A data encryption and decryption system, method, computer device and storage medium

Abstract

The application relates to the technical field of computers, in particular to a data encryption and decryption system and method, a computer device and a storage medium. The system comprises a first server, an application program running on the first server, the application program comprising a data encryption and decryption service; a second server, the second server being configured to perform encryption and decryption operations on received data to generate encrypted and decrypted data; a service offloading unit, the service offloading unit being arranged between the first server and the second server and being in communication with both; and the service offloading unit being configured to offload the data encryption and decryption service of the application program and send the data encryption and decryption service to the second server for execution, and receive the encrypted and decrypted data from the second server and return the encrypted and decrypted data to the application program of the first server. The scheme can improve the operation efficiency of data encryption and decryption operations, and can reduce the influence of other service operations in the first server due to a large number of data encryption and decryption operations.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data encryption / decryption system, a data encryption / decryption method, a computer device, and a computer-readable storage medium. Background Technology

[0002] With the advancement of technology and the development of the times, humanity has entered a completely new era: the information age. The information age has spawned a plethora of application services, such as audio and video publishing software. However, these published audio and video user data contain a great deal of sensitive information, requiring encryption and decryption to protect it. For example, application service providers can encrypt and store this sensitive data on a disk. This way, even if the disk is lost without the decryption password, user data will not be leaked, ensuring data security.

[0003] Currently, traditional application data encryption and decryption are performed on the server where the application resides. However, as the amount of data to be encrypted increases, the amount of data to be encrypted in each request from the service system also increases, leading to slower encryption and decryption speeds. Furthermore, data encryption and decryption operations are processor-intensive tasks, consuming significant processor resources during execution, which inevitably impacts other business operations within the service system. Therefore, there is an urgent need to improve traditional application data encryption and decryption methods. Summary of the Invention

[0004] In view of this, it is necessary to provide a data encryption / decryption system, a data encryption / decryption method, a computer device, and a computer-readable storage medium to address the above technical problems.

[0005] According to a first aspect of the present invention, a data encryption / decryption system is provided, the data encryption / decryption system comprising:

[0006] A first server, on which an application is running, wherein the application includes data encryption and decryption services;

[0007] A second server is configured to perform encryption and decryption operations on received data to generate encrypted and decrypted data.

[0008] A service offloading unit, wherein the service offloading unit is disposed between the first server and the second server and communicates with both the first server and the second server respectively; and

[0009] The service unloading unit is configured to unload the data encryption / decryption service of the application and send it to the second server for execution, and to receive the encrypted / decrypted data from the second server and return it to the first server.

[0010] In some embodiments, the service offloading unit communicates with the application through a preset interface, and the service offloading unit communicates with the second server through the Socket protocol, wherein the service offloading unit acts as a TCP client of the Socket protocol, and the second server acts as a TCP server of the Socket protocol.

[0011] In some embodiments, the service offloading unit includes a unified interface layer and a data layer;

[0012] The unified interface layer is configured to receive external requests from the first server and to receive responses to external requests from the second server.

[0013] The data layer is configured to parse the external request and assemble a data packet to send to the second server, and to parse the response to the external request and assemble a response packet to return to the first server.

[0014] In some embodiments, the service offloading unit further includes a log module;

[0015] The log module is configured to record all data operations of the unified interface layer and the data layer.

[0016] In some embodiments, the unified interface layer provides at least one of the following: SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface.

[0017] In some embodiments, the second server includes a processing engine and an encryption / decryption library;

[0018] The processing engine is configured to use the epoll mechanism to detect Socket descriptors, create data processing message queues, and create multiple threads in a thread pool to encrypt and decrypt data in the message queues.

[0019] The encryption / decryption database configuration is used to provide at least one callable encryption / decryption method for each thread, wherein the encryption / decryption method includes SDF, SKF, PKCS#11, third-party encryption machine HSM, and encryption card.

[0020] In some embodiments, there are multiple second servers, and a load balancing unit is further provided between the service offloading unit and the second servers;

[0021] The load balancing unit is configured to distribute the encryption and decryption services of the application on the first server evenly to multiple second servers.

[0022] According to a second aspect of the present invention, a data encryption / decryption method is provided, the data encryption / decryption method comprising:

[0023] An application is run on a first server, wherein the application includes data encryption and decryption services;

[0024] Configure the second server to encrypt and decrypt received data to generate encrypted and decrypted data;

[0025] A service offloading unit is provided between the first server and the second server, which communicates with the first server and the second server respectively;

[0026] The service unloading unit unloads the application's data encryption / decryption service and sends it to the second server for execution, and receives the encrypted / decrypted data from the second server and returns it to the first server.

[0027] According to a third aspect of the present invention, a computer device is also provided, the computer device comprising:

[0028] At least one processor; and

[0029] The memory stores computer programs that can run on the processor, which executes the aforementioned data encryption and decryption methods when executing the program.

[0030] According to a fourth aspect of the present invention, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, performs the aforementioned data encryption and decryption method.

[0031] The aforementioned data encryption and decryption system, by setting up a business offloading unit between a first server running the application and a second server used for encryption and decryption, separates the data encryption and decryption operations from the first server and performs the calculations on the second server dedicated to data encryption and decryption. This not only improves the computational efficiency of data encryption and decryption operations but also reduces the impact of other business operations on the first server due to a large number of data encryption and decryption operations.

[0032] In addition, the present invention also provides a data encryption / decryption method, a computer device, and a computer-readable storage medium, which can achieve the above-mentioned technical effects, and will not be described in detail here. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the structure of a data encryption and decryption system according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of the communication process between the service offloading unit and the second server provided in one embodiment of the present invention;

[0036] Figure 3 This is a schematic diagram of the processing flow of a processing engine provided in one embodiment of the present invention;

[0037] Figure 4 A flowchart illustrating a data encryption / decryption method according to another embodiment of the present invention;

[0038] Figure 5 This is an internal structural diagram of a computer device according to another embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0040] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities or parameters with the same name but different names. It is clear that "first" and "second" are only for the convenience of expression and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0041] To facilitate understanding, the abbreviations and key terms mentioned will be explained first:

[0042] HSM: Hardware Security Module (also known as encryption machine or cryptographic machine in China) is a computer hardware device used to protect and manage the keys used by strong authentication systems, while also providing related cryptographic operations. HSM acts as a trust anchor, protecting the cryptographic infrastructure of the world's most security-critical organizations by securely managing, processing, and storing encryption keys in a robust, tamper-proof device.

[0043] SDF: In the Cryptography Industry Standard of the People's Republic of China, all interfaces in the Cryptography Device Application Interface Specification begin with SDF_. Therefore, the industry commonly refers to the Cryptography Device Application Interface Specification as the SDF Standard or SDF Specification.

[0044] SKF: In the People's Republic of China cryptography industry standard Smart Cryptographic Key Application Interface Specification, all interfaces begin with SKF_. Therefore, the industry commonly refers to the Smart Cryptographic Key Application Interface Specification as the SKF standard or SKF specification.

[0045] PKCS#11: The 11th standard in the Public-Key Cryptography Standards (PKCS), which defines a platform-independent API (Application Programming Interface) for cryptographic tokens such as Hardware Security Modules (HSMs) and smart cards.

[0046] JCE: Java™ Cryptography Extension (JCE) provides a framework and implementation for encryption, key generation and key negotiation, and Message Authentication Code (MAC) algorithms. Support for encryption includes symmetric, asymmetric, block, and stream ciphers. The software also supports secure streams and sealed objects.

[0047] In one embodiment, please refer to Figure 1 As shown, the present invention provides a data encryption / decryption system 100, specifically the data encryption / decryption system 100 comprising:

[0048] A first server 110, on which an application 111 runs, wherein the application 111 includes data encryption and decryption services;

[0049] The second server 120 is configured to perform encryption and decryption operations on received data to generate encrypted and decrypted data.

[0050] Service offloading unit 130, wherein the service offloading unit 130 is disposed between the first server 110 and the second server 120 and communicates with both the first server 110 and the second server 120 respectively; and

[0051] The service unloading unit 130 is configured to unload the data encryption / decryption service of the application and send it to the second server 120 for execution, and to receive the encrypted / decrypted data from the second server 120 and return it to the first server 110.

[0052] The aforementioned data encryption / decryption system 100, by setting up a business offloading unit between a first server running the application and a second server for encryption / decryption operations, separates the data encryption / decryption operations from the first server and performs the calculations on the second server specifically for data encryption / decryption. This not only improves the computational efficiency of data encryption / decryption operations but also reduces the impact of other business operations on the first server due to a large number of data encryption / decryption operations.

[0053] In some embodiments, the service offloading unit 130 communicates with the application through a preset interface, and the service offloading unit 130 communicates with the second server 120 through the Socket protocol, wherein the service offloading unit 130 acts as a TCP client of the Socket protocol, and the second server 120 acts as a TCP server of the Socket protocol.

[0054] In some embodiments, the service offloading unit 130 includes a unified interface layer and a data layer;

[0055] The unified interface layer is configured to receive external requests from the first server and to receive responses to external requests from the second server 120.

[0056] The data layer is configured to parse the external request and assemble a data packet to send to the second server 120, and to parse the response to the external request and assemble a response packet to return to the first server 110.

[0057] In some embodiments, the service offloading unit 130 further includes a log module;

[0058] The log module is configured to record all data operations of the unified interface layer and the data layer.

[0059] In some embodiments, the unified interface layer provides at least one of the following: SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface.

[0060] In some embodiments, the second server 120 includes a processing engine 121 and an encryption / decryption library 122;

[0061] The processing engine 121 is configured to use the epoll mechanism to detect Socket descriptors, create a data processing message queue, and create multiple threads in a thread pool to encrypt and decrypt the data in the message queue.

[0062] The encryption / decryption database 122 is configured to provide at least one callable encryption / decryption method for each thread, wherein the encryption / decryption method includes SDF, SKF, PKCS#11, third-party encryption machine HSM, and encryption card.

[0063] In some embodiments, there are multiple second servers 120, and a load balancing unit 140 is also provided between the service offloading unit 130 and the second servers 120.

[0064] The load balancing unit 140 is configured to distribute the encryption and decryption services of the application on the first server 110 evenly to multiple second servers 120.

[0065] In another embodiment, to facilitate understanding of the technical solution of the present invention, a detailed description is given below using a video publishing application as an example. This embodiment provides a data encryption and decryption system, such as... Figure 1 As shown, the data encryption and decryption system includes several first servers 110, several second servers 120, and a service offloading unit 130 (which can be deployed on the first servers in the form of a libcrypto library, for example). The following is a description of each part:

[0066] I. First Server

[0067] The first server 110 is a server that runs various applications. The first server 110 can be an application server for a service provider, and the data stored on it can be audio, video, text, etc. Application data encryption refers to the encryption and decryption processing of data within the application.

[0068] II. Second Server

[0069] The second server is a socket server, used to receive data packets sent by the service offloading unit 130, encrypt and decrypt the data, assemble and return packets to the service offloading unit 130, thus completing the encryption and decryption business of the application. Figure 2 As shown, in the relationship between the TCP client and server, the second server 120 is the TCP server, and the service offloading unit 130 is the TCP client. One second server 120 can connect to multiple service offloading units 130, providing encryption and decryption services to multiple clients. The second server 120 includes a processing engine 121 and an encryption / decryption library 122, which are described below:

[0070] (1) Processing engine 121; such as Figure 3The processing engine 121 shown is divided into three parts: using epoll to detect socket descriptors, storing request information in a message queue, and using multiple threads in a thread pool for data processing. When the second server 120 starts, it reads the configuration file to obtain information such as the IP address and port of the socket service to be listened to, and the number of threads in the thread pool. Next, it creates epoll, a message queue, and a thread pool. Then, it creates a socket based on the socket service IP address and port, and adds the socket descriptor returned by the socket service's accept() function to epoll as the descriptor for epoll detection. After epoll detects a message from the client, it performs operations such as connect(), read(), and write(), storing the information in the message header of the message queue, which is a FIFO (First-In, First-Out) queue. Threads in the thread pool preemptively read messages from the message queue. When data is found in the message queue, the thread first locks the message queue, then retrieves the message content from the tail of the message queue, and finally unlocks the message queue. After a thread in the thread pool obtains message data, it parses the message, distinguishes between protocols such as SDF, SKF, and PKCS#11, and calls the appropriate encryption / decryption library in the encryption / decryption service to perform data encryption / decryption operations based on the different protocols. A sample configuration file is shown below:

[0071] 1) IP = 100.2.97.179

[0072] 2) port = 3654

[0073] 3) threadsnum = 10

[0074] (2) Encryption and decryption library 122; The second server 120 provides three types of encryption and decryption libraries: SDF, SKF, and PKCS#11. The specific implementation of the encryption and decryption library can be implemented by yourself or by calling third-party hardware devices such as encryption machines HSM and encryption cards.

[0075] III. Business Unloading Unit 130 (Libcrypto Library Files)

[0076] The business offloading unit 130 serves as an intermediary layer between the second server 120 and the application. The application in the first server 110 only needs to load the libcrypto library file during compilation and call the business encryption / decryption interface within the libcrypto library file. This greatly increases the ease of use for encryption and decryption using the second server. The business offloading unit 130 comprises the following parts: a unified interface layer, a data layer, and a logging module. These are described below:

[0077] (1) Unified Interface Layer; The unified interface layer is the unified interface provided by the business offloading unit 130 to receive and respond to external requests. In the specific implementation process, after the application in the first server 110 imports the libcrypto library file, it can complete the specific operation business by simply calling the interface of the unified interface layer and passing in the corresponding parameters, and receiving the return parameters of the interface, without having to pay attention to the specific implementation details. In this embodiment, the unified interface layer provides SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface. If the application needs to use the interface of a certain protocol and physical device, it only needs to reference the corresponding header file.

[0078] (2) Data Layer; In this embodiment, the data layer is used to assemble data packets and send them to the second server 120, parse service response packets and pass them to the application, and complete data encryption and decryption operations. At startup, the service offloading unit 130 reads the information about the socket communication section in the configuration file and, as a client of the socket service, connects to the socket service through the ` / connect()` function. After the service offloading unit 130 establishes a TCP connection with the second server 120, it assembles data packets according to the specific protocol interface called by the application and sends the packets to the second server 120 through the `write()` / `read()` functions. The packets assemble different protocol parameters for the SDF, SKF, and PKCS#11 protocol interfaces to facilitate the calling of specific encryption and decryption libraries in the second server. Next, the service offloading unit 130 receives the return packets and returns them to the application. An example of the socket communication section in the configuration file is shown below:

[0079] 1) IP = 100.2.97.179

[0080] 2) port = 3654

[0081] 3) protocol = TCP

[0082] (3) Log Module; The task unloading unit 130 has a separate log module that records database file data operations. At startup, the task unloading unit 130 reads the log information from the configuration file, generates a log file, and records the log information. An example of the log section in the configuration file is shown below:

[0083] 1)[log]

[0084] 2)Logpath= / var / log / crypto.log

[0085] 3) Logsize = 10M

[0086] 4) Loglevel = 1

[0087] The data encryption / decryption system of this embodiment has at least the following beneficial technical effects:

[0088] (1) Unified interface: It provides a unified interface to the outside world, which is completely transparent to users and can solve the problem of directly connecting the same business system to multiple standard hardware security modules. It reduces the adaptation cost of introducing different hardware security modules; and the business offloading unit lowers the threshold for applications to use a second server for data encryption and decryption, making it easy to use and integrate.

[0089] (2) Improve encryption and decryption speed. By separating data encryption and decryption operations from the service system and performing them on a dedicated data encryption and decryption server, the computational efficiency of data encryption and decryption operations can be improved, and the impact of a large number of data encryption and decryption operations on other business operations in the service system can be reduced.

[0090] (3) Easy to expand. The second server providing encryption and decryption services is a socket server. If load balancers such as Nginx are added to the front end, the encryption and decryption services can be expanded horizontally to improve the data encryption and decryption rate.

[0091] In yet another embodiment, please refer to Figure 4 As shown, the present invention also provides a data encryption / decryption method 200, specifically the data encryption / decryption method 200 comprising:

[0092] Step 201: Run an application on the first server, wherein the application includes data encryption and decryption services;

[0093] Step 202: Configure the second server to perform encryption and decryption operations on the received data to generate encrypted and decrypted data;

[0094] Step 203: Set up a service offloading unit between the first server and the second server, which communicates with the first server and the second server respectively;

[0095] Step 204: The service unloading unit unloads the data encryption / decryption service of the application and sends it to the second server for execution, and receives the encrypted / decrypted data from the second server and returns it to the first server.

[0096] The aforementioned data encryption and decryption method, by setting up a business offloading unit between a first server running the application and a second server used for encryption and decryption, separates the data encryption and decryption operations from the first server and performs the calculations on the second server dedicated to data encryption and decryption. This not only improves the computational efficiency of data encryption and decryption operations but also reduces the impact of other business operations on the first server due to a large number of data encryption and decryption operations.

[0097] According to another aspect of the present invention, a computer device is provided, which may be a server, and its internal structure diagram is shown below. Figure 5 As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the data encryption / decryption method described above. Specifically, the data encryption / decryption method includes the following steps:

[0098] An application is run on a first server, wherein the application includes data encryption and decryption services;

[0099] Configure the second server to encrypt and decrypt received data to generate encrypted and decrypted data;

[0100] A service offloading unit is set between the first server and the second server, and communicates with both of them respectively;

[0101] The service unloading unit unloads the application's data encryption / decryption service and sends it to the second server for execution, and receives the encrypted / decrypted data from the second server and returns it to the first server.

[0102] According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, it implements the data encryption and decryption method described above, specifically including the following steps:

[0103] An application is run on a first server, wherein the application includes data encryption and decryption services;

[0104] Configure the second server to encrypt and decrypt received data to generate encrypted and decrypted data;

[0105] A service offloading unit is set between the first server and the second server, and communicates with both of them respectively;

[0106] The service unloading unit unloads the application's data encryption / decryption service and sends it to the second server for execution, and receives the encrypted / decrypted data from the second server and returns it to the first server.

[0107] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0108] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data encryption / decryption system, characterized in that, The data encryption / decryption system includes: A first server, on which an application is running, wherein the application includes data encryption and decryption services; A second server is configured to perform encryption and decryption operations on received data to generate encrypted and decrypted data. A service offloading unit, wherein the service offloading unit is disposed between the first server and the second server and communicates with both the first server and the second server respectively; and The service unloading unit is configured to unload the data encryption / decryption service of the application and send it to the second server for execution, and to receive the encrypted / decrypted data from the second server and return it to the first server. The service offloading unit includes a unified interface layer and a data layer; The unified interface layer is configured to receive external requests from the first server and to receive responses to external requests from the second server; the unified interface layer provides at least one of the following: SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface. The data layer is configured to parse the external request and assemble a data packet to send to the second server, and to parse the response to the external request and assemble a response packet to return to the first server. The packet assembles the corresponding protocol parameters for the SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface. The second server includes a processing engine and encryption / decryption libraries; The processing engine is configured to use the epoll mechanism to detect Socket descriptors, create data processing message queues, and create multiple threads in a thread pool to encrypt and decrypt data in the message queues. After the threads in the thread pool obtain message data, they parse the message, distinguish between SDF, SKF, and PKCS#11 protocols, and call different encryption and decryption libraries in the encryption and decryption service to perform data encryption and decryption operations according to the different protocols. The encryption / decryption database configuration is used to provide at least one callable encryption / decryption method for each thread, wherein the encryption / decryption method includes SDF, SKF, PKCS#11, third-party encryption machine HSM, and encryption card.

2. The data encryption / decryption system according to claim 1, characterized in that, The service offloading unit communicates with the application through a preset interface, and the service offloading unit communicates with the second server through the Socket protocol, wherein the service offloading unit acts as a TCP client of the Socket protocol, and the second server acts as a TCP server of the Socket protocol.

3. The data encryption / decryption system according to claim 1, characterized in that, The service offloading unit also includes a log module; The log module is configured to record all data operations of the unified interface layer and the data layer.

4. The data encryption / decryption system according to claim 1, characterized in that, There are multiple second servers, and a load balancing unit is also provided between the service offloading unit and the second servers; The load balancing unit is configured to distribute the encryption and decryption services of the application on the first server evenly to multiple second servers.

5. A data encryption / decryption method, characterized in that, The data encryption and decryption methods include: An application is run on a first server, wherein the application includes data encryption and decryption services; Configure the second server to encrypt and decrypt the received data to generate encrypted and decrypted data; A service offloading unit is provided between the first server and the second server, which communicates with the first server and the second server respectively; The service unloading unit unloads the application's data encryption / decryption service and sends it to the second server for execution, and receives the encrypted / decrypted data from the second server and returns it to the first server. The service offloading unit includes a unified interface layer and a data layer; The unified interface layer is configured to receive external requests from the first server and to receive responses to external requests from the second server; the unified interface layer provides at least one of the following: SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface. The data layer is configured to parse the external request and assemble a data packet to send to the second server, and to parse the response to the external request and assemble a response packet to return to the first server. The packet assembles the corresponding protocol parameters for the SDF protocol interface, SKF protocol interface, and PKCS#11 protocol interface. The second server includes a processing engine and encryption / decryption libraries; The processing engine is configured to use the epoll mechanism to detect Socket descriptors, create data processing message queues, and create multiple threads in a thread pool to encrypt and decrypt data in the message queues. After the threads in the thread pool obtain message data, they parse the message, distinguish between SDF, SKF, and PKCS#11 protocols, and call different encryption and decryption libraries in the encryption and decryption service to perform data encryption and decryption operations according to the different protocols. The encryption / decryption database configuration is used to provide at least one callable encryption / decryption method for each thread, wherein the encryption / decryption method includes SDF, SKF, PKCS#11, third-party encryption machine HSM, and encryption card.

6. A computer device, characterized in that, include: At least one processor; as well as A memory storing a computer program that can be run in the processor, which executes the program to perform the method of claim 5.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it performs the method of claim 5.

Images