Verification method and device of encrypted data, electronic equipment and storage medium

Abstract

The application discloses a kind of verification method and its device of encrypted data, electronic equipment and storage medium, it is related to information security field, wherein, the verification method includes: receiving the first encrypted data, first encryption key, first interference parameter, second encrypted data, second encryption key, second interference parameter sent by payment component client, using private key, first encryption key and second encryption key are decrypted, respectively obtain first key and second key, using second key and second interference parameter, second encrypted data is decrypted, obtain second data, based on first key, first interference parameter and first encrypted data, second data is verified, obtain verification result.The application solves the technical problem that encrypted data cannot be integrity verified in the related art, resulting in low security.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular, to a verification method and device for encrypted data, an electronic device and a storage medium. BACKGROUND

[0002] Currently, the encryption algorithms in the network request of the barcode payment system of the financial institutions mainly include national encryption algorithms and non-national encryption algorithms. The national encryption algorithms are pre-identified domestic encryption algorithms, mainly including SM1, SM2, SM3, SM4 and the like. The non-national encryption algorithms include symmetric encryption algorithms (such as AES, DES, 3DES and the like) and asymmetric encryption algorithms (such as RSA, DSA and the like).

[0003] However, the encryption speed of the non-national encryption algorithms is slow in the barcode payment system, resulting in low work efficiency. Although the national encryption algorithms have high security coefficients, the national encryption algorithms cannot verify the integrity of the encrypted data in the barcode payment system, resulting in low security.

[0004] At present, no effective solution has been proposed for the above problems. SUMMARY

[0005] The embodiments of the present application provide a verification method and device for encrypted data, an electronic device and a storage medium, to at least solve the technical problem that the encrypted data cannot be verified for integrity in the related art, resulting in low security.

[0006] According to an aspect of the embodiments of the present application, a verification method for encrypted data is provided, applied to a payment component server, the payment component server pre-storing a private key of a preset encryption algorithm, including: receiving first encrypted data, a first encryption key, a first interference parameter, second encrypted data, a second encryption key and a second interference parameter sent by a payment component client; using the private key to decrypt the first encryption key and the second encryption key to obtain a first key and a second key, respectively; using the second key and the second interference parameter to decrypt the second encrypted data to obtain second data; verifying the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result.

[0007] Optionally, before receiving the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, the method further comprises: the payment component client generates the first key and the first interference parameter used by the first encryption strategy, wherein the payment component client pre-stores a public key of the preset encryption algorithm; the payment component client encrypts the received business data by using the first key and the first interference parameter to obtain the first encrypted data, wherein the business data is data sent by a payment system server; and the payment component client encrypts the first key by using the public key to obtain the first encrypted key.

[0008] Optionally, before receiving the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, the method further comprises: the payment component client generates the second key and the second interference parameter used by the second encryption strategy; the payment component client encrypts the received business data by using the second key and the second interference parameter to obtain the second encrypted data; and the payment component client encrypts the second key by using the pre-stored public key to obtain the second encrypted key.

[0009] Optionally, the step of decrypting the first encrypted key and the second encrypted key by using the private key to obtain the first key and the second key respectively comprises: determining a private key type of the private key, and loading a preset encryption machine corresponding to the private key type; and decrypting the first encrypted key and the second encrypted key by using the preset encryption machine to obtain the first key and the second key respectively.

[0010] Optionally, the step of verifying the second data based on the first key, the first interference parameter and the first encrypted data comprises: encrypting the second data by using the first key and the first interference parameter based on the first encryption strategy to obtain third encrypted data; comparing the first encrypted data and the third encrypted data to obtain a comparison result; and determining that the verification of the second data is passed in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data.

[0011] Optionally, after verifying the second data, obtaining a verification result, further comprising: in a case where the verification result indicates that the verification is passed, processing the second data to obtain processed data; generating a third interference parameter used by the first encryption strategy and a fourth interference parameter used by the second encryption strategy; encrypting the processed data by using the third interference parameter and the first key to obtain first encrypted processed data; encrypting the processed data by using the fourth interference parameter and the second key to obtain second encrypted processed data; and sending the third interference parameter, the fourth interference parameter, the first encrypted processed data and the second encrypted processed data to the payment component client.

[0012] Optionally, after sending the third interference parameter, the fourth interference parameter, the first encrypted processed data and the second encrypted processed data to the payment component client, further comprising: the payment component client decrypting the second encrypted processed data by using the second key and the fourth interference parameter to obtain return data; and the payment component client verifying the return data based on the first key, the third interference parameter and the first encrypted processed data, and returning the return data to the payment system client for display in a case where the verification is passed.

[0013] According to another aspect of the embodiments of the present application, a verification method of encrypted data is also provided, applied to a payment component client, the payment component client pre-storing a public key of a preset encryption algorithm, comprising: generating a first key and a first interference parameter used by a first encryption strategy, and generating a second key and a second interference parameter used by a second encryption strategy; encrypting business data sent by a payment system server by using the first key and the first interference parameter to obtain first encrypted data, and encrypting the business data by using the second key and the second interference parameter to obtain second encrypted data; encrypting the first key and the second key by using the public key to obtain the first encrypted key and the second encrypted key respectively; sending the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter to the payment component client, wherein the payment component client decrypts the first encrypted key and the second encrypted key by using a pre-stored private key of the preset encryption algorithm to obtain the first key and the second key respectively; decrypting the second encrypted data by using the second key and the second interference parameter to obtain second data; verifying the second data based on the first key, the first interference parameter and the first encrypted data, and in the case of verification passing, processing the second data to obtain processed data, and returning the encrypted processed data to the payment component client; decrypting the encrypted processed data to obtain returned data, and in the case of verification passing of the returned data, returning the returned data to the payment system client for display.

[0014] According to another aspect of the embodiments of the present application, a verification device of encrypted data is also provided, applied to a payment component server, the payment component server pre-storing a private key of a preset encryption algorithm, comprising: a receiving unit, configured to receive first encrypted data, a first encrypted key, a first interference parameter, second encrypted data, a second encrypted key and a second interference parameter sent by a payment component client; a first decryption unit, configured to decrypt the first encrypted key and the second encrypted key by using the private key to obtain a first key and a second key respectively; a second decryption unit, configured to decrypt the second encrypted data by using the second key and the second interference parameter to obtain second data; and a verification unit, configured to verify the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result.

[0015] Optionally, the verification device further comprises: a first generation module, configured to, before receiving the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, generate the first key and the first interference parameter used by the first encryption strategy by the payment component client, wherein the payment component client pre-stores a public key of the preset encryption algorithm; a first encryption module, configured to encrypt the received service data by the payment component client using the first key and the first interference parameter to obtain the first encrypted data, wherein the service data is data sent by a payment system server; and a second encryption module, configured to encrypt the first key by the payment component client using the public key to obtain the first encrypted key.

[0016] Optionally, the verification device further comprises: a second generation module, configured to, before receiving the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, generate the second key and the second interference parameter used by the second encryption strategy by the payment component client; a third encryption module, configured to encrypt the received service data by the payment component client using the second key and the second interference parameter to obtain the second encrypted data; and a fourth encryption module, configured to encrypt the second key by the payment component client using the pre-stored public key to obtain the second encrypted key.

[0017] Optionally, the first decryption unit comprises: a first determination module, configured to determine a private key type of the private key and load a preset encryption machine corresponding to the private key type; and a first decryption module, configured to decrypt the first encrypted key and the second encrypted key using the preset encryption machine to obtain the first key and the second key, respectively.

[0018] Optionally, the verification unit comprises: a fifth encryption module, configured to encrypt the second data using the first key and the first interference parameter based on the first encryption strategy to obtain third encrypted data; a first comparison module, configured to compare the first encrypted data and the third encrypted data to obtain a comparison result; and a second determination module, configured to determine that the verification of the second data is passed in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data.

[0019] Optionally, the verification device further comprises: a first processing module, configured to, after verifying the second data and obtaining a verification result, process the second data to obtain processed data if the verification result indicates that the verification is passed; a third generation module, configured to generate a third interference parameter used by a first encryption strategy and a fourth interference parameter used by a second encryption strategy; a sixth encryption module, configured to encrypt the processed data by using the third interference parameter and the first key to obtain first encrypted processed data; a seventh encryption module, configured to encrypt the processed data by using the fourth interference parameter and the second key to obtain second encrypted processed data; and a first sending module, configured to send the third interference parameter, the fourth interference parameter, the first encrypted processed data and the second encrypted processed data to the payment component client.

[0020] Optionally, the verification device further comprises: a second decryption module, configured to, after sending the third interference parameter, the fourth interference parameter, the first encrypted processed data and the second encrypted processed data to the payment component client, decrypt the second encrypted processed data by using the second key and the fourth interference parameter to obtain returned data; and a first verification module, configured to verify the returned data by the payment component client based on the first key, the third interference parameter and the first encrypted processed data, and return the returned data to the payment system client for display if the verification is passed.

[0021] According to another aspect of the embodiments of the present application, there is also provided a verification device for encrypted data, applied to a payment component client, the payment component client pre-storing a public key of a preset encryption algorithm, comprising: a generating unit configured to generate a first key and a first interference parameter used by a first encryption strategy, and generate a second key and a second interference parameter used by a second encryption strategy; a first encryption unit configured to encrypt service data sent by a payment system server by using the first key and the first interference parameter to obtain first encrypted data, and encrypt the service data by using the second key and the second interference parameter to obtain second encrypted data; a second encryption unit configured to encrypt the first key and the second key by using the public key to obtain the first encrypted key and the second encrypted key respectively; and a sending unit configured to send the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter to the payment component client, wherein the payment component client decrypts the first encrypted key and the second encrypted key by using a pre-stored private key of the preset encryption algorithm to obtain the first key and the second key respectively, decrypts the second encrypted data by using the second key and the second interference parameter to obtain second data, verifies the second data based on the first key, the first interference parameter and the first encrypted data, processes the second data to obtain processed data in a case where the verification is passed, and returns the encrypted processed data to the payment component client; and a third decryption unit configured to decrypt the encrypted processed data to obtain returned data, and return the returned data to the payment component client for display in a case where the returned data is verified.

[0022] According to another aspect of the embodiments of the present application, there is also provided a computer readable storage medium, comprising a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to perform the above-mentioned verification method for encrypted data when the computer program is running.

[0023] According to another aspect of the embodiments of the present application, there is also provided an electronic device, comprising one or more processors and a memory, the memory being configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the above-mentioned verification method for encrypted data.

[0024] In the present disclosure, the payment component server receives the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, decrypts the first encrypted key and the second encrypted key by using the private key to obtain the first key and the second key respectively, decrypts the second encrypted data by using the second key and the second interference parameter to obtain the second data, and verifies the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result. In the present disclosure, the payment component server can first receive the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client, then decrypt the first encrypted key and the second encrypted key by using the pre-stored private key to obtain the first key and the second key, and then decrypt the second encrypted data by using the second key and the second interference parameter to obtain the second data, and then verify the second data according to the first key, the first interference parameter and the first encrypted data, which can realize the integrity verification of the encrypted data, improve the security of the data, and further solve the technical problem of low security caused by the inability to perform integrity verification on the encrypted data in the related art. BRIEF DESCRIPTION OF DRAWINGS

[0025] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0026] Figure 1 is a flowchart of an optional encryption data verification method according to an embodiment of the present application;

[0027] Figure 2 is a flowchart of another optional encryption data verification method according to an embodiment of the present application;

[0028] Figure 3 is a schematic diagram of a data confidentiality and integrity verification process in an optional bar code payment system according to an embodiment of the present application;

[0029] Figure 4 is a schematic diagram of an optional encryption data verification device according to an embodiment of the present application;

[0030] Figure 5 is a schematic diagram of another optional encryption data verification device according to an embodiment of the present application;

[0031] Figure 6 is a hardware structure block diagram of an electronic device (or mobile device) for an encryption data verification method according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0033] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0034] In order to facilitate the understanding of the present application by those skilled in the art, the following explains some terms or names involved in the embodiments of the present application:

[0035] Barcode payment: a fast and secure on-site payment solution for offline physical merchants. No need to install POS machine (i.e. sales terminal), directly through existing cash register system or mobile terminal, scan the bar code or two-dimensional code on the user terminal to initiate cash register to the user.

[0036] MAC (Message Authentication Codes) algorithm: a Hash (hash) function with secret key, the hash value of the message is controlled by the secret key known only to the communication parties.

[0037] SM1 algorithm: a symmetric encryption algorithm.

[0038] SM2 algorithm: a non-symmetric encryption algorithm.

[0039] SM3 algorithm: message digest, mainly used for digital signature and verification, message authentication code generation and verification, random number generation, etc.

[0040] SM4 algorithm: a wireless local area network standard packet data algorithm.

[0041] Symmetric encryption algorithm: refers to the same key for encryption and decryption, which is reversible (i.e. decryptable).

[0042] AES (Advanced Encryption Standard) algorithm: is a high-level encryption standard in cryptography, which adopts a symmetric block cipher system, and the minimum support for key length is 128.

[0043] DES (Data Encryption Standard) algorithm: is a symmetric cipher system in cryptography.

[0044] 3DES (Triple Data Encryption Algorithm) algorithm: is a mode of DES algorithm.

[0045] Asymmetric encryption algorithm: refers to the use of different keys (public key and private key) for encryption and decryption, so asymmetric encryption is also called public key encryption, and it is reversible (i.e. decryptable).

[0046] RSA algorithm: is an encryption algorithm based on number theory facts. The number theory fact is that it is very easy to multiply two large prime numbers, but it is extremely difficult to factorize the product, so the product can be publicly disclosed as an encryption key.

[0047] DSA (Digital Signature Algorithm) algorithm: is a variant of signature algorithm.

[0048] It should be noted that the encryption data verification method and device in the present disclosure can be used in the information security field when verifying encrypted data, and can also be used in any field other than the information security field when verifying encrypted data. The application field of the encryption data verification method and device in the present disclosure is not limited.

[0049] It should be noted that the related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant national and regional laws, regulations and standards, and provide corresponding operation interface for user to choose authorization or refusal. For example, the system and related users or institutions are provided with an interface, before obtaining the related information, the interface needs to send a request for obtaining to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the related information is obtained.

[0050] The following embodiments of the present application can be applied to various systems / applications / devices for verifying encrypted data. The present application can be applied to the scenario of network data confidentiality and integrity verification in barcode payment, can encrypt and decrypt network request data in the barcode payment system of a financial institution, and further optimizes data confidentiality and integrity on the basis of a national secret algorithm, thereby effectively improving the security of data.

[0051] The present application will be described in detail below in conjunction with various embodiments.

[0052] Embodiment One

[0053] According to the embodiments of the present application, an embodiment of a method for verifying encrypted data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0054] Figure 1 is a flowchart of an optional method for verifying encrypted data according to the embodiments of the present application, as shown in Figure 1 The method comprises the following steps:

[0055] Step S101, receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter sent by the payment component client.

[0056] Step S102, decrypting the first encryption key and the second encryption key using a private key to obtain the first key and the second key, respectively.

[0057] Step S103, decrypting the second encrypted data using the second key and the second interference parameter to obtain the second data.

[0058] Step S104, verifying the second data based on the first key, the first interference parameter, and the first encrypted data to obtain a verification result.

[0059] By the above steps, the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client can be received, the first encryption key and the second encryption key are decrypted by using the private key to obtain the first key and the second key respectively, the second encrypted data is decrypted by using the second key and the second interference parameter to obtain the second data, and the second data is verified based on the first key, the first interference parameter and the first encrypted data to obtain a verification result. In the embodiment of the application, the payment component server can first receive the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client, then decrypt the first encryption key and the second encryption key by using the pre-stored private key to obtain the first key and the second key, and then decrypt the second encrypted data by using the second key and the second interference parameter to obtain the second data, and then verify the second data according to the first key, the first interference parameter and the first encrypted data, so that the integrity of the encrypted data can be verified, the security of the data is improved, and the technical problem that the encrypted data cannot be verified for integrity in the related art and the resulting low security are solved.

[0060] The embodiment of the application will be described in detail below in combination with the above steps. The following steps can be applied to the payment component server, which pre-stores the private key of a preset encryption algorithm (for example, SM2 algorithm).

[0061] In the embodiment of the application, the public key of the preset encryption algorithm can be pre-embedded in the payment component client and the payment system client, and the private key of the preset encryption algorithm can be pre-stored in the payment component server and the payment system server, and the private key ciphertext can be stored in the HSM (Hierarchical Storage Management, i.e., hierarchical storage management) mode.

[0062] Optionally, before receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client, the following steps are further included: the payment component client generates the first key and the first interference parameter used by the first encryption strategy, wherein the payment component client pre-stores the public key of the preset encryption algorithm; the payment component client encrypts the received business data by using the first key and the first interference parameter to obtain the first encrypted data, wherein the business data is the data sent by the payment system server; and the payment component client encrypts the first key by using the public key to obtain the first encryption key.

[0063] In another alternative embodiment, before receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client, the method further comprises: the payment component client generating a second key and a second interference parameter used by a second encryption strategy; the payment component client encrypting the received business data using the second key and the second interference parameter to obtain the second encrypted data; and the payment component client encrypting the second key using the pre-stored public key to obtain the second encryption key.

[0064] In the embodiment of the present application, the data confidentiality and integrity of the payment component client can be protected first, specifically: the payment component client can generate a first encryption strategy (such as a MAC algorithm) required to use a first key makKey (such as an SM4 algorithm working key) by using a random number, and generate an interference factor iv1 (that is, a first interference parameter) required to use the first encryption strategy (that is, the payment component client generates a first key and a first interference parameter used by the first encryption strategy, and the payment component client pre-stores a public key of a preset encryption algorithm). Then the payment component client can use the generated makKey and iv1 to perform a first encryption strategy on the business plaintext data tranData (that is, business data, which is the number sent by the payment system server) to generate the result data ebdp_hsmMAC (that is, first encrypted data) (that is, the payment component client encrypts the received business data by using a first key and a first interference parameter to obtain first encrypted data). The payment component client can use the public key to encrypt the makKey to obtain the ciphertext ebdp_encryptMAK (that is, a first encryption key) (that is, the payment component client encrypts the first key by using the public key to obtain the first encryption key). The payment component client can generate a second encryption strategy (such as an SM4 algorithm) required to use a second key dekKey (such as an SM4 working key) and an interference factor iv2 (that is, a second interference parameter) by using a random number, and use the dekKey and iv2 to perform a second encryption strategy (SM4 algorithm) on the business plaintext data tranData to obtain the business data ciphertext ebdp_K1encryptData (that is, second encrypted data) (that is, the payment component client encrypts the received business data by using a second key and a second interference parameter to obtain second encrypted data). The payment component client uses the public key to encrypt the dekKey to obtain the ciphertext ebdp_encryptDEK (that is, a second encryption key) (that is, the payment component client encrypts the second key by using the pre-stored public key to obtain the second encryption key). Then, ebdp_K1encryptData, ebdp_encryptDEK, ebdp_encryptMAK, iv1, iv2, and ebdp_hsmMAC are transmitted to the payment component server through an https protocol (that is, a hypertext transfer protocol secure).

[0065] In the embodiment of the present application, if the first encryption strategy uses the MAC algorithm, the data to be sent to the payment component server can be composed of a MACELEMEMENT BLOCK (that is, MAB, which is an encrypted hash value) from the message type to the 63 domain, and the MAB can be exclusive-ORed (regardless of the character format in the data) every 8 bytes, and if the last one is not full 8 bytes, “0X00” is added to complete the data encryption.

[0066] Step S101, receiving the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter sent by the payment component client.

[0067] In the embodiment of the application, the payment component server can receive the first encrypted data ebdp_hsmMAC, the first encrypted key ebdp_encryptMAK, the first interference parameter iv1, the second encrypted data ebdp_K1encryptData, the second encrypted key ebdp_encryptDEK and the second interference parameter iv2 sent by the payment component client, and then perform integrity verification according to the data.

[0068] Step S102, decrypting the first encrypted key and the second encrypted key by using the private key to obtain the first key and the second key respectively.

[0069] Optionally, the step of decrypting the first encrypted key and the second encrypted key by using the private key to obtain the first key and the second key respectively includes: determining the private key type of the private key, and loading a preset encryption machine corresponding to the private key type; and decrypting the first encrypted key and the second encrypted key by using the preset encryption machine to obtain the first key and the second key respectively.

[0070] In the embodiment of the application, the payment component server can decrypt the first encrypted key and the second encrypted key by using the stored private key to obtain the first key and the second key (i.e. using the private key to decrypt ebdp_encryptDEK to obtain dekKey, and using the private key to decrypt encryptMAK to obtain makKey), and temporarily store the first key and the second key in the memory for subsequent use. Specifically, the key type can be selected first (i.e. determining the private key type of the private key), then a preset encryption machine corresponding to the private key type is loaded, the encrypted key (i.e. the first encrypted key and the second encrypted key) is imported into the preset encryption machine for decryption to obtain the first key and the second key (i.e. decrypting the first encrypted key and the second encrypted key by using the preset encryption machine to obtain the first key and the second key respectively).

[0071] Step S103, decrypting the second encrypted data by using the second key and the second interference parameter to obtain the second data.

[0072] In the embodiment of the application, the payment component server can decrypt the second encrypted data by using the second key and the second interference parameter to obtain the second data (i.e. using dekKey and iv2 to decrypt the business data ciphertext ebdp_K1encryptData by using the second encryption strategy to obtain the business plaintext data tranData).

[0073] Step S104, verifying the second data based on the first key, the first interference parameter and the first encrypted data, and obtaining a verification result.

[0074] Optionally, the step of verifying the second data based on the first key, the first interference parameter and the first encrypted data comprises: encrypting the second data based on the first encryption strategy, using the first key and the first interference parameter to obtain third encrypted data; comparing the first encrypted data and the third encrypted data to obtain a comparison result; and determining that the verification of the second data is passed in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data.

[0075] In the embodiment of the application, the payment component server can verify the confidentiality and integrity of the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result (i.e. using makKey, iv1 and ebdp_hsmMAC information to verify the integrity of tranData), and specifically: the first encrypted data can be verified in a manner of being regenerated, a MAC is regenerated by calling the first encryption strategy, and whether the regenerated MAC is consistent with the first encrypted data is compared; if the regenerated MAC is consistent with the first encrypted data, the verification is passed; if not, the verification is not passed (i.e. according to the first encryption strategy, the second data is encrypted using the first key and the first interference parameter to obtain third encrypted data, then the first encrypted data and the third encrypted data are compared to obtain a comparison result, and if the comparison result indicates that the first encrypted data is consistent with the third encrypted data, it is determined that the verification of the second data is passed).

[0076] Optionally, after the second data is verified to obtain a verification result, the method further comprises: processing the second data to obtain processed data in a case where the verification result indicates that the verification is passed; generating a third interference parameter used by the first encryption strategy and a fourth interference parameter used by a second encryption strategy; encrypting the processed data using the third interference parameter and the first key to obtain first encrypted processed data; encrypting the processed data using the fourth interference parameter and a second key to obtain second encrypted processed data; and sending the third interference parameter, the fourth interference parameter, the first encrypted processed data and the second encrypted processed data to the payment component client.

[0077] In the embodiment of the present application, if the verification result indicates that the verification is passed, the payment component server can process the second data to obtain processing data. Then the payment component server can generate an interference factor iv3 (i.e., the third interference parameter) used in the first encryption strategy using the random number, and generate an interference factor iv4 (i.e., the fourth interference parameter) used in the second encryption strategy using the random number. Then the makKey (i.e., the first key) stored in the memory of the payment component server and the iv3 (i.e., the third interference parameter) are used to perform the first encryption strategy processing on the data plaintext responseData (i.e., the processing data) to be returned to generate ebdp_responseHsmMAC (i.e., the first encrypted processing data). The dekKey (i.e., the second key) stored in the memory of the payment component server and the iv4 (i.e., the fourth interference parameter) are used to perform the second encryption strategy processing on the data plaintext responseData to be returned to obtain the business data ciphertext ebdp_encryptResponseData (i.e., the second encrypted processing data). Then the ebdp_responseHsmMAC, the ebdp_encryptResponseData, the iv3, and the iv4 are synchronously returned to the payment component client (i.e., the third interference parameter, the fourth interference parameter, the first encrypted processing data, and the second encrypted processing data are sent to the payment component client).

[0078] Optionally, after the third interference parameter, the fourth interference parameter, the first encrypted processing data, and the second encrypted processing data are sent to the payment component client, the method further includes: the payment component client decrypts the second encrypted processing data using the second key and the fourth interference parameter to obtain the return data; and the payment component client verifies the return data based on the first key, the third interference parameter, and the first encrypted processing data, and returns the return data to the payment system client for display in a case where the verification is passed.

[0079] In the embodiment of the present application, the payment component client can use the dekKey and the iv4 to decrypt the business data ciphertext ebdp_encryptResponseData to obtain the responseData (i.e., the return data) (i.e., the payment component client decrypts the second encrypted processing data using the second key and the fourth interference parameter to obtain the return data). Then the payment component client can use the makKey, the iv3, and the ebdp_responseHsmMAC information to verify the integrity of the responseData (i.e., the payment component client verifies the return data based on the first key, the third interference parameter, and the first encrypted processing data). If the verification is passed, the return data can be returned to the payment system client for display.

[0080] In the embodiment, the network request data in the bar code payment system of the financial institution can be encrypted and decrypted, and the data confidentiality and integrity are further optimized on the basis of the national secret algorithm, thereby effectively improving the security of the data.

[0081] Embodiment two

[0082] According to the embodiment of the application, an embodiment of a verification method of encrypted data is also provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0083] Figure 2 is a flowchart of another optional verification method of encrypted data according to the embodiment of the application, as shown in Figure 2 the method comprises the following steps:

[0084] In step S201, a first key and a first interference parameter used by a first encryption strategy are generated, and a second key and a second interference parameter used by a second encryption strategy are generated.

[0085] In step S202, the business data sent by the payment system server is encrypted by using the first key and the first interference parameter to obtain first encrypted data, and the business data is encrypted by using the second key and the second interference parameter to obtain second encrypted data.

[0086] In step S203, the first key and the second key are encrypted by using a public key to obtain a first encrypted key and a second encrypted key, respectively.

[0087] In step S204, the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key, and the second interference parameter are sent to the payment component client, wherein the payment component client decrypts the first encrypted key and the second encrypted key by using a private key of a preset encryption algorithm stored in advance to obtain the first key and the second key, respectively; decrypts the second encrypted data by using the second key and the second interference parameter to obtain second data; verifies the second data based on the first key, the first interference parameter, and the first encrypted data, and in the case of verification passing, processes the second data to obtain processed data, and returns the encrypted processed data to the payment component client.

[0088] In step S205, the encrypted processed data is decrypted to obtain return data, and in the case of verification passing of the return data, the return data is returned to the payment system client for display.

[0089] By the above steps, the first key and the first interference parameter used by the first encryption strategy can be generated, and the second key and the second interference parameter used by the second encryption strategy can be generated, the business data sent by the payment system server is encrypted by using the first key and the first interference parameter to obtain first encrypted data, and the business data is encrypted by using the second key and the second interference parameter to obtain second encrypted data, the first key and the second key are encrypted by using the public key to obtain a first encrypted key and a second encrypted key, the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter are sent to the payment component client, the encrypted processing data is decrypted to obtain return data, and in the case that the return data is verified, the return data is returned to the payment system client for display. In the embodiment of the application, the payment component client can first generate the first key, the first interference parameter used by the first encryption strategy and the second key, the second interference parameter used by the second encryption strategy, then encrypt the business data sent by the payment system server by using the first key and the first interference parameter to obtain first encrypted data, then encrypt the business data by using the second key and the second interference parameter to obtain second encrypted data, then encrypt the first key and the second key by using the pre-stored public key to obtain a first encrypted key and a second encrypted key, and send the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key and the second interference parameter to the payment component client, so that the payment component server verifies the integrity of the encrypted data, processes the decrypted data after verification, and returns the encrypted processing data. The payment component client can decrypt the returned data and verify the integrity of the returned data, realize the integrity verification of the encrypted data, improve the security of the data, and further solve the technical problem that the encrypted data cannot be integrity verified in the related art, resulting in low security.

[0090] The embodiment of the application will be described in detail below in combination with the above steps. The following steps can be applied to the payment component client, and the payment component client pre-stores the public key of a preset encryption algorithm (for example, SM2 algorithm).

[0091] Step S201, the first key and the first interference parameter used by the first encryption strategy are generated, and the second key and the second interference parameter used by the second encryption strategy are generated.

[0092] In this embodiment of the invention, the payment component client may use random numbers to generate a first key makKey (e.g., the working key of the SM4 algorithm) required for a first encryption strategy (e.g., the MAC algorithm), an interference factor iv1 (i.e., the first interference parameter) required for the first encryption strategy, and a second key dekKey (e.g., the SM4 working key) and an interference factor iv2 (i.e., the second interference parameter) used for encryption by a second encryption strategy (e.g., the SM4 algorithm)

[0093] Step S202: The business data sent by the payment system server is encrypted using the first key and the first interference parameter to obtain the first encrypted data, and the business data is encrypted using the second key and the second interference parameter to obtain the second encrypted data.

[0094] In this embodiment of the invention, the payment component client can use the generated `makKey` and `iv1` to perform a first encryption strategy on the plaintext business data `tranData` (i.e., the business data, which is the data sent by the payment system server) to generate the result data `ebdp_hsmMAC` (i.e., the first encrypted data). Then, using `dekKey` and `iv2`, the plaintext business data `tranData` is encrypted using a second encryption strategy (SM4 algorithm) to obtain the ciphertext business data `ebdp_K1encryptData` (i.e., the second encrypted data).

[0095] Step S203: Encrypt the first key and the second key using the public key to obtain the first encryption key and the second encryption key respectively.

[0096] In this embodiment of the invention, the payment component client can use the public key to encrypt the makeKey to obtain the ciphertext ebdp_encryptMAK (i.e., the first encryption key), and use the public key to encrypt the dekKey to obtain the ciphertext ebdp_encryptDEK (i.e., the second encryption key) (i.e., use the public key to encrypt the first key and the second key to obtain the first encryption key and the second encryption key respectively).

[0097] Step S204: The first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter are sent to the payment component client. The payment component client uses a pre-stored private key of a preset encryption algorithm to decrypt the first encryption key and the second encryption key to obtain the first key and the second key, respectively. The second encrypted data is decrypted using the second key and the second interference parameter to obtain the second data. Based on the first key, the first interference parameter, and the first encrypted data, the second data is verified. If the verification is successful, the second data is processed to obtain processed data, and the encrypted processed data is returned to the payment component client.

[0098] In this embodiment of the invention, the payment component client can transmit ebdp_K1encryptData, ebdp_encryptDEK, ebdp_encryptMAK, iv1, iv2, and ebdp_hsmMAC to the payment component server via HTTPS (i.e., Hypertext Transfer Security Protocol). This involves sending the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter to the payment component client. The payment component server can use its stored private key to decrypt the first and second encryption keys to obtain the first key and the second key (i.e., using the private key to decrypt ebdp_encryptDEK to obtain dekKey, and using the private key to decrypt encryptMAK to obtain makKey), and temporarily store them in memory for later use. Then, the payment component server can use the second key and the second interference parameter to decrypt the second encrypted data to obtain the second data (i.e., using dekKey and iv2 to decrypt the ciphertext ebdp_K1encryptData of the business data using the second encryption strategy to obtain the plaintext data tranData). Based on the first key, the first interference parameter, and the first encrypted data, it verifies the confidentiality and integrity of the second data to obtain a verification result (i.e., using makeKey, iv1, and ebdp_hsmMAC information to verify the integrity of tranData). If the verification result indicates successful verification, the payment component server can process the second data to obtain processed data. Then, the payment component server can use random numbers to generate the interference factor iv3 (i.e., the third interference parameter) used in the first encryption strategy and the interference factor iv4 (i.e., the fourth interference parameter) used in the second encryption strategy. Then, using makeKey (i.e., the first key) and iv3 (i.e., the third interference parameter) stored in the payment component server's memory, it performs the first encryption strategy processing on the plaintext data responseData (i.e., the processed data) to generate ebdp_responseHsmMAC (i.e., the first encrypted processed data). The payment component server uses the dekKey (second key) and iv4 (fourth interference parameter) stored in its memory to perform a second encryption strategy on the plaintext responseData, resulting in the encrypted business data ebdp_encryptResponseData (second encrypted data). Then, ebdp_responseHsmMAC, ebdp_encryptResponseData, iv3, and iv4 are synchronously returned to the payment component client (i.e., the encrypted processed data is returned to the payment component client).

[0099] Step S205: Decrypt the encrypted processed data to obtain the returned data, and if the returned data is verified, return the returned data to the payment system client for display.

[0100] In this embodiment of the invention, the payment component client can use dekKey and iv4 to decrypt the encrypted business data ebdp_encryptResponseData to obtain responseData (i.e., the returned data) (i.e., decrypting the encrypted processed data to obtain the returned data). Then, the payment component client can use makeKey, iv3, and ebdp_responseHsmMAC information to verify the integrity of responseData. If the verification is successful, the returned data can be returned to the payment system client for display (i.e., if the returned data is verified, it is returned to the payment system client for display).

[0101] The following describes in detail another optional implementation method.

[0102] Figure 3 This is a schematic diagram of an optional data confidentiality and integrity verification process in a barcode payment system according to an embodiment of the present invention, such as... Figure 3 As shown, it includes: a client terminal, a payment system client, a payment system server, a payment component, a payment component client, and a payment component server. The interaction flow between each module is as follows:

[0103] (1) The client terminal first starts the payment system, the payment system client loads the parameters, the payment system server reads the parameters, and then after the main interface of the payment system client is loaded, the client terminal scans the code. Then the payment system client initializes the payment component, passes the preset SM2 public key, passes the parameter information to the payment component for component initialization, and after the payment component is initialized, it passes the business data tranData to the payment component client for integrity verification.

[0104] (2) The payment component client randomly generates an SM4 working key `makKey` for MAC and a random interference factor `iv1` for MAC. It then uses `makKey` and `iv1` to perform MAC processing on the plaintext business data `tranData`, generating MAC data `ebdp_hsmMAC`. This MAC data is then encrypted using the SM2 public key against `makKey` to obtain the ciphertext `ebdp_encryptMAK`. Next, it randomly generates an SM4 working key `dekKey` for encryption and a random interference factor `iv2` for SM4 encryption. `dekKey` is used to perform SM4 encryption on `tranData` to obtain the ciphertext business data `ebdp_K1encryptData`. Finally, it uses the SM2 public key to encrypt `dekKey` to obtain the ciphertext `ebdp_encryptDEK`. Afterward, `ebdp_K1encryptData`, `ebdp_encryptDEK`, `ebdp_encryptMAK`, `iv1`, `iv2`, and `ebdp_hsmMAC` are passed to the payment component server.

[0105] (3) The payment component server uses the SM2 private key to decrypt ebdp_encryptDEK to obtain the SM4 working key dekKey, and temporarily stores it in memory. It then uses dekKey and iv2 to decrypt the ciphertext ebdp_K1encryptData of the business data using SM4 to obtain tranData. Finally, it uses the SM2 private key to decrypt ebdp_encryptMAK to obtain the SM4 working key makeKey, and stores it in memory. Then, it uses makeKey, iv1, and ebdp_hsmMAC information to verify the integrity of tranData. Afterwards, business processing is performed. An interference factor iv3 for SM4 encryption is randomly generated. The SM4 working keys makeKey and iv3 stored in memory are used to perform MAC processing on the plaintext responseData of the business data to generate ebdp_responseHsmMAC. An interference factor iv4 for SM4 encryption is randomly generated. The SM4 working keys dekKey and iv4 stored in memory are used to perform SM4 encryption on responseData to obtain the ciphertext ebdp_encryptResponseData of the business data. Then, Ebdp_responseHsmMAC, ebdp_encryptResponseData, iv3, and iv4 are passed to the payment component client.

[0106] (4) The payment component client uses dekKey and iv4 to decrypt the ciphertext ebdp_encryptResponseData of the business data to obtain responseData. Then, it uses makeKey, iv3 and ebdp_responseHsmMAC information to verify the integrity of responseData. After the integrity verification is passed, the responseData information is sent to the payment component for parameter parsing.

[0107] (5) After the payment component is parsed, the parsing result is sent to the payment system client for page display.

[0108] The following is a detailed description with reference to another embodiment.

[0109] Example 3

[0110] The encrypted data verification device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0111] Figure 4 This is a schematic diagram of an optional encrypted data verification device according to an embodiment of the present invention, such as... Figure 4 As shown, the verification device may include: a receiving unit 40, a first decryption unit 41, a second decryption unit 42, and a verification unit 43, wherein...

[0112] The receiving unit 40 is used to receive the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter sent by the payment component client;

[0113] The first decryption unit 41 is used to decrypt the first encryption key and the second encryption key using the private key, and obtain the first key and the second key respectively.

[0114] The second decryption unit 42 is used to decrypt the second encrypted data using the second key and the second interference parameters to obtain the second data.

[0115] The verification unit 43 is used to verify the second data based on the first key, the first interference parameter and the first encrypted data, and obtain the verification result.

[0116] The aforementioned verification device can receive first encrypted data, a first encryption key, a first interference parameter, second encrypted data, a second encryption key, and a second interference parameter sent by the payment component client via the receiving unit 40. The first decryption unit 41 uses a private key to decrypt the first and second encryption keys, obtaining a first key and a second key respectively. The second decryption unit 42 uses the second key and the second interference parameter to decrypt the second encrypted data, obtaining second data. The verification unit 43 verifies the second data based on the first key, the first interference parameter, and the first encrypted data, obtaining a verification result. In this embodiment of the invention, the payment component server can first receive the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter sent by the payment component client. Then, it uses a pre-stored private key to decrypt the first and second encryption keys to obtain the first key and the second key. Next, it uses the second key and the second interference parameter to decrypt the second encrypted data to obtain the second data. Finally, it verifies the second data based on the first key, the first interference parameter, and the first encrypted data. This enables integrity verification of encrypted data, improves data security, and solves the technical problem in related technologies where integrity verification of encrypted data is impossible, leading to low security.

[0117] Optionally, the verification device further includes: a first generation module, used by the payment component client to generate a first key and a first interference parameter for a first encryption strategy before receiving the first encrypted data, a first encryption key, a first interference parameter, a second encrypted data, a second encryption key, and a second interference parameter sent by the payment component client, wherein the payment component client pre-stores a public key for a preset encryption algorithm; a first encryption module, used by the payment component client to encrypt the received business data using the first key and the first interference parameter to obtain the first encrypted data, wherein the business data is data sent by the payment system server; and a second encryption module, used by the payment component client to encrypt the first key using the public key to obtain the first encryption key.

[0118] Optionally, the verification device further includes: a second generation module, used by the payment component client to generate a second key and a second interference parameter for the second encryption strategy before receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter sent by the payment component client; a third encryption module, used by the payment component client to encrypt the received business data using the second key and the second interference parameter to obtain the second encrypted data; and a fourth encryption module, used by the payment component client to encrypt the second key using a pre-stored public key to obtain the second encryption key.

[0119] Optionally, the first decryption unit includes: a first determining module, used to determine the private key type of the private key and load a preset encryption machine corresponding to the private key type; and a first decryption module, used to use the preset encryption machine to decrypt the first encryption key and the second encryption key to obtain the first key and the second key respectively.

[0120] Optionally, the verification unit includes: a fifth encryption module, used to encrypt the second data based on the first encryption strategy, using the first key and the first interference parameter to obtain the third encrypted data; a first comparison module, used to compare the first encrypted data and the third encrypted data to obtain a comparison result; and a second determination module, used to determine that the verification of the second data is successful when the comparison result indicates that the first encrypted data and the third encrypted data are consistent.

[0121] Optionally, the verification device further includes: a first processing module, configured to process the second data and obtain processed data after verifying the second data and obtaining a verification result, provided that the verification result indicates that the verification is successful; a third generation module, configured to generate a third interference parameter used by the first encryption strategy and a fourth interference parameter used by the second encryption strategy; a sixth encryption module, configured to encrypt the processed data using the third interference parameter and a first key to obtain first encrypted processed data; a seventh encryption module, configured to encrypt the processed data using the fourth interference parameter and a second key to obtain second encrypted processed data; and a first sending module, configured to send the third interference parameter, the fourth interference parameter, the first encrypted processed data, and the second encrypted processed data to the payment component client.

[0122] Optionally, the verification device further includes: a second decryption module, used to decrypt the second encrypted data using a second key and the fourth interference parameter after the third interference parameter, the fourth interference parameter, the first encrypted data, and the second encrypted data are sent to the payment component client, and obtain the returned data; and a first verification module, used to verify the returned data based on the first key, the third interference parameter, and the first encrypted data, and, if the verification is successful, return the returned data to the payment system client for display.

[0123] The verification device described above may also include a processor and a memory. The receiving unit 40, the first decryption unit 41, the second decryption unit 42, the verification unit 43, etc., are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0124] The aforementioned processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured, and by adjusting kernel parameters, the second data is verified based on a first key, a first interference parameter, and the first encrypted data to obtain the verification result.

[0125] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0126] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: receiving first encrypted data, a first encryption key, a first interference parameter, second encrypted data, a second encryption key, and a second interference parameter sent by a payment component client; using a private key to decrypt the first encryption key and the second encryption key to obtain the first key and the second key respectively; using the second key and the second interference parameter to decrypt the second encrypted data to obtain the second data; and verifying the second data based on the first key, the first interference parameter, and the first encrypted data to obtain a verification result.

[0127] Example 4

[0128] The other encrypted data verification device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 2 above.

[0129] Figure 5 This is a schematic diagram of another optional encryption data verification device according to an embodiment of the present invention, such as... Figure 5 As shown, the verification device may include: a generation unit 50, a first encryption unit 51, a second encryption unit 52, a sending unit 53, and a third decryption unit 54, wherein...

[0130] The generation unit 50 is used to generate a first key and a first interference parameter used by the first encryption strategy, and to generate a second key and a second interference parameter used by the second encryption strategy.

[0131] The first encryption unit 51 is used to encrypt the business data sent by the payment system server using a first key and a first interference parameter to obtain first encrypted data, and to encrypt the business data using a second key and a second interference parameter to obtain second encrypted data.

[0132] The second encryption unit 52 is used to encrypt the first key and the second key using a public key to obtain the first encryption key and the second encryption key respectively.

[0133] The sending unit 53 is used to send the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter to the payment component client. The payment component client uses a pre-stored private key of a preset encryption algorithm to decrypt the first encryption key and the second encryption key to obtain the first key and the second key, respectively; uses the second key and the second interference parameter to decrypt the second encrypted data to obtain the second data; verifies the second data based on the first key, the first interference parameter, and the first encrypted data; if the verification is successful, processes the second data to obtain processed data, and returns the encrypted processed data to the payment component client.

[0134] The third decryption unit 54 is used to decrypt the encrypted processed data to obtain the returned data, and if the returned data is verified, the returned data is returned to the payment system client for display.

[0135] The aforementioned verification device can generate a first key and a first interference parameter for the first encryption strategy using the generation unit 50, and generate a second key and a second interference parameter for the second encryption strategy. The first encryption unit 51 encrypts the business data sent by the payment system server using the first key and the first interference parameter to obtain first encrypted data, and then encrypts the business data using the second key and the second interference parameter to obtain second encrypted data. The second encryption unit 52 encrypts the first key and the second key using a public key to obtain the first encryption key and the second encryption key, respectively. The sending unit 53 sends the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter to the payment component client. The third decryption unit 54 decrypts the encrypted processed data to obtain return data. If the return data is verified to be valid, the return data is returned to the payment system client for display. In this embodiment of the invention, the payment component client can first generate a first key and a first interference parameter used by a first encryption strategy, and a second key and a second interference parameter used by a second encryption strategy. Then, it uses the first key and the first interference parameter to encrypt the business data sent by the payment system server to obtain first encrypted data. Next, it uses the second key and the second interference parameter to encrypt the business data to obtain second encrypted data. Afterward, it uses a pre-stored public key to encrypt the first key and the second key to obtain a first encryption key and a second encryption key. The first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter are sent to the payment component client so that the payment component server can verify the integrity of the encrypted data. After successful verification, the server processes the decrypted data and returns the encrypted processed data. The payment component client can decrypt the returned data and verify its integrity, thus achieving integrity verification of the encrypted data, improving data security, and solving the technical problem in related technologies where the integrity of encrypted data cannot be verified, resulting in low security.

[0136] The verification device described above may also include a processor and a memory. The generation unit 50, the first encryption unit 51, the second encryption unit 52, the sending unit 53, the third decryption unit 54, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0137] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; by adjusting kernel parameters, the encrypted processed data is decrypted to obtain the returned data. Upon successful verification of the returned data, it is sent back to the payment system client for display.

[0138] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0139] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: generating a first key and a first interference parameter used by a first encryption strategy, and generating a second key and a second interference parameter used by a second encryption strategy; encrypting business data sent by the payment system server using the first key and the first interference parameter to obtain first encrypted data; encrypting the business data using the second key and the second interference parameter to obtain second encrypted data; encrypting the first key and the second key using a public key to obtain a first encryption key and a second encryption key respectively; sending the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key, and the second interference parameter to the payment component client; decrypting the encrypted processed data to obtain return data; and, if the return data is verified to be valid, returning the return data to the payment system client for display.

[0140] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the above-described method for verifying encrypted data.

[0141] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the above-described method for verifying encrypted data.

[0142] Figure 6 This is a hardware structure block diagram of an electronic device (or mobile device) for a method of verifying encrypted data according to an embodiment of the present invention. Figure 6 As shown, an electronic device may include one or more ( Figure 6The processor 602 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 604 for storing data may also be included. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 6 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown.

[0143] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0144] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0149] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method of verifying encrypted data, characterized by, The application is applied to a payment component server, the payment component server pre-stores a private key of a preset encryption algorithm, and comprises: receiving first encrypted data, a first encryption key, a first interference parameter, second encrypted data, a second encryption key and a second interference parameter sent by a payment component client; wherein the first interference parameter and the second interference parameter are randomly generated by the payment component client; decrypting the first encryption key and the second encryption key by using the private key to obtain a first key and a second key respectively; decrypting the second encrypted data by using the second key and the second interference parameter to obtain second data; verifying the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result; the step of verifying the second data based on the first key, the first interference parameter and the first encrypted data comprises: encrypting the second data by using the first key and the first interference parameter based on a first encryption strategy to obtain third encrypted data; comparing the first encrypted data and the third encrypted data to obtain a comparison result; in the case that the comparison result indicates that the first encrypted data is consistent with the third encrypted data, it is determined that the verification of the second data is passed.

2. The authentication method of claim 1, wherein, Before receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client, the method further comprises: the payment component client generates the first key and the first interference parameter used by the first encryption strategy, wherein the payment component client pre-stores a public key of the preset encryption algorithm; the payment component client encrypts the received business data by using the first key and the first interference parameter to obtain the first encrypted data, wherein the business data is data sent by a payment system server; the payment component client encrypts the first key by using the public key to obtain the first encryption key.

3. The authentication method of claim 1, wherein, Before receiving the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter sent by the payment component client, the method further comprises: the payment component client generates the second key and the second interference parameter used by the second encryption strategy; the payment component client encrypts the received business data by using the second key and the second interference parameter to obtain the second encrypted data; the payment component client encrypts the second key by using the pre-stored public key to obtain the second encryption key.

4. The authentication method of claim 1, wherein, The step of decrypting the first encryption key and the second encryption key by using the private key to obtain a first key and a second key respectively comprises: determining the private key type of the private key and loading a preset encryption machine corresponding to the private key type; decrypting the first encryption key and the second encryption key by using the preset encryption machine to obtain the first key and the second key respectively.

5. The method of claim 1, wherein, After verifying the second data to obtain a verification result, the method further comprises: In a case where the verification result indicates that the verification is passed, processing the second data to obtain processed data; generating a third interference parameter used by the first encryption strategy and a fourth interference parameter used by the second encryption strategy; encrypting the processed data using the third interference parameter and the first key to obtain first encrypted processed data; encrypting the processed data using the fourth interference parameter and the second key to obtain second encrypted processed data; sending the third interference parameter, the fourth interference parameter, the first encrypted processed data, and the second encrypted processed data to the payment component client.

6. The authentication method of claim 5, wherein, After sending the third interference parameter, the fourth interference parameter, the first encrypted processed data, and the second encrypted processed data to the payment component client, further comprising: decrypting, by the payment component client, the second encrypted processed data using the second key and the fourth interference parameter to obtain return data; verifying, by the payment component client, the return data based on the first key, the third interference parameter, and the first encrypted processed data, and returning the return data to the payment system client for display in a case where the verification is passed.

7. A method of verifying encrypted data, characterized by, The payment component client pre-stores a public key of a preset encryption algorithm, and comprises: generating a first key and a first interference parameter used by a first encryption strategy, and generating a second key and a second interference parameter used by a second encryption strategy; wherein the first interference parameter and the second interference parameter are randomly generated by the payment component client; encrypting business data sent by a payment system server using the first key and the first interference parameter to obtain first encrypted data, and encrypting the business data using the second key and the second interference parameter to obtain second encrypted data; encrypting the first key and the second key using the public key to obtain a first encrypted key and a second encrypted key, respectively; sending the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key, and the second interference parameter to the payment component client, wherein the payment component client decrypts the first encrypted key and the second encrypted key using a pre-stored private key of the preset encryption algorithm to obtain a first key and a second key, respectively; decrypts the second encrypted data using the second key and the second interference parameter to obtain second data; verifies the second data based on the first key, the first interference parameter, and the first encrypted data, and processes the second data to obtain processed data in a case where the verification is passed, and returns the encrypted processed data to the payment component client; decrypting the encrypted processed data to obtain return data, and returning the return data to the payment system client for display in a case where the return data is verified; and decrypting the encrypted processed data to obtain return data, and returning the return data to the payment system client for display in a case where the return data is verified. The step of verifying the second data based on the first key, the first interference parameter and the first encrypted data comprises: encrypting the second data based on a first encryption strategy using the first key and the first interference parameter to obtain third encrypted data; comparing the first encrypted data and the third encrypted data to obtain a comparison result; in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data, determining that the verification of the second data is passed.

8. An authentication apparatus of encrypted data, characterized by, The application is applied to a payment component server, and the payment component server pre-stores a private key of a preset encryption algorithm, and comprises: a receiving unit configured to receive first encrypted data, a first encryption key, a first interference parameter, second encrypted data, a second encryption key and a second interference parameter sent by a payment component client, wherein the first interference parameter and the second interference parameter are randomly generated by the payment component client; a first decryption unit configured to decrypt the first encryption key and the second encryption key using the private key to obtain a first key and a second key respectively; a second decryption unit configured to decrypt the second encrypted data using the second key and the second interference parameter to obtain second data; a verification unit configured to verify the second data based on the first key, the first interference parameter and the first encrypted data to obtain a verification result; The verification unit comprises: a fifth encryption module configured to encrypt the second data based on a first encryption strategy using a first key and a first interference parameter to obtain third encrypted data; a first comparison module configured to compare the first encrypted data and the third encrypted data to obtain a comparison result; and a second determination module configured to determine that the verification of the second data is passed in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data.

9. An authentication apparatus of encrypted data, characterized by, The application is applied to a payment component client, and the payment component client pre-stores a public key of a preset encryption algorithm, and comprises: a generating unit configured to generate a first key and a first interference parameter used by a first encryption strategy, and generate a second key and a second interference parameter used by a second encryption strategy, wherein the first interference parameter and the second interference parameter are randomly generated by the payment component client; a first encryption unit configured to encrypt business data sent by a payment system server using the first key and the first interference parameter to obtain first encrypted data, and encrypt the business data using the second key and the second interference parameter to obtain second encrypted data; a second encryption unit configured to encrypt the first key and the second key using the public key to obtain a first encryption key and a second encryption key respectively; and a sending unit configured to send the first encrypted data, the first encryption key, the first interference parameter, the second encrypted data, the second encryption key and the second interference parameter to the payment system server. The sending unit is configured to send the first encrypted data, the first encrypted key, the first interference parameter, the second encrypted data, the second encrypted key, and the second interference parameter to the payment component client, wherein the payment component client decrypts the first encrypted key and the second encrypted key by using a private key of the preset encryption algorithm stored in advance to obtain a first key and a second key respectively, decrypts the second encrypted data by using the second key and the second interference parameter to obtain second data, verifies the second data based on the first key, the first interference parameter, and the first encrypted data, and in a case where the verification is passed, processes the second data to obtain processed data and returns encrypted processed data to the payment component client; The third decryption unit is configured to decrypt the encrypted processed data to obtain returned data, and in a case where the returned data is verified, return the returned data to the payment system client for display. The apparatus is further configured to encrypt second data by using a first key and a first interference parameter based on a first encryption strategy to obtain third encrypted data, compare the first encrypted data and the third encrypted data to obtain a comparison result, and in a case where the comparison result indicates that the first encrypted data is consistent with the third encrypted data, determine that the verification of the second data is passed.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer program controls a device in which the computer readable storage medium is located to perform the encryption data verification method of any one of claims 1 to 7 when the computer program is running.

11. An electronic device, comprising: The apparatus comprises one or more processors and a memory, and the memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the encryption data verification method of any one of claims 1 to 7.

Images