Method for processing ciphertext data, authority management server and decryption server

Abstract

Embodiments of the present application provide a ciphertext data processing method, an authority management server and a decryption server, which are used to improve data security. The method of the embodiments of the present application comprises: receiving a first authority verification request sent by a service function server, the first authority verification request comprising a user identifier; judging whether the user identifier is bound with a role authorization code; if the user identifier is bound with the role authorization code, sending a decryption request carrying the role authorization code to a decryption server, so that the decryption server uses a decryption key bound with the role authorization code to decrypt ciphertext data determined by the decryption request to obtain plaintext data, and sends the plaintext data to the service function server. In the embodiments of the present application, the access to data is simultaneously provided with authority management and data encryption, and the access range is controlled by using the role authorization code. When the database is directly attacked, the leaked data is ciphertext data, and the security is relatively high.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of data security, and in particular to a ciphertext data processing method, a permission management server and a decryption server. BACKGROUND

[0002] An enterprise resource planning (ERP) data of an enterprise may have a business requirement of different secret level control. A common processing manner to achieve such secret level control is to control the accessibility by system division.

[0003] For the design of system division, data is stored in a database, posts performing different businesses are divided into different roles, and the authorization ranges of different roles are different, so that data within the permission range is visible and data outside the permission range is invisible.

[0004] Such permission management only acts on the system inside, and when the database is directly attacked, the data leakage risk is high and the security is low. SUMMARY

[0005] Embodiments of the present application provide a ciphertext data processing method, a permission management server and a decryption server, which are used to improve data security.

[0006] A first aspect of embodiments of the present application provides a ciphertext data processing method applied to a permission management server, and the method comprises:

[0007] receiving a first permission verification request sent by a business function server, the first permission verification request comprising a user identifier;

[0008] determining whether the user identifier is bound with a role authorization code;

[0009] if the user identifier is bound with the role authorization code, sending a decryption request carrying the role authorization code to a decryption server, so that the decryption server uses a decryption key bound with the role authorization code to decrypt ciphertext data determined by the decryption request to obtain plaintext data, and sends the plaintext data to the business function server.

[0010] In embodiments of the present application, permission management and data encryption are simultaneously set for data access, and a role authorization code is used to control the access range. When the database is directly attacked, the leaked data is ciphertext data, and the security is high.

[0011] In an implementation manner of the first aspect of embodiments of the present application, the method further comprises:

[0012] generating a role authorization code in response to the received permission design request;

[0013] extracting the user identifier from the permission design request, and binding the user identifier and the role authorization code;

[0014] sending the application key request carrying the role authorization code to the decryption server, so that the decryption server generates the encryption key and the decryption key according to the application key request, and binds the decryption key and the role authorization code; wherein the encryption key is used to encrypt the plaintext data to obtain the ciphertext data;

[0015] receiving the encryption key returned by the decryption server, and binding the encryption key and the role authorization code.

[0016] In the embodiment of the application, the encryption key is saved by the permission management server, and the decryption key is saved by the decryption server, so that the encryption key and the decryption key are stored separately.

[0017] In an implementation manner of the first aspect of the embodiment of the application, the encryption key and the decryption key are asymmetric keys, the encryption key is a public key, and the decryption key is a private key.

[0018] In the embodiment of the application, the key pair is generated based on the RSA asymmetric encryption strategy, and the security is high.

[0019] In an implementation manner of the first aspect of the embodiment of the application, the method further includes:

[0020] receiving the second permission verification request sent by the service function server, and the second permission verification request includes the user identifier;

[0021] judging whether the user identifier is bound with the role authorization code;

[0022] if the user identifier is bound with the role authorization code, obtaining the plaintext data and encrypting the plaintext data by using the encryption key to obtain the ciphertext data.

[0023] In the embodiment of the application, the encryption and decryption are separated, the encryption is provided by the permission management server, and the security is high.

[0024] In an implementation manner of the first aspect of the embodiment of the application, before sending the decryption request carrying the role authorization code to the decryption server, the method further includes:

[0025] obtaining the ciphertext data requested by the user corresponding to the user identifier, and writing the ciphertext data into the decryption request.

[0026] In the embodiment of the application, the encryption and decryption are separated, the decryption request is sent by the permission management server to the decryption server, and the decryption is hosted by the decryption server and only allows the permission management server to access.

[0027] The second aspect of the embodiment of the application provides a ciphertext data processing method, applied to a decryption server, and including:

[0028] Receive a decryption request sent by the permission management server. The decryption request includes a role authorization code and encrypted data. The role authorization code is the role authorization code bound to the user identifier. The user identifier is the user identifier carried in the first permission verification request sent by the business function server received by the permission management server.

[0029] Determine the decryption key corresponding to the role authorization code, and use the decryption key to decrypt the ciphertext data to obtain the plaintext data;

[0030] Send plaintext data to the business function server.

[0031] In this embodiment, access to data is subject to both permission management and data encryption. Role-based authorization codes are used to control the scope of access. In the event of a direct attack on the database, the leaked data is encrypted, thus ensuring high security.

[0032] In one implementation of the second aspect of this application, before receiving the decryption request sent by the access control server, the method further includes:

[0033] In response to the key request sent by the access control server, generate a matching decryption key and encryption key;

[0034] Extract the role authorization code from the key request and bind the decryption key and the role authorization code;

[0035] Send the encryption key to the permission management server so that the permission management server can bind the encryption key and the role authorization code.

[0036] In this embodiment, the encryption key is stored by the access control server, and the decryption key is stored by the decryption server, thus achieving separate storage of the encryption key and the decryption key.

[0037] A third aspect of this application provides a permission management server, including:

[0038] The receiving unit is used to receive a first authorization verification request sent by the business function server. The first authorization verification request includes a user identifier.

[0039] The judgment unit is used to determine whether the user identifier is bound to a role authorization code;

[0040] The sending unit is used to send a decryption request carrying the role authorization code to the decryption server when the judgment unit determines that the user identifier is bound to the role authorization code. This allows the decryption server to use the decryption key bound to the role authorization code to decrypt the ciphertext data determined by the decryption request to obtain plaintext data, and then send the plaintext data to the business function server.

[0041] A fourth aspect of this application provides a decryption server, including:

[0042] The receiving unit is used to receive a decryption request sent by the permission management server. The decryption request includes a role authorization code and encrypted data. The role authorization code is the role authorization code bound to the user identifier. The user identifier is the user identifier carried in the first permission verification request sent by the business function server received by the permission management server.

[0043] The determining unit is used to determine the decryption key corresponding to the role authorization code, and to use the decryption key to decrypt the ciphertext data to obtain the plaintext data;

[0044] The sending unit is used to send plaintext data to the business function server.

[0045] A fifth aspect of this application provides a computer device, including:

[0046] Central processing unit, memory;

[0047] The memory can be either temporary or permanent storage.

[0048] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method of the first aspect.

[0049] A sixth aspect of this application provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method of the first aspect or the second aspect.

[0050] A seventh aspect of this application provides a computer program product including instructions that, when run on a computer, cause the computer to perform the method of the first aspect or the second aspect.

[0051] An eighth aspect of this application provides a chip system including at least one processor and a communication interface, the communication interface and the at least one processor being interconnected via a line, the at least one processor being used to run a computer program or instructions to perform the method of the first aspect or the second aspect. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of an architecture of the encrypted data processing system disclosed in an embodiment of this application;

[0053] Figure 2 This is another schematic diagram of the architecture of the encrypted data processing system disclosed in the embodiments of this application;

[0054] Figure 3 This is a flowchart of a method for processing encrypted data disclosed in an embodiment of this application;

[0055] Figure 4 This is another flowchart of the encrypted data processing method disclosed in the embodiments of this application;

[0056] Figure 5 This is a schematic diagram of the key generation process of the encrypted data processing method disclosed in the embodiments of this application;

[0057] Figure 6 This is a schematic diagram of the encryption process of the encrypted data processing method disclosed in the embodiments of this application;

[0058] Figure 7 This is a schematic diagram of the decryption process of the encrypted data processing method disclosed in the embodiments of this application;

[0059] Figure 8 This is a schematic diagram of an architecture of the permission management server disclosed in an embodiment of this application;

[0060] Figure 9 This is a schematic diagram of an architecture of the decryption server disclosed in an embodiment of this application;

[0061] Figure 10 This is a schematic diagram of the architecture of a computer device disclosed in an embodiment of this application. Detailed Implementation

[0062] This application provides a method for processing encrypted data, an access control server, and a decryption server to improve data security.

[0063] A company's ERP data may have different security levels depending on the business requirements. ERP data, such as the Bill of Materials (BOM), is a file describing the product structure in a data format. It's a computer-readable product structure data file and the primary document in the ERP system. Common physical data encryption methods include the Data Encryption Standard (DES) algorithm and the RSA asymmetric encryption algorithm. DES encryption algorithm: A symmetric encryption algorithm where encryption and decryption operations share the same key. Therefore, the encryption key needs to be published to complete decryption, posing a risk of key leakage. RSA asymmetric encryption: An asymmetric encryption strategy where the RSA algorithm generates a key pair for encryption and decryption. The private key is used for decryption, and the public key is used for encryption. As long as the private key is secure, the encrypted data is difficult to crack.

[0064] Using only access control does not extend data protection to the control of the physical structure, leaving potential data leaks or unauthorized resource usage due to feature expansion. Access control only operates within the system and does not extend to the control of physical table data, thus posing a risk of data leaks and unauthorized resource usage when features are expanded.

[0065] When only physical data is encrypted, the encryption key is unified, which poses a risk that once the key is leaked, the globally encrypted data can be cracked.

[0066] like Figure 1 As shown in the illustration, an encrypted data processing system according to an embodiment of this application includes a business function server, a permission management server, and a decryption server. The permission management server and the decryption server are communicatively connected. Clients access the business function server via a network. The business function server identifies the user identifier of the client to distinguish different users. The business function server provides corresponding functions to different users, including access to encrypted data. When providing access to encrypted data, the business function server communicates with the decryption server through the permission management server to obtain the plaintext data obtained by decrypting the encrypted data and sends the plaintext data to the client.

[0067] The ERP system service adds a key management server, providing key pair generation, private key transfer, and data decryption services. The overall service structure is as follows: Figure 2 As shown in the figure. An embodiment of this application provides a data encryption processing system including a client 201 and a cloud service cluster 202, wherein the cloud service cluster 202 includes a business function terminal 2021 and an RSA decryption server 2022. The business function terminal 2021 includes a business function module 20211 and a permission management module 20212. The business function module 20211 can be a business function server, and the permission management module 20212 can be a permission management server; or the business function terminal 2021 is a business server, and the business server is divided into the business function module 20211 and the permission management module 20212. The client 201 is used to perform function access. The business function module 20211 is used to obtain confidential data and business data. Confidential data can be represented as encrypted data and plaintext data, and business data is business-related data that accompanies the confidential data. The permission management module 20212 is used to perform key management. The permission management module 20212 stores a permission public key certificate library, which also stores role authorization codes and public keys. The RSA decryption server 2022 is used to perform key creation and decryption services. The RSA decryption server stores the permission private key certificate library, which also stores the role authorization code and private key.

[0068] like Figure 3 As shown, the encrypted data processing method of this application embodiment includes steps 301 to 303.

[0069] 301. Receive the first permission verification request sent by the business function server.

[0070] The access control server receives a first access verification request from the business function server. This first access verification request includes a user identifier. The user identifier is used to uniquely identify a user; different users have different user identifiers. The user identifier can be a user ID, user name, etc. The first access verification request is used to ask the access control server to determine whether the user with that user identifier has the right to access encrypted data. The first access verification request can also carry encrypted data to reduce the number of interactions between the business function server and the access control server.

[0071] 302. Determine whether the user identifier is bound to a role authorization code.

[0072] The access control server obtains the user identifier from the first access verification request. The server then queries the role authorization code and user identifier relationship table to determine the role authorization code bound to that user identifier. In this table, one role authorization code can correspond to only one user identifier, or one role authorization code can correspond to multiple user identifiers; similarly, one user identifier can correspond to only one role authorization code, or one user identifier can correspond to multiple role authorization codes. When one user identifier corresponds to only one role authorization code, the access control server can determine the role authorization code bound to that user identifier. When one user identifier corresponds to multiple role authorization codes, the access control server needs to receive role selection information sent by the business function server. One role selection information corresponds to one role authorization code. This role selection information can be written into the first access verification request by the business function server and sent to the access control server.

[0073] 303. Send a decryption request carrying the role authorization code to the decryption server.

[0074] After determining that a user identifier is bound to a role authorization code, the access control server sends a decryption request carrying the role authorization code to the decryption server. This allows the decryption server to use the decryption key bound to the role authorization code to decrypt the ciphertext data determined by the decryption request, obtaining plaintext data, which is then sent to the business function server. The decryption request can also carry ciphertext data, in which case the decryption server retrieves the ciphertext data from the request and decrypts it; alternatively, the decryption request can carry a ciphertext data identification code, which the decryption server retrieves from the request and uses to obtain the ciphertext data from the database.

[0075] In this embodiment, access to data is subject to both permission management and data encryption. Role-based authorization codes are used to control the scope of access. In the event of a direct attack on the database, the leaked data is encrypted, thus ensuring high security.

[0076] The embodiments of this application can be divided into three processes: key creation, encryption, and decryption, as detailed below. Figure 4 As shown, the method for processing encrypted data in this application embodiment includes steps 401 to 407.

[0077] 401. Startup permission design.

[0078] The access control server receives access control design requests, which carry a user identifier. Access control design requests are typically initiated by administrators. Administrators can initiate these requests through the access control server's input device or through a device with access control design permissions. The access control server generates role authorization codes based on the access control design requests. One role authorization code corresponds to one role, and the access control server defines the authorization scope of each role. The access control server binds the user identifier to each role authorization code. There are various types of operations, such as writing, viewing, approving, and modifying. Different roles may allow or prohibit different operations, or they may be the same; the same role may allow or prohibit the same operations.

[0079] A user ID can be bound to a role authorization code, indicating that a user has only one role and enjoys the authorization scope of that role.

[0080] A user ID can be bound to multiple role authorization codes, indicating that a user has multiple roles and authorizations for those roles.

[0081] A role authorization code can be bound to multiple user IDs, indicating that multiple users possess the same role. Role authorization codes and user IDs can be written into a table to obtain the user authorization table, which is generated and stored by the permission management server.

[0082] 402. Generate encryption and decryption keys.

[0083] The access control server sends a key request to the decryption server, carrying the role authorization code. The decryption server receives the key request and retrieves the role authorization code from it. The decryption server generates an encryption key and a decryption key based on the request; these are a key pair. If the encryption and decryption keys are asymmetric, the encryption key is the public key, and the decryption key is the private key; if they are symmetric, they are the same key. The decryption server binds the role authorization code and the decryption key. The decryption server then sends the encryption key to the access control server. The access control server receives the encryption key from the decryption server and binds it to the role authorization code. Generally, the encryption key and role authorization code are bound one-to-one, and the decryption key and role authorization code are also bound one-to-one; that is, one role authorization code corresponds to one encryption key and one decryption key. When updating the key, the role authorization code needs to be unbound from the old key, and then bound to the new key.

[0084] 403. Plaintext data is encrypted into ciphertext data.

[0085] The business function server sends a second permission verification request to the permission management server, carrying the user identifier. The permission management server receives the second permission verification request from the business function server and retrieves the user identifier from it. The permission management server determines whether the user identifier is bound to a role authorization code. If so, it retrieves the encryption key associated with the role authorization code. The permission management server can send the encryption key to the business function server or to the encryption service module, as explained below:

[0086] (1) The access control server can send the encryption key to the business function server.

[0087] After obtaining the encryption key, the access control server sends it to the business function server. The business function server receives the encryption key from the access control server. The business function server then sends the encryption key and plaintext data to the encryption service module. The encryption service module receives the encryption key and plaintext data from the business function server. The encryption service module uses the encryption key to encrypt the plaintext data to obtain ciphertext data. The encryption service module sends the ciphertext data to the business function server, which receives the ciphertext data and stores it in the database; alternatively, the encryption service module stores the ciphertext data in the database.

[0088] It should be noted that if the business function server already stores the encryption key—for example, if the business function server obtained and saved the encryption key during the previous encryption process—the access control server may not need to send the encryption key to the business function server. Instead, it can send an encryption license to the business function server. The business function server receives the encryption license from the access control server and uses the encryption key already stored on the business function server to perform encryption. The encryption service module can be an encryption server or it can be built into the access control server.

[0089] (2) The access control server sends the encryption key to the encryption service module.

[0090] After obtaining the encryption key, the access control server generates an encryption key identification code. The access control server sends the encryption key and encryption key identification code to the encryption service module, and sends the encryption key identification code to the business function server. The business function server receives the encryption key identification code from the access control server and sends it along with plaintext data to the encryption service module. The encryption service module receives the encryption key and encryption key identification code from the access control server and the plaintext data and encryption key identification code from the business function server, and determines whether the two received encryption key identification codes match. If the two received encryption key identification codes match, the encryption service module uses the encryption key to encrypt the plaintext data to obtain ciphertext data. The encryption service module sends the ciphertext data to the business function server, which receives the ciphertext data and stores it in the database; alternatively, the encryption service module stores the ciphertext data in the database.

[0091] It should be noted that when the encryption service module is bound to both an encryption key identifier and an encryption key, the access control server can send only the encryption key identifier to the encryption service module. The encryption key identifier can be valid indefinitely or a time-limited random verification code. The encryption service module can be an encryption server or it can be built into the access control server.

[0092] 404. Retrieve encrypted data from the database.

[0093] There are several ways to retrieve encrypted data from a database. These include retrieving encrypted data from the database by the business function server, the access control server, or the decryption server, as detailed below:

[0094] (1) Business function: The server retrieves encrypted data from the database.

[0095] The business function server sends a data retrieval request to the database. The database receives the request and determines the encrypted data based on it. The database then sends the encrypted data to the business function server. The business function server receives the encrypted data from the database. The business function server then sends the encrypted data to the access control server. The access control server receives the encrypted data from the business function server. Finally, the access control server sends the encrypted data to the decryption server. The decryption server receives the encrypted data from the access control server.

[0096] (2) The access control server retrieves encrypted data from the database.

[0097] The business function server sends a encrypted data identification code to the access control server. The access control server receives the encrypted data identification code from the business function server and generates a data retrieval request based on it. The access control server can also determine the encrypted data or encrypted data identification code based on the user identifier and role authorization code. The access control server sends a data retrieval request to the database. The database receives the data retrieval request from the access control server and determines the encrypted data based on the request. The database sends the encrypted data to the access control server. The access control server receives the encrypted data sent by the database. The access control server sends the encrypted data to the decryption server. The decryption server receives the encrypted data sent by the access control server. The encrypted data identification code can be an encrypted data address or a retrieval bit in the encrypted data.

[0098] (3) The decryption server retrieves the encrypted data from the database.

[0099] The business function server sends a encrypted data identification code to the access control server. The access control server receives the encrypted data identification code from the business function server. The access control server can also determine the encrypted data or encrypted data identification code based on the user identifier and role authorization code. The access control server sends the encrypted data identification code to the decryption server. The decryption server receives the encrypted data identification code from the access control server and generates a data retrieval request based on the encrypted data identification code. The decryption server sends a data retrieval request to the database. The database receives the data retrieval request from the decryption server and determines the encrypted data based on the data retrieval request. The database sends the encrypted data to the decryption server. The decryption server receives the encrypted data sent by the database. The encrypted data identification code can be an encrypted data address or a retrieval bit in the encrypted data.

[0100] It should be noted that the database can determine the encrypted data and other business data based on the data acquisition request, and then return the encrypted data and other business data together.

[0101] 405. Determine the role authorization code bound to the user identifier.

[0102] The business function server sends a first permission verification request to the permission management server, carrying a user identifier. The permission management server receives the first permission verification request from the business function server and retrieves the user identifier from it. The permission management server determines whether the user identifier is bound to a role authorization code; if so, it retrieves the role authorization code. The permission management server generates a decryption request, which includes the role authorization code and encrypted data, or the decryption request includes the role authorization code and an encrypted data identifier. The permission management server then sends the decryption request to the decryption server.

[0103] It should be noted that when step 404 is the business function server retrieving encrypted data from the database, the timing of steps 404 and 405 is not limited; when step 404 is the permission management server retrieving encrypted data from the database, the timing of steps 404 and 405 is not limited; when step 404 is the decryption server retrieving encrypted data from the database, step 405 is executed first, followed by step 404.

[0104] 406. Use the decryption key bound to the role authorization code to decrypt the ciphertext data to obtain the plaintext data.

[0105] The decryption server receives a decryption request from the access control server. The decryption server retrieves the role authorization code and encrypted data from the decryption request, or retrieves the role authorization code and encrypted data identification code from the decryption request, and then retrieves the encrypted data based on the encrypted data identification code. The decryption server obtains the decryption key bound to the role authorization code. The decryption server uses the decryption key to decrypt the encrypted data, obtaining plaintext data. The decryption server sends the plaintext data to the access control server, which then sends the plaintext data to the business function server; alternatively, the decryption server sends the plaintext data directly to the business function server.

[0106] 407. Use plaintext data.

[0107] The business function server receives plaintext data sent by the access control server or decryption server. The business function server uses the plaintext data, which may be to display the plaintext data, perform calculations using the plaintext data, or modify the plaintext data, etc.

[0108] The embodiments of this application can be divided into three processes: key creation, encryption, and decryption. The following will describe them in detail. Figures 5 to 7 Let's take an example to illustrate.

[0109] Figure 5The diagram illustrates the key creation process according to an embodiment of this application. The permission management server 501 receives a permission design request initiated by an administrator. The administrator can send the permission design request to the permission management server 501 via the network, or generate the permission design request locally on the permission management server 501. The permission management server 501 generates a role authorization code based on the permission design request. The permission management module writes the role authorization code into the key request and sends it to the decryption server 502. The decryption server 502 receives the key request and obtains the role authorization code from it. The decryption server 502 generates a public key and a private key, binds the private key to the role authorization code, and sends the public key to the permission management server 501. The permission management server 501 receives the public key and binds it to the role authorization code. The public key and authorization code binding is stored in the ERP business database for data encryption. The private key, according to the corresponding structure of the ERP role authorization code plus the private key, is hosted in the key management service.

[0110] Figure 6 The following illustrates the encryption process according to an embodiment of this application. The business function server 601 sends a second permission verification request to the permission management server 602. The permission management server 602 receives the second permission verification request and obtains the user identifier from it. The permission management server 602 determines the public key bound to the user identifier and sends the public key to the business function server 601. The business function server 601 sends the public key and plaintext data to the permission management server 602. The permission management server 602 receives the public key and plaintext data and uses the public key to encrypt the plaintext data into ciphertext data. The permission management server 602 sends the ciphertext data to the business function server 601. The business function server 601 receives the ciphertext data and stores it in the database layer 603. The database layer 603 has one or more databases. The encryption service is built into the permission management server 602; after completing appropriate permission verification, the corresponding public key can be obtained to encrypt business data. After completing permission verification at the business layer, the user obtains the public key corresponding to the authorization information. This public key, along with the specified encrypted business data, is then used to encrypt the data via the encryption service of the permission management server 602. The business data is then stored separately. The database layer 603 employs object-relational mapping (ORM).

[0111] Figure 7The following describes the decryption process according to an embodiment of this application. The business function server 701 sends a data acquisition request to the database layer 704. The data acquisition request carries a data identification code of the data that the business function server 701 needs to access. The data identification code can be a data address or a data retrieval bit. The database layer 704 determines the encrypted data and business data based on the data acquisition request; the business data and encrypted data are paired. The business function server 701 receives the encrypted data and business data. The business function module sends the encrypted data and a first permission verification request to the permission management server 702. The permission management server 702 receives the encrypted data and the first permission verification request. The permission management server 702 obtains the user identifier from the first permission verification request and determines the role authorization code bound to the user identifier. The permission management server 702 sends the encrypted data and the role authorization code to the decryption server 703. The decryption server 703 receives the encrypted data and the role authorization code. The decryption server 703 determines the private key bound to the role authorization code. The decryption server 703 uses the private key to decrypt the encrypted data to obtain the plaintext data. Decryption server 703 sends plaintext data to permission management server 702. Permission management server 702 receives the plaintext data and then sends it to business function server 701. Business function server 701 receives the plaintext data and displays it. Decryption server 703 is deployed separately on the key management server, providing unified decryption service hosting and blocking access requests from non-permission management server 702. The business layer must, after business function server 701 completes permission verification based on the user identifier of the current login information, initiate a decryption request to decryption server 703 using the role authorization code and ciphertext data provided by permission management server 702, returning plaintext data that can be decrypted using the private key. The business layer then completes the data decryption and displays it.

[0112] like Figure 8 As shown in the figure, an embodiment of the present application provides a permission management server, comprising:

[0113] The receiving unit 801 is used to receive a first authorization verification request sent by the business function server. The first authorization verification request includes a user identifier.

[0114] The judgment unit 802 is used to determine whether the user identifier is bound to a role authorization code;

[0115] The sending unit 803 is used to send a decryption request carrying the role authorization code to the decryption server when the judgment unit 802 determines that the user identifier is bound to the role authorization code, so that the decryption server uses the decryption key bound to the role authorization code to decrypt the ciphertext data determined by the decryption request to obtain plaintext data, and sends the plaintext data to the business function server.

[0116] like Figure 9 As shown in the figure, a decryption server according to an embodiment of this application includes:

[0117] The receiving unit 901 is used to receive a decryption request sent by the permission management server. The decryption request includes a role authorization code and encrypted data. The role authorization code is the role authorization code bound to the user identifier. The user identifier is the user identifier carried in the first permission verification request sent by the business function server received by the permission management server.

[0118] The determining unit 902 is used to determine the decryption key corresponding to the role authorization code, and use the decryption key to decrypt the ciphertext data to obtain the plaintext data;

[0119] The sending unit 903 is used to send plaintext data to the service function server.

[0120] like Figure 10 As shown in the illustration, this application also provides a computer device 1000, comprising:

[0121] Central processing unit 1001, memory 1002;

[0122] Memory 1002 is either a short-term storage memory or a persistent storage memory;

[0123] The central processing unit 1001 is configured to communicate with the memory 1002 and execute instructions stored in the memory 1002 to perform actions such as... Figures 3 to 7 The method in the illustrated embodiment.

[0124] This application also provides a computer-readable storage medium, which includes instructions that, when executed on a computer, cause the computer to perform actions such as... Figures 3 to 7 The method in the illustrated embodiment.

[0125] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform actions such as... Figures 3 to 7 The method in the illustrated embodiment.

[0126] This application also provides a chip system, which includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected via a circuit. The at least one processor is used to run computer programs or instructions to perform tasks such as... Figures 3 to 7 The method in the illustrated embodiment.

[0127] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0128] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0131] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for processing encrypted data, characterized in that, Applied to a permission management server, the method includes: After receiving the encryption key returned by the decryption server, an encryption key identification code is generated; wherein the encryption key and the role authorization code are bound together, and the role authorization code and the user identifier are bound together. The encryption key identification code is sent to the encryption service module and the encryption key identification code is sent to the business function server; wherein the encryption key identification code is used by the encryption service module to determine whether the encryption key identification code sent by the permission management server corresponds to the encryption key identification code sent by the business function server, and if they correspond, the encryption key bound to the encryption key identification code is used to encrypt the plaintext data sent by the business function server to obtain ciphertext data. Receive a first permission verification request sent by the business function server, the first permission verification request including a user identifier; determine whether the user identifier is bound to a role authorization code; if the user identifier is bound to the role authorization code, send a decryption request carrying the role authorization code to the decryption server; The decryption server uses the decryption key bound to the role authorization code to decrypt the ciphertext data determined by the decryption request to obtain plaintext data, and then sends the plaintext data to the business function server.

2. The processing method according to claim 1, characterized in that, Before receiving the first permission verification request sent by the service function server, the method further includes: In response to the received permission design request, the role authorization code is generated; Extract the user identifier from the permission design request, and bind the user identifier and the role authorization code; A request for a key carrying the role authorization code is sent to the decryption server, so that the decryption server generates the encryption key and the decryption key according to the request for a key, and binds the decryption key to the role authorization code; wherein the encryption key is used to encrypt the plaintext data to obtain the ciphertext data; Receive the encryption key returned by the decryption server, and bind the encryption key and the role authorization code.

3. The processing method according to claim 2, characterized in that, The encryption key and the decryption key are asymmetric keys, the encryption key is a public key, and the decryption key is a private key.

4. The processing method according to claim 2 or 3, characterized in that, The method further includes: Receive a second permission verification request sent by the business function server, wherein the second permission verification request includes the user identifier; Determine whether the user identifier is bound to the role authorization code; If the user identifier is bound to the role authorization code, then the plaintext data is obtained and the plaintext data is encrypted using the encryption key to obtain the ciphertext data.

5. The processing method according to any one of claims 1 to 3, characterized in that, Before sending a decryption request carrying the role authorization code to the decryption server, the method further includes: Obtain the ciphertext data requested by the user corresponding to the user identifier, and write the ciphertext data into the decryption request.

6. A permission management server, characterized in that, include: The receiving unit is configured to receive a first permission verification request sent by the business function server, wherein the first permission verification request includes a user identifier. The judgment unit is used to determine whether the user identifier is bound to a role authorization code; The sending unit is configured to send a decryption request carrying the role authorization code to the decryption server when the judgment unit determines that the user identifier is bound to the role authorization code, so that the decryption server uses the decryption key bound to the role authorization code to decrypt the ciphertext data determined by the decryption request to obtain plaintext data, and sends the plaintext data to the business function server. The receiving unit is further configured to receive the encryption key returned by the decryption server and generate an encryption key identification code; wherein the encryption key and the role authorization code are bound together, and the role authorization code and the user identifier are bound together. The sending unit is further configured to send the encryption key identification code to the encryption service module and to send the encryption key identification code to the business function server; wherein the encryption key identification code is used by the encryption service module to determine whether the encryption key identification code sent by the permission management server corresponds to the encryption key identification code sent by the business function server, and if they correspond, the encryption key is used to encrypt the plaintext data sent by the business function server to obtain ciphertext data.

7. A computer device, characterized in that, include: Central processing unit, memory; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 5.

Images