Business data processing method, device, server and storage medium of government affairs system

Abstract

The embodiments of the present application provide a business data processing method, device, server and storage medium of a government affairs system. The method obtains a business data storage request sent by a first user through a government affairs system client, wherein the business data storage request includes initial business data. A target field in the initial business data is encrypted using a target encryption algorithm according to a first configuration file through a standard encryption and decryption interface to obtain target business data, wherein the target field is a field in the initial business data that needs to be encrypted. The target business data is stored in a first storage path, which is a business data storage path of the first user. The method implements encryption processing of key fields in the business data by calling different encryption algorithms through a standard encryption and decryption interface, thereby avoiding developers from modifying the source code, thereby improving the stability and reliability of the government affairs system.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and in particular, to a method, device, server and storage medium for processing business data of a government affairs system. Background Art

[0002] With the advent of the big data era, relevant units in different regions and fields have also begun to process daily affairs through government systems. In order to avoid data leakage, the relevant data involved in the government system needs to be transmitted or stored after encryption. However, due to the complexity and diversity of the business types involved in the government system, the different security levels of different business data and the different needs of users, different encryption methods need to be used when encrypting different business data.

[0003] In the related art, the encryption method is changed by modifying the source code. That is, each time the encryption method is changed, the developer deletes the original code and rewrites a new code according to the new encryption method. The modification of the source code may cause some unexpected errors during the operation of the system, thereby affecting the stability and reliability of the government system. Summary of the invention

[0004] The embodiments of the present application provide a business data processing method, device, server and storage medium of a government affairs system to solve the problem in the prior art that the stability and reliability of the system are affected due to changes in the encryption method.

[0005] In a first aspect, an embodiment of the present application provides a business data processing method of an e-government system, comprising:

[0006] Acquire a business data storage request sent by a first user through an e-government system client, wherein the business data storage request includes initial business data, and the initial business data includes at least one field;

[0007] Calling a standard encryption and decryption interface according to the first configuration file, and using a target encryption algorithm to encrypt a target field in the initial business data to obtain target business data, wherein the target field is a field in the initial business data that needs to be encrypted;

[0008] The target business data is stored in a first storage path, where the first storage path is the business data storage path of the first user. The first configuration file is generated based on information of multiple key fields that need to be encrypted in the government affairs system and information of multiple encryption algorithms involved.

[0009] In a second aspect, an embodiment of the present application provides a business data processing device of an e-government system, including:

[0010] An acquisition module, configured to acquire a business data storage request sent by a first user through an e-government system client, wherein the business data storage request includes initial business data, and the initial business data includes at least one field;

[0011] A processing module is used to call a standard encryption and decryption interface according to a first configuration file, and adopt a target encryption algorithm to encrypt a target field in the initial business data to obtain target business data, wherein the target field is a field in the initial business data that needs to be encrypted, and the first configuration file is generated based on information on multiple key fields that need to be encrypted in a government affairs system and information on multiple encryption algorithms involved; and the target business data is stored in a first storage path, which is a business data path for the first user.

[0012] In a third aspect, an embodiment of the present application provides an e-government system server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the business data processing method of the e-government system as described in the first aspect above is implemented.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the business data processing method of the government affairs system as described in the first aspect above.

[0014] The business data processing method, device, server and storage medium of the government affairs system provided in the embodiment of the present application obtain a business data storage request sent by a first user through a government affairs system client, the business data storage request includes initial business data, the initial business data includes at least one field, and a target encryption algorithm is used to encrypt the target field in the initial business data according to a first configuration file through a standard encryption and decryption interface to obtain target business data, the target field is the field that needs to be encrypted in the initial business data, and the target business data is stored in a first storage path, the first storage path is the business data storage path of the first user, and encryption processing of key fields in the business data is realized through a standard encryption and decryption interface. Since the standard encryption and decryption interface can implement different encryption algorithms by calling according to needs, thereby avoiding the modification of the source code by developers, not only improving the stability and reliability of the government affairs system, saving the maintenance cost of the government affairs system, but also when a new encryption algorithm needs to be used, it can be realized by modifying the configuration file, thereby improving the scalability of the government affairs system.

[0015] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A flowchart of a method for encrypting business data of an e-government system provided in Embodiment 1 of the present application;

[0018] Figure 2 A schematic diagram of the structure of a first configuration file provided in Example 1 of the present application;

[0019] Figure 3 A schematic diagram of the working principle of a standard encryption and decryption interface provided in Example 1 of the present application;

[0020] Figure 4 A flowchart of a method for decrypting business data of an e-government system provided in Embodiment 2 of the present application;

[0021] Figure 5 A schematic diagram of the structure of a second configuration file provided in Embodiment 2 of the present application;

[0022] Figure 6 A schematic diagram of the structure of a business data processing device of an e-government system provided in Embodiment 3 of the present application;

[0023] Figure 7 A structural diagram of an e-government system server provided in Example 4 of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In the related art, the encryption method is changed by modifying the source code, which mainly has the following problems: (1) A set of codes needs to be implemented for each encryption method, which is difficult and costly to modify, and it is difficult to avoid the impact on the stability and reliability of the government system after the modification; (2) The government system is not scalable enough, and there is no unified standard for the implementation of various encryption methods, which is not convenient for subsequent system modifications.

[0027] Based on the technical problems existing in the prior art, the present application provides a business data processing method for a government affairs system, by pre-writing encryption / decryption programs corresponding to different encryption / decryption methods based on a service provider interface (SPI) mechanism and constructing and instantiating a standard encryption / decryption interface. During the business data processing process, the standard encryption / decryption interface calls the corresponding encryption / decryption program based on the needs of different application scenarios to implement encryption / decryption of business data. Therefore, when different encryption / decryption methods are needed, the encryption / decryption program corresponding to the standard encryption / decryption interface can be used, and developers do not need to repeatedly modify the source code. This not only improves the stability and reliability of the government affairs system, but also improves the scalability of the government affairs system, and reduces the transformation and maintenance costs of the government affairs system.

[0028] Embodiment 1

[0029] For example, Figure 1 This is a flowchart of a business data encryption method for an e-government system provided in Embodiment 1 of the present application. The method of this embodiment can be executed by a business data processing device for an e-government system provided in Embodiment 1 of the present application. The device can be implemented in software and / or hardware and can be integrated into an e-government system server. Figure 1 As shown, the business data encryption method of the government affairs system of this embodiment includes:

[0030] S101. Obtain a business data storage request sent by a first user through an e-government system client.

[0031] When the first user uses the government affairs system client to handle related business, it may be necessary to upload files or fill in information, thereby generating business data. Accordingly, when the user completes uploading files or submitting information, the government affairs system client sends a business data storage request to the government affairs system server. The business data storage request carries the files uploaded by the user or the information filled in, that is, the initial business data. After receiving the business data storage request, the government affairs system server obtains the initial business data through parsing. It can be understood that the initial business data includes at least one field.

[0032] For example, when the first user conducts business through the government affairs system client, the user may be required to upload or fill in personal information in order to verify his / her identity. In order to avoid leakage of the user's personal information, the user's personal information needs to be encrypted.

[0033] The first user is a person who submits initial business data, for example, the first user is an applicant for the relevant business.

[0034] S102: calling a standard encryption and decryption interface according to the first configuration file, and using a target encryption algorithm to encrypt a target field in the initial business data to obtain target business data.

[0035] In this step, after parsing the initial business data, the government affairs system server calls the pre-built standard encryption and decryption interface, and the standard encryption and decryption interface determines whether there is a field in the initial business data that needs to be encrypted, that is, the target field. If so, the initial business data is stored after the target field is encrypted. If not, the initial business data is directly stored.

[0036] The standard encryption and decryption interface is a standard software interface pre-defined based on the SPI mechanism and having encryption and decryption functions.

[0037] The target field refers to one or more fields in the initial business data determined by the standard encryption and decryption interface that need to be encrypted.

[0038] The target encryption algorithm refers to one or more encryption algorithms determined by the standard encryption and decryption interface for encrypting the target field in the initial business data. It should be noted that since there may be many types of target fields, and the encryption algorithms for encrypting different types of target fields may be the same or different, the determined target encryption algorithm may be one or more. For example, in this step, the determined target fields include the first user information and the second user information, and the encryption algorithms required to encrypt the first user information and the second user information are the first encryption algorithm and the second encryption algorithm, respectively. Therefore, the first encryption algorithm and the second encryption algorithm are both target encryption algorithms.

[0039] In order to avoid modifying the source code when modifying the encryption algorithm, in addition to pre-defining the standard encryption and decryption interface, this embodiment also requires configuration of key fields that need to be encrypted, as well as configuration of the encryption algorithm involved in encrypting the key fields.

[0040] In a possible implementation, in this embodiment, key fields can be determined in advance based on relevant regulations and user needs, and then corresponding encryption algorithms can be configured for different key fields based on the application scenarios and / or security levels and / or user needs of different key fields.

[0041] Optionally, the key fields are fields that constitute sensitive data or data related to sensitive data, such as fields related to personal information.

[0042] In a possible implementation, in this embodiment, a developer may pre-write encryption programs corresponding to a variety of encryption algorithms involved in the government affairs system, and store the obtained encryption programs separately.

[0043] Optionally, the encryption program is stored via a software development kit (SDK).

[0044] In this embodiment, the various encryption algorithms involved in the government affairs system may include symmetric encryption algorithms, such as SM4, DES, 3DES, DESX, Blowfish, IDEA, RC4, RC5, RC6 and AES, etc., and may also include asymmetric encryption algorithms, such as SM2, RSA, ECC, Diffie-Hellman, El Gamal, DSA, etc., and also include hash algorithms, such as SM3, MD2, MD4, MD5, HAVAL, SHA, SHA-1, HMAC, HMAC-MD5, HMAC-SHA1, etc. The specific type of encryption algorithm used can be determined according to actual conditions and is not limited here.

[0045] In a possible implementation, in order to facilitate the standard encryption and decryption interface to identify the target field and match the encryption method for the target field, in this embodiment, a first configuration file can be generated in advance based on the key field and the encryption algorithm involved, and the first configuration file includes information about the first key field (such as the name of the key field), information about the encryption algorithm (such as the name of the encryption algorithm), and a first mapping relationship between the encryption algorithm and the key field. For ease of distinction, in this embodiment, the configuration file used in the data storage process is called the first configuration file, and the mapping relationship between the encryption algorithm and the key field is called the first mapping relationship.

[0046] The key field information includes a set of all key fields that need to be encrypted in the government affairs system, and the encryption algorithm information includes a second mapping relationship between all encryption algorithms involved in the government affairs system and the storage paths of the encryption algorithms. For ease of distinction, the mapping relationship between the encryption algorithm and the storage path of the encryption algorithm is called the second mapping relationship.

[0047] For example, Figure 2 A schematic diagram of the structure of a first configuration file provided in Example 1 of the present application is shown in FIG. Figure 2 As shown, the left side is key field information. Optionally, in the key field set, the key field set is divided into multiple subsets according to different first users. Figure 2 Take user U1 and user U2 as examples, where field a1, field a2 and field a3 are fields in user U1's business data that need to be encrypted, and field b1, field b2 and field b3 are fields in user U2's business data that need to be encrypted. The right side is the encryption algorithm information. Figure 2 Take the encryption algorithms including SM4 and SM3 as an example, wherein the storage paths of the encryption programs corresponding to SM4 and SM3 are L1 and L2 respectively. Figure 2 The arrows between the key field information and the encryption algorithm information represent the first mapping relationship, which is used to indicate the encryption algorithm to be used for each key field. The arrows inside the encryption algorithm information represent the second mapping relationship, which is used to indicate the storage path of the encryption algorithm program corresponding to each encryption algorithm. It can be seen that SM4 is used to encrypt field a1, field a2, field b1 and field b3, and SM3 is used to encrypt field a2 and field b2.

[0048] For example, Figure 3 A schematic diagram of the working principle of a standard encryption and decryption interface provided in Example 1 of the present application is shown as follows: Figure 3As shown, in a possible implementation, the standard encryption and decryption interface has a data interception function. When the government affairs system server receives data or needs to send data, the standard encryption and decryption interface can intercept the interactive data and implement encryption or decryption of the interactive data by calling a pre-encryption or decryption program based on the configuration file. Among them, the input parameter is the data intercepted by the standard encryption and decryption interface, which can be the data to be sent by the government affairs system server or the data just received by the government affairs system server. The output parameter is the data encrypted or decrypted by the standard encryption and decryption interface. During the encryption process, the program called by the standard encryption and decryption interface is the encryption program, and during the decryption process, the program called by the standard encryption and decryption interface is the decryption program.

[0049] In this embodiment, the standard encryption and decryption interface is mainly used to encrypt the received business data. Accordingly, the standard encryption and decryption interface is mainly used to: first, according to the first configuration file, call the target encryption program corresponding to the target encryption algorithm to encrypt the target field to obtain the ciphertext of the target field, and then replace all target fields in the initial business data with the ciphertext to obtain the target business data.

[0050] In one possible implementation, the standard encryption and decryption interface first determines the second storage path of the target field and the target encryption program contained in the initial business data according to the first configuration file, and then, according to the determined second storage path, calls out the target encryption program from the corresponding position, and uses the target encryption program to encrypt the target field to obtain the ciphertext of the target field.

[0051] The second storage path is a storage path of an encryption program for encrypting a target field in the initial business data determined by a standard encryption and decryption interface.

[0052] For example, continue to refer to Figure 2, assuming that the first user is user U1, the standard encryption and decryption interface reads from the first configuration file that the fields that need to be encrypted for the business data of user U1 are field a1, field a2, and field a3. Further, the standard encryption and decryption interface traverses the initial business data according to field a1, field a2, and field a3 to determine whether field a1, field a2, or field a3 exists in the initial business data. Assuming that the result of the traversal is that the initial business data includes field a1 and field a2, that is, the target field includes field a1 and field a2, and the number of occurrences of field a1 is 5 times, and the number of occurrences of field a2 is 3 times; further, the standard encryption and decryption interface determines the mapping relationship between the key fields and the encryption algorithm in the first configuration file. The encryption algorithms required for encrypting field a1 and field a2 are SM4 and SM3 respectively, that is, the target encryption algorithm includes SM4 and SM3, and according to the mapping relationship between the encryption algorithm and the encryption program, the storage paths of SM4 and SM3 are determined to be path L1 and path L2 respectively; finally, the standard encryption and decryption interface calls the SM4 encryption program according to path L1 to encrypt field a1 and obtain the ciphertext x1 of field a1, and calls the SM3 encryption program according to path L2 to encrypt field a2 and obtain the ciphertext x2 of field a2, and replaces all fields a1 in the initial business data with ciphertext x1, and replaces all fields a2 in the initial business data with ciphertext x2 to obtain the target business data. It can be understood that if field a1, field a2 or field a3 does not exist in the initial business data, the standard encryption and decryption interface does not process the initial business data, and the output parameter is still the initial business data.

[0053] In a possible implementation, when replacing the target field, in this step, the position of each target field in the initial business data can be determined first, and then the target field at the corresponding position of the corresponding ciphertext can be replaced at that position. Figure 2 In the example, the positions of field a1 and field a2 in the initial service data are first determined, wherein the position of field a1 includes: a11 , L a12 , L a13 , L a14 and L a15 , the position of field a2 includes: L a21 , L a22 and L a23 , and then, according to L a11 , L a12 , L a13 , L a14 and L a15 , use the ciphertext x1 to replace the field a1 in the initial business data, according to L a21 , L a22 and L a23, use ciphertext x2 to replace field a2 in the initial business data to obtain the target business data.

[0054] In a possible implementation, an encryption function may also be predefined in this embodiment. Accordingly, in this step, the standard encryption and decryption interface is specifically used to: according to the first configuration file, call the target encryption program corresponding to the target encryption algorithm through the encryption function to encrypt the target field to obtain the ciphertext of the target field.

[0055] Exemplarily, a custom EncryptAlgorithm interface is used as a standard encryption and decryption interface, and three basic functions, "getName()", "encrypt()" and "decrypt()", are defined according to the EncryptAlgorithm interface, where "getName()" is a name query function, "encrypt()" is an encryption function, and "decrypt()" is a decryption function. In the encryption process, after determining the target field and the target encryption algorithm, assuming that the target encryption algorithm used to encrypt the target field a0 is SM3, all fields a0 in the business data can be found through "getName(a0)", and then the encryption algorithm corresponding to SM3 can be called through "encrypt(SM3)" to encrypt the field a0 and obtain the ciphertext of a0. If there are other target fields, they are encrypted in the same way and with their corresponding encryption algorithms, thereby realizing arbitrary switching between multiple encryption algorithms, and finally using different encryption algorithms to encrypt different target fields.

[0056] S103: Store the target business data in the first storage path.

[0057] The first storage path is determined according to a storage location of the business data of the first user, and is a path for storing the business data of the first user.

[0058] In this embodiment, different data storage areas may be divided in advance for different first users to store their business data respectively. For example, when a business data storage request sent by a first user is received, it is first determined whether the first user is a new user. If the first user is a new user, a new data storage area is created for the user according to a preset logic, and the target business data obtained in S102 is stored in the new data storage area in this step; if the first user is an old user, the location of the data storage area of ​​the first user is found in this step, and the target business data obtained in S102 is stored in the existing data storage area of ​​the user in this step.

[0059] In a possible implementation, to facilitate the storage of target business data, in this embodiment, a correspondence table between the user identification of the first user and its business data storage path is generated according to the location of the data storage area of ​​different first users. Accordingly, in this step, according to the first user identification, by looking up the table, the storage path corresponding to the target business data can be determined, and then the target business data can be stored in the corresponding data storage area according to the storage path. It can be understood that each time a new data storage area is constructed, the correspondence table will be updated, so that the server can store data based on the updated data table each time.

[0060] It should be noted that in this step, it can be executed through the standard encryption and decryption interface, that is, the target business data is stored by the standard encryption and decryption interface, and it can also be executed by the target processor in the server that processes the business data of the government system, that is, the target business data is sent to the target processor by the standard encryption and decryption interface, and then the target processor stores the target business data. The specific details can be determined according to the actual situation and are not limited here.

[0061] Optionally, the first configuration file includes a correspondence between the user identifier of the first user and the storage path of his business data. Accordingly, in this step, the first storage path of the target business data is determined according to the first configuration file through a standard encryption and decryption interface, and the target business data is stored according to the first storage path.

[0062] In this embodiment, by obtaining a business data storage request sent by a first user through a government affairs system client, the business data storage request includes initial business data, and the initial business data includes at least one field. The target field in the initial business data is encrypted using a target encryption algorithm according to a first configuration file through a standard encryption and decryption interface to obtain target business data, where the target field is a field that needs to be encrypted in the initial business data. The target business data is stored in a first storage path, which is the business data storage path of the first user, and encryption processing of key fields in the business data is implemented through a standard encryption and decryption interface. Since the standard encryption and decryption interface can implement different encryption algorithms by calling according to needs, thereby avoiding the modification of the source code by developers, not only the stability and reliability of the government affairs system is improved, and the maintenance cost of the government affairs system is saved, but also when a new encryption algorithm needs to be used, it can be implemented by modifying the configuration file, thereby improving the scalability of the government affairs system.

[0063] Embodiment 2

[0064] For example, Figure 4This is a flow chart of a business data decryption method for an e-government system provided in Embodiment 2 of the present application. The method of this embodiment can be executed by a business data processing device for an e-government system provided in Embodiment 2 of the present application. The device can be implemented by software and / or hardware and can be integrated into an e-government system server. Figure 4 As shown, the business data decryption method of the government affairs system of this embodiment includes:

[0065] S401. Obtain a business data acquisition request sent by a second user through an e-government system client.

[0066] When the second user uses the government affairs system client to process the business data of the first user, illustratively, when the second user clicks on a link or tag to open the business data of the first user, the government affairs system client sends a business data acquisition request of the first user to the government affairs system server. The second user is the person who extracts the initial business data, and the second user may be the first user or may not be the first user, for example, the second user is a staff member who handles the relevant business.

[0067] Since the government affairs system server stores a lot of business data, in order to facilitate subsequent data processing by the government affairs system server, in this embodiment, the business data acquisition request includes the user identification of the first user.

[0068] S402: Extract target business data from the first storage path according to the user identifier.

[0069] After S401, in this step, a first storage path of the business data of the first user is determined according to the user identifier of the first user, and then, target business data is extracted from a storage area of ​​the business data of the first user according to the first storage path.

[0070] In a possible implementation, in this step, the first storage path of the first user's service data is determined according to a correspondence table between the first user's user identification and its service data storage path.

[0071] It should be noted that this step can be executed by the target server in the government affairs system server that processes the business data of the government affairs system, or it can be executed by the target server calling the standard encryption and decryption interface.

[0072] This step is the reverse process of S103. The specific implementation method thereof can refer to S103 and will not be described in detail here.

[0073] S403: Call the standard encryption and decryption interface according to the second configuration file, and use the target decryption algorithm to decrypt the ciphertext in the target business data to obtain initial business data.

[0074] In this implementation, when the target business data includes ciphertext, the target decryption algorithm for decrypting the ciphertext in the target business data is determined according to the second configuration file by calling the standard encryption and decryption interface, and then the target decryption algorithm is used to decrypt the ciphertext in the target business data to obtain the initial business data.

[0075] The target decryption algorithm refers to one or more decryption algorithms determined by the standard encryption and decryption interface for decrypting the ciphertext in the target business data. It should be noted that since the ciphertext in the target business data may be encrypted by one or more encryption algorithms, the decryption algorithm used in this step may be one or more, and the target decryption algorithm is the same as the target encryption algorithm used in S102.

[0076] For example, refer to Figure 2 The ciphertexts included in the target business data include two types: ciphertext x1 and ciphertext x2. Since the ciphertext x1 is encrypted according to the SM4 encryption algorithm, and the ciphertext x2 is encrypted according to the SM3 encryption algorithm, it can be determined that the target decryption algorithm in the step includes the SM4 decryption algorithm and the SM3 decryption algorithm.

[0077] The standard encryption and decryption interface in this embodiment is mainly used to decrypt the business data to be sent. In a possible implementation, first, according to the second configuration file, the target decryption program corresponding to the target decryption algorithm is called to decrypt the ciphertext in the target business data to obtain the plaintext of the target field. For example, the SM4 decryption program is called to decrypt the ciphertext x1 to obtain the plaintext of the field a1, and the SM3 decryption program is called to decrypt the ciphertext x2 to obtain the plaintext of the field a2; then all the ciphertexts in the target business data are replaced by the plaintext to obtain the initial business data. For example, all the ciphertexts x1 in the target business data are replaced by the plaintext of the field a1, and all the ciphertexts x2 in the target business data are replaced by the plaintext of the field a2 to obtain the initial business data.

[0078] For the sake of distinction, in this embodiment, the configuration file used in the decryption process of the standard encryption and decryption interface is called the second configuration file. The second configuration file may be the first configuration file or may not be the first configuration file.

[0079] In this embodiment, in order to facilitate the standard encryption and decryption interface to restore the encrypted business data, the second configuration file is set to include the ciphertext location information of the stored business data, the decryption algorithm information, and the third mapping relationship between the ciphertext and the decryption algorithm, wherein the ciphertext location information includes the location index set of the ciphertext contained in the stored business data, and the decryption algorithm information includes the fourth mapping relationship between the decryption algorithm for decrypting the ciphertext and the storage path of the decryption program. For the convenience of distinction, in this embodiment, the mapping relationship between the ciphertext and the decryption algorithm is called the third mapping relationship, and the mapping relationship between the decryption algorithm and the storage path of the decryption program is called the fourth mapping relationship.

[0080] For example, Figure 5 This is a schematic diagram of the structure of a second configuration file provided in the second embodiment of the present application. The second configuration file can be constructed by a standard encryption and decryption interface during the encryption process. Taking the second configuration file of user U1 as an example, Figure 5 As shown, the left side is the ciphertext position information. Optionally, according to different ciphertexts, the ciphertext position index set is divided into multiple subsets. Figure 5 In the example, ciphertext x1 and ciphertext x2 are taken as examples, where the ciphertext x1 appears at position L in the target business data. a11 , L a12 , L a13 , L a14 and L a15 , the ciphertext x2 appears at position L in the target business data a21 , L a22 and L a23 The right side is the decryption algorithm information, Figure 2 The encryption algorithm in corresponds to, Figure 5 The decryption algorithms in include two decryption algorithms, SM4 and SM3. SM4 is used to decrypt the ciphertext x1, and the storage path of the SM4 decryption program is P1. SM3 is used to decrypt the ciphertext x2, and the storage path of the SM3 decryption program is P2. Figure 5 The arrow between the ciphertext position information and the decryption algorithm information represents a third mapping relationship, which is used to indicate the decryption algorithm to be used for each ciphertext. The arrow inside the decryption algorithm information represents a fourth mapping relationship, which is used to indicate the storage path of the decryption algorithm program corresponding to each decryption algorithm.

[0081] In one possible implementation, the standard encryption and decryption interface first determines the location of the ciphertext in the target business data and the third storage path corresponding to the target decryption program for decrypting the ciphertext at each location based on the location index set, the third mapping relationship, and the fourth mapping relationship in the second configuration file, and then calls the target decryption program to decrypt the ciphertext in the target business data based on the third storage path to obtain the plaintext of the target field.

[0082] The third storage path is a storage path of a decryption program corresponding to a decryption algorithm for decrypting ciphertext determined by the standard encryption and decryption interface, ie, a target decryption program.

[0083] Example, continue with parameter Figure 5 The standard encryption and decryption interface determines the position L in the target service data from the position index set in the second configuration file. a11 , L a12 , L a13 , L a14 and L a15 There is ciphertext x1 at position L a21 , L a22 , L a23 There is a ciphertext x2 at the location, and then according to the third mapping relationship, determine the L a11 , L a12 , L a13 , L a14 and L a15 The algorithm for decrypting the ciphertext at a total of 5 positions is SM4, a21 , L a22 and L a23 The algorithm for decrypting the ciphertext at the three positions is SM3. Then, according to the fourth mapping relationship, the storage path of the SM4 decryption program is determined to be P1, and the storage path of the SM3 decryption program is determined to be P2. Accordingly, the standard encryption and decryption interface calls the SM4 decryption program according to the storage path P1, decrypts the ciphertext x1, obtains the field a1 (plaintext), and then uses the field a1 to decrypt L a11 , L a12 , L a13 , L a14 and L a15 The ciphertext x1 at the position is replaced, and the SM4 decryption program is called according to the storage path P2 to decrypt the ciphertext x2 to obtain the field a2 (plaintext), and then the L a21 , L a22 and L a23 The ciphertext x2 at the position is replaced, thereby restoring the target business data to the original business data.

[0084] In a possible implementation, the decryption function can also be predefined in this embodiment. Accordingly, in this step, the standard encryption and decryption interface is specifically used to: according to the second configuration file, the target decryption program corresponding to the target decryption algorithm is called by the decryption function to decrypt the ciphertext in the target business data to obtain the plaintext of the target field. For example, the ciphertext in the target business data is decrypted by the "getName()" function and the "decrypt()" function. After the ciphertext and the target decryption algorithm are determined according to the second configuration file, assuming that the target decryption algorithm used to decrypt the ciphertext x0 is SM3, all the ciphertexts x0 in the business data can be found by "getName(x0)", and then the decryption algorithm corresponding to SM3 can be called by "decrypt(SM3)" to decrypt the ciphertext x0 and obtain the plaintext corresponding to x0. If there are other ciphertexts, they are decrypted in the same way and with their corresponding decryption algorithms, so as to realize the arbitrary switching between multiple encryption algorithms, and finally realize the decryption of different ciphertexts by using different decryption algorithms.

[0085] It is understandable that the second configuration files of different first users are different. For the same first user in a business scenario, since the business data requested for processing may be different, the target fields and target encryption algorithms may also be different accordingly, and therefore, the second configuration files may also be different.

[0086] It should be noted that in this step, the standard encryption and decryption interface will first determine whether there is ciphertext in the target encrypted data. If there is ciphertext, the steps in S403 will be executed to decrypt the ciphertext in the target encrypted data to obtain the initial business data without ciphertext, and generate output parameters based on the initial business data; if there is no ciphertext, there is no need to execute the decryption step in S403, and the output parameters can be generated directly according to the target business data.

[0087] S404: Feedback the initial service data to the second user.

[0088] In this step, a feedback message is generated according to the initial business data obtained in S403, and the feedback message is fed back to the second user through the government affairs system client.

[0089] In one possible implementation, the output parameter generated by the standard encryption and decryption interface in S404 is the initial business data. The standard encryption and decryption interface sends the initial business data to the target processor in the server that processes the government system business data. The target processor then constructs a feedback message based on the initial business data and sends it to the second user through the government system client.

[0090] In another possible implementation, the output parameter generated by the standard encryption and decryption interface in S404 is the feedback message, and the standard encryption and decryption interface directly sends the feedback message to the second user through the government affairs system client.

[0091] In this embodiment, a business data acquisition request sent by a second user through a government affairs system client is obtained, wherein the business data acquisition request includes a user identifier of a first user. According to the user identifier, target business data is extracted from a first storage path, and the ciphertext in the target business data is decrypted using a target decryption algorithm according to a second configuration file through a standard encryption and decryption interface to obtain initial business data. The initial business data is fed back to the second user, thereby realizing decryption processing of the ciphertext of key fields in the business data through a standard encryption and decryption interface. Since the standard encryption and decryption interface can implement different decryption algorithms by calling as needed, thereby avoiding modification of the source code by developers, not only improving the stability and reliability of the government affairs system and saving the maintenance cost of the government affairs system, but also, when a new decryption algorithm is needed, it can be achieved by modifying the configuration file, thereby improving the scalability of the government affairs system.

[0092] Embodiment 3

[0093] Figure 6 This is a schematic diagram of the structure of a business data processing device of an e-government system provided in Embodiment 3 of the present application. The device can be implemented by software and / or hardware and can be integrated into an e-government system server. Figure 6 As shown, the business data processing device 10 of the government affairs system in this embodiment includes:

[0094] An acquisition module 11 and a processing module 12.

[0095] An acquisition module 11 is used to acquire a business data storage request sent by a first user through an e-government system client, where the business data storage request includes initial business data, and the initial business data includes at least one field;

[0096] The processing module 12 is used to call the standard encryption and decryption interface according to the first configuration file, and adopt the target encryption algorithm to encrypt the target field in the initial business data to obtain the target business data. The target field is the field that needs to be encrypted in the initial business data. The first configuration file is generated based on the information of various key fields that need to be encrypted in the government system and the information of various encryption algorithms involved; the target business data is stored in the first storage path, and the first storage path is the business data path of the first user.

[0097] Optionally, the standard encryption and decryption interface is specifically used for:

[0098] According to the first configuration file, calling the target encryption program corresponding to the target encryption algorithm to encrypt the target field to obtain the ciphertext of the target field;

[0099] All target fields in the initial business data are replaced by ciphertext to obtain the target business data.

[0100] Optionally, the first configuration file includes key field information, encryption algorithm information, and a first mapping relationship between the key field and the encryption algorithm, the key field information includes a key field set, and the encryption algorithm information includes a second mapping relationship between the encryption algorithm and the storage path of the encryption algorithm program; the standard encryption and decryption interface is specifically used for:

[0101] Determine a second storage path of a target field and a target encryption program in the initial business data according to the key field set, the first mapping relationship, and the second mapping relationship;

[0102] According to the second storage path, the target encryption program is called to encrypt the target field to obtain the ciphertext of the target field.

[0103] Optionally, the standard encryption and decryption interface is specifically used for:

[0104] According to the key field information, traverse all fields in the initial business data and determine the target field;

[0105] Determine a target encryption algorithm corresponding to the target field according to the target field and the first mapping relationship;

[0106] According to the target encryption algorithm and the second mapping relationship, a second storage path of the target encryption program is determined.

[0107] Optionally, the standard encryption and decryption interface is specifically used for:

[0108] According to the first configuration file, the target field is encrypted by calling the target encryption program corresponding to the target encryption algorithm through the encryption function to obtain the ciphertext of the target field.

[0109] Optionally, the acquisition module 11 is further used for:

[0110] Obtaining a business data acquisition request sent by a second user through an e-government system client, wherein the business data acquisition request includes a user identifier of the first user;

[0111] Optionally, the processing module 12 is further used for:

[0112] According to the user identifier, the target business data is extracted from the first storage path; according to the second configuration file, the standard encryption and decryption interface is called, and the ciphertext in the target business data is decrypted using the target decryption algorithm to obtain the initial business data, and the second configuration file is generated based on the information of the ciphertext in the stored business data and the information of the decryption algorithm involved; the initial business data is fed back to the second user.

[0113] Optionally, the standard encryption and decryption interface is specifically used for:

[0114] According to the second configuration file, calling the target decryption program corresponding to the target decryption algorithm to decrypt the ciphertext in the target business data to obtain the plaintext of the target field;

[0115] The initial business data is obtained by replacing all ciphertexts in the target business data with plaintext.

[0116] Optionally, the second configuration file includes ciphertext location information of stored business data, decryption algorithm information, and a third mapping relationship between the ciphertext and the decryption algorithm, the ciphertext location information includes a location index set of the ciphertext, and the decryption algorithm information includes a fourth mapping relationship between the decryption algorithm and the storage path of the decryption program; the standard encryption and decryption interface is specifically used for:

[0117] Determine, according to the position index set, the third mapping relationship and the fourth mapping relationship, the position of the ciphertext in the target business data and the third storage path corresponding to the target decryption program for decrypting the ciphertext at each position, where the target decryption program is a decryption program corresponding to the target decryption algorithm;

[0118] According to the third storage path, the target decryption program is called to decrypt the ciphertext in the target business data to obtain the plaintext of the target field.

[0119] Optionally, the standard encryption and decryption interface is specifically used for:

[0120] Identify the ciphertext in the target business data according to the location index set;

[0121] Determining a target decryption algorithm for decrypting the ciphertext according to the third mapping relationship;

[0122] A third storage path of the target decryption program is determined according to the target decryption algorithm and the fourth mapping relationship.

[0123] Optionally, the standard encryption and decryption interface is specifically used for:

[0124] According to the second configuration file, the target decryption program corresponding to the target decryption algorithm is called by the decryption function to decrypt the ciphertext in the target business data to obtain the plaintext of the target field.

[0125] The business data processing device of the government affairs system provided in this embodiment can execute the business data processing method of the government affairs system provided in the above method embodiment, and has the corresponding functional modules and beneficial effects of the execution method. The implementation principle and technical effects of this embodiment are similar to those of the above method embodiment, and will not be repeated here.

[0126] Embodiment 4

[0127] Figure 7 A schematic diagram of the structure of an e-government system server provided in Example 4 of the present application is shown in FIG. Figure 7 As shown, the government affairs system server 20 includes a memory 21, a processor 22, and a computer program stored in the memory and executable on the processor; the number of processors 22 in the government affairs system server 20 may be one or more. Figure 7 A processor 22 is taken as an example; the processor 22 and the memory 21 in the government system server 20 can be connected by a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0128] The memory 21, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the acquisition module 11 and the processing module 12 in the embodiment of the present application. The processor 22 executes various functional applications and data processing of the government affairs system server by running the software programs, instructions and modules stored in the memory 21, that is, realizes the business data processing method of the government affairs system mentioned above.

[0129] The memory 21 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 21 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 21 may further include a memory remotely arranged relative to the processor 22, and these remote memories may be connected to the government system server via a grid. Examples of the above-mentioned grid include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] Embodiment 5

[0131] Embodiment 5 of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer processor, the computer program is used to execute a business data processing method of an e-government system. The method includes:

[0132] Acquire a business data storage request sent by a first user through an e-government system client, where the business data storage request includes initial business data, and the initial business data includes at least one field;

[0133] Encrypting the target field in the initial business data using the target encryption algorithm according to the first configuration file through the standard encryption and decryption interface to obtain the target business data, where the target field is the field in the initial business data that needs to be encrypted;

[0134] The target business data is stored in a first storage path, where the first storage path is a business data storage path for the first user.

[0135] Of course, the computer-readable storage medium provided in the embodiment of the present application, whose computer program is not limited to the method operations described above, can also execute related operations in the business data processing method of the government affairs system provided in any embodiment of the present application.

[0136] Through the above description of the implementation method, the technicians in the relevant field can clearly understand that the present application can be implemented with the help of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or grid device, etc.) to execute the methods described in each embodiment of the present application.

[0137] It is worth noting that in the embodiment of the business data processing device of the above-mentioned government affairs system, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.

[0138] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A business data processing method for a government affairs system, characterized in that: include: Acquire a business data storage request sent by a first user through an e-government system client, wherein the business data storage request includes initial business data, and the initial business data includes at least one field; Calling a standard encryption and decryption interface according to a first configuration file, and using a target encryption algorithm to encrypt a target field in the initial business data to obtain target business data, wherein the target field is a field in the initial business data that needs to be encrypted, and the first configuration file is generated according to information of multiple key fields that need to be encrypted in the government affairs system and information of multiple encryption algorithms involved; storing the target business data in a first storage path, where the first storage path is a business data storage path for the first user; The standard encryption and decryption interface is specifically used to: according to the first configuration file, call the target encryption program corresponding to the target encryption algorithm to encrypt the target field to obtain the ciphertext of the target field; Replacing all target fields in the initial business data with the ciphertext to obtain the target business data; The first configuration file includes key field information, encryption algorithm information and a first mapping relationship between key fields and encryption algorithms. The key field information includes a key field set. The encryption algorithm information includes a second mapping relationship between an encryption algorithm and a storage path of an encryption algorithm program.

2. The method according to claim 1, characterized in that The step of calling a target encryption program corresponding to the target encryption algorithm to encrypt the target field according to the first configuration file to obtain a ciphertext of the target field includes: Determine, according to the key field set, the first mapping relationship, and the second mapping relationship, a target field in the initial business data and a second storage path of the target encryption program; According to the second storage path, the target encryption program is called to encrypt the target field to obtain the ciphertext of the target field.

3. The method according to claim 2, characterized in that The determining, according to the key field information, the first mapping relationship, and the second mapping relationship, the target field in the initial service data and the second storage path of the target encryption program comprises: According to the key field information, traverse all fields in the initial business data to determine the target field; Determine a target encryption algorithm corresponding to the target field according to the target field and the first mapping relationship; A second storage path of the target encryption program is determined according to the target encryption algorithm and the second mapping relationship.

4. The method according to claim 1, characterized in that: The step of calling a target encryption program corresponding to the target encryption algorithm to encrypt the target field according to the first configuration file to obtain a ciphertext of the target field includes: According to the first configuration file, the target encryption program corresponding to the target encryption algorithm is called by an encryption function to encrypt the target field to obtain a ciphertext of the target field.

5. The method according to claim 1, characterized in that After storing the target service data in the first storage path, the method further includes: Acquire a service data acquisition request sent by a second user through the government affairs system client, wherein the service data acquisition request includes a user identifier of the first user; extracting the target service data from the first storage path according to the user identifier; Calling the standard encryption and decryption interface according to the second configuration file, and using the target decryption algorithm to decrypt the ciphertext in the target business data to obtain the initial business data, wherein the second configuration file is generated according to the information of the ciphertext in the stored business data and the information of the decryption algorithm involved; The initial service data is fed back to the second user.

6. The method according to claim 5, characterized in that The standard encryption and decryption interface is specifically used for: According to the second configuration file, calling the target decryption program corresponding to the target decryption algorithm to decrypt the ciphertext in the target business data to obtain the plaintext of the target field; The initial business data is obtained by replacing all ciphertexts in the target business data with the plaintext.

7. The method according to claim 6, characterized in that The second configuration file includes ciphertext location information of stored business data, decryption algorithm information, and a third mapping relationship between ciphertext and decryption algorithm, the ciphertext location information includes a location index set of ciphertext, and the decryption algorithm information includes a fourth mapping relationship between a decryption algorithm and a storage path of a decryption program; the method of calling a target decryption program corresponding to the target decryption algorithm to decrypt the ciphertext in the target business data according to the second configuration file to obtain the plaintext of the target field includes: Determine, according to the position index set, the third mapping relationship, and the fourth mapping relationship, the position of the ciphertext in the target business data and a third storage path corresponding to a target decryption program for decrypting the ciphertext at each position, wherein the target decryption program is a decryption program corresponding to the target decryption algorithm; According to the third storage path, the target decryption program is called to decrypt the ciphertext in the target business data to obtain the plaintext of the target field.

8. The method according to claim 7, characterized in that The determining, according to the position index set, the third mapping relationship and the fourth mapping relationship, the position of the ciphertext in the target business data and the third storage path corresponding to the target decryption program for decrypting the ciphertext at each position includes: Identifying the ciphertext in the target business data according to the location index set; Determining a target decryption algorithm for decrypting the ciphertext according to the third mapping relationship; A third storage path of the target decryption program is determined according to the target decryption algorithm and the fourth mapping relationship.

9. The method according to claim 6, characterized in that The method of calling the target decryption program corresponding to the target decryption algorithm to decrypt the ciphertext in the target business data according to the second configuration file to obtain the plaintext of the target field includes: According to the second configuration file, the target decryption program corresponding to the target decryption algorithm is called through a decryption function to decrypt the ciphertext in the target business data to obtain the plaintext of the target field.

10. A business data processing device for a government affairs system, characterized in that: include: An acquisition module, configured to acquire a business data storage request sent by a first user through an e-government system client, wherein the business data storage request includes initial business data, and the initial business data includes at least one field; a processing module, configured to call a standard encryption and decryption interface according to a first configuration file, encrypt a target field in the initial business data using a target encryption algorithm, and obtain target business data, wherein the target field is a field in the initial business data that needs to be encrypted, and the first configuration file is generated according to information of multiple key fields that need to be encrypted in the government affairs system and information of multiple encryption algorithms involved; and store the target business data in a first storage path, wherein the first storage path is a storage path for the business data of the first user; The standard encryption and decryption interface is specifically used to: according to the first configuration file, call the target encryption program corresponding to the target encryption algorithm to encrypt the target field to obtain the ciphertext of the target field; replace all target fields in the initial business data with the ciphertext to obtain the target business data; The first configuration file includes key field information, encryption algorithm information and a first mapping relationship between key fields and encryption algorithms. The key field information includes a key field set. The encryption algorithm information includes a second mapping relationship between an encryption algorithm and a storage path of an encryption algorithm program.

11. A government affairs system server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the business data processing method of the government affairs system as described in any one of claims 1-9 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the business data processing method of the government affairs system as described in any one of claims 1 to 9 is implemented.

Images