area and the new encryption result are stored in the configuration file as the encryption result.

[0021] A further technical solution is: after storing the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file, the method further comprises:

[0022] The timer is reset, and when the current time reaches the time set by the timer and a key update occurs, the step of obtaining a new key when a key update occurs is executed.

[0023] A further technical solution is: re-encrypting the encryption result that needs to be updated with the new key to obtain a new encryption result, including:

[0024] Decrypt the encrypted result that needs to be updated to obtain the original data;

[0025] The original data is re-encrypted using the new key to obtain a new encryption result.

[0026] A further technical solution is: encrypting the original data according to the data processing request in combination with a key to obtain an encryption result, including:

[0027] Reading the password or data to be encrypted according to the data processing request to obtain the original data;

[0028] Get the original root key;

[0029] Generate a random number through the OpenSSL library standard interface to obtain the salt value;

[0030] Use the PBKDF2 standard encryption algorithm to encrypt the original root key with the salt value to obtain the root key, and store the root key in the specified location;

[0031] Generate a random number and use the PBKDF2 standard encryption algorithm to encrypt the random number with the salt value to obtain the working key;

[0032] Generate another random number through the OpenSSL library standard interface to obtain a vector;

[0033] Use the AES256 standard encryption algorithm to encrypt the working key with the root key and vector to obtain the key;

[0034] Use the AES256 standard encryption algorithm to encrypt the original data with the working key to obtain the data ciphertext;

[0035] The data ciphertext, key and vector are concatenated to obtain the encryption result.

[0036] A further technical solution is: decrypting the encryption result to obtain a decryption result includes:

[0037] Splitting the encryption result into data ciphertext, key and vector by bit;

[0038] Read the stored root key from the specified location;

[0039] Use the PBKDF2 standard decryption interface to decrypt the key into a working key using the root key;

[0040] Use the AES256 standard decryption interface to decrypt the data ciphertext into original data through the vector and working key to obtain the decryption result.

[0041] The present invention also provides a system security encryption and decryption device, comprising:

[0042] A request acquisition unit, used to acquire a data processing request;

[0043] a request determination unit, configured to determine whether the data processing request is a request for encrypted data;

[0044] an encryption unit, configured to, if the data processing request is a request for encrypting data, encrypt the original data according to the data processing request in combination with a key to obtain an encryption result;

[0045] A storage unit, configured to store the encryption result in a configuration file;

[0046] an updating unit, configured to re-encrypt the original data corresponding to the encryption result according to the new key when a key update occurs, so as to update the encryption result;

[0047] a result reading unit, configured to read a corresponding encryption result from the configuration file according to the data processing request if the data processing request is not a request for encrypting data;

[0048] a decryption unit, configured to decrypt the encryption result to obtain a decrypted result;

[0049] An output unit is used to output the decryption result.

[0050] Its further technical solution is: the updating unit includes:

[0051] A new key acquisition subunit is used to obtain a new key when a key update occurs;

[0052] A reading subunit, configured to read the encryption result to be updated from the configuration file;

[0053] a re-encryption subunit, configured to re-encrypt the encryption result to be updated using the new key to obtain a new encryption result;

[0054] A temporary storage subunit, used for storing the new encryption result in a temporary storage area;

[0055] All encryption subunits are used to re-encrypt the encryption results in the configuration file according to the new key and store the encrypted ciphertext in a temporary storage area;

[0056] The moving-in subunit is used to store the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file.

[0057] The present invention further provides a computer device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0058] The present invention also provides a storage medium storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0059] The beneficial effects of the present invention compared with the prior art are: the present invention obtains the data processing request of the terminal and determines whether to execute the encryption process or the decryption process based on the request. The encryption process is based on the PBKDF2 and AES256 standard encryption algorithms. Through multiple keys and components, it is encrypted multiple times to ensure that the ciphertext is irregular and unbreakable. After encryption, the key will be updated regularly and re-encrypted to realize encryption and decryption of the system data, and the key will be updated in real time to ensure the security of the data.

[0060] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0062] Figure 1 A schematic diagram of an application scenario of the system security encryption and decryption method provided by an embodiment of the present invention;

[0063] Figure 2 A schematic diagram of the process flow of a system security encryption and decryption method provided by an embodiment of the present invention;

[0064] Figure 3 A schematic diagram of a sub-process of a system security encryption and decryption method provided by an embodiment of the present invention;

[0065] Figure 4 A schematic diagram of a sub-process of a system security encryption and decryption method provided by an embodiment of the present invention;

[0066] Figure 5 A schematic diagram of a sub-process of a system security encryption and decryption method provided by an embodiment of the present invention;

[0067] Figure 6 A schematic diagram of a sub-process of a system security encryption and decryption method provided by an embodiment of the present invention;

[0068] Figure 7 A schematic block diagram of a system security encryption and decryption device provided in an embodiment of the present invention;

[0069] Figure 8 A schematic block diagram of an update unit of a system security encryption and decryption device provided by an embodiment of the present invention;

[0070] Figure 9 A schematic block diagram of a re-encryption subunit of a system security encryption and decryption device provided by an embodiment of the present invention;

[0071] Figure 10 A schematic block diagram of an encryption unit of a system security encryption and decryption device provided in an embodiment of the present invention;

[0072] Figure 11 A schematic block diagram of a decryption unit of a system security encryption and decryption device provided by an embodiment of the present invention;

[0073] Figure 12 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0074] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0075] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0076] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0077] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0078] See also Figure 1 and Figure 2 , Figure 1 Schematic diagram of an application scenario of the system security encryption and decryption method provided by an embodiment of the present invention. Figure 2 This is a schematic flow chart of a system security encryption and decryption method provided in an embodiment of the present invention. This system security encryption and decryption method is applied to a server. The server interacts with a terminal, obtains a data processing request from the terminal, and determines whether to execute the encryption or decryption process based on the request. The encryption process is based on the PBKDF2 and AES256 standard encryption algorithms, using multiple keys and components and undergoing multiple encryptions to ensure that the ciphertext is unpredictable and unbreakable. After encryption, the key is periodically updated and re-encrypted to ensure data security.

[0079] Figure 2 This is a flow chart of the system security encryption and decryption method provided by the embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S180.

[0080] S110: Obtain a data processing request.

[0081] In this embodiment, the data processing request refers to a request for data encryption or decryption operations on important configuration parameters and authentication passwords in the device, including but not limited to WiFi passwords, web login passwords, and VPN authentication passwords.

[0082] S120: Determine whether the data processing request is a request for encrypted data;

[0083] S130: If the data processing request is a request for encrypting data, encrypt the original data according to the data processing request and a key to obtain an encryption result.

[0084] In this embodiment, the encryption result refers to the encryption of original data using a key, and the original data refers to data such as parameters specified in the data processing request.

[0085] In one embodiment, see Figure 3 , the above-mentioned step S130 may include steps S131 to S139.

[0086] S131. Read the password or data to be encrypted according to the data processing request to obtain original data.

[0087] In this embodiment, the password to be encrypted or the data input by the user in the configuration is read as the original data S to be encrypted, such as "key123456".

[0088] S132. Obtain the original root key.

[0089] In this embodiment, the original root key refers to one of the original contents used to generate the key.

[0090] Specifically, the composition of the original root key is divided into the following steps:

[0091] Read the device's IMEI (International Mobile Equipment Identity), for example, "ffffffffffffffff";

[0092] Read the device MAC address, for example, "78a351000121";

[0093] Generate a random number through the / dev / random device as a random component, such as "f9c084bdebf37d021";

[0094] The IMEI, MAC, and random components are concatenated into the original root key, which is 32 bits long, such as "fffffffffffffff78a3510001216ee059f333314128".

[0095] S133. Generate a random number through the OpenSSL library standard interface to obtain a salt value.

[0096] In this embodiment, the salt value refers to a random number generated through the OpenSSL library standard interface.

[0097] Specifically, a random number is generated through the OpenSSL library standard interface as the salt value s, for example, "d47aa89cc578121f9c084bdebf37d021".

[0098] S134. Use the PBKDF2 standard encryption algorithm to encrypt the original root key with the salt value to obtain the root key, and store the root key in a designated location.

[0099] In this embodiment, the PBKDF2 standard encryption algorithm is used to encrypt the original root key R with the salt value s to obtain the root key R', and the root key R' is stored in a specific location on the device; at this time, the root key R' is e6749acacdf59c45db8b884b136e58b37e621c773450b4990a333da677682a1d.

[0100] S135. Generate a random number, use the PBKDF2 standard encryption algorithm, and encrypt the random number with the salt value to obtain a working key.

[0101] In this embodiment, a random number is generated through the / dev / random device, for example, "2ca4w5a625c42c58f". The PBKDF2 standard encryption algorithm is used to encrypt the random number with the salt value s, and the obtained ciphertext is used as the working key W; W is "9d425918def0a9728d7baadf98fe5137".

[0102] S136. Generate another random number through the OpenSSL library standard interface to obtain a vector.

[0103] In this embodiment, a random number is generated through the OpenSSL library standard interface as the IV vector I, with a length of 32 bits, for example, "1ebbeaca27f063da579dcc6b9beee779";

[0104] S137. Use the AES256 standard encryption algorithm to encrypt the working key using the root key and the vector to obtain a key.

[0105] In this embodiment, the AES256 standard encryption algorithm is used to encrypt the working key W with the root key R' and the IV vector I to obtain the key W' with a length of 64 bits; W' is "9cc5aa2bc50eb3a3ff49f9c1bfef4877691172a072cb34d17fb9ad65bc635d8f".

[0106] S138. Use the AES256 standard encryption algorithm to encrypt the original data with the working key to obtain data ciphertext.

[0107] In this embodiment, the AES256 standard encryption algorithm is used to encrypt the original data S with the working key W to obtain a data ciphertext S' with a length of 64 bits; S' is "68aa4fe41ec0f02a07045ffc67debbcd9661f23db6f168cf3541edd6e5fa7ac0".

[0108] S139: Concatenate the data ciphertext, key, and vector to obtain an encryption result.

[0109] Specifically, the data ciphertext S', key W', and IV vector I are concatenated into the final ciphertext K, i.e., the encryption result, with a length of 160 bits; the final ciphertext is "68aa4fe41ec0f02a07045ffc67debbcd9661f23db6f168cf3541edd6e5fa7ac09cc5aa2bc50eb3a3ff49f9c1bfef4877691172a072cb34d17fb9ad65bc635d8f1ebbeaca27f063da579dcc6b9beee779".

[0110] S140, storing the encryption result in a configuration file;

[0111] S150: When a key update occurs, the original data corresponding to the encryption result is re-encrypted according to the new key to update the encryption result.

[0112] In one embodiment, see Figure 4 , the above-mentioned step S150 may include steps S151 to S157.

[0113] S151. When a key update occurs, obtain a new key.

[0114] In this embodiment, when a key update occurs, step S132 is used to generate a root key r, which is assumed to be "768ad429b98db3de137d2ca89fa232d8eed93bdf759d37be5e253005cceb2ff0"; and steps S133 to S137 are used to regenerate a new key.

[0115] S152: Read the encryption result that needs to be updated from the configuration file.

[0116] In this embodiment, the ciphertext to be updated, that is, the encryption result K, is read from the configuration file, for example, "68aa4fe41ec0f02a07045ffc67debbcd9661f23db6f168cf3541edd6e5fa7ac09cc5aa2bc50eb3a3ff49f9c1bfef4877691172a072cb34d17fb9ad65bc635d8f1ebbeaca27f063da579dcc6b9beee779".

[0117] S153: re-encrypt the encryption result that needs to be updated with the new key to obtain a new encryption result.

[0118] In one embodiment, see Figure 5 , the above-mentioned step S153 may include steps S1531 to S1532.

[0119] S1531. Decrypt the encryption result that needs to be updated to obtain the original data.

[0120] The decryption process is the same as step S170 and will not be repeated here.

[0121] S1532. Re-encrypt the original data using the new key to obtain a new encryption result.

[0122] The encryption process is the same as step S130 and will not be repeated here.

[0123] The ciphertext K is restored to the original data S, where S is "key123456". The encryption module then encrypts data S using the new root key r. If encryption fails using the new root key r, the system timer is reset and the next key update is awaited. If encryption succeeds, the following process continues. Assume the new ciphertext k is "a23acada88cd0da8fa493d8bd4b9d322d97e46ef8b1b0425729be37a24bd6030f610a64b521980198a5b244f2bea7b07c0c33da2d71ca119acd60e0f8acb8bd08bd81a90c48d2726b480e1f44d754ccf".

[0124] S154, storing the new encryption result in a temporary storage area;

[0125] S155. Re-encrypt the encryption result in the configuration file using the new key, and store the encrypted ciphertext in a temporary storage area;

[0126] S156. The ciphertext in the temporary storage area and the new encryption result are stored as the encryption result in the configuration file;

[0127] S157, reset the timer;

[0128] When the current time reaches the time set by the timer and a key update occurs, step S151 is executed.

[0129] Save the new encryption result k in the temporary storage area; continue to read the configuration file, update other ciphertexts, and repeat the above step S153 until all ciphertexts are updated; after all ciphertexts are successfully updated, store all ciphertexts in the temporary storage area into the configuration, and save the new root key r to the specified location of the device; reset the system timer.

[0130] S160: If the data processing request is not a request for encrypting data, read a corresponding encryption result from the configuration file according to the data processing request.

[0131] In this embodiment, the ciphertext to be decrypted, i.e., the encryption result K, is read from the configuration. The length is 160 bits, for example, "68aa4fe41ec0f02a07045ffc67debbcd9661f23db6f168cf3541edd6e5fa7ac09cc5aa2bc50eb3a3ff49f9c1bfef4877691172a072cb34d17fb9ad65bc635d8f1ebbeaca27f063da579dcc6b9beee779";

[0132] S170: Decrypt the encryption result to obtain a decryption result.

[0133] In this embodiment, the decryption result refers to the original data.

[0134] In one embodiment, see Figure 6 , the above-mentioned step S170 may include steps S171 to S174.

[0135] S171. Divide the encryption result into data ciphertext, key and vector by bit.

[0136] Specifically, the ciphertext K is split into data ciphertext S', working key ciphertext W', and IV vector I by bit-wise division at 64+64+32 according to its length; here, the data ciphertext S', working key ciphertext W', and IV vector I are: "68aa4fe41ec0f02a07045ffc67debbcd9661f23db6f168cf3541edd6e5fa7ac0", "9cc5aa2bc50eb3a3ff49f9c1bfef4877691172a072cb34d17fb9ad65bc635d8f", and "1ebbeaca27f063da579dcc6b9beee779", respectively.

[0137] S172. Read the stored root key from the specified location.

[0138] Specifically, the stored root key R' is read from the specified location of the device; for example, "e6749acacdf59c45db8b884b136e58b37e621c773450b4990a333da677682a1d".

[0139] S173. Use the PBKDF2 standard decryption interface to decrypt the key into a working key using the root key.

[0140] Specifically, the PBKDF2 standard decryption interface is used to decrypt the key W' into the working key W through the root key R'; at this time, W is "9d425918def0a9728d7baadf98fe5137".

[0141] S174. Use the AES256 standard decryption interface to decrypt the data ciphertext into original data using the vector and the working key to obtain a decryption result.

[0142] Specifically, the AES256 standard decryption interface is used to decrypt the data ciphertext S' into the original data S through the IV vector I and the working key W. Here, S is "key123456".

[0143] S180: Output the decryption result.

[0144] Each time the root key is generated, the system timer will be reset. When the timer reaches zero, the default time is 48 hours, triggering the key update process, regenerating the key, and updating the ciphertext.

[0145] The above-mentioned system security encryption and decryption method is applicable not only to Linux systems, but also to OpenWRT, Yocto, Android, and other systems. It is not limited to encrypting and decrypting data based on the PBKDF2 and AES256 algorithms, but also applies to other similar standard algorithms. 1. It integrates encryption and decryption interfaces to improve system security. Based on the PBKDF2 and AES256 standard encryption algorithms, it uses multiple keys and components and undergoes multiple encryptions to ensure that the ciphertext is irregular and unbreakable. Encryption is based on the device MAC and IMEI. The ciphertext is different between different devices, ensuring the independence and security of each device.

[0146] The above-mentioned system security encryption and decryption method obtains the data processing request of the terminal and determines whether to execute the encryption process or the decryption process based on the request. The encryption process is based on the PBKDF2 and AES256 standard encryption algorithms. Through multiple keys and components, it is encrypted multiple times to ensure that the ciphertext is irregular and unbreakable. After encryption, the key will be updated regularly and re-encrypted to realize the encryption and decryption of the system data, and the key will be updated in real time to ensure the security of the data.

[0147] Figure 7 FIG is a schematic block diagram of a system security encryption and decryption device 300 provided by an embodiment of the present invention. Figure 7 As shown, corresponding to the above system security encryption and decryption method, the present invention also provides a system security encryption and decryption device 300. The system security encryption and decryption device 300 includes a unit for executing the above system security encryption and decryption method, and the device can be configured in a server. Specifically, please refer to Figure 7The system security encryption and decryption device 300 includes a request acquisition unit 301, a request judgment unit 302, an encryption unit 303, a storage unit 304, an update unit 305, a result reading unit 306, a decryption unit 307 and an output unit 308.

[0148] A request acquisition unit 301 is used to obtain a data processing request; a request judgment unit 302 is used to judge whether the data processing request is a request for encrypted data; an encryption unit 303 is used to encrypt the original data according to the data processing request in combination with a key to obtain an encryption result if the data processing request is a request for encrypted data; a storage unit 304 is used to store the encryption result in a configuration file; an update unit 305 is used to re-encrypt the original data corresponding to the encryption result according to the new key when a key update occurs to update the encryption result; a result reading unit 306 is used to read the corresponding encryption result from the configuration file according to the data processing request if the data processing request is not a request for encrypted data; a decryption unit 307 is used to decrypt the encryption result to obtain a decrypted result; and an output unit 308 is used to output the decrypted result.

[0149] In one embodiment, if Figure 8 As shown, the update unit 305 includes a new key acquisition subunit 3051, a reading subunit 3052, a re-encryption subunit 3053, a temporary storage subunit 3054, a full encryption subunit 3055, a move-in subunit 3056 and a reset subunit 3057.

[0150] The new key acquisition subunit 3051 is used to obtain a new key when a key update occurs; the reading subunit 3052 is used to read the encryption result that needs to be updated from the configuration file; the re-encryption subunit 3053 is used to re-encrypt the encryption result that needs to be updated in combination with the new key to obtain a new encryption result; the temporary storage subunit 3054 is used to store the new encryption result in a temporary storage area; the full encryption subunit 3055 is used to re-encrypt the encryption result in the configuration file according to the new key and store the encrypted ciphertext in the temporary storage area; the move subunit 3056 is used to store the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file. The reset subunit 3057 is used to reset the timer. When the current time reaches the timer setting time and a key update occurs, the method of obtaining a new key when a key update occurs is executed.

[0151] In one embodiment, if Figure 9 As shown, the re-encryption subunit 3053 includes a result decryption module 30531 and a new encryption module 30532.

[0152] The result decryption module 30531 is used to decrypt the encryption result that needs to be updated to obtain the original data; the new encryption module 30532 is used to re-encrypt the original data using the new key to obtain a new encryption result.

[0153] In one embodiment, if Figure 10 As shown, the encryption unit 303 includes a data reading subunit 3031, a root key acquisition subunit 3032, a salt value generation subunit 3033, a first encryption subunit 3034, a second encryption subunit 3035, a vector generation subunit 3036, a third encryption subunit 3037, a fourth encryption subunit 3038 and a splicing subunit 3039.

[0154] The data reading subunit 3031 is used to read the password or data to be encrypted according to the data processing request to obtain the original data; the root key acquisition subunit 3032 is used to obtain the original root key; the salt value generation subunit 3033 is used to generate a random number through the OpenSSL library standard interface to obtain the salt value; the first encryption subunit 3034 is used to encrypt the original root key with the salt value using the PBKDF2 standard encryption algorithm to obtain the root key, and store the root key in a specified location; the second encryption subunit 3035 is used to generate a random number, encrypt it using the PBKDF2 standard algorithm, encrypting the random number with a salt value to obtain a working key; a vector generation subunit 3036, used to generate another random number through the OpenSSL library standard interface to obtain a vector; a third encryption subunit 3037, used to use the AES256 standard encryption algorithm to encrypt the working key with the root key and the vector to obtain a key; a fourth encryption subunit 3038, used to use the AES256 standard encryption algorithm to encrypt the original data with the working key to obtain a data ciphertext; a splicing subunit 3039, used to splice the data ciphertext, the key and the vector to obtain an encryption result.

[0155] In one embodiment, if Figure 11 As shown, the decryption unit 307 includes a slicing subunit 3071 , a root key reading subunit 3072 , a first decryption subunit 3073 and a second decryption subunit 3074 .

[0156] The slicing subunit 3071 is used to split the encryption result into data ciphertext, key and vector by bit; the root key reading subunit 3072 is used to read the stored root key from the specified location; the first decryption subunit 3073 is used to use the PBKDF2 standard decryption interface to decrypt the key into a working key through the root key; the second decryption subunit 3074 is used to use the AES256 standard decryption interface to decrypt the data ciphertext into original data through the vector and working key to obtain the decryption result.

[0157] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned system security encryption and decryption device 300 and each unit can refer to the corresponding description in the aforementioned method embodiment. For the convenience and brevity of the description, it will not be repeated here.

[0158] The system security encryption and decryption device 300 can be implemented in the form of a computer program. The computer program can be used in Figure 12 Runs on the computer equipment shown.

[0159] See also Figure 12 , Figure 12 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0160] See Figure 12 The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0161] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can enable the processor 502 to perform a system security encryption and decryption method.

[0162] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0163] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a system security encryption and decryption method.

[0164] The network interface 505 is used to communicate with other devices through the network. Figure 12The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0165] The processor 502 is configured to execute a computer program 5032 stored in the memory to implement the following steps:

[0166] Obtain a data processing request; determine whether the data processing request is a request for encrypted data; if the data processing request is a request for encrypted data, encrypt the original data according to the data processing request in combination with a key to obtain an encryption result; store the encryption result in a configuration file; when a key is updated, re-encrypt the original data corresponding to the encryption result according to the new key to update the encryption result; if the data processing request is not a request for encrypted data, read the corresponding encryption result from the configuration file according to the data processing request; decrypt the encryption result to obtain a decrypted result; and output the decrypted result.

[0167] In one embodiment, when the processor 502 implements the step of re-encrypting the original data corresponding to the encryption result according to the new key to update the encryption result when a key update occurs, the processor 502 specifically implements the following steps:

[0168] When a key update occurs, a new key is obtained; the encryption result that needs to be updated is read from the configuration file; the encryption result that needs to be updated is re-encrypted in combination with the new key to obtain a new encryption result; the new encryption result is stored in a temporary storage area; the encryption result in the configuration file is re-encrypted according to the new key, and the encrypted ciphertext is stored in the temporary storage area; the ciphertext in the temporary storage area and the new encryption result are stored as the encryption result in the configuration file.

[0169] In one embodiment, after implementing the step of storing the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file, the processor 502 further implements the following steps:

[0170] The timer is reset, and when the current time reaches the time set by the timer and a key update occurs, the step of obtaining a new key when a key update occurs is executed.

[0171] In one embodiment, when the processor 502 implements the step of re-encrypting the encryption result that needs to be updated with the new key to obtain a new encryption result, the processor 502 specifically implements the following steps:

[0172] The encryption result that needs to be updated is decrypted to obtain the original data; and the original data is re-encrypted using the new key to obtain a new encryption result.

[0173] In one embodiment, when the processor 502 implements the step of encrypting the original data according to the data processing request and the key to obtain an encryption result, it specifically implements the following steps:

[0174] The invention relates to a method for obtaining a cryptographic key, comprising: reading a password or data to be encrypted according to the data processing request to obtain the original data; obtaining the original root key; generating a random number through the OpenSSL library standard interface to obtain a salt value; encrypting the original root key through the salt value using the PBKDF2 standard encryption algorithm to obtain a root key, and storing the root key in a specified location; generating a random number, encrypting the random number through the salt value using the PBKDF2 standard encryption algorithm to obtain a working key; generating another random number through the OpenSSL library standard interface to obtain a vector; encrypting the working key through the root key and the vector using the AES256 standard encryption algorithm to obtain a key; encrypting the original data through the working key using the AES256 standard encryption algorithm to obtain a data ciphertext; and concatenating the data ciphertext, the key, and the vector to obtain an encryption result.

[0175] In one embodiment, when the processor 502 implements the step of decrypting the encryption result to obtain the decryption result, it specifically implements the following steps:

[0176] The encryption result is divided into data ciphertext, key and vector by bit; the stored root key is read from the specified location; the key is decrypted into a working key using the root key using the PBKDF2 standard decryption interface; the data ciphertext is decrypted into original data using the vector and the working key using the AES256 standard decryption interface to obtain the decryption result.

[0177] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0178] Those skilled in the art will appreciate that all or part of the steps in the method of the above-described embodiment can be implemented by instructing the relevant hardware through a computer program. The computer program includes program instructions, which can be stored in a storage medium that is computer-readable. The program instructions are executed by at least one processor in the computer system to implement the steps in the method of the above-described embodiment.

[0179] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor performs the following steps:

[0180] Obtain a data processing request; determine whether the data processing request is a request for encrypted data; if the data processing request is a request for encrypted data, encrypt the original data according to the data processing request in combination with a key to obtain an encryption result; store the encryption result in a configuration file; when a key is updated, re-encrypt the original data corresponding to the encryption result according to the new key to update the encryption result; if the data processing request is not a request for encrypted data, read the corresponding encryption result from the configuration file according to the data processing request; decrypt the encryption result to obtain a decrypted result; and output the decrypted result.

[0181] In one embodiment, when the processor executes the computer program to implement the step of re-encrypting the original data corresponding to the encryption result according to the new key to update the encryption result when a key update occurs, the processor specifically implements the following steps:

[0182] When a key update occurs, a new key is obtained; the encryption result that needs to be updated is read from the configuration file; the encryption result that needs to be updated is re-encrypted in combination with the new key to obtain a new encryption result; the new encryption result is stored in a temporary storage area; the encryption result in the configuration file is re-encrypted according to the new key, and the encrypted ciphertext is stored in the temporary storage area; the ciphertext in the temporary storage area and the new encryption result are stored as the encryption result in the configuration file.

[0183] In one embodiment, after executing the computer program to implement the step of storing the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file, the processor further implements the following steps:

[0184] The timer is reset, and when the current time reaches the time set by the timer and a key update occurs, the step of obtaining a new key when a key update occurs is executed.

[0185] In one embodiment, when the processor executes the computer program to implement the step of re-encrypting the encryption result that needs to be updated with the new key to obtain a new encryption result, the processor specifically implements the following steps:

[0186] The encryption result that needs to be updated is decrypted to obtain the original data; and the original data is re-encrypted using the new key to obtain a new encryption result.

[0187] In one embodiment, when the processor executes the computer program to implement the step of encrypting the original data according to the data processing request in combination with the key to obtain an encryption result, the processor specifically implements the following steps:

[0188] The invention relates to a method for obtaining a cryptographic key, comprising: reading a password or data to be encrypted according to the data processing request to obtain the original data; obtaining the original root key; generating a random number through the OpenSSL library standard interface to obtain a salt value; encrypting the original root key through the salt value using the PBKDF2 standard encryption algorithm to obtain a root key, and storing the root key in a specified location; generating a random number, encrypting the random number through the salt value using the PBKDF2 standard encryption algorithm to obtain a working key; generating another random number through the OpenSSL library standard interface to obtain a vector; encrypting the working key through the root key and the vector using the AES256 standard encryption algorithm to obtain a key; encrypting the original data through the working key using the AES256 standard encryption algorithm to obtain a data ciphertext; and concatenating the data ciphertext, the key, and the vector to obtain an encryption result.

[0189] In one embodiment, when the processor executes the computer program to implement the step of decrypting the encryption result to obtain the decryption result, the processor specifically implements the following steps:

[0190] The encryption result is divided into data ciphertext, key and vector by bit; the stored root key is read from the specified location; the key is decrypted into a working key using the root key using the PBKDF2 standard decryption interface; the data ciphertext is decrypted into original data using the vector and the working key using the AES256 standard decryption interface to obtain the decryption result.

[0191] The storage medium may be any computer-readable storage medium that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0192] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0193] In the several embodiments provided herein, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the various units is merely a logical functional division, and actual implementation may employ other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0194] The steps in the methods of the embodiments of the present invention may be adjusted in order, combined, or deleted as needed. The units in the devices of the embodiments of the present invention may be combined, divided, or deleted as needed. Furthermore, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0195] If this integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, terminal, or network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present invention.

[0196] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. System security encryption and decryption method, characterized in that: include: Obtain data processing requests; Determining whether the data processing request is a request for encrypted data; If the data processing request is a request for encrypting data, encrypting the original data according to the data processing request in combination with a key to obtain an encryption result; Storing the encryption result in a configuration file; When a key update occurs, the original data corresponding to the encryption result is re-encrypted according to the new key to update the encryption result; If the data processing request is not a request for encrypting data, reading a corresponding encryption result from the configuration file according to the data processing request; Decrypting the encryption result to obtain a decryption result; Outputting the decryption result; When a key update occurs, re-encrypting the original data corresponding to the encryption result according to the new key to update the encryption result includes: When a key update occurs, obtain the new key; Read the encryption result that needs to be updated from the configuration file; Re-encrypting the encryption result that needs to be updated with the new key to obtain a new encryption result; Storing the new encryption result in a temporary storage area; Re-encrypting the encryption result in the configuration file according to the new key, and storing the encrypted ciphertext in a temporary storage area; The ciphertext in the temporary storage area and the new encryption result are stored in the configuration file as the encryption result.

2. The system security encryption and decryption method according to claim 1, characterized in that: After storing the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file, the method further includes: The timer is reset, and when the current time reaches the time set by the timer and a key update occurs, the step of obtaining a new key when a key update occurs is executed.

3. The system security encryption and decryption method according to claim 1, characterized in that: The step of re-encrypting the encryption result that needs to be updated by combining it with the new key to obtain a new encryption result includes: Decrypt the encrypted result that needs to be updated to obtain the original data; The original data is re-encrypted using the new key to obtain a new encryption result.

4. The system security encryption and decryption method according to claim 1, characterized in that: The encrypting the original data according to the data processing request in combination with a key to obtain an encryption result includes: Reading the password or data to be encrypted according to the data processing request to obtain the original data; Get the original root key; Generate a random number through the OpenSSL library standard interface to obtain the salt value; Use the PBKDF2 standard encryption algorithm to encrypt the original root key with the salt value to obtain the root key, and store the root key in the specified location; Generate a random number and use the PBKDF2 standard encryption algorithm to encrypt the random number with the salt value to obtain the working key; Generate another random number through the OpenSSL library standard interface to obtain a vector; Use the AES256 standard encryption algorithm to encrypt the working key with the root key and vector to obtain the key; Use the AES256 standard encryption algorithm to encrypt the original data with the working key to obtain the data ciphertext; The data ciphertext, key and vector are concatenated to obtain the encryption result.

5. The system security encryption and decryption method according to claim 4, characterized in that: Decrypting the encryption result to obtain a decryption result includes: Splitting the encryption result into data ciphertext, key and vector by bit; Read the stored root key from the specified location; Use the PBKDF2 standard decryption interface to decrypt the key into a working key using the root key; Use the AES256 standard decryption interface to decrypt the data ciphertext into original data through the vector and working key to obtain the decryption result.

6. System security encryption and decryption device, characterized in that: include: A request acquisition unit, used to acquire a data processing request; a request determination unit, configured to determine whether the data processing request is a request for encrypted data; an encryption unit, configured to, if the data processing request is a request for encrypting data, encrypt the original data according to the data processing request in combination with a key to obtain an encryption result; A storage unit, configured to store the encryption result in a configuration file; an updating unit, configured to re-encrypt the original data corresponding to the encryption result according to the new key when a key update occurs, so as to update the encryption result; a result reading unit, configured to read a corresponding encryption result from the configuration file according to the data processing request if the data processing request is not a request for encrypting data; a decryption unit, configured to decrypt the encryption result to obtain a decrypted result; An output unit, configured to output the decryption result; The updating unit includes: A new key acquisition subunit is used to obtain a new key when a key update occurs; A reading subunit, configured to read the encryption result to be updated from the configuration file; a re-encryption subunit, configured to re-encrypt the encryption result to be updated using the new key to obtain a new encryption result; A temporary storage subunit, used for storing the new encryption result in a temporary storage area; All encryption subunits are used to re-encrypt the encryption results in the configuration file according to the new key and store the encrypted ciphertext in a temporary storage area; The moving-in subunit is used to store the ciphertext in the temporary storage area and the new encryption result as the encryption result in the configuration file.

7. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 5 when executing the computer program.

8. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images