Encryption method, device, storage medium and electronic device

Abstract

The application discloses an encryption method and device, a storage medium and an electronic device. The method comprises the following steps: determining an original key, and obtaining an encryption key by iteratively processing the original key by a data encryption algorithm for a predetermined number of times; obtaining an initialization vector in a ciphertext structure, and obtaining an encrypted original ciphertext according to the encryption key and the initialization vector; obtaining an encryption salt, and splicing the encrypted original ciphertext, the initialization vector, the encryption salt and the predetermined number of times to obtain a target ciphertext. The application solves the technical problem that different encryption strength requirements cannot be implemented for different systems due to the difficulty in managing keys in the related art and the fixed encryption strength.

Description

Technical Field

[0001] This application relates to the field of cryptography, and more specifically, to an encryption method, apparatus, storage medium, and electronic device. Background Technology

[0002] With the booming development of online business, the types and quantities of orders received by the system are increasing daily. The system also stores various sensitive user information. To prevent information leakage during inter-system interactions, information needs to be encrypted. However, existing technologies suffer from drawbacks such as difficulties in managing binary format keys, fixed security strength, and poor usability. These limitations fail to truly meet the requirements for efficient and easy-to-use encryption mechanisms in application systems, and cannot accommodate different encryption strengths for different systems.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides an encryption method, apparatus, storage medium, and electronic device to at least solve the technical problem that it is impossible to apply different encryption strength requirements to different systems due to the difficulty in managing keys and the fixed encryption strength caused by related technologies.

[0005] According to one aspect of the embodiments of this application, an encryption method is provided, comprising: determining an original key; iterating the original key through a data encryption algorithm a predetermined number of times to obtain an encryption key; obtaining an initialization vector in a ciphertext structure; obtaining the encrypted original ciphertext based on the encryption key and the initialization vector; obtaining an encryption salt; and concatenating the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of iterations to obtain a target ciphertext.

[0006] Optionally, obtaining the encrypted original ciphertext based on the encryption key and the initialization vector includes: encrypting the plaintext using a cipher block chaining cipher mode based on the encryption key and the initialization vector to obtain the encrypted original ciphertext.

[0007] Optionally, the original key is iterated through a data encryption algorithm a predetermined number of times to obtain an encryption key, including: determining the base and exponent in the ciphertext structure; and obtaining the predetermined number of iterations based on the base and exponent.

[0008] Optionally, determining the base and exponent includes: determining the security level of the encrypted data; and determining the base and exponent based on the security level, wherein the higher the security level, the larger the base and exponent.

[0009] Optionally, the base and exponent are determined based on the security level, including: determining whether the encrypted data contains personal information and order number; if the encrypted data contains personal information and order number, determining that the security level of the encrypted data is greater than a preset level; if the security level is greater than the preset level, obtaining the target range corresponding to the base and exponent; and selecting the values ​​corresponding to the base and exponent from the target range.

[0010] Optionally, the target ciphertext is obtained by concatenating the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times, including: determining the plaintext blocks, obtaining the base and exponent; and concatenating the blocks, base, exponent, encryption salt, initialization vector, and the encrypted original ciphertext in sequence to obtain the target ciphertext.

[0011] Optionally, after concatenating the encrypted original ciphertext, initialization vector, encryption salt, and a predetermined number of times to obtain the target ciphertext, the method further includes: after obtaining the target ciphertext, converting the binary ciphertext corresponding to the target ciphertext into hexadecimal ciphertext.

[0012] Optionally, the method further includes: obtaining hexadecimal ciphertext and converting it into binary ciphertext; extracting the encrypted original ciphertext from the binary ciphertext and obtaining an encryption key by iterating the original key a predetermined number of times using a data encryption algorithm; and decrypting the encrypted original ciphertext using the encryption key to obtain plaintext.

[0013] Optionally, the encryption salt is determined by inserting a specific string at any fixed position in the original ciphertext, and then randomly generating a first predetermined number of bytes as the encryption salt after encryption; the initialization vector is determined by generating a second predetermined number of bytes as the initialization vector after encryption when encrypting in the ciphertext block chaining mode, wherein the first predetermined number is less than the second predetermined number.

[0014] According to another aspect of the embodiments of this application, an encryption device is also provided, comprising: a determining module, configured to determine an original key and iterate the original key through a data encryption algorithm a predetermined number of times to obtain an encryption key; an obtaining module, configured to obtain an initialization vector in the ciphertext structure and obtain the encrypted original ciphertext based on the encryption key and the initialization vector; and a concatenation module, configured to obtain an encryption salt and concatenate the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of times to obtain a target ciphertext.

[0015] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, comprising: the storage medium including a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute any encryption method.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement any encryption method.

[0017] In this embodiment, the encryption strength is controlled by dynamically adjusting the number of encryption iterations. The method involves determining the original key, iterating it a predetermined number of times using a data encryption algorithm to obtain the encryption key, acquiring the initialization vector in the ciphertext structure, and obtaining the encrypted original ciphertext based on the encryption key and the initialization vector. Finally, the encryption salt is acquired, and the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of iterations are concatenated to obtain the target ciphertext. This simplifies key management, enhances the usability of the encryption mechanism, and improves the network transmission efficiency of the ciphertext. It achieves the technical effect of dynamically adjusting the encryption strength, thereby solving the problem of difficulty in key management and the inability to apply different encryption strength requirements to different systems due to fixed encryption strength. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a flowchart illustrating an encryption method according to an embodiment of this application;

[0020] Figure 2 This is a schematic diagram of a ciphertext structure according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of an encryption device structure according to an embodiment of this application;

[0022] Figure 4 This is a schematic block diagram of an example electronic device 400 according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] To facilitate a better understanding by those skilled in the art, the technical terms or some nouns that may be involved in this application are explained below in the relevant embodiments:

[0026] The encryption strength parameter refers to the number of iterations. The number of times the PBKDF2 algorithm is executed is configured to be N (base) raised to the power of M (index), so as to adjust the strength of the encryption algorithm according to actual needs and adapt to various scenarios.

[0027] Random encryption salts are created by inserting a specific string at arbitrary fixed positions in the password, making the hash result different from the hash result using the original password.

[0028] An initialization vector is required when using the cryptographic block chain mode and is introduced as a selected data block.

[0029] According to an embodiment of this application, an encryption method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] Figure 1 This is an encryption method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0031] Step S102: Determine the original key, and iterate the original key through the data encryption algorithm a predetermined number of times to obtain the encryption key;

[0032] Step S104: Obtain the initialization vector in the ciphertext structure, and obtain the encrypted original ciphertext based on the encryption key and the initialization vector;

[0033] Step S106: Obtain the encryption salt, and concatenate the encrypted original ciphertext, initialization vector, encryption salt, and a predetermined number of times to obtain the target ciphertext.

[0034] In this embodiment, the encryption strength is controlled by dynamically adjusting the number of encryption iterations. The method involves determining the original key, iterating it a predetermined number of times using a data encryption algorithm to obtain the encryption key, acquiring the initialization vector in the ciphertext structure, and obtaining the encrypted original ciphertext based on the encryption key and the initialization vector. Finally, the encryption salt is acquired, and the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of iterations are concatenated to obtain the target ciphertext. This simplifies key management, enhances the usability of the encryption mechanism, and improves the network transmission efficiency of the ciphertext. It achieves the technical effect of dynamically adjusting the encryption strength, thereby solving the problem of difficulty in key management and the inability to apply different encryption strength requirements to different systems due to fixed encryption strength.

[0035] In some optional embodiments of this application, obtaining the encrypted original ciphertext based on the encryption key and the initialization vector includes: encrypting the plaintext using a cipher block chaining cipher mode based on the encryption key and the initialization vector to obtain the encrypted original ciphertext.

[0036] As an optional implementation, the original key is iterated through a data encryption algorithm a predetermined number of times to obtain an encryption key, including: determining the base and exponent in the ciphertext structure; and obtaining the predetermined number of iterations based on the base and exponent.

[0037] For example, assuming the base is 2 and the exponent is 2, then the number of iterations is 2. 2 =4.

[0038] In an exemplary embodiment of this application, determining the base and exponent includes: determining the security level of the encrypted data; and determining the base and exponent based on the security level, wherein the higher the security level, the larger the base and exponent.

[0039] Understandably, when transmitting data with a high security level, a larger base and exponent are used, resulting in a larger number of iterations and increasing the difficulty of decryption; when transmitting data with a low security level, a smaller exponent and base are used, resulting in a smaller number of iterations and reducing the resource consumption for encryption and decryption.

[0040] It should be noted that the maximum number of iterations supported is 255. 255 Second-rate.

[0041] As an optional implementation, determining the base and exponent based on the security level includes: determining whether the encrypted data contains personal information and order number; if the encrypted data contains personal information and order number, determining that the security level of the encrypted data is greater than a preset level; if the security level is greater than the preset level, obtaining the target range corresponding to the base and exponent; and selecting the values ​​corresponding to the base and exponent from the target range.

[0042] It should be noted that the default level is the normal security level.

[0043] For example, the value range of 0-255 can be divided into three ranges: 0-85 is the target range for obtaining the base and exponent at the low security level, 85-170 is the target range for obtaining the base and exponent at the normal security level, and 170-255 is the target range for obtaining the base and exponent at the high security level.

[0044] In some optional embodiments of this application, the target ciphertext is obtained by concatenating the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times. This includes: determining the plaintext blocks and obtaining the base and exponent; and concatenating the blocks, the base, the exponent, the encryption salt, the initialization vector, and the encrypted original ciphertext sequentially to obtain the target ciphertext.

[0045] In an exemplary embodiment of this application, after concatenating the encrypted original ciphertext, initialization vector, encryption salt, and a predetermined number of times to obtain the target ciphertext, the method further includes: after obtaining the target ciphertext, converting the binary ciphertext corresponding to the target ciphertext into hexadecimal ciphertext.

[0046] It should be noted that converting binary ciphertext to hexadecimal facilitates its transmission over the network.

[0047] In some optional embodiments of this application, the method further includes: obtaining hexadecimal ciphertext and converting the hexadecimal ciphertext into binary ciphertext; extracting the encrypted original ciphertext from the binary ciphertext and obtaining an encryption key by iterating the original key a predetermined number of times using a data encryption algorithm; and decrypting the encrypted original ciphertext according to the encryption key to obtain plaintext.

[0048] As an optional implementation, the encryption salt is determined as follows: a specific string is inserted at any fixed position in the original ciphertext, and a first predetermined number of bytes are randomly generated after encryption as the encryption salt; the initialization vector is determined as follows: when encrypting in the ciphertext block chaining mode, a second predetermined number of bytes are randomly generated after encryption as the initialization vector, wherein the first predetermined number is less than the second predetermined number.

[0049] It should be noted that the first predetermined quantity is 8, and the second predetermined quantity is 16, that is, the length of the encryption salt is 8 bytes and the length of the initialization vector is 16 bytes.

[0050] To facilitate a better understanding of the technical solutions of this application by those skilled in the art, a specific embodiment will now be described.

[0051] Specifically, the process mainly includes the following steps:

[0052] I. Encryption Process:

[0053] (1) Randomly generate an encryption salt with a length of 8 bytes;

[0054] (2) Randomly generate an initialization vector with a length of 16 bytes;

[0055] (3) Generate the encryption key using the PBKDF2 algorithm: The original key in string format is iterated a predetermined number of times using the SHA-1PRF algorithm (N). M This yields the encryption key, which is 32 bytes in length.

[0056] It should be noted that N is the base and M is the exponent. By determining the values ​​of the base and the exponent, the number of iterations can be obtained.

[0057] It is understandable that when transmitting data with a high security level, using a larger base and exponent results in a larger number of iterations, increasing the difficulty of decryption; when transmitting data with a low security level, using a smaller exponent and base results in a smaller number of iterations, reducing the resource consumption for encryption and decryption.

[0058] (4) Obtain CBC mode ciphertext: Obtain the encryption key and initialization vector, and encrypt the plaintext according to the encryption key and initialization vector using the AES-256 algorithm and CBC mode to obtain the original ciphertext;

[0059] (5) Concatenate the base, exponent, encryption salt, initialization vector and original ciphertext of CBC mode to obtain binary ciphertext;

[0060] Figure 2 This is a schematic diagram of a ciphertext structure according to an embodiment of this application, such as... Figure 2 As shown, the structure includes: base, index, encryption salt, initialization vector (IV), and CBC pattern ciphertext.

[0061] (6) Convert the binary ciphertext into the final hexadecimal ciphertext.

[0062] II. Decryption process:

[0063] (1) Convert hexadecimal ciphertext to binary ciphertext;

[0064] (2) Parse binary ciphertext: Decompose the structure of binary ciphertext into the fields of base, exponent, encryption salt, initialization vector, and CBC mode ciphertext;

[0065] (3) Generate encryption key: Use the SHA-1PRF algorithm to iterate the ciphertext in string format a predetermined number of times to obtain the encryption key, which is 32 bytes in length;

[0066] (4) Obtain plaintext: Use the encryption key and initialization vector to decrypt using the AES-256 algorithm and CBC mode to obtain plaintext.

[0067] This application uses a method of dynamically adjusting the number of encryption iterations to control encryption strength, which has the following advantages:

[0068] (1) The ciphertext structure of this application concatenates the random value required for decryption into the ciphertext. The ciphertext structure is kept secret, which increases the difficulty of decryption. The final ciphertext is converted to hexadecimal, which facilitates the network transmission of the ciphertext. In contrast, the ciphertext format of the AES algorithm used in related technologies is binary, which is inconvenient for direct transmission.

[0069] (2) The security strength of this application can be adjusted by passing the number of iterations in the custom ciphertext structure, so that the security strength can be dynamically adjusted to adapt to various scenario requirements. In contrast, the related technologies use the PBKDF2 algorithm for encryption and decryption, and both parties need to agree on a fixed number of iterations.

[0070] (3) The key in this application is in string format. The original key in string format is used, and a specific 256-bit binary key is dynamically generated during encryption, which makes the management of the original key more convenient. In contrast, the AES algorithm key used in related technologies is 256-bit binary, which makes key management inconvenient.

[0071] Figure 3 This is a schematic diagram of an encryption device structure according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0072] The determination module 30 is used to determine the original key and obtain the encryption key by iterating the original key through a predetermined number of data encryption algorithms;

[0073] The acquisition module 32 is used to acquire the initialization vector in the ciphertext structure and obtain the encrypted original ciphertext based on the encryption key and the initialization vector.

[0074] The splicing module 34 is used to obtain the encryption salt and splice the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times to obtain the target ciphertext.

[0075] In this device, the determining module 30 is used to determine the original key and obtain the encryption key by iterating the original key through a predetermined number of data encryption algorithms; the obtaining module 32 is used to obtain the initialization vector in the ciphertext structure and obtain the encrypted original ciphertext based on the encryption key and the initialization vector; the splicing module 34 is used to obtain the encryption salt and splice the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of times to obtain the target ciphertext. This achieves the purpose of simplifying key management, enhancing the usability of the encryption mechanism, and improving the network transmission efficiency of ciphertext. Thus, it realizes the technical effect of dynamically adjusting the encryption strength, thereby solving the technical problem that it is impossible to apply different encryption strength requirements to different systems due to the difficulty of key management in related technologies and the fixed encryption strength.

[0076] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to execute any encryption method.

[0077] Specifically, the aforementioned storage medium is used to store program instructions for the following functions, thereby implementing the following functions:

[0078] Determine the original key, and iterate the original key through the data encryption algorithm a predetermined number of times to obtain the encryption key; obtain the initialization vector in the ciphertext structure, and obtain the encrypted original ciphertext based on the encryption key and the initialization vector; obtain the encryption salt, and concatenate the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of iterations to obtain the target ciphertext.

[0079] Optionally, in this embodiment, the storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specific examples of the storage medium include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0080] In an exemplary embodiment of this application, a computer program product is also provided, including a computer program that implements any of the above-described encryption methods when executed by a processor.

[0081] Optionally, when executed by a processor, the computer program may perform the following steps:

[0082] Determine the original key, and iterate the original key through the data encryption algorithm a predetermined number of times to obtain the encryption key; obtain the initialization vector in the ciphertext structure, and obtain the encrypted original ciphertext based on the encryption key and the initialization vector; obtain the encryption salt, and concatenate the encrypted original ciphertext, the initialization vector, the encryption salt, and the predetermined number of iterations to obtain the target ciphertext.

[0083] An electronic device is provided according to an embodiment of this application, the electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the above-described encryption methods.

[0084] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0085] Figure 4 This is a schematic block diagram of an example electronic device 400 according to an embodiment of this application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.

[0086] like Figure 4 As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 402 or a computer program loaded from storage unit 408 into random access memory (RAM) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0087] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0088] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as encryption methods. For example, in some embodiments, the encryption method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of the encryption method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform encryption methods by any other suitable means (e.g., by means of firmware).

[0089] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0090] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0092] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0093] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0094] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0095] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0096] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0101] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An encryption method, characterized in that, include: A raw key is determined, and the raw key is iterated through a data encryption algorithm a predetermined number of times to obtain an encryption key. The predetermined number of times is positively correlated with the security level of the plaintext, and the predetermined number of times is determined by: determining the base and exponent in the ciphertext structure; and obtaining the predetermined number of times based on the base and exponent. Obtain the initialization vector from the ciphertext structure, and obtain the encrypted original ciphertext based on the encryption key and the initialization vector; Obtain the encryption salt, and concatenate the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times to obtain the target ciphertext.

2. The method according to claim 1, characterized in that, Obtaining the encrypted original ciphertext based on the encryption key and the initialization vector includes: encrypting the plaintext using a cipher block chaining cipher mode based on the encryption key and the initialization vector to obtain the encrypted original ciphertext.

3. The method according to claim 1, characterized in that, Determining the base and the exponent includes: Determine the security level of encrypted data; The base and the exponent are determined based on the security level, wherein the higher the security level, the larger the base and the exponent.

4. The method according to claim 3, characterized in that, Determining the base and the index based on the security level includes: Determine whether the encrypted data contains personal information and an order number; If the encrypted data contains the personal information and the order number, it is determined that the security level of the encrypted data is greater than a preset level. When the security level is greater than the preset level, obtain the target range corresponding to the base and the index; Select the values ​​corresponding to the base and the exponent from the target range.

5. The method according to claim 1, characterized in that, The target ciphertext is obtained by concatenating the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times, including: Determine the blocks of the plaintext, and obtain the base and the exponent; The target ciphertext is obtained by sequentially concatenating the block, the base, the exponent, the encryption salt, the initialization vector, and the encrypted original ciphertext.

6. The method according to claim 1, characterized in that, After concatenating the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times to obtain the target ciphertext, the method further includes: after obtaining the target ciphertext, converting the binary ciphertext corresponding to the target ciphertext into hexadecimal ciphertext.

7. The method according to claim 6, characterized in that, The method further includes: Obtain the hexadecimal ciphertext and convert it into the binary ciphertext; The encrypted original ciphertext is extracted from the binary ciphertext, and the original key is iterated through a data encryption algorithm a predetermined number of times to obtain the encryption key. The encrypted original ciphertext is decrypted using the encryption key to obtain the plaintext.

8. The method according to claim 1, characterized in that, The encryption salt is determined as follows: a specific string is inserted at any fixed position in the original ciphertext, and a first predetermined number of bytes are randomly generated after encryption as the encryption salt; The initialization vector is determined as follows: when encrypting in ciphertext block chaining mode, a second predetermined number of bytes are randomly generated after encryption as the initialization vector, wherein the first predetermined number is less than the second predetermined number.

9. An encryption device, characterized in that, include: A determination module is used to determine the original key, and to obtain an encryption key by iterating the original key through a data encryption algorithm a predetermined number of times. The predetermined number of times is positively correlated with the security level of the plaintext, and the predetermined number of times is determined by: determining the base and exponent in the ciphertext structure; and obtaining the predetermined number of times based on the base and exponent. The acquisition module is used to acquire the initialization vector in the ciphertext structure and obtain the encrypted original ciphertext based on the encryption key and the initialization vector. The concatenation module is used to obtain the encryption salt and concatenate the encrypted original ciphertext, the initialization vector, the encryption salt, and a predetermined number of times to obtain the target ciphertext.

10. A non-volatile storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the storage medium to perform the encryption method according to any one of claims 1 to 8.

11. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the encryption method as described in any one of claims 1 to 8.

Images