Information encryption and decryption device, information encryption method, and information decryption method

Abstract

The application discloses an information encryption and decryption device, an information encryption method and an information decryption method. The device comprises an adaptation unit, a client encryption unit and a server decryption unit. The adaptation unit is used for determining a target encryption mode and informing the target encryption mode to the client encryption unit. The client encryption unit is used for encrypting to-be-transmitted information according to the target encryption mode to obtain information ciphertext, and sending the information ciphertext to the server decryption unit. The server decryption unit is used for receiving the information ciphertext sent by the client encryption unit, and decrypting the information ciphertext to obtain the to-be-transmitted information. The technical scheme of the embodiment of the application provides an information encryption and decryption device with rich encryption strategies, has strong portability, is isolated from business logic and page layout, well adapts to various application system platforms, and greatly reduces introduction cost.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an information encryption / decryption device, an information encryption method, and an information decryption method. Background Technology

[0002] In the open internet environment, request and response messages are at risk of being intercepted or tampered with. Encrypted transmission strategies are primarily used for business applications requiring high data security. Transmitting data in plaintext leaves data security completely unsecured. The core idea of ​​encrypted transmission is to customize front-end and back-end encryption schemes, establish encrypted channels between the two sides before communication, transmit data encrypted with a key over the internet, and decrypt the data using the corresponding key at both the front-end and back-end to obtain the plaintext data.

[0003] Existing information encryption methods use relatively simple and inflexible encryption strategies. Asymmetric encryption has various algorithms, each with its own characteristics, and a fixed encryption strategy cannot be applied to all encryption scenarios. Existing information encryption methods do not consider code portability; encryption strategies, as part of a project, are usually separated from specific business logic and page layout. The front-end and back-end automatically perform encryption and decryption operations when making HTTP (Hypertext Transfer Protocol) requests, and these operations are generally imperceptible to developers, so encryption and decryption operations are usually embedded into the project. Summary of the Invention

[0004] This invention provides an information encryption / decryption device, an information encryption method, and an information decryption method. It provides an information encryption / decryption device with rich encryption strategies, strong portability, and is isolated from business logic and page layout. It is well adapted to various application system platforms and greatly reduces the cost of implementation.

[0005] According to one aspect of the present invention, an information encryption and decryption apparatus is provided, the apparatus comprising: an adaptation unit, a client encryption unit, and a server decryption unit;

[0006] The adaptation unit is used to determine the target encryption method and notify the client encryption unit of the target encryption method;

[0007] The client encryption unit is used to encrypt the information to be transmitted according to the target encryption method to obtain ciphertext, and send the ciphertext to the server decryption unit.

[0008] The server-side decryption unit is used to receive the ciphertext sent by the client-side encryption unit and decrypt the ciphertext to obtain the information to be transmitted.

[0009] According to another aspect of the present invention, an information encryption method is provided, applied to an adapter unit in an information encryption / decryption apparatus according to any embodiment of the present invention, the method comprising:

[0010] An algorithm selector determines a target encryption algorithm that matches the current working environment from a variety of encryption algorithms; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm.

[0011] Based on the target encryption algorithm, the target encryption method for the information to be transmitted in the current working environment is determined to be hybrid encryption.

[0012] According to another aspect of the present invention, an information encryption method is provided, applied to a client encryption unit in an information encryption / decryption apparatus according to any embodiment of the present invention, the method comprising:

[0013] Generate a client-side random number and receive the server-side random number and server public key sent by the server-side decryption unit;

[0014] Obtain the client's public key and private key based on the target encryption algorithm corresponding to the target encryption method;

[0015] The client-side random number, the server-side random number, the server public key, and the client-side private key are used to encrypt the information to be transmitted to obtain the ciphertext.

[0016] The encrypted information and the client's public key are sent to the server-side decryption unit.

[0017] According to another aspect of the present invention, an information decryption method is provided, applied to the server-side decryption unit in the information encryption / decryption apparatus described in any embodiment of the present invention, the method comprising:

[0018] Obtain the server's public and private keys, and generate a random number on the server side;

[0019] The server public key and the server-side random number are sent to the client encryption unit;

[0020] Receive the ciphertext and client public key sent by the client's encryption unit;

[0021] The encrypted information is decrypted using the server's private key, the server-side random number, and the client's public key to obtain the information to be transmitted.

[0022] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0023] At least one processor; and

[0024] A memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the information encryption method or the information decryption method according to any embodiment of the present invention.

[0026] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the information encryption method or the information decryption method according to any embodiment of the present invention.

[0027] The technical solution of this invention provides an information encryption and decryption device by setting an adaptation unit, a client encryption unit, and a server decryption unit. The adaptation unit determines the target encryption method and notifies the client encryption unit. The client encryption unit encrypts the information to be transmitted according to the target encryption method to obtain ciphertext, and sends the ciphertext to the server decryption unit for decryption, enabling the server decryption unit to obtain the information to be transmitted and complete the information transmission. This solves the problem that existing encryption strategies are limited in scope and cannot be widely applied to various encryption scenarios, and have poor portability. It provides an information encryption and decryption device with rich encryption strategies, strong portability, and is isolated from business logic and page layout, making it well-suited to various application system platforms and greatly reducing the introduction cost.

[0028] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of the structure of an information encryption / decryption device provided in Embodiment 1 of the present invention;

[0031] Figure 2 This is a flowchart of an information encryption method for an adapter unit in an information encryption / decryption device according to Embodiment 2 of the present invention;

[0032] Figure 3 This is a flowchart of an information encryption method for a client encryption unit in an information encryption / decryption device according to Embodiment 3 of the present invention;

[0033] Figure 4 This is a flowchart of an information decryption method for a server-side decryption unit in an information encryption / decryption device according to Embodiment 4 of the present invention;

[0034] Figure 5 This is a schematic diagram of the structure of an information encryption device for an adapter unit in an information encryption / decryption device according to Embodiment 5 of the present invention;

[0035] Figure 6 This is a schematic diagram of the structure of an information encryption device for a client encryption unit in an information encryption and decryption device according to an embodiment of the present invention, provided in Embodiment Six of the present invention;

[0036] Figure 7 This is a schematic diagram of the structure of an information decryption device for a server-side decryption unit in an information encryption / decryption device according to Embodiment 7 of the present invention;

[0037] Figure 8 This is a schematic diagram of the structure of an electronic device that implements the information encryption method or information decryption method of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0039] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products or devices.

[0040] Example 1

[0041] Figure 1 This is a schematic diagram of an information encryption / decryption device provided in Embodiment 1 of the present invention. This embodiment is applicable to the encryption and decryption of information transmitted over a network. (See reference...) Figure 1 The information encryption and decryption device may include: an adaptation unit 110, a client encryption unit 120, and a server decryption unit 130;

[0042] The adaptation unit 110 is used to determine the target encryption method and notify the client encryption unit of the target encryption method; wherein, the adaptation unit can load the encryption algorithm in the initialization state of the information encryption and decryption device, and provide a variety of selectable encryption methods.

[0043] The client encryption unit 120 is used to encrypt the information to be transmitted according to the target encryption method to obtain ciphertext, and send the ciphertext to the server decryption unit.

[0044] The server-side decryption unit 130 is used to receive the ciphertext sent by the client-side encryption unit and decrypt the ciphertext to obtain the information to be transmitted.

[0045] The technical solution of this invention provides an information encryption and decryption device by setting an adaptation unit, a client encryption unit, and a server decryption unit. The adaptation unit determines the target encryption method and notifies the client encryption unit. The client encryption unit encrypts the information to be transmitted according to the target encryption method to obtain ciphertext, and sends the ciphertext to the server decryption unit for decryption, enabling the server decryption unit to obtain the information to be transmitted and complete the information transmission. This solves the problem that existing encryption strategies are limited in scope and cannot be widely applied to various encryption scenarios, and have poor portability. It provides an information encryption and decryption device with rich encryption strategies, strong portability, and is isolated from business logic and page layout, making it well-suited to various application system platforms and greatly reducing the introduction cost.

[0046] Example 2

[0047] Figure 2 This is a flowchart of an information encryption method provided in Embodiment 2 of the present invention. This embodiment is applicable to the encryption and decryption of information transmitted over a network. The method can be applied to the adapter unit in the information encryption / decryption device described in any embodiment of the present invention. The method can be executed by the information encryption device, which can be implemented in hardware and / or software. The information encryption device can be configured in the adapter unit of the information encryption / decryption device. Figure 2 As shown, the method includes:

[0048] S210. A target encryption algorithm matching the current working environment is determined from a variety of encryption algorithms by an algorithm selector; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm.

[0049] The current working environment can refer to the current application system platform, such as mobile applications, official accounts, and mini-programs.

[0050] In this embodiment, the algorithm selector in the adapter unit can select an encryption algorithm according to the settings. If no algorithm is set, the default encryption algorithm can be used. The thread controller is notified to create a sub-thread, which then passes resources and commands to the next unit for subsequent processing. Symmetric encryption algorithms may include 3DES and SM4, while asymmetric encryption algorithms may include RSA and SM2.

[0051] S220. Based on the target encryption algorithm, the target encryption method for the information to be transmitted in the current working environment is determined to be hybrid encryption.

[0052] In this embodiment, the target encryption method for the information to be transmitted in the current working environment can be determined to be hybrid encryption based on the target encryption algorithm.

[0053] The technical solution of this invention determines a target encryption algorithm that matches the current working environment from a variety of encryption algorithms through an algorithm selector; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm; based on the target encryption algorithm, the target encryption method for the information to be transmitted in the current working environment is determined to be hybrid encryption, providing a flexible encryption strategy, strong portability, isolation from business logic and page layout, good adaptation to various application system platforms, and greatly reducing the introduction cost.

[0054] Example 3

[0055] Figure 3 This is a flowchart of an information encryption method provided in Embodiment 3 of the present invention. This embodiment is applicable to the encryption and decryption of information transmitted over a network. The method can be applied to the client encryption unit in the information encryption / decryption device described in any embodiment of the present invention. The method can be executed by the information encryption device, which can be implemented in hardware and / or software. The information encryption device can be configured in the client encryption unit of the information encryption / decryption device. Figure 3 As shown, the method includes:

[0056] S310. Generate a client-side random number and receive the server-side random number and server public key sent by the server-side decryption unit.

[0057] S320. Obtain the client's public key and client's private key according to the target encryption algorithm corresponding to the target encryption method.

[0058] S330. The information to be transmitted is encrypted using the client random number, the server random number, the server public key, and the client private key to obtain the ciphertext.

[0059] The information to be transmitted may include sensitive information, client-side random numbers, and a digest of the sensitive information. Sensitive information may include, for example, key payment information.

[0060] In one optional implementation, encrypting the information to be transmitted using the client random number, the server random number, the server public key, and the client private key to obtain ciphertext may include: synthesizing a symmetric key using the client random number and the server random number; encrypting the sensitive information using the symmetric key to obtain sensitive information ciphertext; encrypting the client random number using the server public key to obtain client random number ciphertext; obtaining the client public key and client private key according to the target encryption algorithm; and encrypting the sensitive information digest using the client private key to obtain a digital signature.

[0061] Based on the above implementation, encrypting the sensitive information digest using the client's private key to obtain a digital signature may include: calculating the sensitive information digest using a digest algorithm; and encrypting the sensitive information digest using the client's private key to obtain a digital signature that matches the sensitive information.

[0062] S340. Send the encrypted information and the client public key to the server-side decryption unit.

[0063] The technical solution of this invention effectively strengthens the security of information transmission by generating a client-side random number and receiving a server-side random number and a server public key sent by a server-side decryption unit; obtaining a client-side public key and a client-side private key according to a target encryption algorithm corresponding to the target encryption method; encrypting the information to be transmitted using the client-side random number, the server-side random number, the server public key, and the client-side private key to obtain ciphertext; and sending the ciphertext and the client-side public key to the server-side decryption unit.

[0064] Example 4

[0065] Figure 4This is a flowchart of an information decryption method provided in Embodiment 4 of the present invention. This embodiment is applicable to the encryption and decryption of network-transmitted information. This method can be applied to the server-side decryption unit in the information encryption / decryption device described in any embodiment of the present invention. This method can be executed by the information decryption device, which can be implemented in hardware and / or software, and can be configured in the server-side decryption unit of the information encryption / decryption device. For example... Figure 4 As shown, the method includes:

[0066] S410. Obtain the server's public key and private key, and generate a random number on the server side.

[0067] S420. Send the server public key and the server-side random number to the client encryption unit.

[0068] S430: Receive the ciphertext of the information sent by the client encryption unit and the client public key.

[0069] S440. Decrypt the encrypted information using the server's private key, the server-side random number, and the client's public key to obtain the information to be transmitted.

[0070] The encrypted information can include encrypted sensitive information, encrypted client-side random numbers, and digital signatures.

[0071] In one optional implementation, decrypting the ciphertext of the information to be transmitted using the server private key, the server-side random number, and the client public key may include: using the server private key to decrypt the ciphertext of the client random number to obtain the client random number; synthesizing a symmetric key based on the client random number and the server-side random number; using the symmetric key to decrypt the ciphertext of the sensitive information to obtain the sensitive information; and using the client public key to decrypt the digital signature to obtain the sensitive information digest.

[0072] Based on the above implementation method, after decrypting the digital signature using the client public key to obtain the sensitive information digest, the method may further include: calculating the expected received sensitive information digest using a digest algorithm; and confirming whether the sensitive information has been modified based on the expected received sensitive information digest and the sensitive information digest.

[0073] The technical solution of this invention effectively strengthens the security of information transmission by obtaining a server public key and a server private key, generating a server-side random number, sending the server public key and the server-side random number to the client encryption unit, receiving ciphertext and the client public key sent by the client encryption unit, and decrypting the ciphertext according to the server private key, the server-side random number, and the client public key to obtain the information to be transmitted.

[0074] Example 5

[0075] Figure 5 This is a schematic diagram of an information encryption device provided in Embodiment 5 of the present invention. This device can be applied to the adapter unit in any embodiment of the information encryption / decryption device of the present invention, such as… Figure 5 As shown, the device includes: a target encryption algorithm determination module 510 and a target encryption method determination module 520. Wherein:

[0076] The target encryption algorithm determination module 510 is used to determine, through an algorithm selector, a target encryption algorithm that matches the current working environment from a variety of encryption algorithms; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm.

[0077] The target encryption method determination module 520 is used to determine, based on the target encryption algorithm, that the target encryption method for the information to be transmitted in the current working environment is hybrid encryption.

[0078] The technical solution of this invention determines a target encryption algorithm that matches the current working environment from a variety of encryption algorithms through an algorithm selector; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm; based on the target encryption algorithm, the target encryption method for the information to be transmitted in the current working environment is determined to be hybrid encryption, providing a flexible encryption strategy, strong portability, isolation from business logic and page layout, good adaptation to various application system platforms, and greatly reducing the introduction cost.

[0079] The information encryption device provided in the embodiments of the present invention can execute the information encryption method provided by the adapter unit in the information encryption and decryption device of any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0080] Example 6

[0081] Figure 6 This is a schematic diagram of an information encryption device provided in Embodiment Six of the present invention. This device can be applied to the client encryption unit in any embodiment of the information encryption / decryption device described in the present invention, such as… Figure 6As shown, the device includes: a server-side random number and public key receiving module 610, a client-side key pair acquisition module 620, a ciphertext acquisition module 630, and a ciphertext and client-side public key sending module 640. Wherein:

[0082] The server-side random number and public key receiving module 610 is used to generate client-side random numbers and receive server-side random numbers and server-side public keys sent by the server-side decryption unit.

[0083] The client key pair acquisition module 620 is used to obtain the client public key and client private key according to the target encryption algorithm corresponding to the target encryption method;

[0084] The ciphertext acquisition module 630 is used to encrypt the information to be transmitted based on the client random number, the server random number, the server public key and the client private key to obtain the ciphertext.

[0085] The ciphertext and client public key sending module 640 is used to send the ciphertext and client public key to the server-side decryption unit.

[0086] The technical solution of this invention effectively strengthens the security of information transmission by generating a client-side random number and receiving a server-side random number and a server public key sent by a server-side decryption unit; obtaining a client-side public key and a client-side private key according to a target encryption algorithm corresponding to the target encryption method; encrypting the information to be transmitted using the client-side random number, the server-side random number, the server public key, and the client-side private key to obtain ciphertext; and sending the ciphertext and the client-side public key to the server-side decryption unit.

[0087] Optionally, the information to be transmitted includes sensitive information, a client random number, and a digest of the sensitive information;

[0088] The encrypted information acquisition module 630 includes:

[0089] The sensitive information ciphertext acquisition unit is used to synthesize a symmetric key based on the client random number and the server random number, and use the symmetric key to encrypt the sensitive information to obtain sensitive information ciphertext;

[0090] A client random number ciphertext acquisition unit is used to encrypt the client random number using the server public key to obtain the client random number ciphertext;

[0091] The digital signature acquisition unit is used to acquire the client public key and the client private key according to the target encryption algorithm, and to encrypt the sensitive information digest using the client private key to obtain a digital signature.

[0092] Optional, the digital signature acquisition unit can be used for:

[0093] A digest of the sensitive information is obtained by calculating the sensitive information using a digest algorithm;

[0094] The client's private key is used to encrypt the sensitive information digest to obtain a digital signature that matches the sensitive information.

[0095] The information encryption device provided in the embodiments of the present invention can execute the information encryption method provided by the client encryption unit in the information encryption and decryption device described in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0096] Example 7

[0097] Figure 7 This is a schematic diagram of an information decryption device provided in Embodiment 7 of the present invention. This device can be applied to the server-side decryption unit of the information encryption / decryption device described in any embodiment of the present invention, such as… Figure 7 As shown, the device includes: a server-side random number generation module 710, a server public key and random number sending module 720, an information ciphertext and client public key receiving module 730, and a message to be transmitted acquisition module 740. Wherein:

[0098] The server-side random number generation module 710 is used to obtain the server's public key and private key, and generate server-side random numbers.

[0099] The server public key and random number sending module 720 is used to send the server public key and the server-side random number to the client encryption unit;

[0100] The ciphertext and client public key receiving module 730 is used to receive ciphertext and client public key sent by the client encryption unit;

[0101] The information to be transmitted acquisition module 740 is used to decrypt the encrypted information based on the server private key, the server-side random number and the client public key to obtain the information to be transmitted.

[0102] The technical solution of this invention effectively strengthens the security of information transmission by obtaining a server public key and a server private key, generating a server-side random number, sending the server public key and the server-side random number to the client encryption unit, receiving ciphertext and the client public key sent by the client encryption unit, and decrypting the ciphertext according to the server private key, the server-side random number, and the client public key to obtain the information to be transmitted.

[0103] Optionally, the encrypted information includes encrypted sensitive information, encrypted client random number, and digital signature;

[0104] The information acquisition module 740 can be used specifically for:

[0105] The client random number is obtained by decrypting the client random number ciphertext using the server's private key.

[0106] A symmetric key is synthesized based on the client-side random number and the server-side random number, and the symmetric key is used to decrypt the ciphertext of the sensitive information to obtain the sensitive information.

[0107] The digital signature is decrypted using the client's public key to obtain a digest of sensitive information.

[0108] Optionally, the information decryption device further includes a sensitive information modification confirmation module, used to decrypt the digital signature using the client public key to obtain a sensitive information digest:

[0109] The expected received sensitive information digest is calculated from the sensitive information using a digest algorithm;

[0110] Based on the expected received sensitive information digest and the sensitive information digest, confirm whether the sensitive information has been modified.

[0111] The information decryption device provided in the embodiments of the present invention can execute the information decryption method provided by the server-side decryption unit in the information encryption and decryption device described in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0112] Example 8

[0113] Figure 8 A schematic diagram of an electronic device 800 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0114] like Figure 8As shown, the electronic device 800 includes at least one processor 801 and a memory, such as a read-only memory (ROM) 802 and a random access memory (RAM) 803, communicatively connected to the at least one processor 801. The memory stores computer programs executable by the at least one processor. The processor 801 can perform various appropriate actions and processes based on the computer program stored in the ROM 802 or loaded into the RAM 803 from storage unit 808. The RAM 803 can also store various programs and data required for the operation of the electronic device 800. The processor 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0115] Multiple components in electronic device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of displays, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows electronic device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0116] Processor 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 801 performs the various methods and processes described above, such as information encryption methods or information decryption methods.

[0117] In some embodiments, the information encryption method or information decryption method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by processor 801, one or more steps of the information encryption method or information decryption method described above may be performed. Alternatively, in other embodiments, processor 801 may be configured to perform the information encryption method or information decryption method by any other suitable means (e.g., by means of firmware).

[0118] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0120] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0121] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0122] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0123] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0124] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0125] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An information encryption / decryption method, characterized in that, The information encryption and decryption device is used in an information encryption and decryption device, which includes an adaptation unit, a client encryption unit, and a server decryption unit. The adaptation unit is used to determine the target encryption method and notify the client encryption unit of the target encryption method, wherein the target encryption method is an encryption algorithm selected by the algorithm selector in the adaptation unit according to settings and the current working environment; the client encryption unit is used to encrypt the information to be transmitted according to the target encryption method to obtain ciphertext, and send the ciphertext to the server decryption unit; the server decryption unit is used to receive the ciphertext sent by the client encryption unit and decrypt the ciphertext to obtain the information to be transmitted. The method includes: The adaptation unit determines a target encryption algorithm that matches the current working environment from a variety of encryption algorithms through an algorithm selector; the target encryption algorithm includes a target symmetric encryption algorithm and a target asymmetric encryption algorithm; based on the target encryption algorithm, the target encryption method for the information to be transmitted in the current working environment is determined to be hybrid encryption; The client encryption unit generates a client random number and receives a server-side random number and a server public key sent by the server-side decryption unit; it obtains the client public key and client private key according to the target encryption algorithm corresponding to the target encryption method; it encrypts the information to be transmitted using the client random number, the server-side random number, the server public key, and the client private key to obtain ciphertext; and it sends the ciphertext and the client public key to the server-side decryption unit. The server-side decryption unit obtains the server public key and server private key, and generates a server-side random number; it sends the server public key and the server-side random number to the client-side encryption unit; it receives the ciphertext and client public key sent by the client-side encryption unit; and it decrypts the ciphertext according to the server private key, the server-side random number, and the client public key to obtain the information to be transmitted.

2. The method according to claim 1, characterized in that, The information to be transmitted includes sensitive information, a client-generated random number, and a digest of the sensitive information. The information to be transmitted is encrypted using the client-side random number, the server-side random number, the server public key, and the client private key to obtain ciphertext, including: A symmetric key is synthesized based on the client-side random number and the server-side random number, and the sensitive information is encrypted using the symmetric key to obtain the sensitive information ciphertext; The client random number is encrypted using the server's public key to obtain the client random number ciphertext; The client public key and client private key are obtained according to the target encryption algorithm, and the client private key is used to encrypt the sensitive information digest to obtain a digital signature.

3. The method according to claim 2, characterized in that, The client's private key is used to encrypt the sensitive information digest to obtain a digital signature, including: A digest of the sensitive information is obtained by calculating the sensitive information using a digest algorithm; The client's private key is used to encrypt the sensitive information digest to obtain a digital signature that matches the sensitive information.

4. The method according to claim 1, characterized in that, The encrypted information includes encrypted sensitive information, encrypted client-side random numbers, and a digital signature. The encrypted information is decrypted using the server's private key, the server-side random number, and the client's public key to obtain the information to be transmitted, including: The client random number is obtained by decrypting the client random number ciphertext using the server's private key. A symmetric key is synthesized based on the client-side random number and the server-side random number, and the symmetric key is used to decrypt the ciphertext of the sensitive information to obtain the sensitive information. The digital signature is decrypted using the client's public key to obtain a digest of sensitive information.

5. The method according to claim 4, characterized in that, After decrypting the digital signature using the client's public key to obtain the sensitive information digest, the process further includes: The expected received sensitive information digest is calculated from the sensitive information using a digest algorithm; Based on the expected received sensitive information digest and the sensitive information digest, confirm whether the sensitive information has been modified.

6. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the information encryption / decryption method according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the information encryption / decryption method according to any one of claims 1-5.

Images