User password encryption and decryption method and device based on national secret algorithm

Abstract

This application relates to a user password encryption and decryption method and apparatus based on Chinese national cryptographic algorithms. The method includes: obtaining a user's plaintext password, and obtaining a first public key for the user's plaintext password sent by a server and a communication certificate public key between the client and the server; converting the user's plaintext password into a first ciphertext conforming to a preset format; performing asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext; randomly generating a preset-byte encryption key and an initialization vector, and sequentially performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset-byte encryption key and the initialization vector to obtain a third ciphertext; obtaining a first key based on the communication certificate between the client and the server, the preset-byte encryption key, and the initialization vector; concatenating the first key and the third ciphertext, and sending the concatenation result to the server for verification. This application reduces reliance on international algorithms, thus providing better protection for personal user information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, and more particularly to a user password encryption and decryption method and device based on a national cryptographic algorithm. BACKGROUND

[0002] The national cryptographic algorithm is a series of data encryption processing algorithms independently researched and developed by China, which realizes symmetric, asymmetric, and digest algorithm functions from SM1 to SM4. The international algorithm is an algorithm published by the US security bureau. The existing user encryption generally uses the international algorithm to encrypt and decrypt the user plaintext password. However, the use of the international algorithm inevitably depends on the international community and affects the security of communication, so that the personal user information cannot be well protected. Moreover, due to the high security of the national cryptographic algorithm and other reasons, domestic banks and payment institutions recommend the use of the national cryptographic algorithm. SUMMARY

[0003] Based on the above technical problems, the present application aims to encrypt and decrypt the user password based on the national cryptographic algorithm, so as to break away from the control of the international algorithm and improve the security performance of the encryption and decryption algorithm.

[0004] The first aspect of the present application provides a user password encryption and decryption method based on a national cryptographic algorithm, applied to a client, the method comprising:

[0005] obtaining a user plaintext password, and obtaining a first public key for the user plaintext password sent by a server and a communication certificate public key between the client and the server;

[0006] converting the user plaintext password into a first ciphertext conforming to a preset format;

[0007] performing asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext;

[0008] randomly generating a preset byte encryption key and an initial vector, and sequentially performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector to obtain a third ciphertext;

[0009] obtaining a first key according to the communication certificate between the client and the server, the preset byte encryption key, and the initial vector;

[0010] splicing the first key and the third ciphertext, and sending the splicing result to the server for verification.

[0011] In some embodiments of the present application, the first ciphertext of the preset format is sequentially composed of a password length and a password plaintext, and the number of bits after composition reaches a preset number of bits. If the number of bits after composition is insufficient, 0 is appended after the password plaintext to make the number of bits after appending 0 reach the preset number of bits.

[0012] In some embodiments of the present application, after inputting the user plaintext password, a timestamp corresponding to the user plaintext password sent by the server is also obtained; the asymmetric encryption of the first ciphertext based on the first public key to obtain the second ciphertext comprises:

[0013] Combining the timestamp with the first ciphertext;

[0014] Asymmetrically encrypting the combination result of the timestamp and the first ciphertext by using the first public key to obtain the second ciphertext.

[0015] In some embodiments of the present application, the second ciphertext is sequentially subjected to asymmetric encryption and preset format conversion based on the preset byte encryption key and the initial vector to obtain the third ciphertext, which comprises:

[0016] Asymmetrically encrypting the second ciphertext based on the preset byte encryption key and the initial vector to obtain an intermediate result;

[0017] Converting the intermediate result into a lowercase preset format, and taking the converted intermediate result as the third ciphertext.

[0018] In some embodiments of the present application, the first key is obtained according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector, which comprises:

[0019] Splicing the preset byte encryption key and the initial vector;

[0020] Asymmetrically encrypting the splicing result of the preset byte encryption key and the initial vector by using the communication certificate between the client and the server to obtain the first key.

[0021] The second aspect of the present application provides a user password encryption and decryption method based on a national secret algorithm, applied to a server, which comprises:

[0022] Receiving the ciphertext encrypted by the client for the user plaintext password;

[0023] Splitting the encrypted ciphertext into a first key and the third ciphertext;

[0024] Obtaining a first key index and a second key index;

[0025] Decrypting the first secret key according to the first key index, and decrypting the third ciphertext according to the second key index to obtain the second ciphertext;

[0026] Decrypting the second ciphertext according to the first key index to obtain a timestamp and a first ciphertext;

[0027] When the timestamp is verified, the first ciphertext is converted into a ciphertext digest according to a preset national secret algorithm.

[0028] In some embodiments of the present application, after the first ciphertext is converted into a ciphertext digest according to the preset national secret algorithm, the following steps are further included:

[0029] The ciphertext digest is searched in a database of the server, and if the ciphertext digest is found and is consistent with the plaintext password of the target user, a message of successful password verification of the client is returned.

[0030] The third aspect of the present application provides a user password encryption and decryption device based on a national secret algorithm, which comprises:

[0031] The acquisition module is configured to input a user plaintext password and acquire a first public key for the user plaintext password sent by a server and a communication certificate public key between the client and the server;

[0032] The conversion module is configured to convert the user plaintext password into a first ciphertext conforming to a preset format;

[0033] The first encryption module is configured to asymmetrically encrypt the first ciphertext based on the first public key to obtain a second ciphertext;

[0034] The second encryption module is configured to randomly generate a preset byte encryption key and an initial vector, and sequentially asymmetrically encrypt and convert the second ciphertext based on the preset byte encryption key and the initial vector to obtain a third ciphertext;

[0035] The third encryption module is configured to obtain a first key according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector;

[0036] The splicing module is configured to splice the first key and the third ciphertext, and send the splicing result to the server for verification.

[0037] The fourth aspect of the present application provides a computer device comprising a memory and a processor, the memory storing computer readable instructions, and the computer readable instructions are executed by the processor to make the processor execute the following steps:

[0038] A user plaintext password is acquired, and a first public key for the user plaintext password sent by a server and a communication certificate public key between the client and the server are acquired;

[0039] The user plaintext password is converted into a first ciphertext conforming to a preset format;

[0040] encrypt the first ciphertext based on the first public key to obtain second ciphertext;

[0041] randomly generate a preset byte encryption key and an initial vector, and sequentially perform asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector to obtain third ciphertext;

[0042] obtain a first key according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector;

[0043] splice the first key and the third ciphertext, and send the spliced result to the server for verification.

[0044] The fifth aspect of the application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the following steps:

[0045] obtain a user plaintext password, and obtain a first public key for the user plaintext password sent by a server and a communication certificate public key between the client and the server;

[0046] convert the user plaintext password into first ciphertext in a preset format;

[0047] encrypt the first ciphertext based on the first public key to obtain second ciphertext;

[0048] randomly generate a preset byte encryption key and an initial vector, and sequentially perform asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector to obtain third ciphertext;

[0049] obtain a first key according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector;

[0050] splice the first key and the third ciphertext, and send the spliced result to the server for verification.

[0051] The technical scheme provided in the embodiments of the application has at least the following technical effects or advantages:

[0052] The application obtains a user plaintext password, obtains a first public key for the user plaintext password sent by a server and a communication certificate public key between a client and the server, converts the user plaintext password into a first ciphertext conforming to a preset format, performs asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext, randomly generates a preset byte encryption key and an initial vector, and performs asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector to obtain a third ciphertext, obtains a first key according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector, splices the first key and the third ciphertext, and sends the splicing result to the server for verification. The overall encryption process no longer depends on international algorithms, personal user information is better protected, and communication security is realized.

[0053] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the application. BRIEF DESCRIPTION OF DRAWINGS

[0054] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments, and are not intended to limit the scope of the present application. Moreover, like reference numerals designate like parts throughout the several views in the drawings. In the drawings:

[0055] Figure 1 A user password encryption and decryption method based on a national secret algorithm in an exemplary embodiment of the application is shown in a step schematic diagram;

[0056] Figure 2 A partial working process schematic diagram of client user password encryption in an exemplary embodiment of the application is shown;

[0057] Figure 3 A user password encryption and decryption device structure schematic diagram in an exemplary embodiment of the application is shown;

[0058] Figure 4 A structure schematic diagram of a computer device provided by an exemplary embodiment of the application is shown. DETAILED DESCRIPTION

[0059] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It should be understood that these descriptions are merely exemplary of the application and should not be in any way interpreted in regard to limiting the scope of the application. Further, in the following description, well-known functions or constructions are not described in detail since they would obscure the application in regard to the aspects of the application. It should be understood that the application can be practiced without one or more of these details.

[0060] It should be noted that the terms used herein are merely exemplary and should not be construed to limit the scope of the exemplary embodiments of the present application. As used herein, the singular forms are intended to include the plural forms as well unless the context clearly indicates otherwise. It should also be understood that when the term "comprise" or "include" is used in this specification, it is intended to cover the case where the term "comprise" or "include" is replaced with "consist of."

[0061] Now, exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. The exemplary embodiments may, however, be implemented in many different ways and should not be construed as being limited to the embodiments set forth herein. The drawings are not drawn to scale and some details may be exaggerated for the sake of clarity. The shapes and relative sizes of the various regions, layers and elements illustrated in the drawings are exemplary only and may vary depending on the manufacturing process or technical requirements. The exemplary embodiments should be considered in a descriptive sense only and not for purposes of limitation.

[0062] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. Figure 1 - The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. Figure 4 Several embodiments will be given to describe the exemplary embodiments according to the present application. It should be noted that the following application scenarios are merely exemplary and are shown for the purpose of facilitating understanding of the spirit and principles of the present application, and the embodiments of the present application are not limited in this respect. On the contrary, the embodiments of the present application can be applied to any applicable scenario.

[0063] The national secret algorithm is a series of data encryption processing algorithms independently researched and developed by China. The SM1 to SM4 respectively realize the functions of symmetric, asymmetric, and digest algorithms. The international algorithm is an algorithm published by the US security bureau. The existing user encryption generally uses the international algorithm to encrypt and decrypt the user plaintext password. However, the use of the international algorithm inevitably depends on the international and affects the communication security, so that the personal user information cannot be better protected. Moreover, due to the high security of the national secret algorithm and other reasons, domestic banks and payment institutions recommend using the national secret algorithm.

[0064] Therefore, in some example embodiments of the present application, a user password encryption and decryption method based on the national secret algorithm is provided, as shown in Figure 1 The method comprises the following steps.

[0065] S1, obtaining a user plaintext password, and obtaining a first public key for the user plaintext password sent by a server and a communication certificate public key between a client and the server;

[0066] S2, converting the user plaintext password into a first ciphertext conforming to a preset format;

[0067] S3, performing asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext;

[0068] S4, randomly generating a preset byte encryption key and an initial vector, and sequentially performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector to obtain a third ciphertext;

[0069] S5, obtaining a first key according to the communication certificate between the client and the server, the preset byte encryption key, and the initial vector;

[0070] S6, splicing the first key and the third ciphertext, and sending the splicing result to the server for verification.

[0071] It should be noted that the SM2 algorithm represents the national secret asymmetric algorithm, which needs a public-private key pair to encrypt and decrypt the algorithm; the SM3 algorithm represents the national secret Hash digest algorithm, which generates a Hash digest for a plaintext string; and the SM4 algorithm represents the national secret symmetric encryption algorithm, and the client and the server encrypt and decrypt data by using the same key to achieve data transmission security guarantee.

[0072] In a specific implementation, the SM2 public key of the service end for the user's plaintext password in S1 is denoted as hsmPubKeyGM, the communication certificate public key between the client and the service end is denoted as appPubKeyGM, and the public key sent by the service end is from the encryption machine of the service end. The first ciphertext in the preset format is composed of the password length and the password plaintext in sequence and the bit number after composition reaches the preset bit number. If the bit number after composition is less than the preset bit number, 0 is appended after the password plaintext, so that the bit number after appending 0 reaches the preset bit number, and the preset bit number is a multiple of 16. In other words, the first ciphertext in the preset format is in the format of password length + password plaintext + zero padding, and the total length of the first ciphertext in the preset format is a multiple of 16. For example, 32 bits, 64 bits, etc. Here, reference can be made to Figure 2 As shown in Figure 2 , the user inputs the plaintext password in the APP of the client, and the plaintext password of the user is converted into the format of "password length + password plaintext + zero padding", and the overall length is a multiple of 16.

[0073] In a preferred implementation, after inputting the user's plaintext password, the time stamp timestamp corresponding to the user's plaintext password sent by the service end is also acquired; the first ciphertext password1 is asymmetrically encrypted based on the SM2 public key hsmPubKeyGM to obtain the second ciphertext, including: combining the timestamp with the first ciphertext; the combination result of the timestamp and the first ciphertext, i.e., timestamp: password1, is asymmetrically encrypted by the SM2 public key to obtain the second ciphertext. In a specific implementation, the format of the second ciphertext is by default in the order of C1C3C2 without the leading byte 04.

[0074] In a preferred implementation, a 32-byte encryption key key and an initial vector lv are randomly generated, and the second ciphertext is sequentially subjected to SM4 asymmetric encryption and HEX format conversion based on the 32-byte encryption key key and the initial vector lv to obtain the third ciphertext, including: the second ciphertext is subjected to SM4 asymmetric encryption based on the 32-byte encryption key and the initial vector to obtain an intermediate result; the intermediate result is converted into lowercase HEX format, and the converted intermediate result is taken as the third ciphertext.

[0075] In a preferred implementation, the first key is obtained according to the communication certificate between the client and the server, the 32-byte encryption key and the initial vector, including: splicing the 32-byte encryption key and the initial vector; performing SM2 asymmetric encryption on the spliced result of the 32-byte encryption key and the initial vector using the communication certificate between the client and the server to obtain a first key key2. Finally, the first key key2 is spliced with the third ciphertext, and the spliced result is sent to the server for verification, that is, the APP calls the server interface to upload the spliced result.

[0076] Due to the high security of the national encryption algorithm and other reasons, domestic banks and payment institutions recommend using the national encryption algorithm. The method provided in the embodiments of the present application includes the process of password encryption from user input of plaintext password to encrypted upload of ciphertext. The password encryption is encrypted by SM2 encryption, SM4 encryption, SM2 encryption and other three times to generate the final password ciphertext uploaded to the server. The overall encryption process no longer depends on international algorithms, which realizes better protection of personal user information and thus realizes communication security.

[0077] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application.

[0078] In some exemplary embodiments of the present application, a user password encryption and decryption method based on the national encryption algorithm is also provided, which is applied to the server. The method includes: receiving the ciphertext of the encrypted user plaintext password sent by the client; splitting the encrypted ciphertext into a first key and the third ciphertext; obtaining an SM2 key index and an SM4 key index; decrypting the first secret key according to the SM2 key index and decrypting the third ciphertext according to the SM4 key index to obtain a second ciphertext; decrypting the second ciphertext according to the SM2 key index to obtain a timestamp and a first ciphertext; when the timestamp is verified (preferably not more than 10 minutes), converting the first ciphertext into a ciphertext digest according to the SM3 national encryption algorithm. It should be noted that the key index is obtained through a configuration file hosted in the server, which will not be described here.

[0079] In a preferred implementation, before the first ciphertext is converted into a ciphertext digest according to the SM3 national encryption algorithm, the process further includes calling an encryption machine to perform SM2 to SM4 conversion encryption, wherein the "SM2 to SM4 conversion encryption" refers to a process in which the encryption machine first decrypts the user password into plaintext through SM2 decryption, then encrypts the user password plaintext through SM4 encryption, and finally returns the user password ciphertext encrypted through SM4.

[0080] In a specific implementation, the second ciphertext is decrypted according to the SM2 key index to obtain the timestamp and the first ciphertext. Since the timestamp and the first ciphertext are combined through a colon during encryption, the timestamp and the first ciphertext are intercepted through the colon during decryption.

[0081] In a preferred implementation, after the first ciphertext is converted into a ciphertext digest according to the SM3 national encryption algorithm, the process further includes searching for the ciphertext digest in a database of the server. If the ciphertext digest is found and is consistent with the plaintext password of the target user, a message indicating that the password verification of the client is successful is returned. In other words, if the input user password is the same as the record stored in the database, the input user password is considered correct, and if the input user password is different from the record stored in the database, the input user password is considered incorrect.

[0082] In summary, the server decrypts and converts the user password through SM2 decryption, SM4 decryption, SM2 to SM4 conversion encryption, and SM3 digest, thereby reducing the dependence on international algorithms and protecting personal user information, and thus achieving communication security.

[0083] In some example embodiments of the present application, a user password encryption and decryption device based on a national encryption algorithm is also provided, as shown in Figure 3 The device is configured to perform the user password encryption and decryption method based on the national encryption algorithm provided in any of the above embodiments. The device includes:

[0084] The acquisition module is configured to input the user plaintext password and acquire the SM2 public key sent by the server for the user plaintext password and the communication certificate public key between the client and the server.

[0085] The conversion module is configured to convert the user plaintext password into the first ciphertext in a predetermined format.

[0086] The first encryption module is configured to perform asymmetric encryption on the first ciphertext based on the SM2 public key to obtain the second ciphertext.

[0087] a second encryption module configured to randomly generate a 32-byte encryption key and an initial vector, and sequentially perform SM4 asymmetric encryption and HEX format conversion on the second ciphertext based on the 32-byte encryption key and the initial vector to obtain third ciphertext;

[0088] a third encryption module configured to obtain a first key according to a communication certificate between the client and the server, the 32-byte encryption key and the initial vector;

[0089] a splicing module configured to splice the first key and the third ciphertext, and send the splicing result to the server for verification.

[0090] It can be understood that the user password encryption and decryption device based on the national secret algorithm further includes some supporting hardware or devices, which are not described here. It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application.

[0091] In some exemplary embodiments of the present application, a user password encryption and decryption device based on the national secret algorithm is also provided, which comprises:

[0092] a receiving module configured to receive ciphertext encrypted by the client based on user plaintext password;

[0093] a splitting module configured to split the encrypted ciphertext into a first key and the third ciphertext;

[0094] an obtaining module configured to obtain SM2 key index and SM4 key index;

[0095] a first decryption module configured to decrypt the first key according to the SM2 key index, and decrypt the third ciphertext according to the SM4 key index to obtain second ciphertext;

[0096] a second decryption module configured to decrypt the second ciphertext according to the SM2 key index to obtain a timestamp and first ciphertext;

[0097] a third decryption module configured to convert the first ciphertext into ciphertext digest according to SM3 national secret algorithm when the timestamp is verified.

[0098] It can be understood that the device further includes a conversion encryption module for calling an encryption machine to perform SM2 to SM4 conversion encryption. It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application.

[0099] It should be further emphasized that the system provided in the embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) is a theory, method, technology and application system for using digital computers or computer-controlled machines to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain optimal results. Artificial intelligence basic technologies generally include technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. Artificial intelligence software technologies mainly include computer vision technology, robot technology, biometric technology, speech processing technology, natural language processing technology, and machine learning / deep learning, etc.

[0100] Reference is made below to Figure 4 which shows a schematic diagram of a computer device provided by some embodiments of the present application. As shown in Figure 4 , the computer device 2 comprises a processor 200, a memory 201, a bus 202 and a communication interface 203, the processor 200, the communication interface 203 and the memory 201 are connected through the bus 202; the memory 201 stores a computer program executable on the processor 200, and the processor 200 executes the computer program to perform the user password encryption and decryption method based on the national secret algorithm provided by any of the preceding embodiments of the present application.

[0101] The memory 201 can include a high-speed random access memory (RAM) and can also include a non-volatile memory such as at least one disk memory. The communication between the system network element and at least one other network element is realized through at least one communication interface 203 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.

[0102] The bus 202 can be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store programs, and the processor 200 executes the programs after receiving execution instructions. The user password encryption and decryption method based on the national secret algorithm disclosed in any of the preceding embodiments of the present application can be applied to the processor 200 or realized by the processor 200.

[0103] The processor 200 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor 200 or the instruction in the form of software. The processor 200 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a ready programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201 and completes the steps of the above method in combination with the hardware thereof.

[0104] The embodiments of the present application also provide a computer readable storage medium corresponding to the user password encryption and decryption method based on the national secret algorithm provided by the foregoing embodiments, and a computer program is stored on the computer readable storage medium. When the computer program is run by a processor, the user password encryption and decryption method based on the national secret algorithm provided by any of the foregoing embodiments is executed.

[0105] In addition, examples of the computer readable storage medium can also include, but are not limited to, a phase change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read only memory (ROM), an electrically erasable programmable read only memory (EEPROM), a flash memory or other optical, magnetic storage medium, which will not be described one by one here.

[0106] The embodiment of the present application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the user password encryption and decryption method based on the national secret algorithm provided by any of the preceding embodiments, comprising: obtaining a user plaintext password, and obtaining a first public key sent by a server for the user plaintext password and a communication certificate public key between the client and the server; converting the user plaintext password into a first ciphertext conforming to a preset format; performing asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext; randomly generating a preset byte encryption key and an initial vector, and performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset byte encryption key and the initial vector in sequence to obtain a third ciphertext; obtaining a first key according to the communication certificate between the client and the server, the preset byte encryption key and the initial vector; splicing the first key and the third ciphertext, and sending the splicing result to the server for verification.

[0107] It should be noted that the algorithms and displays provided herein are not inherently related to any particular computer, virtual apparatus, or other device. Various general purpose devices can be used with these teachings based on the description herein. Those skilled in the art will recognize that structures required to construct such devices will be apparent in light of the above description. Also, the present application is not necessarily limited to any particular programming language. It will be appreciated that a variety of programming languages can be used to implement the teachings of the present application as described herein, and any references below to specific languages are provided for disclosure of enablement of the best mode of the present application. Numerous specific details are described herein in order to provide a thorough understanding of the application. However, it will be recognized by those skilled in the art that the embodiment of the present application can be practiced without some or all of the specific details. In some instances, well known methods, structures and techniques have not been described in detail in order not to obscure the understanding of this description.

[0108] Those skilled in the art will appreciate that modules in the apparatuses in the embodiments can be adapted and arranged in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and furthermore can be divided into multiple sub-modules or sub-units or sub-components. All the features disclosed in the specification and all the processes or units of any methods disclosed can be combined in any combination, except where such features or processes or units are explicitly stated as incompatible. Each feature disclosed in the specification can also be replaced by an alternative feature providing the same, equivalent or similar functionality unless stated otherwise.

[0109] The various component embodiments of the present application can be implemented in hardware, or as software modules running in one or more processors, or in combinations thereof. As will be appreciated by one skilled in the art, a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functionality of some or all of the components of the virtual machine creation apparatus according to embodiments of the present application. The present application can also be implemented as a program for executing the part or all of the methods described herein on a device or apparatus. The program implementing the present application can be stored on a computer readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier medium, or in any other form.

[0110] The above description is only preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any changes or replacements within the technical scope disclosed by the present application, which can be easily thought by any person skilled in the art, should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A user password encryption and decryption method based on a national secret algorithm, applied to a client, characterized in that, The method comprises: obtaining a user plaintext password, and obtaining a first public key corresponding to the user plaintext password and a communication certificate public key between a client and a server sent by a server; converting the user plaintext password into a first ciphertext in a preset format; performing asymmetric encryption on the first ciphertext based on the first public key to obtain a second ciphertext; randomly generating a preset-byte encryption key and an initial vector, and performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset-byte encryption key and the initial vector to obtain a third ciphertext; obtaining a first key according to the communication certificate between the client and the server, the preset-byte encryption key and the initial vector; splicing the first key and the third ciphertext, and sending the splicing result to the server for verification; after inputting the user plaintext password, a timestamp corresponding to the user plaintext password sent by the server is also obtained; the asymmetric encryption of the first ciphertext based on the first public key to obtain the second ciphertext comprises: combining the timestamp and the first ciphertext; performing asymmetric encryption on the combination result of the timestamp and the first ciphertext using the first public key to obtain the second ciphertext arranged in the order of C1C3C2 by default and without a leading byte 04.

2. The user password encryption and decryption method based on the SM algorithm according to claim 1, characterized in that, The first ciphertext in the preset format is composed of a password length and a password plaintext in sequence, and the number of bits after composition reaches a preset number of bits; if the number of bits after composition is less than the preset number of bits, 0 is appended after the password plaintext to make the number of bits after appending 0 reach the preset number of bits.

3. The user password encryption and decryption method based on the SM algorithm according to claim 1, characterized in that, Performing asymmetric encryption and preset format conversion on the second ciphertext based on the preset-byte encryption key and the initial vector to obtain the third ciphertext comprises: performing asymmetric encryption on the second ciphertext based on the preset-byte encryption key and the initial vector to obtain an intermediate result; converting the intermediate result into a lowercase preset format, and taking the converted intermediate result as the third ciphertext.

4. The user password encryption and decryption method based on the SM algorithm according to claim 1, characterized in that, The first key is obtained according to the communication certificate between the client and the server, the preset-byte encryption key and the initial vector, which comprises: splicing the preset-byte encryption key and the initial vector; performing asymmetric encryption on the splicing result of the preset-byte encryption key and the initial vector using the communication certificate between the client and the server to obtain the first key.

5. A user password encryption and decryption method based on a national secret algorithm, applied to a server, characterized in that, The method comprises: receiving a ciphertext encrypted by a client for a user plaintext password; splitting the encrypted ciphertext into a first key and a third ciphertext; obtaining a first key index and a second key index; decrypting the first key according to the first key index, and decrypting the third ciphertext according to the second key index to obtain a second ciphertext, wherein the second ciphertext is arranged in the order of C1C3C2 by default and without a leading byte 04; decrypting the second ciphertext according to the first key index to obtain a timestamp and a first ciphertext; when the timestamp is verified, converting the first ciphertext into a ciphertext digest according to a preset national secret algorithm.

6. The user password encryption and decryption method based on the SM algorithm according to claim 5, characterized in that, After the first ciphertext is converted into the ciphertext digest according to the preset national secret algorithm, the following steps are further included: Finding the ciphertext digest in a database of the server, if the ciphertext digest is found and the ciphertext digest is consistent with the plaintext password of the target user, returning a message of successful password verification of the client.

7. A user password encryption and decryption device based on a national secret algorithm, characterized in that, The device comprises: An acquisition module configured to input a user plaintext password and acquire a first public key sent by a server for the user plaintext password and a communication certificate public key between the client and the server; A conversion module configured to convert the user plaintext password into a first ciphertext conforming to a preset format; A first encryption module configured to asymmetrically encrypt the first ciphertext based on the first public key to obtain a second ciphertext; A second encryption module configured to randomly generate a preset byte encryption key and an initial vector and sequentially asymmetrically encrypt and convert the second ciphertext based on the preset byte encryption key and the initial vector to obtain a third ciphertext; A third encryption module configured to obtain a first key according to a communication certificate between the client and the server, the preset byte encryption key and the initial vector; A splicing module configured to splice the first key and the third ciphertext and send the splicing result to the server for verification; After inputting the user plaintext password, a timestamp corresponding to the user plaintext password sent by the server is further acquired; the asymmetrically encrypting the first ciphertext based on the first public key to obtain the second ciphertext comprises: Combining the timestamp and the first ciphertext; Asymmetrically encrypting the combination result of the timestamp and the first ciphertext using the first public key to obtain the second ciphertext arranged in a default order of C1C3C2 and without a leading byte 04. 8.A computer device, comprising a memory and a processor, and characterized in that, The computer readable instructions stored in the memory are executed by the processor to make the processor execute the method of any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-6.

Images