Authentication encryption and decryption method, system, device and storage medium

Abstract

The present invention provides an authentication encryption and decryption system, method, device and storage medium, which relates to authentication encryption and decryption. The invention includes: receiving a first request, obtaining a first service according to the type of the first request, the type of the first request being at least one of authentication, encryption or decryption; obtaining a first parameter from the data content of the first request, the first service determining at least one encryption machine as an execution machine according to the first parameter; the first service sending the data content of the first request to the execution machine, so that the execution machine executes the operation corresponding to the type of the first request and returns the operation result; the first service returns the received operation result to the request object that issued the first request. The present invention reduces the coupling between the business platform and the encryption machine, thereby reducing the load of the business platform, increasing the authentication, encryption and decryption speed of the business platform; and improving the development efficiency of the upper-layer application when performing authentication, encryption and decryption.

Description

Technical Field

[0001] The present invention relates to the technical field of data authentication encryption and decryption, and in particular to an authentication encryption and decryption method, system, device and storage medium. Background Art

[0002] Business application platforms usually require authentication or encryption and decryption operations through encryption machines. However, there are many types of encryption machines on the market, and the speed of replacement is relatively fast.

[0003] Once the business application platform is developed, it is usually tightly coupled with the encryption machine. In order to expand the business application platform to support multiple encryption machines, the load of the business application platform will increase, resulting in a decrease in the authentication and encryption and decryption speed. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the embodiment of the present invention proposes an authentication encryption and decryption method, system, device and storage medium to reduce the authentication and encryption and decryption speed of the business application platform.

[0005] On the one hand, an embodiment of the present invention provides an authentication and encryption method, including: receiving a first request, obtaining a first service according to the type of the first request, the type of the first request being at least one of authentication, encryption or decryption; obtaining a first parameter from the data content of the first request, the first service determining at least one encryption machine as an execution machine according to the first parameter; the first service sending the data content of the first request to the execution machine, so that the execution machine performs an operation corresponding to the type of the first request and returns the operation result; the first service returns the received operation result to the request object that issued the first request.

[0006] According to some embodiments of the present invention, the method for generating the first parameter includes: receiving business demand data and obtaining a business type identifier; determining required encryption machine parameters based on the business demand data, the encryption machine parameters including: encryption machine type and encryption and decryption algorithms; generating the first parameter based on the encryption machine parameters and the business type identifier.

[0007] According to some embodiments of the present invention, the method includes: encapsulating the interface of the encryption machine to be connected based on preset rules; and accessing the encryption machine through an underlying service plug-in.

[0008] According to some embodiments of the present invention, the encryption machine publishes encryption and decryption interfaces in RPC mode.

[0009] According to some embodiments of the present invention, it includes: receiving a custom request for an authentication process, obtaining a process sequence of the authentication process; constructing an authentication process interface according to the process sequence; accessing the authentication process interface in the form of a plug-in, and publishing the authentication process interface to the requester of the authentication process.

[0010] On the one hand, an embodiment of the present invention provides an authentication and encryption system, including: an application module, used to receive a first request, obtain a first service according to the type of the first request, and obtain a first parameter from the data content of the first request, wherein the type of the first request is at least one of authentication, encryption or decryption; an interface module, used to provide the application module with an access interface of the service module, determine at least one encryption machine as an execution machine according to the first parameter, send the data content of the first request to the execution machine, so that the execution machine executes the operation corresponding to the type of the first request and returns the operation result; and, receive the operation result and return it to the application module that issued it; a service module, used to access at least one encryption machine in the form of a bottom-level service plug-in, and classify and manage the at least one encrypted interface; and at least one encryption machine.

[0011] According to some embodiments of the present invention, the application module includes: a key management module, which is used to manage the encryption and decryption interface published by the at least one cryptographic machine through the interface module in PRC, and receive a first request of encryption or decryption type, so that the interface module calls the service module to obtain encryption and decryption results; a certificate management module, which is used to manage the interface related to the authentication service published by the at least one cryptographic machine through the interface module in PRC, and receive a first request of authentication type, so that the interface module calls the service module to obtain encryption and authentication results.

[0012] According to some embodiments of the present invention, the application module includes: an issuance management module for managing the issuance policy of the certificate and recording the issuance log. On the other hand, an embodiment of the present invention provides a computer device, including: at least one processor; at least one memory for storing at least one program; when the at least one program is executed by the at least one processor, the at least one processor implements the authentication encryption and decryption method as described above.

[0013] On the other hand, the present invention provides a computer-readable storage medium, wherein program instructions are stored in the storage medium, and when the program instructions are executed by a processor, the above-mentioned authentication and encryption method is implemented.

[0014] The authentication and encryption and decryption methods, systems, devices and storage media according to the embodiments of the present invention have at least the following beneficial effects: by receiving a first request from a business platform, a corresponding encryption machine is determined according to the request type and the first parameter in the request content, so that the determined encryption machine performs authentication and encryption and decryption operations and returns the operation results to the business platform, thereby reducing the coupling between the business platform and the encryption machine, thereby reducing the load of the business platform and increasing the authentication and encryption and decryption speed of the business platform; and it is easy to expand various types of encryption machines, so that the development efficiency of upper-level applications is improved when performing authentication and encryption and decryption.

[0015] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0017] Figure 1 It is a flowchart of the steps of the authentication encryption and decryption method provided by an embodiment of the present invention.

[0018] Figure 2 It is a schematic block diagram of the modules of the authentication encryption and decryption system provided by an embodiment of the present invention.

[0019] Figure 3 It is a schematic block diagram of the system architecture of the authentication and encryption system.

[0020] Figure 4 Schematic diagram of the encryption process of the system in this embodiment.

[0021] Figure 5 Schematic diagram of the decryption process of the system in this embodiment.

[0022] Figure 6 It is a schematic diagram of the non-authentication process provided in the system of this embodiment. DETAILED DESCRIPTION

[0023] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. In the subsequent description, the use of suffixes such as "module", "component" or "unit" used to represent elements is only for the purpose of facilitating the description of the present invention, and has no specific meaning in itself. Therefore, "module", "component" or "unit" can be used in a mixed manner. "First", "second" and the like are only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features. In this subsequent description, the continuous numbering of the method steps is for the convenience of review and understanding. In combination with the overall technical solution of the present invention and the logical relationship between the various steps, adjusting the implementation order between the steps will not affect the technical effect achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0024] Reference Figure 1 This embodiment discloses an authentication encryption and decryption method, including but not limited to the following steps S100 to S400.

[0025] Step S100: receiving a first request, and acquiring a first service according to the type of the first request.

[0026] The request object that issues the first request may be a terminal or a third-party platform. The type of the first request may be at least one of authentication, encryption, or decryption. For example, a user sends an authentication request through a terminal to determine that the first service is an authentication service; a third-party platform sends an encryption or decryption request to determine that the first service is an encryption service, etc.

[0027] Step S200: obtaining a first parameter from the data content of the first request, and the first service determines at least one encryption machine as an execution machine according to the first parameter.

[0028] The data content of the first request includes a first parameter. According to the first parameter, the type of encryption machine to be used can be determined. According to the type of encryption machine, at least one encryption machine can be determined as an execution machine so that the execution machine performs operations corresponding to the first request type.

[0029] Step S300: The first service sends the data content of the first request to the execution machine, so that the execution machine executes the operation corresponding to the type of the first request and returns the operation result.

[0030] For example, the first request is an encryption request, and its data content includes data to be encrypted as an encryption object. After the execution machine determines it, it will encrypt the encryption object and return the encrypted ciphertext. Specifically, the execution machine will also determine the encryption algorithm according to the encryption type in the first parameter, and call the corresponding encryption interface to encrypt the data to be encrypted.

[0031] Step S400: The first service returns the received operation result to the request object that issued the first request.

[0032] Reference Figure 2 , this embodiment discloses an authentication encryption and decryption system, including but not limited to the following modules: an application module 100, an interface module 200, a service module 300 and at least one encryption machine 400. The application module 100 is used to receive a first request, obtain a first service according to the type of the first request, and obtain a first parameter from the data content of the first request, wherein the type of the first request is at least one of authentication, encryption or decryption. That is, the application module 100 is located at the top layer and is responsible for docking with a terminal or a third-party platform. The interface module 200 is used to determine at least one encryption machine as an execution machine according to the first parameter, send the data content of the first request to the execution machine, so that the execution machine performs the operation corresponding to the type of the first request and returns the operation result; and, receive the operation result and return it to the issuing application module. That is, the interface module 200 provides the application module with a standard access interface of the service module to uniformly manage various interfaces of the encryption machine. The service module 300 is used to access at least one encryption machine in the form of an underlying service plug-in and classify and manage at least one encrypted interface.

[0033] The following will refer to Figure 3 , further describing the technical features adopted by the authentication and encryption system of this embodiment. Figure 3 Schematic diagram of the system architecture of this embodiment.

[0034] Figure 3 The system platform provided in the system includes: upper-layer applications (equivalent to application modules), public interfaces (equivalent to interface modules), encryption machines, and services that encapsulate the interfaces provided by encryption machines (equivalent to service modules). Upper-layer applications provide a unified interface for external objects to use, such as terminals, third-party platforms, and people. Upper-layer applications include key management systems, certificate management systems, and issuance management systems.

[0035] Based on preset rules, the interface of the encryption machine is encapsulated into a bottom-level service plug-in. For example, taking the SM2 (an elliptic curve public key cryptographic algorithm issued by the National Cryptography Administration) encryption and decryption interface as an example, the server cryptographic machine provides the SM2 encryption and decryption interface to the outside world by providing a jdk; the financial data cryptographic machine provides the SM2 encryption and decryption service to the outside world in the TCP / IP communication mode; the signature verification server provides the SM2 encryption and decryption service to the outside world in the HTTP / HTTPS communication protocol. Based on preset rules, the interface of the encryption machine is uniformly encapsulated as a bottom-level service plug-in (see Figure 3 The underlying plug-in in the ). For example, the underlying plug-in can use Java for cross-platform development to be compatible with the interfaces provided by various types of cryptographic machines. In addition to the SM2 encryption and decryption interface, the system platform can also encapsulate: obtaining certificates, verifying certificates, verifying terminal signatures, generating temporary public and private key pairs, key negotiation services (initiating), key negotiation services (response), signing (through private key tags), signing (through hexadecimal private keys), using the negotiated key to sign random numbers, generating verification signatures for the negotiated keys, SM4_CBC encryption, SM4_CBC decryption, terminal certificate issuance, terminal certificate issuance (supporting save mode), generating root certificates, generating root certificates (supporting save mode), SM3 calculating HASH and other interfaces.

[0036] When the system platform is running, it will encapsulate different encryption interfaces into services such as encrypted data, calculated decryption, calculated MAC, calculated random ciphertext, etc. based on preset rules. The system platform will first complete the underlying integration of the cryptographic machine (the underlying plug-in); the underlying plug-in will publish the encryption and decryption interface to the key management system in the form of RPC (Remote Procedure Call), so that it has the encryption and decryption capabilities of the cryptographic machine; the key management system will publish encryption and decryption interfaces to different objects accessing the system according to its own business needs.

[0037] That is, the key management system is equivalent to the key management module, which is used to manage the encryption and decryption interface published by the cipher machine through the public interface in the form of PRC, and receives the first request of encryption or decryption type, so that the interface module ( Figure 3 The equivalent of the public interface) calls the service module to obtain the encryption and decryption results.

[0038] Similarly, the certificate management system is the underlying plug-in that publishes the interface for obtaining certificates, verifying certificates, verifying terminal signatures, and generating temporary public and private key pairs to the certificate management system in the form of RPC, so that it has the ability to issue cryptographic machine certificates. That is, the certificate management module is used to manage the cryptographic machine through the interface module ( Figure 3 The interface is equivalent to the public interface) and is related to the authentication service published by PRC. It receives the first request of authentication type, so that the interface module calls the corresponding service module to obtain the authentication result.

[0039] The issuance management module is used to manage the issuance policy of certificates and record issuance logs.

[0040] The first parameter is generated according to the user's business demand data. Specifically, first, the business demand data is received and the business type identifier is obtained. The business type identifier can be generated, for example, according to at least one of the user's customer number and the business serial number. The business demand data is analyzed to determine the required encryption machine parameters, which include the encryption machine type and the encryption and decryption algorithm. Then, the first parameter is generated according to the encryption machine parameters and the business type identifier.

[0041] The following will refer to Figure 4 and Figure 5 , the encryption and decryption process of the system using this embodiment will be described in detail.

[0042] Figure 4 The encryption process is shown in Figure 1. First, the object (such as a third-party platform) that accesses the key management system sends an encryption data request, which includes a first parameter and the data to be encrypted as the encryption object. The request is sent to the key management system via HTTP / HTTPS. After the key management system performs a service inspection, Figure 3 In the encryption and decryption module of the public interface layer shown, the service encryption interface to be called is determined according to the first parameter, and an internal call is made through the RPC method. After receiving the information to be encrypted (equivalent to the data to be encrypted), the internal service encryption interface is used to calculate the encrypted data and MAC. After the internal service completes the encryption of the encrypted data, the response data is returned to the key management system, and the key management system assembles the returned encrypted data and returns it to the request object that sent the encryption data request.

[0043] Figure 5 The decryption process is shown in Figure 1. First, the object (such as a third-party platform) that accesses the key management system sends a decryption data request, which includes a first parameter and the data to be decrypted as the decryption object. The request is sent to the key management system via HTTP / HTTPS. After the key management system performs a service inspection, Figure 3 In the encryption and decryption module of the public interface layer shown, the service decryption interface to be called is determined according to the first parameter, and an internal call is made through the RPC method. After receiving the information to be decrypted (equivalent to the data to be decrypted), the internal service decryption interface is used to calculate the MAC and compare it. If the comparison passes, the decryption result is calculated. After the internal service completes the decryption of the data to be decrypted, the response data is returned to the key management system, and the key management system assembles the returned decrypted data and returns it to the request object that sent the encryption data request.

[0044] Figure 6In the example of the terminal initiating authentication to the system of this embodiment, an asymmetric authentication process is shown. The terminal prepares to report data, including: obtaining the terminal unique identifier, obtaining the terminal timestamp, obtaining the authentication counter, the terminal generates a random number, the terminal generates a temporary SM2 public-private key pair, obtains SEED, obtains the terminal certificate, the terminal generates a signature value, etc., and initiates a request for two-way authentication. Figure 3 The upper-layer application shown receives the authentication request, performs authentication processing, and calls the corresponding underlying plug-in to perform business processing, including: the root certificate verifies the terminal certificate, generates a signature value for the terminal, verifies the signature, the platform generates a temporary SM2 public-private key pair, the platform negotiates the session key, calculates the random ciphertext and calculates the MAC. The underlying plug-in returns the acquired authentication result to the upper-layer application, and the upper-layer application sends the authentication result as an authentication response to the terminal after performing business processing. The terminal verifies the response result, including: the root certificate verifies the platform certificate, generates a signature value for the platform, verifies the signature, the terminal negotiates the session key, calculates the random ciphertext and compares it, and calculates the MAC and compares it. In an embodiment of the present invention, a variety of authentication process services, such as asymmetric authentication, symmetric two-way comments, etc., can be realized by providing a functional encapsulation interface for the underlying plug-in. The authentication process of this embodiment can exist in the form of a plug-in, so the authentication process can be dynamically deployed to realize the change of the authentication business.

[0045] The authentication process in this embodiment is not limited to Figure 6 . The authentication process can be customized. Specifically, receive a custom request for the authentication process, obtain the process sequence of the authentication process; call the corresponding underlying plug-in interface according to the process sequence to build an authentication process interface; access the authentication process interface in the form of a plug-in, and publish the authentication process interface to the requester of the authentication process. For example, the following authentication process A can be created: the root certificate verifies the SE certificate, the SE generates a signature value verification, the platform negotiates the session key, and calculates the MAC; the authentication process interface is constructed according to the corresponding interface of the underlying plug-in, so that the upper-level application executes the above authentication process when calling the underlying plug-in for business processing. The authentication process will be connected to the system platform in the form of a jar package, for example. Figure 3 A corresponding authentication service A interface (not shown) is added to the public interface for use by the authentication management system of the upper-level application.

[0046] This embodiment can solve the authentication requirements of different businesses by calling multiple plug-ins; it can also carry parameters in the request when making an authentication request. When the certificate management system of the upper-level application receives the authentication request, it can determine the corresponding authentication service interface through the carried parameters and execute the corresponding authentication process.

[0047] The system of this embodiment adds encapsulation of the encryption machine interface, so that the upper-layer application can implement two-way authentication and data encryption and decryption logic only through the system platform, without the need to integrate the underlying interface logic of the encryption machine, and remove the cumbersome interaction process with the encryption machine. In addition, it can support the rapid development of customizable authentication processes. The system platform can provide different service capabilities to the outside world by adding or modifying business plug-ins according to the authentication requirements of different businesses, thus completely liberating the productivity of upper-layer applications.

[0048] The present embodiment provides a computer device, including: at least one processor; at least one memory for storing at least one program; when at least one program is executed by at least one processor, at least one processor implements the above-mentioned authentication encryption and decryption method. Among them, the processor can also be called a CPU (Central Processing Unit). The processor may be an integrated circuit chip with signal processing capabilities. The processor can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor, or the general-purpose processor can also be any conventional processor, etc. The memory can include various components (e.g., machine-readable media), including but not limited to random access memory components, read-only components and any combination thereof. The memory can also include: instructions (e.g., software) (e.g., stored in one or more machine-readable media); the instructions implement the above-mentioned authentication encryption and decryption method of the present invention. It is hoped that it is understood that in order to avoid redundancy, the content not involved in this embodiment can refer to the above-mentioned authentication encryption and decryption method.

[0049] This embodiment provides a computer-readable storage medium, which stores program instructions, and when the program instructions are executed by a processor, the above-mentioned authentication encryption and decryption method can be implemented. It is hoped that, in order to avoid redundancy, the content not involved in this embodiment can refer to the above-mentioned authentication encryption and decryption method.

[0050] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above and the functional modules / units in the devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0051] In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium (storage medium for short), which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer-readable medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0052] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the present invention is not limited thereby. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present invention.

Claims

1. An authentication encryption and decryption method, characterized in that: include: receiving a first request, and acquiring a first service according to a type of the first request, where the type of the first request is at least one of authentication, encryption, or decryption; Acquire a first parameter from the data content of the first request, and the first service determines at least one encryption machine as an execution machine according to the first parameter; The first service sends the data content of the first request to the execution machine, so that the execution machine performs an operation corresponding to the type of the first request and returns an operation result; The first service returns the received operation result to the request object that issued the first request; The method for generating the first parameter includes: receiving business demand data and obtaining a business type identifier; determining required encryption machine parameters according to the business demand data, wherein the encryption machine parameters include: an encryption machine type and an encryption and decryption algorithm; generating the first parameter according to the encryption machine parameters and the business type identifier; wherein the business type identifier is generated according to at least one of a customer number and a business serial number of a user; The authentication encryption and decryption method comprises: based on preset rules, encapsulating the interface of the encryption machine to be accessed to obtain an underlying service plug-in; accessing the encryption machine by means of the underlying service plug-in, and classifying and managing the at least one encrypted interface; The encryption machine publishes the encryption and decryption interface to the key management system in RPC mode through the underlying service plug-in, so that the key management system publishes the encryption and decryption interface to different objects accessing the system according to its own business needs; The method further comprises: Receive a custom request for an authentication process, and obtain a process sequence of the authentication process; Constructing an authentication process interface according to the process sequence; The authentication process interface is accessed in the form of a plug-in, and the authentication process interface is published to the requester of the authentication process.

2. An authentication encryption and decryption system for executing the method of claim 1, characterized in that: include: An application module is used to receive a first request, obtain a first service according to the type of the first request, and obtain a first parameter from the data content of the first request, wherein the type of the first request is at least one of authentication, encryption or decryption; wherein generating the first parameter comprises: receiving business demand data and obtaining a business type identifier; determining required encryption machine parameters according to the business demand data, wherein the encryption machine parameters comprise: an encryption machine type and an encryption and decryption algorithm; generating the first parameter according to the encryption machine parameters and the business type identifier; wherein the business type identifier is generated according to at least one of a user's customer number and a business serial number; an interface module, configured to provide the application module with an access interface of the service module, determine at least one encryption machine as an execution machine according to the first parameter, send the data content of the first request to the execution machine, so that the execution machine performs an operation corresponding to the type of the first request and returns an operation result; and receive the operation result and return it to the application module that issued it; A service module, used to access at least one encryption machine in the form of an underlying service plug-in, and classify and manage the at least one encrypted interface; the underlying service plug-in is obtained by encapsulating the interface of the encryption machine to be accessed based on preset rules; and, at least one encryption machine; The encryption machine publishes the encryption and decryption interface to the key management system in RPC mode through the underlying service plug-in, so that the key management system publishes the encryption and decryption interface to different objects accessing the system according to its own business needs; The system is also used to: receive a custom request for an authentication process, obtain a process sequence of the authentication process; construct an authentication process interface according to the process sequence; access the authentication process interface in the form of a plug-in, and publish the authentication process interface to the requester of the authentication process.

3. According to the authentication and encryption system of claim 2, the application module comprises: A key management module, used to manage the encryption and decryption interface published by the at least one cipher machine through the interface module in PRC, receive a first request of encryption or decryption type, and enable the interface module to call the service module to obtain encryption and decryption results; The certificate management module is used to manage the interface related to the authentication service published by the at least one cryptographic machine through the interface module in PRC, receive the first request of the authentication type, and enable the interface module to call the service module to obtain the authentication result.

4. According to the authentication and encryption system of claim 2, the application module comprises: The issuance management module is used to manage the issuance policy of certificates and record issuance logs.

5. A computer device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the authentication, encryption and decryption method as claimed in claim 1.

6. A computer-readable storage medium, wherein program instructions are stored in the storage medium, and when the program instructions are executed by a processor, the authentication encryption and decryption method according to claim 1 is implemented.

Images