Logistics data encryption and decryption method, device and storage medium

Abstract

The present invention discloses a method, device and storage medium for encrypting and decrypting logistics data. The method includes: determining a target object to be distributed, and a key management system obtaining the privacy data of the target object; the key management system generates at least one key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK; the key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information on the express delivery bill of the target object; the key management system at least sends the key encryption key KEK and the key encryption result ECEK to the user terminal. The present invention solves the technical problem that it is difficult to prevent a large amount of user information from being leaked in the scene of logistics and express delivery in the related technology.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, device and storage medium for encrypting and decrypting logistics data. Background Art

[0002] At present, when shopping on e-commerce platforms, the personal privacy data of the recipient of the goods, such as name, address, mobile phone number, etc., will be sent in original form to the third-party logistics company. The third-party logistics company will then deliver the express based on this information. However, these companies are at risk of having their databases leaked, and the companies themselves may even be motivated by the profit of selling personal information, which can lead to large-scale leakage of user personal information.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a method, device and storage medium for encrypting and decrypting logistics data, so as to at least solve the technical problem that the related technology is difficult to prevent the large-scale leakage of user information in the logistics and express delivery scenario.

[0005] According to one aspect of an embodiment of the present invention, a method for encrypting and decrypting logistics data is provided, comprising: determining a target object to be distributed, and a key management system acquiring privacy data of the target object; the key management system generates at least one type of key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK; the key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information on a courier note of the target object; the key management system at least sends the key encryption key KEK and the key encryption result ECEK to a user terminal.

[0006] Optionally, the method also includes: the key management system generates a user key UK and time verification information of the user key UK according to user authority, wherein the time verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0007] Optionally, the key management system generates a user key UK and time validity verification information of the user key UK according to user authority, including: before determining the target object to be distributed, the key management system sends a decryption authority request to the user management system; the key management system receives decryption information returned by the user management system in response to the decryption authority request, wherein the decryption information at least includes: the user key UK and time validity verification information of the user key UK.

[0008] Optionally, the key management system controls the user key UK to be updated once every first period, controls the content key CEK to be updated once every second period, controls the key encryption key KEK to be updated once every third period, and the duration of the first period is greater than the duration of the second period.

[0009] Optionally, the encrypted privacy information loaded on the express delivery note of the target object carries a key indication bit, wherein the key indication bit is used to indicate the extraction of the content key CEK and the key encryption key KEK generated within the corresponding period.

[0010] Optionally, the method also includes: a terminal decryption system on the user terminal performs time verification based on the time verification information; if the verification passes, the terminal decryption system reads the user key UK from the key storage device, and uses the user key UK to decrypt the reused encryption result EKEK to generate a current key encryption key KEK; the terminal decryption system uses the key encryption key KEK obtained by decryption to decrypt the key encryption result ECEK to generate a corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the content key CEK obtained by decryption is used to decrypt the encrypted privacy information to obtain the privacy data of the target object.

[0011] Optionally, after decrypting and generating the corresponding content key CEK, the method further includes: the terminal confidentiality system uses verification conditions to verify the content key CEK obtained by decryption, wherein the verification conditions include at least one of the following: whether the decryption time is within a predetermined time period, whether the number of user decryption times exceeds a limited value, whether the decrypted geographical location is within a predetermined address range, whether the decryption frequency exceeds a predetermined frequency, whether the number of user violations exceeds a predetermined number, and whether the user service area is within a predetermined area; if the verification passes, triggering the step of using the decrypted content key CEK to decrypt the encrypted privacy information.

[0012] Optionally, the method also includes: a terminal decryption system on the user terminal performs time verification based on the time verification information; if the verification passes, the terminal decryption system reads the key encryption key KEK from the key storage device, and uses the key encryption key KEK to decrypt the key encryption result ECEK to generate a corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the encrypted privacy information is decrypted using the decrypted content key CEK to obtain the privacy data of the target object.

[0013] Optionally, the private information is graphically encoded and then loaded onto the express delivery slip of the target object in the form of graphics and text.

[0014] According to one aspect of an embodiment of the present invention, a method for encrypting and decrypting logistics data is provided, comprising: determining a target object to be distributed, and a key management system acquiring privacy data of the target object; the key management system generates at least one type of key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK; the key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information and the key encryption result ECEK on a courier note of the target object; the key management system at least sends the key encryption key KEK to a user terminal.

[0015] Optionally, the method also includes: the key management system generates a user key UK and time verification information of the user key UK according to user authority, wherein the time verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0016] According to one aspect of an embodiment of the present invention, a method for encrypting and decrypting logistics data is provided, comprising: scanning a target object to be distributed, and displaying the privacy data of the target object in a privacy protection interaction panel; selecting at least one key data in a function menu provided on the privacy protection interaction panel, wherein the key data at least includes: a content key CEK, a key encryption key KEK; when an encryption instruction is detected on the privacy protection interaction panel, performing an encryption operation using the selected key data; displaying the express delivery slip of the target object on the privacy protection interaction panel, and loading the result of the encryption operation on the express delivery slip of the target object; triggering a printing function on the privacy protection interaction panel to print the express delivery slip.

[0017] Optionally, the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, and using a key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK.

[0018] Optionally, the method further includes: sending the key encryption key KEK and the key encryption result ECEK to a user terminal.

[0019] According to one aspect of an embodiment of the present invention, there is provided an encryption and decryption device for logistics data, comprising: a first acquisition module, used for determining a target object to be distributed, and a key management system for acquiring privacy data of the target object; a first generation module, used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK; a first encryption module, used for the key management system to perform an encryption operation on the key data, wherein the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; a first loading module, used for the key management system to at least load the encrypted privacy information on the express delivery note of the target object; and a first sending module, used for the key management system to at least send the key encryption key KEK and the key encryption result ECEK to a user terminal.

[0020] According to one aspect of an embodiment of the present invention, there is provided an encryption and decryption device for logistics data, comprising: a second acquisition module, used for determining a target object to be distributed, and a key management system acquiring the privacy data of the target object; a second generation module, used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: a content key CEK, a key encryption key KEK; a second encryption module, used for the key management system to perform an encryption operation on the key data, wherein the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; a second loading module, used for the key management system to at least load the encrypted privacy information and the key encryption result ECEK on the express delivery note of the target object; a second sending module, used for the key management system to at least send the key encryption key KEK to a user terminal.

[0021] According to one aspect of an embodiment of the present invention, there is provided a logistics data encryption and decryption device, comprising: a display module, used to scan a target object to be distributed, and display the privacy data of the target object in a privacy protection interaction panel; a selection module, used to select at least one key data in a function menu provided on the privacy protection interaction panel, wherein the key data at least includes: a content key CEK, a key encryption key KEK; a third encryption module, used to perform an encryption operation using the selected key data when an encryption instruction is detected on the privacy protection interaction panel; a third loading module, used to display the express delivery slip of the target object on the privacy protection interaction panel, and load the result of the encryption operation on the express delivery slip of the target object; a printing module, used to trigger a printing function on the privacy protection interaction panel and print the express delivery slip.

[0022] According to one aspect of an embodiment of the present invention, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the above-mentioned methods for encrypting and decrypting logistics data.

[0023] According to one aspect of an embodiment of the present invention, there is provided a computer device, comprising: a memory and a processor, wherein the memory stores a computer program; the processor is used to execute the computer program stored in the memory, wherein when the computer program is executed, the processor executes any one of the above-mentioned methods for encrypting and decrypting logistics data.

[0024] In the embodiment of the present invention, the key management system obtains the privacy data of the target object to be distributed, performs encryption operations on at least one key data generated in different cycles, and realizes the protection of user privacy data. In the process of performing the encryption operation, the content key CEK is used to encrypt the privacy data to generate encrypted privacy information, and the key encryption key KEK is used to encrypt the content key CEK to generate the key encryption result ECEK. The encrypted privacy information is loaded on the express delivery bill of the target object to protect the user's information, and the key encryption key KEK and the key encryption result ECEK are sent to the user terminal to be decrypted according to KEK and ECEK, thereby solving the technical problem that the related technology is difficult to prevent the large-scale leakage of user information in the logistics and express delivery scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a mobile device for implementing a method for encrypting and decrypting logistics data is shown;

[0027] Figure 2 is a flow chart of a first method for encrypting and decrypting logistics data according to Embodiment 1 of the present invention;

[0028] Figure 3 is a flow chart of a second method for encrypting and decrypting logistics data according to embodiment 1 of the present invention;

[0029] Figure 4 is a flow chart of a third method for encrypting and decrypting logistics data according to Embodiment 1 of the present invention;

[0030] Figure 5 is a diagram of a key system structure provided by an optional embodiment of the present invention;

[0031] Figure 6 is a key rotation flow chart provided by an optional implementation manner of the present invention;

[0032] Figure 7 is a schematic diagram of key authority management provided by an optional implementation mode of the present invention;

[0033] Figure 8 This is a structural block diagram of a first device for encrypting and decrypting logistics data provided in accordance with Embodiment 2 of the present invention;

[0034] Fig. 9 is a structural block diagram of a second device for encrypting and decrypting logistics data provided in accordance with Embodiment 3 of the present invention;

[0035] Fig.10is a structural block diagram of a third device for encrypting and decrypting logistics data provided in accordance with Embodiment 4 of the present invention;

[0036] Fig.11 is a device block diagram of a terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0038] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0039] Example 1

[0040] According to an embodiment of the present invention, an embodiment of a method for encrypting and decrypting logistics data is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for encrypting and decrypting logistics data is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0042] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0043] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the method for encrypting and decrypting logistics data in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the method for encrypting and decrypting logistics data of the above-mentioned application program is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0044] The transmission device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0045] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0046] Under the above operating environment, this application provides Figure 2 The encryption and decryption method of logistics data is shown. Figure 2 is a flow chart of a method for encrypting and decrypting logistics data according to Embodiment 1 of the present invention. Figure 2 As shown, the method comprises the following steps:

[0047] Step S202, determining the target object to be distributed, and the key management system obtains the private data of the target object;

[0048] Step S204, the key management system generates at least one key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK;

[0049] Step S206, the key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK;

[0050] Step S208, the key management system at least loads the encrypted private information on the express delivery note of the target object;

[0051] Step S210: The key management system sends at least the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0052] Through the above steps, the key management system obtains the privacy data of the target object to be distributed, generates at least one key data in different cycles to perform encryption operations, and realizes the protection of user privacy data. In the process of performing the encryption operation, the content key CEK is used to encrypt the privacy data to generate encrypted privacy information, and the key encryption key KEK is used to encrypt the content key CEK to generate the key encryption result ECEK. The encrypted privacy information is loaded on the express delivery list of the target object to protect the user's information, and the key encryption key KEK and the key encryption result ECEK are sent to the user terminal to be decrypted according to KEK and ECEK, thereby solving the technical problem that the related technology is difficult to prevent the large-scale leakage of user information in the logistics and express delivery scenario.

[0053] First of all, it should be noted that the above-mentioned target object is an object carrying private data, and the target object should be different depending on the scenario. The above-mentioned private data is also different data depending on the scenario and the target object. For example, in the logistics and express delivery scenario, the target object refers to the express package, and the private data is the user's name, address, phone number and other data.

[0054] It should also be noted that the above-mentioned key management system is a system that can encrypt and decrypt private data, and can generate key data in different cycles to enhance the security of key use. The key data generated by the key management system includes: content key CEK and key encryption key KEK. Among them, the content key CEK is used to encrypt user privacy information and is updated at a certain period; the key encryption key KEK is used to encrypt the content key CEK, that is, to protect the content key CEK, and can also be used to control the object usage rights, and is updated at a longer period. The key management system can also generate a user key UK according to the user's authority. The user key UK is used to protect the key encryption key KEK. The update cycle is generally longer and is updated at the longer cycle. Therefore, during the use of the key management system, the key management system controls the user key UK to be updated once every first cycle, controls the content key CEK to be updated once every second cycle, and controls the key encryption key KEK to be updated once every third cycle. The duration of the first cycle is greater than the duration of the second cycle, and is also greater than the duration of the third cycle. To ensure the security of key use.

[0055] As an optional embodiment, the target object to be distributed is determined, the key management system obtains the privacy data of the target object, and performs encryption operations on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, and using the key encryption key KEK to encrypt the content key CEK to generate the key encryption result ECEK. Afterwards, the encrypted privacy information is loaded on the express delivery slip of the target object, so that the express delivery slip does not need to display the user's privacy data, and the privacy data is recorded and encrypted to generate encrypted privacy information, thereby protecting the privacy data and avoiding direct leakage of the privacy data. Moreover, the privacy information can be loaded on the express delivery slip of the target object in the form of graphics and text after being graphic-encoded. Through the form of graphic coding, not only the privacy data is encrypted, but also the encrypted privacy information in the form of graphic coding can be better read by the courier, for example, by scanning the code, which speeds up the delivery process.

[0056] As an optional embodiment, the key management system then sends the key encryption key KEK and the key encryption result ECEK to the user terminal, so that the user terminal can decrypt according to the key encryption key KEK and the key encryption result ECEK to obtain the content encryption key CEK. The user terminal can be a terminal that needs to decrypt private information. For example, in the logistics and express delivery scenario, the user terminal can be a mobile terminal used by the courier. By allowing the mobile terminal used by the courier to receive the key encryption key KEK and the key encryption result ECEK, the encrypted private information on the express delivery order can be decrypted according to the key encryption key KEK and the key encryption result ECEK, thereby realizing the delivery of the express delivery. At the same time, it also prevents other objects from obtaining the key encryption key KEK and the key encryption result ECEK to decrypt private data.

[0057] As an optional embodiment, the encrypted privacy information loaded on the express delivery bill of the target object can also carry a key indicator bit, wherein the key indicator bit is used to indicate the extraction of the content key CEK and the key encryption key KEK generated in the corresponding period. Because the content key CEK and the key encryption key KEK are updated in different periods, that is, they are updated in different periods, and can be rotated regularly to enhance the security of key use. Therefore, the encrypted privacy information on the express delivery bill must also carry a key indicator bit to determine which period of content key to use for decryption. For example, in the scenario of logistics express delivery, express delivery has regional characteristics and timeliness characteristics, and the express delivery in July may need to wait until August to start delivery. At this time, according to the key indicator bit carried in the encrypted privacy information on the express delivery bill, the terminal decryption system can obtain the key encryption key KEK of the corresponding distribution area in July to decrypt the key encryption result on the bill to obtain the content key CEK, so as to ensure that the decryption operation can be performed, and the normal and orderly delivery is guaranteed. It should be noted that the number of key indicator bits and the meaning they represent can be customized. For example, when the key indicator bit is 1, the content key of an odd period is used for decryption, and when the key indicator bit is 0, the content key of an even period is used for decryption. The key indicator bit can be multiple bits. The longer the number of key indicator bits, the longer and clearer the indicated period span, making the key more secure.

[0058] As an optional embodiment, the key management system can also generate a user key UK and time verification information including a dynamic parameter D1 and a verification parameter V1 of the user key UK according to the user authority. The above information should not be the same according to different users. For example, the user key UK, the dynamic parameter D1 and the verification parameter V1 of the user key UK corresponding to the courier are generated. The key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK. The key management system sends the user key UK, the time verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal. So that on the user terminal, the multiplexed encryption result EKEK is decrypted according to the user key UK and the time verification information of the user key UK. It should be noted that the time for obtaining the time verification information can be before determining the target object to be distributed. When the key management system sends a decryption authority request to the user management system, the key management system receives the decryption information returned by the user management system in response to the decryption authority request. The decryption information includes the user key UK and the time verification information of the user key UK. The key management system thus obtains the user key UK and the time validity verification information including the dynamic parameter D1 and the verification parameter V1 of the user key UK based on the decrypted information.

[0059] As an optional embodiment, the terminal decryption system on the user terminal performs time verification based on the time verification information, and can verify the validity of D1 and V1 through the UK calculator. If it is invalid, it will not be calculated and the verification will fail. If it is valid, the verification will pass. If the verification passes, the decryption operation is performed. In the case where the key storage includes the user key UK and the reused encryption result EKEK, the terminal decryption system reads the user key UK from the key storage, and uses the user key UK to decrypt the reused encryption result EKEK to generate the current key encryption key KEK. The terminal decryption system uses the key encryption key KEK obtained by decryption to decrypt the key encryption result ECEK and generate the corresponding content key CEK. After the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the encrypted privacy information is decrypted using the decrypted content key CEK. In the case where the key storage does not include the user key UK and the reused encryption result EKEK, but includes the key encryption key KEK and the key encryption result ECEK, the terminal decryption system reads the key encryption key KEK from the key storage, and uses the key encryption key KEK to decrypt the key encryption result ECEK to generate the corresponding content key CEK. After the terminal decryption system obtains the corresponding encrypted private information by scanning the express delivery slip, it uses the decrypted content key CEK to decrypt the encrypted private information and obtain the private data of the target object, thereby obtaining the private data of the target object so as to deliver the target object.

[0060] As an optional embodiment, after decrypting and generating the corresponding content key CEK, the following steps can also be performed: the terminal confidentiality system verifies the decrypted content key CEK using verification conditions, wherein the verification conditions include at least one of the following: whether the decryption time is within a predetermined time period, whether the number of user decryption times exceeds a limit value, whether the decryption geographical location is within a predetermined address range, whether the decryption frequency exceeds a predetermined frequency, whether the number of user violations exceeds a predetermined number, and whether the user service area is within a predetermined area. If the verification is successful, the step of decrypting the encrypted private information using the decrypted content key CEK is triggered. That is, only after the verification is successful can the decryption key be used to decrypt the private data. In the logistics express delivery scenario, when the courier decrypts the private data for delivery, the decryption operation will be subject to additional time and space restrictions. The delivery of the package can only be carried out within a specified time. If the decryption time is not within the time period, it is considered that the verification has failed; at the same time, the courier can only decrypt the private information near the consignee's address, and the frequency of using the decryption key to decrypt the private information within the specified time cannot be too high, otherwise it will trigger a violation and the verification will fail. In addition, when the courier's decryption location changes significantly within a certain period of time, such as moving from City C to City D within 10 minutes, it can directly trigger the key permission management layer to issue an alarm, and the private information cannot be decrypted normally, which more effectively protects the user's information from being leaked.

[0061] Figure 3 is a flow chart of a second method for encrypting and decrypting logistics data according to Embodiment 1 of the present invention. Figure 3 As shown, the method comprises the following steps:

[0062] Step S302, determining the target object to be distributed, and the key management system obtains the private data of the target object;

[0063] Step S304, the key management system generates at least one key data in different cycles, wherein the key data at least includes: a content key CEK and a key encryption key KEK;

[0064] Step S306, the key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK;

[0065] Step S308, the key management system loads at least the encrypted privacy information and the key encryption result ECEK on the express delivery note of the target object;

[0066] Step S310: The key management system at least sends the key encryption key KEK to the user terminal.

[0067] Through the above steps, the key management system obtains the privacy data of the target object to be distributed, generates at least one key data in different cycles to perform encryption operations, and realizes the protection of user privacy data. In the process of performing the encryption operation, the content key CEK is used to encrypt the privacy data to generate encrypted privacy information, and the key encryption key KEK is used to encrypt the content key CEK to generate the key encryption result ECEK. The encrypted privacy information and the key encryption result ECEK are loaded on the express delivery bill of the target object to protect the user's information, and the key encryption key KEK is sent to the user terminal to decrypt according to the KEK and ECEK, thereby solving the technical problem that the related technology is difficult to prevent the large-scale leakage of user information in the logistics and express delivery scenario.

[0068] Figure 4 : is a flow chart of a third method for encrypting and decrypting logistics data according to Embodiment 1 of the present invention. Figure 4 As shown, the method comprises the following steps:

[0069] Step S402, scanning the target object to be distributed, and displaying the privacy data of the target object in the privacy protection interactive panel;

[0070] Step S404, selecting at least one key data in the function menu provided on the privacy protection interaction panel, wherein the key data at least includes: a content key CEK and a key encryption key KEK;

[0071] Step S406, when an encryption instruction is detected on the privacy protection interaction panel, the encryption operation is performed using the selected key data;

[0072] Step S408, displaying the express delivery note of the target object on the privacy protection interactive panel, and loading the result of the encryption operation on the express delivery note of the target object;

[0073] Step S410, triggering the print function on the privacy protection interactive panel to print the express delivery slip.

[0074] Through the above steps, the target object to be distributed is scanned, the privacy data of the target object is displayed in the privacy protection interaction panel, and at least one key data is selected in the function menu provided on the privacy protection interaction panel, so that when an encryption instruction is detected on the privacy protection interaction panel, the selected key data is used to perform the encryption operation to achieve the protection of the user's privacy data. The express delivery slip of the target object is displayed on the privacy protection interaction panel, and the result of the encryption operation is loaded on the express delivery slip of the target object. The printing function is triggered on the privacy protection interaction panel to print the express delivery slip. Because the result of the encryption operation is loaded on the express delivery slip, the user's information is protected, thereby solving the technical problem that the relevant technology is difficult to prevent the large-scale leakage of user information in the logistics and express delivery scenario.

[0075] Based on the above embodiments and optional embodiments, an optional implementation is provided, which is described in detail below.

[0076] In related technologies, in order to prevent large-scale leakage of user personal information, it is conceived to encrypt user personal information in some way and then distribute it to logistics companies. When delivering the express, the courier obtains the user information by decoding it at the terminal. However, due to the regional and time characteristics in the field of logistics and express delivery, the traditional key rotation mechanism cannot be directly used in this scenario. For example, the express before the key rotation may be delivered after the key rotation, and the key after the rotation will not be able to decrypt the user information on the express.

[0077] Based on this, in an optional implementation of the present invention, a key rotation and authority management scheme for the field of logistics and express delivery is provided, which can be applied to the encryption of user information on logistics and express delivery orders, the field of logistics and express delivery, and other information transmission scenarios with time-delay characteristics. In view of the delay in information transmission in the field of logistics and express delivery, and the spatial intersection of key use, a key rotation system that can be applied to this scenario is specially designed. Specifically, it is a set of multi-party and multi-level keys and corresponding encryption schemes and a layer of key authority management. The optional implementation of the present invention is described in detail below.

[0078] Figure 5 is a diagram of a key system structure provided by an optional embodiment of the present invention, such as Figure 5 As shown in the figure, it mainly includes multiple layers of keys and one layer of key authority management. The figure takes three layers of keys as an example. The three layers of keys include content key CEK (ContentEncryption Key), key encryption key KEK (Key Encryption Key), and user key UK (User Key). In the field of logistics and express delivery, each small area, such as the privacy data on all express delivery bills in City A, is encrypted with the same content key CEK; each large area, such as the content key CEK of all prefecture-level cities in Province B, is encrypted with a key encryption key KEK.

[0079] (I) The following is an introduction to the three-layer key:

[0080] 1) The content key CEK is used to encrypt user privacy information and is updated at a certain period. It is encrypted into ECEK (Encrypted CEK) by the CEK encryptor. ECEK can be sent directly to the user terminal or printed on the express delivery label to reduce the key transmission and storage costs.

[0081] 2) The key encryption key KEK is used to encrypt the content key CEK, that is, to protect the content key CEK, and also to control the object usage rights. The key encryption key KEK can be updated at a longer period and sent to the user terminal in the form of EKEK (Encrypted KEK) through the KEK encryptor.

[0082] 3) The user key UK is used to protect the key encryption key KEK. The update cycle of the user key UK is generally longer, which is several times the update cycle of the KEK.

[0083] It should be noted that there are generally multiple content keys CEK and key encryption keys KEK in the same cycle, and the content key CEK and key encryption key KEK to be used can be determined based on the key indicator bit in the encrypted privacy information.

[0084] (II) The following is an introduction to the key decryption process:

[0085] S1, the front-end key management system generates the user key UK, the dynamic parameter D1 of the user key UK and the verification parameter V1 according to the user authority, and sends the latter two parameters, namely D1 and V1, to the user terminal;

[0086] S2, after the user terminal receives D1 and V1, its UK calculator will verify the validity of D1 and V1. If they are invalid, no calculation will be performed and the verification will fail;

[0087] S3, if valid, calculate UK. After verification, use the KEK decryptor and the user key UK to decrypt EKEK to obtain the key encryption key KEK;

[0088] S4, decrypt ECEK with the key encryption key KEK to obtain the content encryption key CEK;

[0089] S5, the key authority management layer verifies the content key CEK and the user authorization information. If the verification is successful, the encrypted private information is decrypted using the content key CEK. If the verification fails, the decryption cannot be performed normally.

[0090] (III) The key rotation process is introduced below:

[0091] Since the security of private data depends on the security of keys, an optional implementation of the present invention enhances the security of key usage by key versioning or periodic rotation. Figure 6 is a key rotation flow chart provided by an optional embodiment of the present invention, such as Figure 6As shown, in the field of logistics and express delivery, since the encrypted privacy information is not required to be fully decrypted in the current cycle, some encrypted information will be postponed to the next cycle due to the physical transmission and delivery progress, and a courier's service area may span multiple large areas. Therefore, in a certain cycle, the key storage device needs to contain not only the key encryption key of the current cycle of the distribution area, but also the key encryption key of the previous one or several cycles of the distribution area for decrypting the corresponding content key.

[0092] For example, due to the regional characteristics and timeliness characteristics in the field of logistics and express delivery, the express delivery in July may not be delivered until August. The same courier may deliver to multiple large areas, and the key storage device needs to store the key encryption keys of different periods of the corresponding delivery areas. According to the key indicator bit on the delivery bill, the terminal decryption system can directly use the key encryption key KEK of the corresponding large delivery area in July to decrypt the ECEK on the delivery bill to obtain the content key CEK. If the ECEK is sent to the terminal decryption system in the form of network transmission, several key indicator bits can be added to the encrypted privacy information. When decoding, the key indicator bit in the encrypted information is first extracted, and then the key indicator bit is used to determine which period of content key to use for decryption. Taking a key indicator bit as an example, the key indicator bit is 1, and the content key of the odd period is used for decryption. The key indicator bit is 0, and the content key of the even period is used for decryption. The number of bits of the key indicator bit can be multiple bits. The longer the length, the longer and clearer the indicated period span, making the key more secure.

[0093] (IV) The following is an introduction to key authority management:

[0094] Figure 7 Schematic diagram of key authority management provided by an optional implementation mode of the present invention, such as Figure 7As shown in the figure, after the user obtains the decryption key, the key authority management layer will make judgments based on the current decryption time, whether the number of user decryption times exceeds the limit, the current decryption geographical location, the decryption frequency, the number of user violations, the user service area and other parameters. Only when the key authority management layer passes the verification can the decryption key be used to decrypt the private information. In the field of logistics and express delivery, the courier's decryption operation will be subject to additional time and space restrictions. The delivery of packages can only be carried out within a specified time. If the decryption time is not within this time period, it is considered that the verification has failed; at the same time, the courier can only decrypt the private information near the consignee's address, and the frequency of using the decryption key to decrypt the private information within the specified time cannot be too high, otherwise it will trigger a violation and the verification will fail. In addition, when the user's decryption geographical location changes significantly within a certain period of time, such as moving from City C to City D within 10 minutes, it can directly trigger the key authority management layer to alarm, and the private information cannot be decrypted normally. It is more effective to protect the user's information from being leaked.

[0095] It should be noted that the above optional implementation of the present invention also provides two other alternative solutions, which can be implemented in other ways:

[0096] 1) Obtain user information (such as name, mobile phone number, etc.) from the user privacy information system, and use the content key CEK corresponding to the small area where the user is located to encrypt the privacy information M. The content key CEK is rotated and updated at a fixed period, and the ciphertext data EM is directly printed on the express delivery bill after being graphic-encoded; before the courier delivers the letter, the courier requests decryption permission from the user management system. After the key management system authorizes the courier, it generates the corresponding courier's user key UK, the dynamic parameter D1 of the user key UK, and the verification parameter V1. The user key UK is used to encrypt the content key CEK of the small area where the courier delivers the letter. The encrypted ECEK, dynamic parameter D1, and verification parameter V1 are directly sent to the courier's terminal decryption system; after the terminal decryption system receives D1 and V1, its UK calculator will verify the validity of D1 and V1. If valid, UK is calculated, otherwise it is not calculated and the verification fails. After the verification is successful, the CEK decryptor and the user key UK are used to decrypt the ECEK to obtain the content key CEK of the corresponding delivery area. The key authority management layer verifies the content key CEK and the user authorization information. After the verification is passed, the content key CEK is used to decrypt the private information graphic code on the encrypted face sheet. If the verification fails, it cannot be decrypted normally.

[0097] 2) Obtain user information (such as name, mobile phone number, etc.) from the user privacy information system, and use the content key CEK corresponding to the small area where the user is located to encrypt the privacy information M. The content key CEK is rotated and updated at a fixed period, and the ciphertext data EM is directly printed on the express delivery bill after graphic encoding; the key management system generates a key encryption key KEK for a large area, each large area has n small areas, and the key encryption key KEK is used to encrypt the content keys CEK of the n small areas. The key encryption key KEK is rotated and updated at a longer period, and the encrypted ECEK can be directly printed on the express delivery bill after graphic encoding or sent to the terminal decryption system through network transmission; before delivering the letter, the courier requests decryption permission from the user management system. After the key management system authorizes the courier, it generates the corresponding courier's user key UK, the dynamic parameter D1 of the user key UK, and the verification parameter V1. Use the UK to encrypt the key encryption key KEK of the region where the courier is located. The encrypted EKEK, dynamic parameter D1 and verification parameter V1 are directly sent to the courier's terminal decryption system; after the terminal decryption system receives D1 and V1, its UK calculator will verify the validity of D1 and V1. If valid, UK will be calculated, otherwise UK will not be calculated and the verification will fail. After the verification is successful, use the KEK decryptor and user key UK to decrypt EKEK to obtain the key decryption key KEK; the key encryption key KEK decrypts ECEK to obtain the content key CEK of the corresponding distribution area. The key authority management layer verifies the content key CEK and the user authorization information. After the verification is passed, the content key CEK is used to decrypt the private information graphic code on the encrypted delivery note. If the verification fails, it cannot be decrypted normally.

[0098] Through the above optional implementation, the following beneficial effects can be achieved:

[0099] (1) Periodic key rotation reduces the number of times each key is used, the timing, and the spatial usage range, creating a de facto isolation effect on the ciphertext data generated before and after the rotation;

[0100] (2) Security incidents of specific keys can be quickly defined to determine the scope of impact, so that further measures can be taken;

[0101] (3) Introducing a permission management scheme into the key architecture to control decryption permissions greatly increases the difficulty for attackers to crack ciphertext data on a large scale.

[0102] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0103] Through the description of the above implementation methods, those skilled in the art can clearly understand that the encryption and decryption method of logistics data according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0104] Example 2

[0105] According to an embodiment of the present invention, a device for implementing the above-mentioned method 1 for encrypting and decrypting logistics data is also provided. Figure 8 is a structural block diagram of a first device for encrypting and decrypting logistics data according to Embodiment 2 of the present invention. Figure 8 As shown, the device includes: a first acquisition module 802, a first generation module 804, a first encryption module 806, a first loading module 808 and a first sending module 810. The device is described below.

[0106] The first acquisition module 802 is used to determine the target object to be distributed, and the key management system obtains the privacy data of the target object; the first generation module 804 is connected to the above-mentioned first acquisition module 802, and is used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the first encryption module 806 is connected to the above-mentioned first generation module 804, and is used for the key management system to perform encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, and using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK; the first loading module 808 is connected to the above-mentioned first encryption module 806, and is used for the key management system to at least load the encrypted privacy information on the express delivery bill of the target object; the first sending module 810 is connected to the above-mentioned first loading module 808, and is used for the key management system to at least send the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0107] It should be noted that the first acquisition module 802, the first generation module 804, the first encryption module 806, the first loading module 808 and the first sending module 810 correspond to steps S202 to S210 in Example 1, and the examples and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules as part of the device can be run in the computer terminal 10 provided in Example 1.

[0108] Example 3

[0109] According to an embodiment of the present invention, a device for implementing the second method for encrypting and decrypting logistics data is also provided. Fig. 9 is a structural block diagram of a second device for encrypting and decrypting logistics data according to Embodiment 3 of the present invention. Fig. 9 As shown, the device includes: a second acquisition module 902, a second generation module 904, a second encryption module 906, a second loading module 908 and a second sending module 910. The device is described below.

[0110] The second acquisition module 902 is used to determine the target object to be distributed, and the key management system obtains the privacy data of the target object; the second generation module 904 is connected to the above-mentioned second acquisition module 902, and is used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the second encryption module 906 is connected to the above-mentioned second generation module 904, and is used for the key management system to perform encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, and using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK; the second loading module 908 is connected to the above-mentioned second encryption module 906, and is used for the key management system to at least load the encrypted privacy information and the key encryption result ECEK on the express delivery note of the target object; the second sending module 910 is connected to the above-mentioned second loading module 908, and is used for the key management system to at least send the key encryption key KEK to the user terminal.

[0111] It should be noted that the second acquisition module 902, the second generation module 904, the second encryption module 906, the second loading module 908 and the second sending module 910 correspond to steps S302 to S310 in Embodiment 1, and the examples and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above Embodiment 1. It should be noted that the above modules as part of the device can be run in the computer terminal 10 provided in Embodiment 1.

[0112] Example 4

[0113] According to an embodiment of the present invention, a device for implementing the third method for encrypting and decrypting logistics data is also provided. Fig.10 is a structural block diagram of a third device for encrypting and decrypting logistics data according to Embodiment 4 of the present invention. Fig.10 As shown, the device includes: a display module 1002, a selection module 1004, a third encryption module 1006, a third loading module 1008 and a printing module 1010. The device is described below.

[0114] A display module 1002 is used to scan the target object to be distributed and display the privacy data of the target object in the privacy protection interaction panel; a selection module 1004 is connected to the above-mentioned display module 1002, and is used to select at least one key data in the function menu provided on the privacy protection interaction panel, wherein the key data at least includes: content key CEK, key encryption key KEK; a third encryption module 1006 is connected to the above-mentioned selection module 1004, and is used to perform encryption operations using the selected key data when an encryption instruction is detected on the privacy protection interaction panel; a third loading module 1008 is connected to the above-mentioned third encryption module 1006, and is used to display the express delivery slip of the target object on the privacy protection interaction panel, and load the result of the encryption operation on the express delivery slip of the target object; a printing module 1010 is connected to the above-mentioned third loading module 1008, and is used to trigger the printing function on the privacy protection interaction panel to print the express delivery slip.

[0115] It should be noted that the above-mentioned display module 1002, selection module 1004, third encryption module 1006, third loading module 1008 and printing module 1010 correspond to steps S402 to S410 in Example 1, and the examples and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules as part of the device can be run in the computer terminal 10 provided in Example 1.

[0116] Example 5

[0117] The embodiment of the present invention can provide a computer terminal, which can be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal can also be replaced by a terminal device such as a mobile terminal.

[0118] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of the computer network.

[0119] In this embodiment, the above-mentioned computer terminal can execute the program code of the following steps in the method for encrypting and decrypting logistics data of the application: determining the target object to be distributed, and the key management system obtains the privacy data of the target object; the key management system generates at least one kind of key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the key management system performs encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, using the key encryption key KEK to encrypt the content key CEK to generate the key encryption result ECEK; the key management system at least loads the encrypted privacy information on the express delivery note of the target object; the key management system at least sends the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0120] Optionally, Fig.11 is a structural block diagram of a computer terminal according to an embodiment of the present invention. Fig.11 As shown, the computer terminal may include: one or more (only one is shown in the figure) processors 91, a memory 92, and other modules.

[0121] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the encryption and decryption detection method and device of logistics data in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned encryption and decryption method of logistics data. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0122] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the target object to be distributed, and the key management system obtains the privacy data of the target object; the key management system generates at least one kind of key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the key management system performs encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information on the express delivery note of the target object; the key management system at least sends the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0123] Optionally, the processor may also execute program codes of the following steps: the key management system generates a user key UK and time validity verification information of the user key UK according to user authority, wherein the time validity verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time validity verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0124] Optionally, the processor may also execute program code of the following steps: the key management system generates a user key UK and time validity verification information of the user key UK according to user authority, including: before determining the target object to be distributed, the key management system sends a decryption authority request to the user management system; the key management system receives decryption information returned by the user management system in response to the decryption authority request, wherein the decryption information includes at least: the user key UK and time validity verification information of the user key UK.

[0125] Optionally, the processor may also execute the program code of the following steps: the key management system controls the user key UK to be updated once every first cycle, controls the content key CEK to be updated once every second cycle, controls the key encryption key KEK to be updated once every third cycle, and the duration of the first cycle is greater than the duration of the second cycle.

[0126] Optionally, the processor may also execute the program code of the following steps: the encrypted privacy information loaded on the express delivery note of the target object carries a key indication bit, wherein the key indication bit is used to indicate the extraction of the content key CEK and the key encryption key KEK generated within the corresponding period.

[0127] Optionally, the processor may also execute the program code of the following steps: the terminal decryption system on the user terminal performs time verification based on the time verification information; if the verification passes, the terminal decryption system reads the user key UK from the key storage device, and uses the user key UK to decrypt the reused encryption result EKEK to generate the current key encryption key KEK; the terminal decryption system uses the decrypted key encryption key KEK to decrypt the key encryption result ECEK to generate the corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the decrypted content key CEK is used to decrypt the encrypted privacy information to obtain the privacy data of the target object.

[0128] Optionally, the processor may also execute the program code of the following steps: after decrypting and generating the corresponding content key CEK, the method further includes: the terminal confidentiality system uses verification conditions to verify the decrypted content key CEK, wherein the verification conditions include at least one of the following: whether the decryption time is within a predetermined time period, whether the number of user decryption times exceeds a limit value, whether the decrypted geographical location is within a predetermined address range, whether the decryption frequency exceeds a predetermined frequency, whether the number of user violations exceeds a predetermined number, and whether the user service area is within a predetermined area; if the verification passes, trigger the step of using the decrypted content key CEK to decrypt the encrypted privacy information.

[0129] Optionally, the processor may also execute the program code of the following steps: the terminal decryption system on the user terminal performs time verification based on the time verification information; if the verification passes, the terminal decryption system reads the key encryption key KEK from the key storage device, and uses the key encryption key KEK to decrypt the key encryption result ECEK to generate the corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the encrypted privacy information is decrypted using the decrypted content key CEK to obtain the privacy data of the target object.

[0130] Optionally, the processor may also execute the program code of the following steps: the private information is loaded on the express delivery slip of the target object in the form of graphics and text after being graphic-encoded.

[0131] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the target object to be distributed, and the key management system obtains the privacy data of the target object; the key management system generates at least one kind of key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the key management system performs encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information and the key encryption result ECEK on the express delivery note of the target object; the key management system at least sends the key encryption key KEK to the user terminal.

[0132] Optionally, the processor may also execute program codes of the following steps: the key management system generates a user key UK and time validity verification information of the user key UK according to user authority, wherein the time validity verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time validity verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0133] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: scan the target object to be distributed, and display the privacy data of the target object in the privacy protection interaction panel; select at least one key data in the function menu provided on the privacy protection interaction panel, wherein the key data at least includes: content key CEK, key encryption key KEK; when an encryption instruction is detected on the privacy protection interaction panel, the selected key data is used to perform the encryption operation; the express delivery slip of the target object is displayed on the privacy protection interaction panel, and the result of the encryption operation is loaded on the express delivery slip of the target object; the printing function is triggered on the privacy protection interaction panel to print the express delivery slip.

[0134] Optionally, the processor may also execute program code of the following steps: the encryption operation at least includes: encrypting the private data with the content key CEK to generate encrypted private information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK.

[0135] Optionally, the processor may also execute program code of the following steps: The method further includes: sending the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0136] It can be understood by those skilled in the art that Fig.11 The structure shown is for illustration only, and the computer terminal may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Fig.11 The structure of the electronic device is not limited. For example, the computer terminal 11 may also include Fig.11 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Fig.11 Different configurations shown.

[0137] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0138] Example 6

[0139] The embodiment of the present invention further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the method for encrypting and decrypting logistics data provided in the first embodiment.

[0140] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0141] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: determining the target object to be distributed, and the key management system obtains the privacy data of the target object; the key management system generates at least one kind of key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the key management system performs encryption operations on the key data, wherein the encryption operations at least include: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information on the express delivery note of the target object; the key management system at least sends the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0142] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: the key management system generates a user key UK and time verification information of the user key UK according to user authority, wherein the time verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0143] Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the key management system generates a user key UK and time verification information of the user key UK according to user authority, including: before determining the target object to be distributed, the key management system sends a decryption authority request to the user management system; the key management system receives decryption information returned by the user management system in response to the decryption authority request, wherein the decryption information includes at least: the user key UK and time verification information of the user key UK.

[0144] Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: the key management system controls the user key UK to be updated once every first period, controls the content key CEK to be updated once every second period, controls the key encryption key KEK to be updated once every third period, and the duration of the first period is greater than the duration of the second period.

[0145] Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the encrypted privacy information loaded on the express delivery note of the target object carries a key indication bit, wherein the key indication bit is used to indicate the extraction of the content key CEK and key encryption key KEK generated within the corresponding period.

[0146] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: a terminal decryption system on the user terminal performs time verification based on time verification information; if the verification passes, the terminal decryption system reads the user key UK from the key storage device, and uses the user key UK to decrypt the reused encryption result EKEK to generate the current key encryption key KEK; the terminal decryption system uses the decrypted key encryption key KEK to decrypt the key encryption result ECEK to generate the corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the decrypted content key CEK is used to decrypt the encrypted privacy information to obtain the privacy data of the target object.

[0147] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: after decrypting to generate the corresponding content key CEK, the method further includes: the terminal confidentiality system uses verification conditions to verify the decrypted content key CEK, wherein the verification conditions include at least one of the following: whether the decryption time is within a predetermined time period, whether the number of user decryption times exceeds a limit value, whether the decrypted geographical location is within a predetermined address range, whether the decryption frequency exceeds a predetermined frequency, whether the number of user violations exceeds a predetermined number, and whether the user service area is within a predetermined area; if the verification passes, triggering the step of using the decrypted content key CEK to decrypt the encrypted privacy information.

[0148] Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the method also includes: a terminal decryption system on the user terminal performs time verification based on the time verification information; if the verification passes, the terminal decryption system reads the key encryption key KEK from the key storage device, and uses the key encryption key KEK to decrypt the key encryption result ECEK to generate a corresponding content key CEK; after the terminal decryption system obtains the corresponding encrypted privacy information by scanning the express delivery slip, the encrypted privacy information is decrypted using the decrypted content key CEK to obtain the privacy data of the target object.

[0149] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: the private information is graphically encoded and then loaded onto the express delivery slip of the target object in the form of graphics and text.

[0150] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: determining the target object to be distributed, and the key management system obtaining the privacy data of the target object; the key management system generates at least one kind of key data in different cycles, wherein the key data at least includes: content key CEK, key encryption key KEK; the key management system performs encryption operations on the key data, wherein the encryption operations at least include: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, and using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK; the key management system at least loads the encrypted privacy information and the key encryption result ECEK on the express delivery note of the target object; the key management system at least sends the key encryption key KEK to the user terminal.

[0151] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: the key management system generates a user key UK and time verification information of the user key UK according to user authority, wherein the time verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; the key management system uses the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; the key management system sends the user key UK, the time verification information of the user key UK and the multiplexed encryption result EKEK to the user terminal.

[0152] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: scanning the target object to be distributed, and displaying the privacy data of the target object in the privacy protection interaction panel; selecting at least one key data in the function menu provided on the privacy protection interaction panel, wherein the key data includes at least: content key CEK, key encryption key KEK; when an encryption instruction is detected on the privacy protection interaction panel, performing an encryption operation using the selected key data; displaying the express delivery slip of the target object on the privacy protection interaction panel, and loading the result of the encryption operation on the express delivery slip of the target object; triggering the printing function on the privacy protection interaction panel to print the express delivery slip.

[0153] Optionally, in this embodiment, the storage medium is configured to store program code for executing the following steps: the encryption operation at least includes: encrypting the privacy data with the content key CEK to generate encrypted privacy information, and encrypting the content key CEK with the key encryption key KEK to generate the key encryption result ECEK.

[0154] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: The method further includes: sending the key encryption key KEK and the key encryption result ECEK to the user terminal.

[0155] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0156] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0158] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0159] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0160] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0161] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for encrypting and decrypting logistics data, characterized in that: include: Determine a target object to be distributed, and the key management system obtains the privacy data of the target object; The key management system generates at least one key data in different cycles, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; The key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK, and using the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; The key management system at least loads the encrypted private information on the express delivery note of the target object; The key management system sends at least the user key UK, the multiplexed encryption result EKEK and the key encryption result ECEK to the user terminal.

2. The method according to claim 1, characterized in that: The method further comprises: The key management system generates the user key UK and time validity verification information of the user key UK according to the user authority, wherein the time validity verification information includes: the dynamic parameter D1 and the verification parameter V1 of the user key UK; The key management system sends the validity verification information of the user key UK to the user terminal.

3. The method according to claim 2, characterized in that The key management system generates a user key UK and time validity verification information of the user key UK according to the user authority, including: Before determining the target object to be distributed, the key management system sends a decryption authority request to the user management system; The key management system receives the decryption information returned by the user management system in response to the decryption authority request, wherein the decryption information at least includes: the user key UK and time validity verification information of the user key UK.

4. The method according to claim 2, characterized in that: The key management system controls the user key UK to be updated once every first period, controls the content key CEK to be updated once every second period, controls the key encryption key KEK to be updated once every third period, and the duration of the first period is greater than the duration of the second period.

5. The method according to claim 2, characterized in that: The encrypted privacy information loaded on the express delivery note of the target object carries a key indication bit, wherein the key indication bit is used to indicate the extraction of the content key CEK and the key encryption key KEK generated within the corresponding period.

6. The method according to any one of claims 2 to 5, characterized in that: The method further comprises: The terminal decryption system on the user terminal performs time validity verification based on the time validity verification information; If the verification is successful, the terminal decryption system reads the user key UK from the key storage device, and uses the user key UK to decrypt the multiplexed encryption result EKEK to generate the current key encryption key KEK; The terminal decryption system uses the key encryption key KEK obtained by decryption to decrypt the key encryption result ECEK to generate the corresponding content key CEK; After the terminal decryption system obtains the corresponding encrypted private information by scanning the express delivery slip, the encrypted private information is decrypted using the content key CEK obtained by decryption to obtain the private data of the target object.

7. The method according to claim 6, characterized in that After decrypting and generating the corresponding content key CEK, the method further includes: The terminal confidentiality system verifies the content key CEK obtained by decryption using verification conditions, wherein the verification conditions include at least one of the following: whether the decryption time is within a predetermined time period, whether the number of user decryption times exceeds a limit value, whether the decryption geographical location is within a predetermined address range, whether the decryption frequency exceeds a predetermined frequency, whether the number of user violations exceeds a predetermined number, and whether the user service area is within a predetermined area; If the verification is successful, the step of using the decrypted content key CEK to decrypt the encrypted private information is triggered.

8. The method according to any one of claims 2 to 5, characterized in that: The method further comprises: The terminal decryption system on the user terminal performs time validity verification based on the time validity verification information; If the verification is successful, the terminal decryption system reads the key encryption key KEK from the key storage, and uses the key encryption key KEK to decrypt the key encryption result ECEK to generate the corresponding content key CEK; After the terminal decryption system obtains the corresponding encrypted private information by scanning the express delivery slip, the encrypted private information is decrypted using the content key CEK obtained by decryption to obtain the private data of the target object.

9. The method according to claim 1, characterized in that: The private information is graphically encoded and loaded onto the express delivery slip of the target object in the form of graphics and text.

10. A method for encrypting and decrypting logistics data, characterized in that: include: Determine a target object to be distributed, and the key management system obtains the privacy data of the target object; The key management system generates at least one key data in different cycles, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; The key management system performs an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK, and using the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; The key management system at least loads the encrypted private information, the multiplexed encryption result EKEK and the key encryption result ECEK on the express delivery note of the target object; The key management system at least sends the user key UK to the user terminal.

11. The method according to claim 10, characterized in that The method further comprises: The key management system generates a user key UK and time validity verification information of the user key UK according to the user authority, wherein the time validity verification information includes: a dynamic parameter D1 and a verification parameter V1 of the user key UK; The key management system sends the validity verification information of the user key UK to the user terminal.

12. A method for encrypting and decrypting logistics data, characterized in that: include: Scan the target object to be distributed, and display the privacy data of the target object in the privacy protection interactive panel; Selecting at least one key data in a function menu provided on the privacy protection interaction panel, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; When an encryption instruction is detected on the privacy protection interaction panel, an encryption operation is performed using the selected key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the privacy data to generate encrypted privacy information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK, and using the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; Displaying the express delivery note of the target object on the privacy protection interactive panel, and loading the result of the encryption operation on the express delivery note of the target object; The printing function is triggered on the privacy protection interactive panel to print the express delivery slip.

13. The method according to claim 12, characterized in that The method further includes: sending the user key UK, the multiplexed encryption result EKEK and the key encryption result ECEK to a user terminal.

14. A logistics data encryption and decryption device, characterized in that: include: A first acquisition module, used for determining a target object to be distributed, and the key management system acquires the privacy data of the target object; A first generating module, used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; A first encryption module, used for the key management system to perform an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK, and using the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; A first loading module, configured for the key management system to at least load the encrypted private information onto a delivery note of the target object; The first sending module is used for the key management system to at least send the user key UK, the multiplexed encryption result EKEK and the key encryption result ECEK to the user terminal.

15. A logistics data encryption and decryption device, characterized in that: include: A second acquisition module, used for determining a target object to be distributed, and the key management system acquires the privacy data of the target object; A second generating module, used for the key management system to generate at least one key data in different cycles, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; A second encryption module, used for the key management system to perform an encryption operation on the key data, wherein the encryption operation at least includes: using the content key CEK to encrypt the private data to generate encrypted private information, using the key encryption key KEK to encrypt the content key CEK to generate a key encryption result ECEK, and using the user key UK to encrypt the key encryption key KEK to generate a multiplexed encryption result EKEK; A second loading module, configured for the key management system to load at least the encrypted privacy information, the multiplexed encryption result EKEK and the key encryption result ECEK onto the express delivery note of the target object; The second sending module is used for the key management system to at least send the user key UK to the user terminal.

16. A logistics data encryption and decryption device, characterized in that: include: A display module, used for scanning a target object to be distributed and displaying the privacy data of the target object in a privacy protection interactive panel; A selection module, configured to select at least one key data from a function menu provided on the privacy protection interaction panel, wherein the key data at least includes: a content key CEK, a key encryption key KEK and a user key UK; A third encryption module is used to perform an encryption operation using the selected key data when an encryption instruction is detected on the privacy protection interaction panel, wherein the encryption operation at least includes: encrypting the privacy data using the content key CEK to generate encrypted privacy information, encrypting the content key CEK using the key encryption key KEK to generate a key encryption result ECEK, and encrypting the key encryption key KEK using the user key UK to generate a multiplexed encryption result EKEK; A third loading module, configured to display the express delivery note of the target object on the privacy protection interaction panel, and load the result of the encryption operation on the express delivery note of the target object; A printing module is used to trigger a printing function on the privacy protection interactive panel to print the express delivery slip.

17. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the method for encrypting and decrypting logistics data as described in any one of claims 1 to 13.

18. A computer device, characterized in that: include: Memory and processor, The memory stores a computer program; The processor is used to execute the computer program stored in the memory, and when the computer program is running, the processor executes the logistics data encryption and decryption method described in any one of claims 1 to 13.

Images