Password calling method, system, device, electronic device and storage medium

Abstract

The present application discloses a password calling method, system, device, electronic device and storage medium. The method includes: a password calling end device sends a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; detecting whether a predetermined response information returned by the predetermined password management device is received; if the predetermined response information is not detected, determining to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message; and starting a countdown when the predetermined response information is not detected, and continuing to send a password algorithm calling request to the predetermined password management device at the end of the countdown. The present application solves the technical problem that the normal conduct of transactions and the confidentiality of transactions cannot be guaranteed due to the failure of remotely calling encryption algorithms in the related art.

Description

Technical Field

[0001] The present application relates to the field of data encryption, and more specifically, to a password calling method, system, device, electronic device and storage medium. Background Art

[0002] In February 2020, the People's Bank of China issued the "Notice on the Industry Standard for the General Specification for Information Security of Online Banking Systems" (Yinfa

[2020] No. 35), which proposed the security requirements for the national encryption SM series related algorithms. At present, the national encryption schemes certified by the National Cryptography Administration are all implemented through hardware, which means that if the national encryption algorithm is to be used, it is bound to face communication or hardware packaging anomalies caused by remote calls to hardware. That is, the encryption algorithms currently certified by the National Cryptography Administration all involve hardware, with high encryption efficiency and strong resource specificity, but they all need to be remotely called, involving the problem of call failure. Once the call fails, the normal transaction cannot be guaranteed, which wastes time and cannot guarantee the confidentiality of the transaction.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a password calling method, system, device, electronic device and storage medium to at least solve the technical problem that the normal progress of transactions and the confidentiality of transactions cannot be guaranteed due to the failure of calling the encryption algorithm remotely in the related technology.

[0005] According to one aspect of an embodiment of the present application, a password calling method is provided, including: a password calling end device sends a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; detecting whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; in the case where the predetermined response information is not detected, determining to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message; and starting a countdown when the predetermined response information is not detected, and at the end of the countdown, continuing to send the password algorithm calling request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0006] Optionally, determining to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message includes: determining a first encryption identifier corresponding to the second encryption algorithm, wherein the first encryption identifier corresponds one-to-one to the second encryption algorithm; sending the first encryption identifier and the first encrypted message to a server device, wherein the server device is used to determine the encryption algorithm based on the encryption identifier, decrypt the encrypted message to obtain a plaintext message, and execute the service corresponding to the plaintext message.

[0007] Optionally, sending the first encryption identifier and the first encrypted message to the server device includes: determining the header position of the first encrypted message; writing the first encryption identifier into a predetermined position of the header position to obtain a first target encrypted message, and sending the first target encrypted message to the server device.

[0008] Optionally, detecting whether a predetermined response information returned by a predetermined password management device is received includes: continuously sending multiple cryptographic algorithm call requests to a predetermined password management device; if the number of times the multiple cryptographic algorithm call requests do not receive a response from the predetermined password management device reaches a predetermined number, determining that the predetermined response information is not received.

[0009] Optionally, detecting whether a response returned by a predetermined password management device is received includes: when an abnormal return code from the predetermined password management device is received, or the connection between the password calling end device and the predetermined password management device times out, determining that the predetermined response information is not received.

[0010] Optionally, when a predetermined response message is detected, it is determined to use a first encryption algorithm to encrypt the message to be encrypted to obtain a second encrypted message; and when determining the header position of the second encrypted message, a second encryption identifier is written into a predetermined position of the header position to obtain a second target encrypted message, and the second target encrypted message is sent to the server device, wherein the second encryption identifier corresponds one-to-one to the first encryption algorithm.

[0011] Optionally, the second encryption algorithm is preset locally on the password calling end device, the target object's management authority over the device where the second encryption algorithm is located is the same as the management authority over the password calling end device, and the target object has no management authority over the predetermined password management device.

[0012] According to another aspect of an embodiment of the present application, a password calling system is also provided, including: a password calling end device, at least used to send a password algorithm calling request to a predetermined password management device, the password algorithm calling request is used to obtain a first encryption algorithm; when no predetermined response information is detected, determine to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message, and send a first encryption identifier and the first encrypted message to a server device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm; a server device, at least used to receive the first encryption identifier and the first encrypted message, and determine the type of encryption algorithm according to the first encryption identifier, and decrypt the first encrypted message to obtain a plaintext message, and execute the service corresponding to the plaintext message.

[0013] According to another aspect of an embodiment of the present application, a password calling device is also provided, including: a sending module, used for a password calling end device to send a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; a detection module, used to detect whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; a determination module, used to determine to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message when the predetermined response information is not detected; and start a countdown when the predetermined response information is not detected, and continue to send the password algorithm calling request to the predetermined password management device when the countdown ends; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the storage medium including a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any password calling method.

[0015] According to another aspect of an embodiment of the present application, there is also provided an electronic device, comprising: a processor; and a memory for storing processor executable instructions; wherein the processor is configured to execute instructions to implement any password calling method.

[0016] In an embodiment of the present application, once a remote call to an encryption algorithm with a high encryption level fails, a next-level encryption algorithm can be selected to encrypt transaction data. A password algorithm call request is sent to a predetermined password management device through a password calling end device, wherein the password algorithm call request is used to obtain a first encryption algorithm; it is detected whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; if the predetermined response information is not detected, it is determined to use the second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message; and when the predetermined response information is not detected, a countdown is started, and at the end of the countdown, the password algorithm call request is continued to be sent to the predetermined password management device, so as to achieve the purpose of timely encrypting the transaction message, thereby achieving the technical effect of giving priority to ensuring the normal progress of the transaction and ensuring the confidentiality of the transaction at the same time, thereby solving the technical problem that the normal progress of the transaction and the confidentiality of the transaction cannot be guaranteed due to the failure of calling the encryption algorithm remotely in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a flowchart of an optional password calling method according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of password calling in an exemplary embodiment of the present application;

[0020] Figure 3 is an overall workflow diagram in an exemplary embodiment of the present application;

[0021] Figure 4 is a schematic diagram of the structure of an optional password calling system according to an embodiment of the present application;

[0022] Figure 5 is a structural diagram of a password calling device according to an embodiment of the present application;

[0023] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present application is shown. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In order to facilitate those skilled in the art to better understand the relevant embodiments of the present application, the technical terms or some nouns that may be involved in the present application are explained as follows:

[0027] 1. BUMS message: Beijing Bank unified message standard protocol specification, which defines the first bit in the message control bit CtrlBits as the encryption control bit. "1" represents the Beijing Bank unified encryption algorithm, "4" represents the use of the key management platform for SM4 algorithm encryption, and the encryption range is the entire message body.

[0028] 2. Bank of Beijing unified encryption algorithm: Bank of Beijing uses a lightweight symmetric encryption algorithm designed based on inter-system message transmission. The algorithm does not rely on hardware and is a pure soft encryption algorithm.

[0029] 3. Bank of Beijing Key Management Platform: Bank of Beijing manages key data and related information, provides a platform for the encryption process, and provides national secret algorithms (SM2, SM3, SM4) based on hardware encryption machines to the outside world, hereinafter referred to as the "Key Management Platform".

[0030] 4. National Secret SM4 Encryption Algorithm: A domestically produced encryption algorithm recognized by the State Cryptography Administration. It is a standard packet data algorithm for wireless LANs and a symmetric encryption algorithm. Both the key length and packet length are 128 bits.

[0031] According to an embodiment of the present application, an embodiment of a password calling method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 1 is a password calling method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0033] Step S102, the password calling end device sends a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm;

[0034] Step S104, detecting whether predetermined response information returned by a predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called;

[0035] Step S106, when no predetermined response information is detected, determine to use the second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message; and when no predetermined response information is detected, start the countdown, and when the countdown ends, continue to send the cryptographic algorithm call request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0036] It should be noted that the first encryption algorithm is generally managed by a designated department. For example, in some embodiments of the present application, the first encryption algorithm is managed by the National Cryptography Administration. For example, the first encryption algorithm may be the national SM4 algorithm provided by the password management platform (i.e., the predetermined password management device), and the second encryption algorithm may be the unified encryption algorithm of the Bank of Beijing.

[0037] In the password calling method, the password calling end device sends a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; detects whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; if the predetermined response information is not detected, determines to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message; and starts a countdown when the predetermined response information is not detected. At the end of the countdown, the password algorithm calling request continues to be sent to the predetermined password management device, thereby achieving the purpose of encrypting the transaction message in a timely manner, thereby achieving the technical effect of giving priority to ensuring the normal progress of the transaction and ensuring the confidentiality of the transaction at the same time, thereby solving the technical problem that the normal progress of the transaction and the confidentiality of the transaction cannot be guaranteed due to the failure of remotely calling the encryption algorithm in the related technology.

[0038] In some embodiments of the present application, determining to use the second encryption algorithm to encrypt the message to be encrypted to obtain the first encrypted message can be achieved in the following manner. Specifically, the first encryption identifier corresponding to the second encryption algorithm can be determined, wherein the first encryption identifier corresponds to the second encryption algorithm one-to-one; the first encryption identifier and the first encrypted message are sent to the server device, wherein the server device is used to determine the encryption algorithm according to the encryption identifier, and decrypt the encrypted message to obtain the plaintext message, and execute the business corresponding to the plaintext message. For example, "1" can be written into the first bit of the message header control bit. It should be noted that writing "1" represents the unified encryption algorithm of Bank of Beijing.

[0039] As an optional implementation, sending a first encryption identifier and a first encrypted message to a server device includes: determining a header position of the first encrypted message; writing the first encryption identifier into a predetermined position of the header position to obtain a first target encrypted message, and sending the first target encrypted message to the server device.

[0040] In some embodiments of the present application, detecting whether a predetermined response information returned by a predetermined password management device is received includes: continuously sending multiple cryptographic algorithm call requests to the predetermined password management device; if the number of times that the multiple cryptographic algorithm call requests do not receive a response from the predetermined password management device reaches a predetermined number, it is determined that the predetermined response information has not been received.

[0041] In other embodiments of the present application, detecting whether a response returned by a predetermined password management device is received can also be performed by determining that a predetermined response information has not been received when an abnormal return code is received from the predetermined password management device or the connection between the password calling end device and the predetermined password management device times out.

[0042] Specifically, when the predetermined response information is detected, it is determined to use the first encryption algorithm to encrypt the message to be encrypted to obtain the second encrypted message; and the header position of the second encrypted message is determined; the second encryption identifier is written into the predetermined position of the header position to obtain the second target encrypted message, and the second target encrypted message is sent to the server device, wherein the second encryption identifier corresponds to the first encryption algorithm. For example, the number "4" can be used to represent the national encryption SM4 algorithm provided by the secret management platform, and then it can be written into the first bit of the message header control bit.

[0043] In some optional embodiments of the present application, the second encryption algorithm can be preset locally on the password calling end device, and the target object has the same management authority over the device where the second encryption algorithm is located as the management authority over the password calling end device, and the target object has no management authority over the predetermined password management device. The above target object may be an operation and maintenance manager of Bank of Beijing.

[0044] Figure 2 is a flowchart of password calling in an exemplary embodiment of the present application, such as Figure 2 As shown, the process includes: when the caller fails to call the national secret of the secret management platform for a predetermined number of consecutive times, the encryption downgrade mechanism is triggered, and the high-priority encryption algorithm (i.e., the first encryption algorithm) is downgraded to a low-priority encryption algorithm (the second encryption algorithm), and the control bit is changed to a low-priority encryption algorithm identifier. When the service system receives a request, it will select the corresponding decryption method for decryption according to the control bit encryption algorithm identifier, which has the effect of automatically downgrading the encryption algorithm when the remote call fails. And when the encryption algorithm is downgraded, the caller starts the timing. When the timing reaches the predetermined time, the encryption algorithm returns to a high priority and continues to try to call the secret management platform. If it still fails continuously, the low-priority encryption algorithm will continue to be used. If the attempt to call is successful, it will be restored to the normal encryption algorithm. Among them, the secret management platform (predetermined password management device) is used to provide the SM4 encryption algorithm, which is a high-priority encryption algorithm (the first encryption algorithm), and the Beijing Bank's unified encryption algorithm is a low-priority encryption algorithm (the second encryption algorithm).

[0045] It should also be noted that the interaction between the systems of Bank of Beijing uses the unified message standard protocol specification of Bank of Beijing, which includes the message header of the plain text part and the message body containing business meaning. When the interaction between systems needs to call the national encryption algorithm of the key management platform to encrypt the entire message, the component can first remotely call the encrypted message body, and then write the corresponding encryption algorithm category into the first bit of the message header control bit, where the number "4" can be used to represent the national encryption SM4 algorithm provided by the key management platform, and then transmit the entire message to the service system. The service system now reads the encryption algorithm category according to the control bit in the plain text message header, and uses the corresponding decryption algorithm to decrypt the message body according to the category.

[0046] When a connection timeout, connection rejection or other exceptions occur during a remote call to the key management platform, or when an abnormal return code is received from the key management platform, and the call fails for n consecutive times (n is a parameter configured by the component user, and the default value is 5), the key management platform will no longer be called, and the business message body will be downgraded to the Beijing Bank unified encryption algorithm implemented by software. After encryption, the corresponding encryption algorithm category will be written into the first bit of the message header control bit, and the entire message will be transmitted to the service system. The service system also reads the encryption algorithm category according to the control bit in the plaintext message header, and uses the corresponding decryption algorithm to decrypt the message body according to the category.

[0047] When the number of failed calls to the key management platform occurs n times in a row, that is, when the downgrade begins, the timer starts counting. When the time reaches m seconds, it should be noted that m is a parameter configured by the component user and its default value is 300. The component will try to upgrade the encryption algorithm again, that is, try to call the key management platform to encrypt the message body. If the call fails n times in a row, the encryption algorithm will continue to be downgraded until the key management platform resumes service and the encryption process is completely restored to its initial state.

[0048] The above technical solution can be implemented by integrating the caller system and the service system. It is required that the implementation programming language of the caller and service system can be Java, and there is no restriction on the specific framework. For example, it can be JDK version 1.8 and above. Optionally, the communication standard used can be BUMS.

[0049] Figure 3 It is the overall workflow diagram of this embodiment, such as Figure 3 As shown, the calling system is integrated with an encryption downgrade component. After the encryption downgrade component is integrated, the caller system can default to remotely calling the key management platform in the manner of SM4 encryption with national encryption. After the encryption is completed, the first bit of the reset control bit CtrlBits is "4". It should be noted that CtrlBits is located in the HTTPheader of the BUMS standard http protocol, which belongs to the custom HTTP header with a total of 8 bits, of which the first bit is the encryption flag bit. "4" represents the national encryption SM4 encryption algorithm for calling the key management platform, and "1" represents the unified encryption algorithm of Bank of Beijing. At this time, the entire BUMS request can be sent to the service system.

[0050] After receiving the BUMS request, the service system can first parse the CtrlBits in the HTTPheader, take out the first bit to determine the encryption algorithm category, decrypt the message body according to the encryption algorithm of the corresponding category, get the plain text of the message, and continue to complete the business processing; when the key management platform calls abnormally, for example, communication IO abnormality, key management platform encapsulation abnormality, etc., the encryption downgrade component receives abnormality times up to n times, then it will no longer call the key management platform, and downgrade to the software-implemented Beijing Bank unified encryption algorithm to encrypt the business message body. After encryption, the corresponding encryption algorithm category can be written into the first bit of the message header control bit. It is easy to notice that writing "1" represents the unified encryption algorithm of Beijing Bank. Then, the entire message can be transmitted to the service system. The service system also reads the encryption algorithm category according to the control bit in the plain text message header, and uses the corresponding decryption algorithm to decrypt the message body according to the category. This step can be implemented as follows:

[0051]

[0052]

[0053] That is, as mentioned above, when the number of consecutive failures in calling the key management platform reaches n times, that is, when the downgrade begins, the timer can be started to start timing. When the time reaches m seconds, for example, when the time reaches 300 seconds, the component will try to upgrade the encryption algorithm again, that is, try to call the key management platform to encrypt the message body. If n consecutive call failures still occur, the encryption algorithm will continue to be downgraded until the key management platform resumes service and the encryption process is completely restored to the initial state. It can be understood that the above technical solution can realize automatic encryption downgrade and automatic restoration of the original level encryption process, shielding the impact of the failure of the national encryption remote call on the transaction itself, while ensuring the confidentiality of the business message.

[0054] Figure 4 A password calling system according to an embodiment of the present application is provided. Figure 4 As shown, the system includes:

[0055] The password calling end device 10 is at least used to send a password algorithm calling request to a predetermined password management device, the password algorithm calling request is used to obtain a first encryption algorithm; when the predetermined response information is not detected, determine to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message, and send the first encryption identifier and the first encrypted message to the server device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm;

[0056] The server device 20 is at least used to receive the first encryption identifier and the first encrypted message, determine the type of encryption algorithm according to the first encryption identifier, decrypt the first encrypted message to obtain a plaintext message, and execute the service corresponding to the plaintext message.

[0057] In the password calling system, the password calling end device 10 is at least used to send a password algorithm calling request to a predetermined password management device, and the password algorithm calling request is used to obtain a first encryption algorithm; when the predetermined response information is not detected, it is determined to use a second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message, and the first encryption identifier and the first encrypted message are sent to the server device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm; the server device 20 is at least used to receive the first encryption identifier and the first encrypted message, and determine the type of encryption algorithm according to the first encryption identifier, and decrypt the first encrypted message to obtain a plaintext message, and execute the business corresponding to the plaintext message, so as to achieve the purpose of encrypting the transaction message in time, thereby realizing the technical effect of giving priority to ensuring the normal progress of the transaction and ensuring the confidentiality of the transaction at the same time, thereby solving the technical problem that the normal progress of the transaction and the confidentiality of the transaction cannot be guaranteed due to the failure of remotely calling the encryption algorithm in the related technology.

[0058] Figure 5 A password calling device according to an embodiment of the present application is provided. Figure 5 As shown, the device comprises:

[0059] A sending module 50, configured for a password calling end device to send a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm;

[0060] A detection module 52, used to detect whether a predetermined response information returned by a predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called;

[0061] The determination module 54 is used to determine whether to use the second encryption algorithm to encrypt the message to be encrypted to obtain the first encrypted message when the predetermined response information is not detected; and to start the countdown when the predetermined response information is not detected, and at the end of the countdown, continue to send the cryptographic algorithm call request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0062] In the password calling device, a sending module 50 is used for the password calling end device to send a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; a detection module 52 is used to detect whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; a determination module 54 is used to determine to use the second encryption algorithm to encrypt the encrypted message to obtain the first encrypted message when the predetermined response information is not detected; and to start the countdown when the predetermined response information is not detected, and continue to send the password algorithm calling request to the predetermined password management device at the end of the countdown; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm, so as to achieve the purpose of encrypting the transaction message in time, thereby achieving the technical effect of giving priority to ensuring the normal progress of the transaction and ensuring the confidentiality of the transaction at the same time, thereby solving the technical problem that the normal progress of the transaction and the confidentiality of the transaction cannot be guaranteed due to the failure of remotely calling the encryption algorithm in the related technology.

[0063] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the storage medium including a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any password calling method.

[0064] Specifically, the above storage medium is used to store program instructions for the following functions to implement the following functions:

[0065] Send a cryptographic algorithm call request to a predetermined password management device, wherein the cryptographic algorithm call request is used to obtain a first encryption algorithm; detect whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; if the predetermined response information is not detected, determine to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message; and start a countdown when the predetermined response information is not detected, and when the countdown ends, continue to send the cryptographic algorithm call request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0066] Optionally, in this embodiment, the above-mentioned storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above-mentioned contents. More specific examples of the above-mentioned storage medium may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above-mentioned contents.

[0067] In an exemplary embodiment of the present application, a computer program product is further provided, including a computer program, and when the computer program is executed by a processor, the computer program implements any of the above password calling methods.

[0068] Optionally, the computer program may implement the following steps when executed by a processor:

[0069] Send a cryptographic algorithm call request to a predetermined password management device, wherein the cryptographic algorithm call request is used to obtain a first encryption algorithm; detect whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; if the predetermined response information is not detected, determine to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message; and start a countdown when the predetermined response information is not detected, and when the countdown ends, continue to send the cryptographic algorithm call request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

[0070] According to an embodiment of the present application, an electronic device is provided, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the above-mentioned password calling methods.

[0071] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0072] Figure 6A schematic block diagram of an example electronic device 600 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0073] like Figure 6 As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0074] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0075] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as a password calling method. For example, in some embodiments, the password calling method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the password calling method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the password calling method in any other appropriate manner (e.g., by means of firmware).

[0076] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0078] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0079] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0080] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0081] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0082] In the relevant embodiments of the present application, once the remote call to an encryption algorithm with a high encryption level fails, a next-level encryption algorithm can be selected to encrypt the transaction data. A password algorithm call request is sent to a predetermined password management device through a password calling end device, wherein the password algorithm call request is used to obtain a first encryption algorithm; it is detected whether a predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; if the predetermined response information is not detected, it is determined to use the second encryption algorithm to encrypt the encrypted message to obtain the first encrypted message; and when the predetermined response information is not detected, the countdown is started, and when the countdown ends, the password algorithm call request is continued to be sent to the predetermined password management device, so as to achieve the purpose of timely encrypting the transaction message, thereby achieving the technical effect of giving priority to ensuring the normal progress of the transaction and ensuring the confidentiality of the transaction at the same time, thereby solving the technical problem that the normal progress of the transaction and the confidentiality of the transaction cannot be guaranteed due to the failure of the remote call of the encryption algorithm in the related technology.

[0083] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0084] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0085] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0086] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0087] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0088] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.

[0089] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A password calling method, characterized in that: include: The password calling end device sends a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; detecting whether predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; In the case that the predetermined response information is not detected, determine to use the second encryption algorithm to encrypt the encrypted message to obtain a first encrypted message; and when the predetermined response information is not detected, start the countdown, and at the end of the countdown, continue to send the cryptographic algorithm call request to the predetermined password management device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

2. The method according to claim 1, characterized in that Determining to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message includes: Determine a first encryption identifier corresponding to the second encryption algorithm, wherein the first encryption identifier corresponds to the second encryption algorithm in a one-to-one manner; The first encryption identifier and the first encrypted message are sent to a server device, wherein the server device is used to determine an encryption algorithm according to the encryption identifier, decrypt the encrypted message to obtain a plaintext message, and execute a service corresponding to the plaintext message.

3. The method according to claim 2, characterized in that Sending the first encryption identifier and the first encrypted message to a server device includes: Determining a header position of the first encrypted message; The first encryption identifier is written into a predetermined position of the header position to obtain a first target encrypted message, and the first target encrypted message is sent to the server device.

4. The method according to claim 1, characterized in that Detecting whether predetermined response information returned by the predetermined password management device is received includes: Continuously sending multiple password algorithm call requests to the predetermined password management device; If the number of times that the multiple cryptographic algorithm call requests do not receive a response from the predetermined password management device reaches a predetermined number of times, it is determined that the predetermined response information is not received.

5. The method according to claim 1, characterized in that Detecting whether a response returned by the predetermined password management device is received includes: Upon receiving an abnormal return code from the predetermined password management device, or When the connection between the password calling end device and the predetermined password management device times out, it is determined that the predetermined response information has not been received.

6. The method according to claim 1, characterized in that In the case of detecting the predetermined response information, determining to use the first encryption algorithm to encrypt the message to be encrypted to obtain a second encrypted message; and determining a header position of the second encrypted message; A second encryption identifier is written into a predetermined position of the header position to obtain a second target encrypted message, and the second target encrypted message is sent to a server device, wherein the second encryption identifier corresponds one-to-one to the first encryption algorithm.

7. The method according to any one of claims 1 to 6, characterized in that: The second encryption algorithm is preset locally on the password calling end device, the target object has the same management authority over the device where the second encryption algorithm is located as the management authority of the password calling end device, and the target object has no management authority over the predetermined password management device.

8. A password calling system, characterized in that: include: A password calling end device, at least used to send a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; when no predetermined response information is detected, determine to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message, and send a first encryption identifier and the first encrypted message to a server device; wherein the encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm; The server device is at least used to receive the first encryption identifier and the first encrypted message, determine the type of encryption algorithm according to the first encryption identifier, decrypt the first encrypted message to obtain a plaintext message, and execute the service corresponding to the plaintext message.

9. A password calling device, characterized in that: include: A sending module, used for a password calling end device to send a password algorithm calling request to a predetermined password management device, wherein the password algorithm calling request is used to obtain a first encryption algorithm; a detection module, configured to detect whether predetermined response information returned by the predetermined password management device is received, wherein the predetermined response information is used to indicate that the first encryption algorithm of the predetermined password management device can be successfully called; A determination module, configured to determine, when the predetermined response information is not detected, to use a second encryption algorithm to encrypt the message to be encrypted to obtain a first encrypted message; and to start a countdown when the predetermined response information is not detected, and to continue to send the cryptographic algorithm call request to the predetermined password management device when the countdown ends; The encryption level of the first encryption algorithm is higher than the encryption level of the second encryption algorithm.

10. A non-volatile storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the password calling method described in any one of claims 1 to 7.

11. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the password calling method as described in any one of claims 1 to 7.

Images