A data processing method, apparatus, device, and medium

Abstract

Embodiments of the present application provide a data processing method, device and equipment and medium, the method comprises: receiving session encryption data for session service data; when a first encryption data component in the session encryption data meets a collaborative decryption policy associated with a collaborative decryption object, generating a random mask through a first random number generator; when the first encryption data component is masked and processed through the random mask to obtain masked data, obtaining a first decryption data component based on the first private key component and the masked data; sending the first decryption data component to a second service terminal; when the second decryption data component returned by the second service terminal meets the collaborative decryption policy, decrypting the session service data based on the second decryption data component and the first encryption data component, which can avoid the problem of private key leakage caused by single-point storage of private keys, and can also improve the transmission reliability and security of the session service data sent in the session process.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and more particularly to a data processing method, apparatus, device, and medium. Background Technology

[0002] Currently, to ensure data security during sessions, public and private keys are used to encrypt and decrypt session data. For example, when business object A and business object B are in a session, business object A can use business object B's public key to encrypt the session data and send the encrypted session data (i.e., encrypted session data) to business object B's corresponding business terminal via business object A's business terminal. Business terminal B can then use its stored private key to decrypt the encrypted session data, thus obtaining the session data. As can be seen from the above, the existing private key storage method uses a single-point storage approach (i.e., storing the private key used for decryption in the storage space of its own business terminal). With single-point private key storage, there is a high risk of private key leakage; once a private key is leaked, it becomes difficult to ensure the security and reliability of the session data transmitted during the session. Summary of the Invention

[0003] This application provides a data processing method, apparatus, device, and medium that can avoid the problem of private key leakage caused by single-point storage of private keys, and can also improve the transmission reliability and security of session service data sent during a session.

[0004] This application provides a data processing method, executed by a first service terminal, comprising:

[0005] When the first business object conducts a target session with the target business object through the first business terminal, it receives session encrypted data for the session business data sent by the target business terminal corresponding to the target business object; the first business object is a business object in the collaborative decryption object used for data decryption; the target business object is a business object used for data encryption; the session encrypted data is obtained by the target business terminal encrypting the session business data using the collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first business object and the second private key component of the second business object in the collaborative decryption object;

[0006] When the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, a random mask for masking the first encrypted data component is generated by the first random number generator.

[0007] When masking the first encrypted data component with a random mask to obtain mask data, the first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data.

[0008] The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component meets the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing.

[0009] When the second decrypted data component is received from the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component.

[0010] The session encrypted data includes a second encrypted data component; the collaborative decryption strategy includes a collaborative elliptic curve for data decryption.

[0011] Based on the second decrypted data component and the first encrypted data component, the session service data is obtained through decryption, including:

[0012] Based on the second decrypted data component and the first encrypted data component, the decryption elliptic curve points are determined on the cooperative elliptic curve.

[0013] Extract the second encrypted data component from the session encrypted data and determine the bit length of the second encrypted data component;

[0014] The key derivation function is used to expand the key length and the decryption elliptic curve points to obtain the key-derived bit string.

[0015] When the key-derived feature string meets the decryption conditions, the session service data is obtained by decryption based on the key-derived bit string and the second encrypted data component.

[0016] The session encrypted data also includes a third encrypted data component, and the method further includes:

[0017] Hash calculations are performed on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data.

[0018] Extract the third encrypted data component from the session encrypted data, and compare the digest value corresponding to the session business data with the third encrypted data component;

[0019] When the digest value corresponding to the session service data is the same as the third encrypted data component, the session service data is output.

[0020] The methods also include:

[0021] Obtain the agreed-upon numerical value associated with the random mask, and perform a modulo operation based on the random mask and the agreed-upon numerical value to obtain the modulo value corresponding to the random mask;

[0022] If the modulus value corresponding to the random mask is not equal to the mask value, then the first encrypted data component is masked using the random mask to obtain the mask data.

[0023] The methods also include:

[0024] If the modulus value corresponding to the random mask is equal to the mask value, then a new random mask for masking the first encrypted data component is generated by the first random number generator.

[0025] The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption; the method also includes:

[0026] If the second decrypted data component satisfies the expression of the cooperative elliptic curve, and the second decrypted data component is not at infinity on the cooperative elliptic curve, then the second decrypted data component is determined to satisfy the cooperative decryption strategy.

[0027] The method also includes:

[0028] If the second decrypted data component does not satisfy the expression of the cooperative elliptic curve, or if the second decrypted data component is the point at infinity on the cooperative elliptic curve, then it is determined that the second decrypted data component does not satisfy the cooperative decryption strategy, and the first error message is output.

[0029] The method also includes:

[0030] Receive the second public key component sent by the second service terminal. The second public key component is generated by the second service terminal based on the second private key component and the base point on the cooperative elliptic curve.

[0031] A first private key component for data encryption is generated using a second random number generator.

[0032] When the first private key component satisfies the validity of the private key, a collaborative public key is generated collaboratively based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve.

[0033] Public collaborative public key.

[0034] The method also includes:

[0035] A first private key component for data encryption is generated using a second random number generator.

[0036] When the first private key component satisfies the validity of the private key, the first public key component of the first business object is generated based on the first private key component and the base point on the cooperative elliptic curve.

[0037] The first public key component is sent to the second service terminal so that the second service terminal can generate a second private key component for data encryption through a third random number generator. When the second private key component satisfies the legality of the private key, a collaborative public key is generated based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve.

[0038] The method also includes:

[0039] Obtain the associated numerical value and the agreed-upon numerical value associated with the first private key component; perform a modulo operation based on the first private key component, the associated numerical value, and the agreed-upon numerical value to obtain the modulo value corresponding to the first private key component.

[0040] If the modulus value corresponding to the first private key component is not equal to the target value, then the first private key component is determined to satisfy the private key validity.

[0041] The method also includes:

[0042] If the modulus value corresponding to the first private key component is equal to the target value, then the first private key component is determined to be invalid, and a new first private key component for data encryption is generated by the second random number generator.

[0043] One embodiment of this application provides a data processing method, which is executed by a second service terminal, and the method includes:

[0044] The system receives a first decrypted data component corresponding to a first encrypted data component sent by a first service terminal. The first decrypted data component is generated by the first service terminal based on a first private key component and the mask data when it performs masking processing on the first encrypted data component in the session encrypted data using a random mask. The random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. The session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal. The first service object is a service object in the collaborative decryption object used for data decryption. The target service object is a service object used for data encryption. The session encrypted data is obtained by the target service terminal encrypting the session service data using the collaborative public key associated with the collaborative decryption object. The collaborative public key is generated based on the first private key component and the second private key component of the second service object in the collaborative decryption object.

[0045] When the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, the first decrypted data component is processed for collaborative decryption based on the second private key component to obtain the second decrypted data component after collaborative decryption.

[0046] The second decrypted data component is returned to the second service terminal so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component.

[0047] The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption; the method also includes:

[0048] If the first decrypted data component satisfies the expression of the cooperative elliptic curve, and the first decrypted data component is not an infinite point on the cooperative elliptic curve, then it is determined that the first decrypted data component satisfies the cooperative decryption strategy associated with the cooperative decryption object.

[0049] The method also includes:

[0050] If the first decrypted data component does not satisfy the expression of the cooperative elliptic curve, or if the first decrypted data component is not the point of infinity on the cooperative elliptic curve, then it is determined that the first decrypted data component does not satisfy the cooperative decryption strategy associated with the cooperative decryption object, and a second error message is returned to the first business terminal. The second error message is used to indicate that the first decrypted data component is erroneous.

[0051] The method also includes:

[0052] Receive the first public key component of the first service object sent by the first service terminal; the first public key component is generated by the first service terminal through the first private key component and the base point on the cooperative elliptic curve.

[0053] A second private key component for data encryption is generated using a third random number generator;

[0054] When the second private key component satisfies the validity of the private key, a collaborative public key is generated collaboratively based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve.

[0055] Public collaborative public key.

[0056] Wherein, the second service terminal is the target service terminal, the target service object is the second service object, and the method further includes:

[0057] When the first business object conducts a target session with the second business object through the first business terminal, the session business data is obtained, and the session business data is encrypted using the collaborative public key associated with the collaborative decryption object to obtain encrypted session data.

[0058] Send encrypted session data to the first service terminal.

[0059] One embodiment of this application provides a data processing apparatus, which is disposed in a first service terminal. The apparatus includes:

[0060] The receiving module is used to receive session encrypted data for session service data sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal; the first service object is a service object in the collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object;

[0061] The mask generation module is used to generate a random mask for masking the first encrypted data component when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, by using a first random number generator.

[0062] The decrypted data component generation module is used to obtain the first decrypted data component corresponding to the first encrypted data component based on the first private key component and the mask data when the first encrypted data component is masked by a random mask to obtain mask data.

[0063] The sending module is used to send the first decrypted data component to the second service terminal corresponding to the second service object, so that when the first decrypted data component meets the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing.

[0064] The decryption module is used to decrypt the session service data based on the second decrypted data component and the first encrypted data component when it receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy.

[0065] The session encrypted data includes a second encrypted data component; the collaborative decryption strategy includes a collaborative elliptic curve for data decryption; the decryption module includes an elliptic curve point determination unit, an extraction unit, a length determination unit, a bit string determination unit, and a decryption unit; wherein...

[0066] Elliptic curve point determination unit, used to determine decryption elliptic curve points on a cooperative elliptic curve based on the second decrypted data component and the first encrypted data component;

[0067] An extraction unit is used to extract a second encrypted data component from the session encrypted data;

[0068] A length determination unit is used to determine the bit length of the second encrypted data component;

[0069] The bit string determination unit is used to perform key expansion on the bit length and decryption elliptic curve points using a key derivation function to obtain the key-derived bit string.

[0070] The decryption unit is used to decrypt the session service data based on the key-derived bit string and the second encrypted data component when the key-derived feature string meets the decryption conditions.

[0071] The session encrypted data also includes a third encrypted data component. The device further includes: a digest value determination module, an extraction module, a comparison module, and an output module; wherein:

[0072] The digest value determination module is used to perform hash calculations on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data.

[0073] The extraction module is used to extract a third encrypted data component from the session encrypted data;

[0074] The comparison module is used to compare the digest value corresponding to the session service data with the third encrypted data component;

[0075] The output module is used to output the session service data when the digest value corresponding to the session service data is the same as the third encrypted data component.

[0076] The device further includes: an acquisition module and a mask processing module, wherein,

[0077] The acquisition module is used to acquire the agreed-upon value associated with the random mask, and to perform a modulo operation based on the random mask and the agreed-upon value to obtain the modulo value corresponding to the random mask;

[0078] The masking module is used to mask the first encrypted data component using the random mask if the modulus value corresponding to the random mask is not equal to the mask value, thereby obtaining the mask data.

[0079] The mask generation module is also used for:

[0080] If the modulus value corresponding to the random mask is equal to the mask value, then a new random mask for masking the first encrypted data component is generated by the first random number generator.

[0081] The collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption, and the device also includes a strategy determination module.

[0082] The strategy determination module is used to determine that the second decrypted data component satisfies the cooperative decryption strategy if the second decrypted data component satisfies the expression of the cooperative elliptic curve and the second decrypted data component is not an infinity point on the cooperative elliptic curve.

[0083] The strategy determination module is further configured to: if the second decrypted data component does not satisfy the expression of the cooperative elliptic curve, or if the second decrypted data component is the point at infinity on the cooperative elliptic curve, then determine that the second decrypted data component does not satisfy the cooperative decryption strategy and output the first error message.

[0084] The device also includes: a private key component generation module, a public key generation module, and a public module;

[0085] The receiving module is also used to receive the second public key component sent by the second service terminal. The second public key component is generated by the second service terminal based on the second private key component and the base point on the cooperative elliptic curve.

[0086] The private key component generation module is used to generate a first private key component for data encryption via a second random number generator.

[0087] The public key generation module is used to collaboratively generate a collaborative public key based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve, when the first private key component satisfies the legality of the private key.

[0088] The public module is used to publicly disclose the collaborative public key.

[0089] The device also includes: a public key component generation module;

[0090] The private key component generation module is used to generate a first private key component for data encryption via a second random number generator.

[0091] The public key component generation module is used to generate the first public key component of the first business object based on the first private key component and the base point on the cooperative elliptic curve when the first private key component satisfies the legality of the private key;

[0092] The sending module is used to send the first public key component to the second service terminal, so that the second service terminal can generate the second private key component for data encryption through the third random number generator, and generate the collaborative public key based on the second private key component, the first public key component and the base point on the collaborative elliptic curve when the second private key component satisfies the legality of the private key.

[0093] The device also includes: a legality determination module;

[0094] The acquisition module is used to acquire the associated numerical value and the agreed numerical value associated with the first private key component, and to perform a modulo operation based on the first private key component, the associated numerical value and the agreed numerical value to obtain the modulo value corresponding to the first private key component.

[0095] The legitimacy determination module is used to determine that the first private key component satisfies the legitimacy of the private key if the modulus value corresponding to the first private key component is not equal to the target value.

[0096] The legality determination module is further used to determine that the first private key component does not meet the private key legality requirement if the modulus value corresponding to the first private key component is equal to the target value.

[0097] The private key component generation module is used to generate a first private key component for data encryption via a second random number generator.

[0098] One embodiment of this application provides a data processing apparatus, which is disposed in a second service terminal, and the apparatus includes:

[0099] The receiving module is used to receive a first decrypted data component corresponding to a first encrypted data component sent by a first service terminal. The first decrypted data component is generated by the first service terminal based on a first private key component and the mask data when the first encrypted data component in the session encrypted data is masked using a random mask. The random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. The session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal. The first service object is a service object in the collaborative decryption object used for data decryption. The target service object is a service object used for data encryption. The session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object. The collaborative public key is generated based on the first private key component and the second private key component of the second service object in the collaborative decryption object.

[0100] The collaborative decryption module is used to perform collaborative decryption processing on the first decrypted data component based on the second private key component when the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, so as to obtain the second decrypted data component after collaborative decryption processing.

[0101] The return module is used to return a second decrypted data component to the second service terminal, so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component.

[0102] The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption; the device also includes a strategy determination module.

[0103] The strategy determination module is used to determine that the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object if the first decrypted data component satisfies the expression of the collaborative elliptic curve and the first decrypted data component is not an infinity point on the collaborative elliptic curve.

[0104] The strategy determination module is further used to determine that the first decrypted data component does not satisfy the collaborative decryption strategy associated with the collaborative decryption object if the first decrypted data component does not satisfy the expression of the collaborative elliptic curve or the first decrypted data component is not the point of infinity on the collaborative elliptic curve.

[0105] The return module is used to return a second error message to the first business terminal. The second error message indicates that the first decrypted data component is incorrect.

[0106] The device also includes: a private key component generation module, a public key generation module, and a public module;

[0107] The receiving module is used to receive the first public key component of the first service object sent by the first service terminal; the first public key component is generated by the first service terminal through the first private key component and the base point on the cooperative elliptic curve;

[0108] The private key component generation module is used to generate a second private key component for data encryption via a third random number generator.

[0109] The public key generation module is used to collaboratively generate a collaborative public key based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve, when the second private key component satisfies the legality of the private key.

[0110] The public module is used to publicly disclose the collaborative public key.

[0111] The second service terminal is the target service terminal, the target service object is the second service object, and the device also includes: an acquisition module, an encryption module and a sending module.

[0112] The acquisition module is used to acquire session service data when the first service object conducts a target session with the second service object through the first service terminal;

[0113] The encryption module is used to encrypt session business data using the collaborative public key associated with the collaborative decryption object, thereby obtaining encrypted session data.

[0114] The sending module is used to send session-encrypted data to the first service terminal.

[0115] One aspect of the application provides a computer device, including a memory and a processor. The memory is connected to the processor, the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method provided in one aspect of the application.

[0116] One aspect of this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having a processor performs the method provided in one aspect of this application.

[0117] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in the above aspect.

[0118] In this embodiment, when a first service object conducts a target session with a target service object through a first service terminal, the first service terminal can receive session encrypted data sent by the target service terminal corresponding to the target service object for session service data; the first service object is a service object in a collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object; when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, A random mask is generated by a first random number generator to mask the first encrypted data component. When the first encrypted data component is masked using the random mask to obtain mask data, a first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data. The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain a second decrypted data component after collaborative decryption processing. Upon receiving the second decrypted data component returned by the second service terminal and finding that the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component. Therefore, the embodiments of this application require that the session business data be obtained through collaborative decryption by both parties during the session. This means that neither party can independently decrypt the session business data during the session using its own private key. In other words, by deploying the private key used for collaborative decryption on different business terminals, the embodiments of this application can not only avoid the problem of private key leakage caused by single-point storage of private keys, but also improve the transmission reliability and security of the session business data sent during the session. Attached Figure Description

[0119] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0120] Figure 1 This application provides a schematic diagram of the architecture of a data processing system.

[0121] Figure 2A schematic diagram illustrating a scenario where a data processing scheme provided in this application is applied to electronic invoices in e-commerce.

[0122] Figure 3 A schematic diagram illustrating a data processing scheme provided in this application embodiment applied to the Internet of Things;

[0123] Figure 4a A schematic diagram illustrating a scenario in which a data processing scheme provided in this application is applied to cloud computing;

[0124] Figure 4b A schematic diagram illustrating a data processing scheme provided in this application embodiment applied to a blockchain scenario;

[0125] Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0126] Figure 6 A flowchart illustrating a collaborative public key generation method provided in this application embodiment;

[0127] Figure 7 A flowchart illustrating another data processing method provided in an embodiment of this application;

[0128] Figure 8 A flowchart illustrating another data processing method provided in an embodiment of this application;

[0129] Figure 9 A flowchart illustrating another data processing method provided in an embodiment of this application;

[0130] Figure 10 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0131] Figure 11 This is a schematic diagram of another data processing apparatus provided in an embodiment of this application;

[0132] Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0133] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0134] This application provides a data processing scheme, which generally works as follows: First, each business object in the collaborative decryption object independently generates its own private key component. Then, based on their respective private key components, they generate a collaborative public key through collaborative computation and publish the collaborative public key. For example, the collaborative decryption object includes a first business object and a second business object. The first business object can generate its own first private key component through a first business terminal, and the second business object can generate its own second private key component through a second business terminal. Then, the first or second business terminal can collaboratively generate a collaborative public key based on the first and second private key components. When an encryption object uses the collaborative public key to encrypt session business data through its own business terminal to obtain encrypted session data, the session business data can only be obtained by collaboratively decrypting the encrypted session data using the private key components of each business object in the collaborative decryption object.

[0135] Through the above scheme, the business terminals corresponding to each business object in the collaborative decryption object can independently generate their own private key components (i.e., the first business terminal generates the first private key component, and the second business terminal generates the second private key component) and store their own private key components separately. Therefore, this application embodiment requires that session business data be obtained through collaborative decryption by both parties during the session. This means that neither party in the collaborative decryption can independently decrypt the session business data during the session using its own private key stored at a single point. In other words, this application embodiment, by deploying the private key used for collaborative decryption on different business terminals, not only avoids the private key leakage problem caused by single-point storage of the private key, but also improves the reliability and security of the transmission of session business data sent during the session. Furthermore, this application embodiment achieves the requirement of collaborative decryption among the business objects in the collaborative decryption object by having each business object in the collaborative decryption object jointly decrypt the session encrypted data sent by the target business object (such as the aforementioned encrypted object).

[0136] Based on the above solution, please refer to Figure 1 , Figure 1 This is a schematic diagram of the architecture of a collaborative decryption system provided in an embodiment of this application. The collaborative decryption system may include a business terminal cluster 10 and a server 104; the business terminal cluster may contain multiple business terminals. (Illustrative, as shown) Figure 1As shown, the business terminal cluster 10 includes business terminal 101, business terminal 102, and business terminal 103. Each business terminal in the cluster can communicate or transmit data through server 104. For example, business terminal 101 can communicate with business terminal 102 through server 104, and business terminal 101 can communicate with business terminal 103 through server 104. The business terminals can include, but are not limited to, smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, in-vehicle terminals, smart wearable devices, etc. Server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0137] It is understood that any business terminal in the business terminal cluster 10 can serve as a first business terminal. For example, business terminal 101 in the business terminal cluster 10 can serve as a first business terminal. The first business terminal can be a terminal used by a first business object, which can be one of the business objects in a collaborative decryption object used for data decryption. The first business terminal can generate and store a first private key component for the first business object. Any business terminal in the business terminal cluster 10 can serve as a second business terminal. For example, business terminal 102 in the business terminal cluster can serve as a second business terminal. The second business terminal can be a terminal used by a second business object, which can also be one of the business objects in a collaborative decryption object used for data decryption. The second business terminal can generate and store a second private key component for the second business object.

[0138] It should be understood that service terminal 101 can also be used as the second service terminal, and service terminal 102 as the first service terminal. The first service terminal and the second service terminal are different service terminals. The following description will use service terminal 101 as the first service terminal and service terminal 102 as the second service terminal as an example.

[0139] It should be understood that the aforementioned collaborative decryption object may include multiple business objects, each of which is a business object used for data decryption. The first and second business objects mentioned above are both business objects in the collaborative decryption object.

[0140] It can be understood that after the first business terminal (i.e., business terminal 101) generates the first private key component and the second business terminal (i.e., business terminal 102) generates the second private key component, either the first or second business terminal can generate a collaborative public key for data encryption based on the first and second private key components. In one implementation, the first business terminal can generate a first public key component for a first business object based on the first private key component and send this first public key component to the second business terminal via server 104; the second business terminal can collaboratively generate a collaborative public key based on the first public key component and its own second private key component, and then publish the collaborative public key. In another implementation, the second business terminal can generate a second public key component for a second business object based on the second private key component and send this second public key component to the first business terminal via server 104; the first business terminal can collaboratively generate a collaborative public key based on the second public key component and its own first private key component, and then publish the collaborative public key.

[0141] This means that a target business terminal can be selected from the business terminal cluster. This target business terminal can be a terminal used by a target business object, which can be a business object that encrypts data during the session. The target business object can establish a target session with either the first or second business terminal (i.e., the target business terminal establishes a target session with the first or second business terminal via server 104) and send session-encrypted data for the session business data to the first or second business terminal, enabling the first and second business terminals to collaboratively decrypt the session-encrypted data. This session-encrypted data is obtained by encrypting the session business data using the aforementioned collaborative public key.

[0142] In this context, it can be understood that the target business object can be a business object used for data encryption. Furthermore, the target business object can also be a business object requesting data decryption. In this case, the session encrypted data can be obtained by encrypting the session business data using a business terminal where other business objects reside. In some embodiments, the target business object can be a business object used for both data encryption and decryption; in this case, the target business object is one of the business objects in the collaborative decryption object. For example, the target business object can be a first business object, which can be both a business object used for data encryption and a business object used for data decryption. Correspondingly, the first business terminal can act as both a business decryption terminal and a data encryption terminal. Similarly, the target business object can be a second business object, which can be both a business object used for data encryption and a business object used for data decryption. Correspondingly, the second business terminal can act as both a business decryption terminal and a data encryption terminal.

[0143] It should be understood that the session service data involved in the embodiments of this application can be encrypted service data (i.e., service data that has been encrypted by encryption means); or, the session service data can be plaintext service data.

[0144] It is understood that, based on the aforementioned data processing system, this application provides a data processing solution that can be applied to multi-party (e.g., two-party) collaborative decryption application scenarios, or to application scenarios such as e-commerce, cloud computing, the Internet of Things (IoT), and blockchain. Accordingly, the data included in the session business data differs depending on the application scenario. For example, when applied to an e-commerce scenario, the session business data may include e-commerce order and electronic invoice information; when applied to a cloud computing scenario, the session business data may include image data stored in the cloud, object identity information, etc.; and when applied to an IoT scenario, the session business data may include access control data, vehicle driving data, etc.

[0145] It should be noted that, in this embodiment of the application, when acquiring data such as order information of the business object (i.e., the user), purchase information of the business object when purchasing goods (such as product model, amount, and address of the business object), access control information of the business object, and identity information of the object, a prompt interface or pop-up window may be provided. This prompt interface or pop-up window is used to inform the user that data such as order information of the business object, purchase information of the business object when purchasing goods, access control information of the business object, and identity information of the object are currently being collected. The data acquisition steps will only begin after the business object issues a confirmation operation to the prompt interface or pop-up window; otherwise, the process will end.

[0146] All data collected or obtained in the embodiments of this application (such as order information of business objects, purchase information of business objects when purchasing goods, access control information of business objects, identity information of objects, etc.) are collected or obtained with the consent and authorization of the corresponding business object (such as the aforementioned first business object). That is to say, when the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0147] In this context, taking the example of a target business terminal obtaining purchase information from a first business object when purchasing a product, an authorization interface will be displayed on the first business terminal corresponding to the first business object. This authorization interface includes a first prompt message, a confirm button, and a cancel button. The first prompt message indicates that the target business object needs to obtain the purchase information of the target product. If the first business object agrees to the target business terminal obtaining the purchase information of the target product, it can trigger the confirm button to authorize the data acquisition of the target business terminal, and then the target business terminal can obtain the purchase information of the target product. If the first business object does not agree to the target business terminal obtaining the purchase information of the target product, it can trigger the cancel button, and in this case, the target business terminal cannot obtain the purchase information of the target product.

[0148] For further information, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart illustrating a collaborative decryption scheme provided in this application, applied to an e-commerce invoicing scenario. In the e-commerce invoicing scenario, session business data can be electronic invoice information, and session encrypted data can be encrypted electronic invoice data. This electronic invoice information may include, but is not limited to, the following: invoice number, invoice date, buyer information, seller information, item name, specifications, unit, quantity, unit price, amount, etc. The target business object can be... Figure 2 The data encryption object in the data encryption object can be the invoice issuer (i.e., the seller) of the electronic invoice. The first and second business objects included in the collaborative decryption object can be the purchaser of the purchased goods, that is, the first business object can be... Figure 2 In the context of collaborative decryption, object A can be the first collaborative decryption object, and object B can be the second business object. The entire e-commerce invoicing scenario can include three processes: public key generation, encryption, and collaborative decryption.

[0149] The public key generation process can be understood to include the following steps: S1: The first business terminal corresponding to collaborative decryption object A generates a first private key component and generates a first public key component based on the first private key component. S2: The first public key component is sent to the second business terminal corresponding to collaborative decryption object B (i.e., the first business terminal sends the first public key component to the server, and the server sends the first public key component to the second business terminal). S3: The second business terminal collaboratively generates a collaborative public key based on the first public key component and its stored second private key component. S4: The second business terminal publishes the collaborative public key.

[0150] The encryption process includes the following steps: S5: The first business terminal (i.e., business terminal 101) can establish a target session with the target business terminal (e.g., business terminal 103) corresponding to the data encryption object, and send an invoice request to the target business terminal corresponding to the data encryption object based on the target session. This invoice request is used to request the issuance of electronic invoice information regarding the purchase of the target goods. That is, the first business terminal sends the invoice request to the server 104, and the server 104 forwards the invoice request to the target business terminal. Then, after receiving the invoice request, the target business terminal can generate electronic invoice information based on the purchase information associated with the target goods, and encrypt the electronic invoice information using a collaborative public key to obtain encrypted electronic invoice data. S6: The target business terminal sends the encrypted electronic invoice data to the first business terminal (i.e., the server sends the encrypted electronic invoice data to the first business terminal).

[0151] The collaborative decryption process includes the following steps: S7: After receiving the encrypted electronic invoice data, the first business terminal generates a random mask for masking the first encrypted data component using a first random number generator. Based on the first private key component and the mask data, it obtains the first decrypted data component corresponding to the first encrypted data component. S8: The first decrypted data component is sent to the second business terminal corresponding to the collaborative decryption object B. S9: The second business terminal performs collaborative decryption processing on the first decrypted data component based on its own second private key component, obtaining the second decrypted data component after collaborative decryption processing. S10: The second business terminal can send the second decrypted data component to the first business terminal. S11: The first business terminal can decrypt the electronic invoice information based on the second decrypted data component and the first encrypted data component.

[0152] In this context, it's understood that in an e-invoice scenario, the session data can be encrypted e-invoice information. Specifically, the e-invoice information is first encrypted in the Trusted Environment (TEE) of the target business terminal. Then, the target business object further encrypts the encrypted e-invoice information using a collaborative public key, obtaining encrypted e-invoice data. This encrypted data is then decrypted according to the aforementioned collaborative decryption process, yielding the encrypted e-invoice information. At this point, after obtaining the encrypted e-invoice information, the first business terminal decrypts it in its trusted environment to obtain the e-invoice information. It should be understood that the trusted environment of the first business terminal and the trusted environment of the target business terminal can agree on corresponding encryption public keys and decryption private keys. The first business terminal can then decrypt the encrypted e-invoice information using the decryption private key to obtain the e-invoice information.

[0153] As can be understood, please refer to Figure 3, Figure 3 This is a schematic diagram illustrating a collaborative decryption scheme provided in this application applied to an Internet scenario. In an IoT scenario, for example, session service data can be vehicle driving information, and correspondingly, session encrypted data can be vehicle driving encrypted information. The first service object and the second service object in the collaborative decryption object can be vehicle users, and the first service object is... Figure 3 In the collaborative decryption object B, the first business terminal corresponding to the first business object can be a first vehicle-mounted terminal, which serves as the collaborative decryption terminal; the second business object can be... Figure 3 In the context of object A, which serves as both a data encryption object and a collaborative decryption object, the corresponding second business terminal can be a second vehicle-mounted terminal, acting as both a data encryption and decryption terminal. In this case, the target business object is the second business object. In an internet scenario, the process can include the following steps: S11: The second vehicle-mounted terminal corresponding to object A generates a second private key component and, based on this, generates a second public key component. Then, it sends the second public key component to the first vehicle-mounted terminal corresponding to collaborative decryption object B (i.e., the second vehicle-mounted terminal sends the first public key component to the server, and the server sends the first public key component to the first vehicle-mounted terminal). S12: The first vehicle-mounted terminal collaboratively generates a collaborative public key based on the first public key component and its stored first private key component. S13: The first vehicle-mounted terminal publishes the collaborative public key. S14: When object A wants to share vehicle driving information with collaborative decryption object B, the second vehicle-mounted terminal obtains its own vehicle driving information and uses the collaborative public key to encrypt the vehicle driving information, obtaining encrypted vehicle driving information. S15: The second vehicle-mounted terminal sends vehicle driving encryption information to the first vehicle-mounted terminal corresponding to the collaborative decryption object B. Specifically, when the second vehicle-mounted terminal establishes a target session with the first vehicle-mounted terminal through the server, it can send vehicle driving encryption information to the server, and the server sends vehicle driving encryption information to the first vehicle-mounted terminal. S16: After receiving the vehicle driving encryption information, the first vehicle-mounted terminal generates a random mask using a first random number generator to mask the first encrypted data component in the vehicle driving encryption information. Based on the first private key component and the mask data, it obtains the first decrypted data component corresponding to the first encrypted data component. S17: The first vehicle-mounted terminal sends the first decrypted data component to the second vehicle-mounted terminal. S18: The second vehicle-mounted terminal performs collaborative decryption processing on the first decrypted data component based on its own second private key component, obtaining the second decrypted data component after collaborative decryption processing. S19: The second vehicle-mounted terminal can send the second decrypted data component to the first vehicle-mounted terminal. S20: The first vehicle-mounted terminal can decrypt the vehicle driving information based on the second decrypted data component and the first encrypted data component. Through collaborative decryption, the security of vehicle driving data during communication can be guaranteed to a certain extent.

[0154] As can be understood, please refer to Figure 4a , Figure 4a This is a schematic diagram illustrating a collaborative decryption scheme provided in this application applied to a cloud computing scenario. In the cloud computing scenario, the session encryption data can be encrypted image data stored in the cloud. The target business object can be the business object that encrypts the image data, such as... Figure 4a The data encryption object in the target business object is the data encryption terminal; the first business object and the second business object included in the collaborative decryption object can be business objects that decrypt encrypted image data, and the first business object can be... Figure 4a In the collaborative decryption object A, the second business object can be... Figure 4a In the collaborative decryption object B, the first business terminal corresponding to the first business object and the second business terminal corresponding to the second business object can be collaborative decryption terminals. In a cloud computing scenario, the entire collaborative decryption process includes the following steps: S21: The target business terminal acquires image data and encrypts the image data using the collaborative public key to obtain encrypted image data. S22: When the first business terminal establishes a target session with the target business terminal corresponding to the target business object (i.e., the first business terminal establishes a target session with the target business terminal through server 104), the target business terminal sends decrypted image data to the first business terminal corresponding to collaborative decryption object A. Specifically, the target business terminal sends encrypted image data to server 104, and server 104 sends encrypted image data to the first business terminal. S23: After receiving the encrypted image data, the first business terminal generates a random mask using a first random number generator to mask the first encrypted data component in the encrypted image data. Based on the first private key component and the mask data, it obtains the first decrypted data component corresponding to the first encrypted data component. S24: The first decrypted data component is sent to the second business terminal corresponding to collaborative decryption object B. S25: The second service terminal performs collaborative decryption processing on the first decrypted data component based on its own second private key component, obtaining the second decrypted data component after collaborative decryption processing. S26: The second service terminal can send the second decrypted data component to the first service terminal. S27: The first service terminal can decrypt the image data based on the second decrypted data component and the first encrypted data component.

[0155] It is understood that the data processing solution provided in this application embodiment can also be applied to blockchain scenarios. Please refer to [link / reference]. Figure 4b , Figure 4b This is a schematic diagram illustrating a data processing scheme provided in this application embodiment applied to a blockchain scenario. Figure 4bIn a blockchain scenario, session business data refers to business data to be uploaded to the blockchain, while encrypted session data can be encrypted business data. The target business object can be the object requesting data to be uploaded to the blockchain, and the target business terminal corresponding to this target business object can be, for example... Figure 4b The data encryption terminal in the middle, the first business terminal corresponding to the first business object can be Figure 4b In the collaborative decryption terminal A, the second service terminal corresponding to the second service object can be... Figure 4b Collaborative decryption terminal B is a node in the blockchain network 30. Collaborative decryption terminal A and collaborative decryption terminal B are two nodes in the blockchain network 30. The entire data processing flow in the blockchain network scenario includes the following steps: S31: The data encryption terminal uses the collaborative public key jointly generated by collaborative decryption terminal A and collaborative decryption terminal B to encrypt the business data to be uploaded to the chain, obtaining encrypted business data. S32: The data encryption terminal sends the encrypted business data to the blockchain network. S33: Collaborative decryption terminal A in the blockchain network can receive the encrypted business data and generate a random mask through a first random number generator to mask the first encrypted data component in the encrypted business data. Based on the first private key component and the mask data, it obtains the first decrypted data component corresponding to the first encrypted data component. S34: Collaborative decryption terminal A sends the first decrypted data component to collaborative decryption terminal B. S35: Collaborative decryption terminal B performs collaborative decryption processing on the first decrypted data component based on its own second private key component, obtaining the second decrypted data component after collaborative decryption processing. S36: Collaborative decryption terminal B can send the second decrypted data component to the first business terminal. S37: Collaborative decryption terminal A can decrypt the business data based on the second decrypted data component and the first encrypted data component. Then, collaborative decryption terminal A can send the business data to other nodes in the blockchain network for consensus, and after successful consensus, save the business data to the blockchain in the blockchain network.

[0156] In this context, it can be understood that when a data encryption terminal wants to communicate with node 31a in the blockchain network, it can encrypt the business data using the collaborative public key jointly generated by collaborative decryption terminals A and B, obtaining encrypted business data. The data encryption terminal then sends the encrypted business data to node 31a in the blockchain network. After receiving the encrypted business data, node 31a can send it to collaborative decryption terminal A in the blockchain network. Collaborative decryption terminal A generates a random mask using a first random number generator to mask the first encrypted data component in the encrypted business data. Based on the first private key component and the mask data, it obtains the first decrypted data component corresponding to the first encrypted data component. Collaborative decryption terminal A sends the first decrypted data component to collaborative decryption terminal B. Collaborative decryption terminal B performs collaborative decryption processing on the first decrypted data component based on its second private key component, obtaining a collaboratively decrypted second decrypted data component, and sends the second decrypted data component to the first business terminal. Collaborative decryption terminal A can then decrypt the business data based on the second decrypted data component and the first encrypted data component, and send the decrypted business data to node 31a. In this context, collaborative decryption terminal A can be a node in the blockchain network that meets the distance requirement (e.g., is closest to node 31a). It should be understood that the data encryption terminal uses a collaborative public key to encrypt business data, ensuring the security of business data during the session. Simultaneously, node 31a sends the encrypted business data to other nodes in the blockchain network (i.e., collaborative decryption terminal A and collaborative decryption terminal B) for collaborative decryption. This allows the node to obtain business data without affecting other tasks (such as data query tasks).

[0157] It is understood that the specific implementation process of how to generate a collaborative public key based on the first and second private key components, and how the first and second service terminals collaboratively decrypt the encrypted session data, can be found in [reference needed]. Figures 5 to 9 Description of the corresponding embodiments.

[0158] Please see Figure 5 , Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application. This data processing method can be implemented by the first service terminal in the aforementioned system (i.e., the aforementioned...). Figure 1 The business terminal 101 and the second business terminal (i.e., the above-mentioned) Figure 1 The data processing method can be jointly executed by the business terminal 102 in the process. The data processing method may include the following steps S101-S107.

[0159] Step S101: When the first service object conducts a target session with the target service object through the first service terminal, receive the session encryption data for the session service data sent by the target service terminal corresponding to the target service object.

[0160] In this context, it can be understood that the first business object can establish a target session with the target business object's corresponding target business terminal through the first business terminal. The first business object is one of the business objects in a collaborative decryption object used for data decryption, and the first business terminal can be a collaborative decryption terminal. The target business object is a business object used for data encryption, and the target business terminal corresponding to the target business object is a data encryption terminal. The collaborative decryption object can include both the first business object and the second business object; that is, both the first business object and the second business object are business objects used for data decryption. Accordingly, the first business terminal corresponding to the first business object and the second business terminal of the second business object are both collaborative decryption terminals.

[0161] It can be understood that the target business object can be any business object that has a target session with the first business object and is used for data encryption. For example, the target business object can be the second business object or other business objects besides the first and second business objects.

[0162] It is understood that, in addition to being data decryption objects, the first business object and the second business object can also be data encryption objects. This application embodiment does not impose any limitations in this regard.

[0163] It is understandable that the session business data can be determined by different business scenarios. For example, when the business scenario is a cloud scenario, the session business data may include image data obtained from the cloud. When the business scenario is an e-commerce scenario, the session business data may include electronic invoice information, order information, and so on.

[0164] It can be understood that the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object. The session encrypted data may contain a first encrypted data component, a second encrypted data component, and a third encrypted data component.

[0165] Here, it can be understood that the session encrypted data can be represented by C, the first encrypted data component can be represented by C1, the second encrypted data component by C2, and the third encrypted data component by C3. The first encrypted data component includes the elliptic curve points on the cooperative elliptic curve used for data encryption in the cooperative encryption strategy. The second encrypted data component includes the ciphertext data corresponding to the session business data, and the third encrypted data includes the digest value associated with the session business data. The session encrypted data is represented as C = C1||C2||C3, where || represents concatenation. The cooperative elliptic curve can be the elliptic curve defined by the SM2 algorithm.

[0166] Step S102: When the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, a random mask for masking the first encrypted data component is generated by the first random number generator.

[0167] It is understood that the collaborative decryption strategy can include a collaborative elliptic curve for data decryption, and the collaborative decryption strategy is the same as the collaborative encryption strategy described above. The first random number generator can be a random number generator that generates a specified number of random numbers based on conditions. The random mask can be represented by r, where r∈[1, n-1].

[0168] In this context, it can be understood that the first service terminal can extract a first encrypted data component from the session encrypted data and determine whether the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. If the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, a random mask for masking the first encrypted data component is generated by a first random number generator. If the first encrypted data component does not satisfy the collaborative decryption strategy associated with the collaborative decryption object, the first service terminal reports an error and exits the collaborative decryption process.

[0169] The specific implementation of determining whether the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object can be as follows: Verify whether the first encrypted data component satisfies the expression of the collaborative elliptic curve. If the first encrypted data component satisfies the expression of the collaborative elliptic curve, determine the collaborative elliptic curve point S based on the cofactor (e.g., cofactor is 1) and the first encrypted data component, and determine whether the collaborative elliptic curve point S is the point of infinity O on the collaborative elliptic curve. If the collaborative elliptic curve point S is not the point of infinity O on the collaborative elliptic curve, then determine that the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. If the first encrypted data component does not satisfy the expression of the collaborative elliptic curve or the collaborative elliptic curve point S is the point of infinity O on the collaborative elliptic curve, then output an error message and exit the collaborative decryption process for the encrypted data of that session.

[0170] It should be understood that the data type of the first encrypted data component is a bit string. It is necessary to convert the first encrypted data component into the elliptic curve coordinate points corresponding to the first encrypted data component, and then determine whether the elliptic curve coordinate points corresponding to the first encrypted data component satisfy the expression of the cooperative elliptic curve.

[0171] Understandably, after obtaining the random mask, the first service terminal can acquire the agreed-upon value n associated with the random mask, and perform a modulo operation based on the random mask and the agreed-upon value to obtain the modulus value corresponding to the random mask. If the modulus value corresponding to the random mask is not equal to the mask value (here, the mask value is 1), then the first encrypted data component can be masked using the random mask to obtain masked data, and step S103 is executed. If the modulus value corresponding to the random mask is equal to the mask value, then a new random mask for masking the first encrypted data component is generated using the first random number generator, and step S103 is executed.

[0172] It should be understood that the agreed-upon value can refer to the value agreed upon in the SM2 algorithm, where the modulus of the random mask is r. -1 mod n, r represents a random mask, mod n represents the modulo operation; n represents a predetermined value. This is illustrative; the mask value is 1, when r... -1 When mod n is not equal to 1, the first service terminal performs masking processing on the first encrypted data component using a random mask to obtain masked data. When r -1 When mod n equals 1, a random mask for masking the first encrypted data component is regenerated using the first random number generator.

[0173] It can be understood that the mask data is determined as follows: R = [r]C1, where R represents the mask data, C1 represents the first encrypted data component, and [r]C1 represents the multiplication operation between the random mask and the first encrypted data component.

[0174] Step S103: When masking the first encrypted data component using a random mask to obtain mask data, the first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data.

[0175] It can be understood that the first service terminal can calculate the difference between the first private key component and the first value (i.e., the first value is 1), and multiply this difference by the mask data to obtain the first decrypted data component corresponding to the first encrypted data component. The calculation method for the first decrypted data component is as follows: T1 = [d1-1]R. Where T1 represents the first decrypted data component, d1 represents the first private key component, and R represents the mask data.

[0176] Step S104: The first service terminal sends the first decrypted data component to the second service terminal corresponding to the second service object.

[0177] It is understood that the first service terminal can establish a session connection with the second service terminal, and send the first decrypted data component to the second service terminal of the second service object based on the session connection. By masking the first encrypted data component with the aforementioned random mask, the security of the first decrypted data component can be ensured during the process of sending the first decrypted data component to the second service terminal, and the leakage of the first private key component in the first decrypted data component can be prevented during the session.

[0178] It can be understood that after receiving the first decrypted data component sent by the first service terminal, the second service terminal can determine whether the first decrypted data component meets the collaborative decryption strategy. If it is determined that the first decrypted data component meets the collaborative decryption strategy, then step S105 is executed. If it is determined that the first decrypted data component does not meet the collaborative decryption strategy, then a second error message is returned to the first service terminal, which indicates that the first decrypted data component is erroneous. After receiving the second error message, the first service terminal can exit the collaborative decryption process based on the second error message.

[0179] In one implementation, the second service terminal's determination of whether the first decrypted data component satisfies the collaborative decryption strategy may include: the second service terminal determining whether the first decrypted data component satisfies the expression of the collaborative elliptic curve; if it is determined that the first decrypted data component satisfies the expression of the collaborative elliptic curve, the second service terminal further determines whether the first decrypted data component is the point at infinity on the collaborative elliptic curve; if the first decrypted data component is not the point at infinity on the collaborative elliptic curve, the second service terminal determines that the first decrypted data component satisfies the collaborative decryption strategy.

[0180] It can be understood that if the first decrypted data component is determined not to satisfy the expression of the cooperative elliptic curve, then the second service terminal determines that the first decrypted data component does not satisfy the cooperative decryption strategy; or, if the first decrypted data component is determined to be the point at infinity on the cooperative elliptic curve, then the second service terminal determines that the first decrypted data component does not satisfy the cooperative decryption strategy.

[0181] Step S105: When the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing.

[0182] It can be understood that, based on the second private key component, the first decrypted data component undergoes collaborative decryption processing to obtain the second decrypted data component. This process includes: determining the difference between the second private key component and a second value (i.e., the second value is 1), and multiplying this difference by the first decrypted data component to obtain the second decrypted data component. This second decrypted data component can be represented by T2, and it is determined as follows: T2 = [d2-1]T1; d2 represents the second private key component of the second business object, and T1 represents the first decrypted data component.

[0183] Step S106: The second service terminal returns the second decrypted data component to the first service terminal.

[0184] Step S107: When the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it decrypts the session service data based on the second decrypted data component and the first encrypted data component.

[0185] It can be understood that the first service terminal receives the second decrypted data component returned by the second service terminal and determines whether the second decrypted data component meets the collaborative decryption strategy. If it is determined that the second decrypted data component meets the collaborative decryption strategy, then step S107 is executed. If it is determined that the second decrypted data component does not meet the collaborative decryption strategy, then a first error message is output and the collaborative decryption process is exited. The first error message is used to indicate that the second decrypted data component is erroneous.

[0186] The process by which the first service terminal determines whether the second decrypted data component satisfies the collaborative decryption strategy may include: the first service terminal determining whether the second decrypted data component satisfies the expression of the collaborative elliptic curve; if the second decrypted data component satisfies the expression of the collaborative elliptic curve, the first service terminal further determining whether the second decrypted data component is the point at infinity on the collaborative elliptic curve; if the second decrypted data component is not the point at infinity on the collaborative elliptic curve, the first service terminal determining that the second decrypted data component satisfies the collaborative decryption strategy.

[0187] It can be understood that if the second decrypted data component is determined to not satisfy the expression of the cooperative elliptic curve, then the first service terminal determines that the second decrypted data component does not satisfy the cooperative decryption strategy; or, if the second decrypted data component is determined to be the point at infinity on the cooperative elliptic curve, then the first service terminal determines that the second decrypted data component does not satisfy the cooperative decryption strategy.

[0188] It is understood that the session encrypted data also includes a second encrypted data component and a third encrypted data component. Based on the second decrypted data component and the first encrypted data component, decrypting the session service data can include: determining a decryption elliptic curve point on the cooperative elliptic curve based on the second decrypted data component and the first encrypted data component. Then, the first service terminal can extract the second encrypted data component from the session encrypted data and determine its bit length. The first service terminal can use a key derivation function to perform key expansion on the bit length and the decryption elliptic curve point to obtain a key-derived bit string. When the key-derived feature string satisfies the decryption conditions, the session service data is decrypted based on the key-derived bit string and the second encrypted data component.

[0189] It is understandable that the key derivation function can be a key derivation function (KDF) as defined in the GB / T 32918-2016.4 standard. Decrypting the elliptic curve point (x2, y2) = [r -1 [T2-C1. Where (x2, y2) represents the decrypted elliptic curve point, r represents the random mask, T2 represents the second decrypted data component, and C1 represents the first encrypted data component. The bit length of the second encrypted data component is denoted as klen; the key-derived bit string is denoted as t, which is t = KDF(x2||y2, klen), where || is used to indicate concatenation.]

[0190] It is understandable that the data type of (x2, y2) needs to be converted into the bit string corresponding to the decrypted elliptic curve point, and the key derivation function is used to expand the key based on the bit string corresponding to the decrypted elliptic curve point and the bit length of the second encrypted data component to obtain the key derivation bit string t.

[0191] This can be understood as follows: decrypting the session service data based on the key-derived bit string and the second encrypted data component may include performing an XOR operation between the key-derived bit string and the second encrypted data component to obtain the session service data. For example, this session service data is represented as M'. C2 represents the second encrypted data component. This represents the XOR operation.

[0192] It is understandable that the decryption condition may include: the key derived feature string is not a string of all zero bits. The first service terminal can determine whether the key derived feature string is a string of all zero bits. If the key derived feature string is not a string of all zero bits, it is determined that the key derived feature string meets the decryption condition. If the key derived feature string is a string of all zero bits, it is determined that the key derived feature string does not meet the decryption condition, and a third error message is output.

[0193] Furthermore, it can be understood that the first service terminal can perform hash calculations on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data; then, it extracts the third encrypted data component from the encrypted session data and compares the digest value corresponding to the session service data with the third encrypted data component; when the digest value corresponding to the session service data is the same as the third encrypted data component, it outputs the session service data. The digest value corresponding to the session service data is calculated as follows: u = Hash(x2||M'||y2), where u represents the digest value corresponding to the session service data, (x2, y2) represents the decrypted elliptic curve point, M' represents the decrypted session service data, and Hash() is a predefined cryptographic hash function in the SM2 algorithm.

[0194] It is understandable that when the digest value corresponding to the session service data is different from the third encrypted data component, the first service terminal directly outputs the fourth error message and exits the collaborative decryption process.

[0195] In this embodiment, when a first service object conducts a target session with a target service object through a first service terminal, the first service terminal can receive session encrypted data sent by the target service terminal corresponding to the target service object for session service data; the first service object is a service object in a collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object; when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, A random mask is generated by a first random number generator to mask the first encrypted data component. When the first encrypted data component is masked using the random mask to obtain mask data, a first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data. The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain a second decrypted data component after collaborative decryption processing. Upon receiving the second decrypted data component returned by the second service terminal and finding that the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component. Therefore, this application embodiment requires collaborative decryption by both parties during the session to obtain the session service data. This means that neither party can independently decrypt the session service data using their own private key. In other words, this application embodiment, by deploying the private key used for collaborative decryption on different service terminals, not only avoids the private key leakage problem caused by single-point storage of the private key, but also improves the reliability and security of the transmission of session service data sent during the session. Furthermore, it enables two service objects to collaboratively decrypt encrypted session data.

[0196] Please see Figure 6 , Figure 6 This application provides a collaborative public key generation method, which can be jointly executed by a first service terminal and a second service terminal. The collaborative public key generation method may include the following steps S201-S205:

[0197] Step S201: The first service terminal generates a first private key component for data encryption using a second random number generator. The first private key component can be represented by d1, where d1∈[2,n-1].

[0198] Step S202: When the first private key component satisfies the validity of the private key, generate the first public key component corresponding to the first private key component based on the first private key component and the base point on the cooperative elliptic curve.

[0199] It is understood that the cooperative elliptic curve here is the same elliptic curve as the cooperative elliptic curve in the aforementioned cooperative decryption strategy. The base point on the cooperative elliptic curve can be represented as G, and the order of the base point is n; the formula for calculating the first public key component is: P1 = [d1]G.

[0200] Specifically, the first service terminal can obtain the associated value and the agreed value related to the first private key component, and perform a modulo operation based on the first private key component, the associated value, and the agreed value to obtain the modulo value corresponding to the first private key component. If the modulo value corresponding to the first private key component is not equal to the target value, then the first private key component is determined to satisfy the private key validity. If the modulo value corresponding to the first private key component is equal to the target value, then the first private key component is determined not to satisfy the private key validity, and step S201 is executed.

[0201] Wherein, the aforementioned agreed-upon value can be n as defined in SM2, the associated value can be 1, and the formula for calculating the modulus value corresponding to the first private key component is: Modulus value corresponding to the first private key component = (d1-1) -1 mod n, illustrative, with a target value of 1, if (d1-1) -1 If mod n is not equal to 1, then the first private key component satisfies the private key validity requirement, and step S202 is executed. If (d1-1) -1 If mod n equals 1, then the first private key component does not satisfy the private key validity requirement, and step S201 is executed.

[0202] Step S203: The first service terminal sends the first public key component to the second service terminal. Correspondingly, the second service terminal can receive the first public key component sent by the first service terminal.

[0203] Step S204: The second service terminal generates a second private key component through a third random number generator. The second private key component can be represented by d2, where d2∈[2,n-1].

[0204] Step S205: When the second private key component satisfies the validity of the private key, a collaborative public key is generated based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve.

[0205] Specifically, the second service terminal can obtain the associated numerical value and the agreed-upon numerical value related to the second private key component, and perform a modulo operation based on the second private key component, the associated numerical value, and the agreed-upon numerical value to obtain the modulo value corresponding to the second private key component. If the modulo value corresponding to the second private key component is not equal to the target numerical value, then the second private key component is determined to satisfy the private key validity. If the modulo value corresponding to the second private key component is equal to the target numerical value, then step S204 is executed.

[0206] It is understood that the associated values ​​and agreed-upon values ​​related to the second private key component are the same as those associated with the first private key component. The formula for calculating the modulus corresponding to the second private key component is: Modulus corresponding to the second private key component = (d² - 1) -1 mod n. Indicative, the target value is 1; if (d²-1) -1 If mod n is not equal to 1, then the second private key component satisfies the private key validity requirement, and step S205 is executed. If (d2-1) -1 If mod n equals 1, then the second private key component does not satisfy the private key validity requirement, and step S204 is executed.

[0207] The collaborative public key is calculated as follows: P = [d2-1]P1 - [d2]G. Here, P represents the collaborative public key; d2 represents the second private key component; P1 represents the first public key component; and G is the base point on the collaborative elliptic curve.

[0208] It is understood that step S203 can be executed before or after step S204, and this application embodiment does not impose any limitation on this.

[0209] In this embodiment, it is understood that the second service terminal generates a second public key component based on its own second private key component and the base point on the collaborative elliptic curve, and sends the second public key component to the first service terminal. The first service terminal generates a first private key component for data encryption using a second random number generator. When the first private key component satisfies the validity of the private key, a collaborative public key is generated and published based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve. It should be understood that this embodiment does not limit the method of generating the collaborative public key.

[0210] In this embodiment, the first service terminal and the second service terminal can independently generate their own first private key components and second private key components, and then collaboratively generate a collaborative public key based on the first private key components and second private key components. This avoids the leakage problem caused by the private key being kept by one party and can ensure the security of the private key to a certain extent.

[0211] Please see Figure 7 , Figure 7 This application provides a flowchart illustrating a data processing method according to an embodiment. This data processing method can be performed by a first service terminal (i.e., the one described above). Figure 1 The data processing method, executed by the business terminal 101 in the process, may include the following steps S301-S305:

[0212] Step S301: When the first service object conducts a target session with the target service object through the first service terminal, the system receives session encrypted data for the session service data sent by the target service terminal corresponding to the target service object. The first service object is a service object in the collaborative decryption object used for data decryption. The target service object is the service object requesting data decryption. The session encrypted data is obtained by the target service terminal encrypting the session service data based on the collaborative public key associated with the collaborative decryption object. The collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object. The session encrypted data includes a first encrypted data component, a second encrypted data component, and a third encrypted data component.

[0213] Step S302: When the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, a random mask for masking the first encrypted data component is generated by the first random number generator.

[0214] Step S303: When masking the first encrypted data component with a random mask to obtain mask data, the first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data.

[0215] Specifically, the first service terminal can obtain a pre-defined value associated with the random mask, and perform a modulo operation based on the random mask and the pre-defined value to obtain the modulus value corresponding to the random mask. If the modulus value corresponding to the random mask is not equal to the mask value, the first encrypted data component is masked using the random mask to obtain mask data, and step S304 is executed. If the modulus value corresponding to the random mask is equal to the mask value, a new random mask for masking the first encrypted data component is generated using the first random number generator, and step S303 is executed.

[0216] Step S304: Send the first decrypted data component to the second service terminal corresponding to the second service object, so that when the first decrypted data component meets the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing.

[0217] Step S305: When the second decrypted data component returned by the second service terminal is received and the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component; the collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption.

[0218] Specifically, if the second decrypted data component satisfies the expression of the cooperative elliptic curve and is not at infinity on the cooperative elliptic curve, then the second decrypted data component is determined to satisfy the cooperative decryption strategy. If the second decrypted data component does not satisfy the expression of the cooperative elliptic curve, or is at infinity on the cooperative elliptic curve, then the second decrypted data component is determined not to satisfy the cooperative decryption strategy, and a first error message is output.

[0219] Specifically, it can be understood that, based on the second decrypted data component and the first encrypted data component, decrypting the session service data includes: determining decryption elliptic curve points on the cooperative elliptic curve based on the second decrypted data component and the first encrypted data component; extracting the second encrypted data component from the session encrypted data and determining the bit length of the second encrypted data component; using a key derivation function to perform key expansion on the bit length and the decryption elliptic curve points to obtain a key-derived bit string; and when the key-derived feature string satisfies the decryption conditions, decrypting the session service data based on the key-derived bit string and the second encrypted data component.

[0220] Furthermore, hash calculations are performed on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data; then, the third encrypted data component is extracted from the session encrypted data, and the digest value corresponding to the session service data is compared with the third encrypted data component; when the digest value corresponding to the session service data is the same as the third encrypted data component, the session service data is output.

[0221] In one embodiment, the first service terminal may receive a second public key component sent by the second service terminal, the second public key component being generated by the second service terminal based on the second private key component and the base point on the collaborative elliptic curve; generate a first private key component for data encryption through a second random number generator; when the first private key component satisfies the legality of the private key, collaborative public key is generated based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve; and publish the collaborative public key.

[0222] In another embodiment, a first private key component for data encryption is generated by a second random number generator; when the first private key component satisfies the validity of the private key, a first public key component for the first business object is generated based on the first private key component and the base point on the cooperative elliptic curve; the first public key component is sent to a second business terminal, so that the second business terminal generates a second private key component for data encryption by a third random number generator, and when the second private key component satisfies the validity of the private key, a cooperative public key is generated based on the second private key component, the first public key component, and the base point on the cooperative elliptic curve.

[0223] Understandably, the first business terminal can obtain the associated value and the agreed value associated with the first private key component, and perform a modulo operation based on the first private key component, the associated value, and the agreed value to obtain the modulo value corresponding to the first private key component; if the modulo value corresponding to the first private key component is not equal to the target value, then the first private key component is determined to satisfy the private key validity; if the modulo value corresponding to the first private key component is equal to the target value, then the first private key component is determined to not satisfy the private key validity, and a new first private key component for data encryption is generated through the second random number generator.

[0224] It should be understood that the first random number generator, the second random number generator, and the third random number generator can be the same random number generator or different random number generators.

[0225] In this embodiment, session service data is obtained through collaborative decryption of encrypted session data by both parties. This means that neither party can independently decrypt the session service data using their own private key. Specifically, by deploying the private key used for collaborative decryption on different service terminals, this embodiment not only avoids the private key leakage problem caused by single-point storage but also improves the reliability and security of the transmitted session service data. Furthermore, this embodiment achieves the collaborative decryption requirement among the various service objects in the collaborative decryption object by having them jointly decrypt the encrypted session data sent by the target service object.

[0226] Please see Figure 8 , Figure 8 This application provides a flowchart illustrating a data processing method. This data processing method can be executed by a second service terminal and may include the following steps S401-S403:

[0227] Step S401: Receive the first decrypted data component corresponding to the first encrypted data component sent by the first service terminal.

[0228] Specifically, the first decrypted data component is generated by the first service terminal based on the first private key component of the first service object corresponding to the first service terminal and the mask data when the first encrypted data component in the session encrypted data is masked by a random mask to obtain mask data; the random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object; the session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal; the session encrypted data is obtained by the target service terminal encrypting the session service data based on the collaborative public key associated with the collaborative decryption object; the first service object is a service object in the collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; and the collaborative public key is generated based on the first private key component and the second private key component of the second service object in the collaborative decryption object.

[0229] Step S402: When the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, the first decrypted data component is processed for collaborative decryption based on the second private key component to obtain the second decrypted data component after collaborative decryption.

[0230] It can be understood that the collaborative decryption strategy includes a collaborative elliptic curve for data decryption. If the first decrypted data component satisfies the expression of the collaborative elliptic curve and is not at infinity, then the first decrypted data component is determined to satisfy the collaborative decryption strategy associated with the collaborative decryption object. If the first decrypted data component is not a point on the elliptic curve or is at infinity on the collaborative elliptic curve, then the first decrypted data component is determined not to satisfy the collaborative decryption strategy associated with the collaborative decryption object, and a second error message is returned to the first service terminal, indicating that the first decrypted data component is erroneous.

[0231] Step S403: Return the second decrypted data component to the second service terminal so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component.

[0232] In one embodiment, the second service terminal receives a first public key component of a first service object sent by the first service terminal; the first public key component is generated by the first service terminal through the first private key component and the base point on the collaborative elliptic curve; a second private key component for data encryption is generated by a third random number generator; when the second private key component satisfies the legality of the private key, a collaborative public key is generated collaboratively based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve; and the collaborative public key is made public.

[0233] It can be understood that the second business terminal can be the target business terminal, and the target business object is the second business object. At this time, when the first business object conducts a target session with the second business object through the first business terminal, the session business data is encrypted using the collaborative public key associated with the collaborative decryption object to obtain encrypted session data, and the encrypted session data is sent to the first business terminal.

[0234] In this embodiment, each business object in the collaborative decryption object can independently generate its own private key component (i.e., the first business object generates the first private key component, and the second business object generates the second private key component), and store its own private key component separately. Furthermore, the business objects in the collaborative decryption object cannot calculate their private keys based on their individual parameters, which to some extent avoids the leakage problem caused by one party storing the private key. In addition, this embodiment achieves the requirement for collaborative decryption among the business objects in the collaborative decryption object by having each business object in the collaborative decryption object jointly decrypt the session encrypted data sent by the target business object.

[0235] Please see Figure 9 , Figure 9 This application provides a flowchart illustrating a data processing method, which can be executed by a target business terminal and may include the following steps S501-S512:

[0236] Step S501: Obtain the session service data to be encrypted. The session service data can be a bit string M, and the bit length of the session service data is klen.

[0237] Step S502: Generate a random number k for data encryption using the fourth random number generator, k∈[1,n-1].

[0238] Step S503: Calculate the first encrypted data component on the cooperative elliptic curve using a random number k and a base point on the cooperative elliptic curve. This first encrypted data component can be represented by C1, where C1 = [k]G.

[0239] Step S504: Calculate the elliptic curve points on the collaborative elliptic curve using the collaborative public key and the remainder factor.

[0240] Step S505: Determine whether the elliptic curve point is an infinite point on the cooperative elliptic curve. If the elliptic curve point is an infinite point on the cooperative elliptic curve, proceed to step S512, output an error, and exit the encryption process. If the elliptic curve point is not an infinite point on the cooperative elliptic curve, proceed to step S506.

[0241] Step S506: Based on the random number and the collaborative public key, determine the encrypted elliptic curve point on the collaborative elliptic curve. The encrypted elliptic curve point can be represented as (x2, y2), that is, [k]PB = (x2, y2), where PB represents the collaborative public key.

[0242] Step S507: Using the key derivation function KDF, the key is expanded based on the encrypted elliptic curve points and bit length to obtain the encrypted derived bit string.

[0243] It is understandable that the target service terminal can concatenate the first and second coordinate values ​​of the encrypted elliptic curve points to obtain a concatenated value, and then use KDF to perform key expansion on the concatenated value and bit length to obtain an encrypted derived bit string.

[0244] Step S508: Determine whether the encrypted derived bit string is a string of all zero bits. If the encrypted derived bit string is a string of all zero bits, proceed to step S502. If the encrypted derived bit string is not a string of all zero bits, proceed to step S509.

[0245] Step S509: Encrypt the session service data based on the encrypted derived bit string to obtain the second encrypted data component. Specifically, the target service terminal can perform an XOR operation on the encrypted derived bit string and the session service data to obtain the second encrypted data component. The second encrypted data component can be represented as C2. M represents the session data, and t represents the encrypted derived bit string.

[0246] Step S510: Calculate the digest of the encrypted elliptic curve points and session service data using the key hash function to obtain the third encrypted data component, C3 = Hash(x2||M||y2), where C3 represents the third encrypted data component, Hash() is the predefined key hash function in the SM2 algorithm, and M represents the bit string of the session service data.

[0247] Step S511: Concatenate the first encrypted data component, the second encrypted data component, and the third encrypted data component to obtain the session encrypted data, i.e., C = C1||C2||C3.

[0248] The following example, using business object A and business object B as examples of collaborative decryption objects, illustrates the entire data processing flow. The session business data is plaintext, and the session encrypted data is ciphertext. To achieve collaborative decryption of their respective private key pairs, business object A and business object B should perform the following operations:

[0249] The first business terminal corresponding to business object A performs the following steps:

[0250] A1: Receive ciphertext data C sent by the target object, extract C1 (i.e., the first encrypted data component) from C, and verify that C1 satisfies the expression of the cooperative elliptic curve; if C1 does not satisfy the expression of the cooperative elliptic curve, output an error and exit the cooperative decryption process.

[0251] A2: Calculate the point S = [h]C1 on the cooperative elliptic curve (where h is the cofactor, and h can be 1). Determine if the cooperative elliptic curve point S is at infinity. If the cooperative elliptic curve point S is at infinity, output an error message and exit the cooperative decryption of the encrypted data for this session.

[0252] A3: Use the first random number generator to generate a random mask r for masking C1, r∈[1,n-1].

[0253] A4: Calculate r -1 mod n, if r -1 If mod n equals 1, then return A3; if r -1 If mod n is not equal to 1, then proceed to step A5.

[0254] A5: Calculate R = [r]C1, where R represents the mask data;

[0255] A6: Using its own first private key component d1, calculate T1 = [d1-1]R, and send T1 to the second business terminal corresponding to business object B. T1 represents the first decrypted data component.

[0256] The second business terminal corresponding to business object B performs the following steps:

[0257] B1: Verify whether T1 satisfies the expression of the cooperative elliptic curve (i.e., whether T1 is a point on the cooperative elliptic curve). If T1 satisfies the expression of the cooperative elliptic curve, determine whether T1 is an infinite point on the cooperative elliptic curve. If T1 is not an infinite point on the cooperative elliptic curve, proceed to step B2. If T1 does not satisfy the expression of the cooperative elliptic curve or is not an infinite point on the cooperative elliptic curve, return the second error message to the first service terminal.

[0258] B2: Using your second private key component d2, calculate T2 = [d2-1]T1; where T2 is the second decrypted data component.

[0259] B3: Send T2 to the first service terminal.

[0260] The first business terminal corresponding to business object A continues to execute the following steps:

[0261] A7: Verify whether T2 satisfies the expression of the cooperative elliptic curve (i.e., whether T2 is a point on the cooperative elliptic curve). If T2 satisfies the expression of the cooperative elliptic curve, determine whether T2 is an infinite point on the cooperative elliptic curve. If T2 is not an infinite point on the cooperative elliptic curve, proceed to step A8. If T2 does not satisfy the expression of the cooperative elliptic curve or is not an infinite point on the cooperative elliptic curve, output the first error message.

[0262] A8: Calculate the decryption elliptic curve point (x2, y2) on the cooperative elliptic curve = [r^(-1)]T2-C1, where r is the random mask and C1 is the first encrypted data component.

[0263] A9: Extract the second encrypted data component C2 from C, calculate the bit length of C2, and denote this bit length as klen; use the key derivation function KDF in the GB / T 32918-2016.4 standard to calculate the key derivation bit string t = KDF(x2||y2,klen). If t is a string of all zero bits, output the third error message; if t is not a string of all zero bits, proceed to step A10.

[0264] A10: Calculate plaintext data

[0265] A11: Calculate the digest value u = Hash(x2||M'||y2) corresponding to the plaintext data; extract the third encrypted data component C3 from C. If u is not equal to C3, report an error and exit the collaborative decryption process.

[0266] A12: Output plaintext data M'.

[0267] Next, the data processing method provided in the embodiments of this application will be verified. The verification process is as follows:

[0268] Let the private key corresponding to the public key P be d. Then, the public key P is generated using the private key d and the base point G on the elliptic curve (i.e., the same as the cooperative elliptic curve mentioned above), i.e., P = [d]G. Then, according to step S205, the public key P = [d2-1]P1 - [d2]G = [(d2-1)*d1]G - [d2]G = [(d2-1)*d1]G - [d2-1]GG = [(d2-1)*(d1-1)]GG, so [d]G = [(d2-1)*(d1-1)]GG, therefore d = (d2-1)*(d1-1)-1. Then, according to steps A5 and A6, T1 = [d1-1]R = [r*(d1-1)]C1.

[0269] Further, according to step B2, T2 = [d2-1]T1 = [r*(d1-1)*(d2-1)]C1. According to step A8, (x2,y2) = [r^(-1)]T2-C1 = [r^(-1)*r*(d1-1)*(d2-1)]C1-C1 = [(d1-1)*(d2-1)]C1-C1 = [(d1-1)*(d2-1)]C1-C1 = [(d1-1)*(d2-1)-1]C1 = [d]C1. This formula is consistent with (x2,y2) = [d]C1 in the SM2 algorithm, indicating that the result is correct.

[0270] Further, please see Figure 10 , Figure 10 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. The data processing device 1 may be running on a first service terminal (i.e., the one described above). Figure 1 The data processing device 1 can be a computer program (including program code) in the business terminal 101, for example, the data processing device 1 can be an application software; the data processing device 1 can be used to execute the corresponding steps in the method provided in the embodiments of this application. The data processing device 1 may include: a receiving module 1001, a mask generation module 1002, a decrypted data component generation module 1003, a sending module 1004, and a decryption module 1005;

[0271] The receiving module 1001 is used to receive session encrypted data for session service data sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal; the first service object is a service object in the collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object;

[0272] The mask generation module 1002 is used to generate a random mask for masking the first encrypted data component when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, by using a first random number generator.

[0273] The decrypted data component generation module 1003 is used to obtain the first decrypted data component corresponding to the first encrypted data component based on the first private key component and the mask data when the first encrypted data component is masked by a random mask to obtain mask data.

[0274] The sending module 1004 is used to send the first decrypted data component to the second service terminal corresponding to the second service object, so that when the first decrypted data component meets the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing.

[0275] The decryption module 1005 is used to decrypt the session service data based on the second decrypted data component and the first encrypted data component when it receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy.

[0276] The session encrypted data includes a second encrypted data component; the collaborative decryption strategy includes a collaborative elliptic curve for data decryption; the decryption module 1005 includes an elliptic curve point determination unit 10051, an extraction unit 10052, a length determination unit 10053, a bit string determination unit 10054, and a decryption unit 10055; wherein...

[0277] Elliptic curve point determination unit 10051 is used to determine decryption elliptic curve points on a cooperative elliptic curve based on the second decrypted data component and the first encrypted data component.

[0278] Extraction unit 10052 is used to extract a second encrypted data component from the session encrypted data;

[0279] The length determination unit 10053 is used to determine the bit length of the second encrypted data component;

[0280] The bit string determination unit 10054 is used to perform key expansion on the bit length and decryption elliptic curve points using a key derivation function to obtain a key-derived bit string.

[0281] The decryption unit 10055 is used to decrypt the session service data based on the key-derived bit string and the second encrypted data component when the key-derived feature string meets the decryption conditions.

[0282] The session encrypted data also includes a third encrypted data component. The device further includes: a digest value determination module 1006, an extraction module 1007, a comparison module 1008, and an output module 1009; wherein:

[0283] The digest value determination module 1006 is used to perform hash calculation on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data.

[0284] Extraction module 1007 is used to extract a third encrypted data component from the session encrypted data;

[0285] The comparison module 1008 is used to compare the digest value corresponding to the session service data with the third encrypted data component;

[0286] The output module 1009 is used to output the session service data when the digest value corresponding to the session service data is the same as the third encrypted data component.

[0287] The device further includes: an acquisition module 1010 and a mask processing module 1011, wherein,

[0288] The acquisition module 1010 is used to acquire the agreed value associated with the random mask, and perform a modulo operation based on the random mask and the agreed value to obtain the modulo value corresponding to the random mask;

[0289] The mask processing module 1011 is used to perform mask processing on the first encrypted data component through the random mask if the modulus value corresponding to the random mask is not equal to the mask value, so as to obtain the mask data.

[0290] The mask generation module 1002 is also used for:

[0291] If the modulus value corresponding to the random mask is equal to the mask value, then a new random mask for masking the first encrypted data component is generated by the first random number generator.

[0292] The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption, and the device also includes a strategy determination module 1012.

[0293] The strategy determination module 1012 is used to determine that the second decrypted data component satisfies the cooperative decryption strategy if the second decrypted data component satisfies the expression of the cooperative elliptic curve and the second decrypted data component is not an infinite point on the cooperative elliptic curve.

[0294] The strategy determination module 1012 is further configured to: if the second decrypted data component does not satisfy the expression of the cooperative elliptic curve, or if the second decrypted data component is the point at infinity on the cooperative elliptic curve, then determine that the second decrypted data component does not satisfy the cooperative decryption strategy and output the first error message.

[0295] The device also includes: a private key component generation module 1013, a public key generation module 1014, and a public module 1015;

[0296] The receiving module 1001 is also used to receive the second public key component sent by the second service terminal. The second public key component is generated by the second service terminal based on the second private key component and the base point on the cooperative elliptic curve.

[0297] Private key component generation module 1013 is used to generate a first private key component for data encryption by using a second random number generator.

[0298] The public key generation module 1014 is used to collaboratively generate a collaborative public key based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve when the first private key component satisfies the legality of the private key.

[0299] Public module 1015 is used to publish the collaborative public key.

[0300] The device also includes: a public key component generation module 1016;

[0301] Private key component generation module 1013 is used to generate a first private key component for data encryption by using a second random number generator.

[0302] The public key component generation module 1016 is used to generate the first public key component of the first business object based on the first private key component and the base point on the cooperative elliptic curve when the first private key component satisfies the legality of the private key.

[0303] The sending module 1004 is used to send the first public key component to the second service terminal so that the second service terminal can generate the second private key component for data encryption through the third random number generator, and generate the collaborative public key based on the second private key component, the first public key component and the base point on the collaborative elliptic curve when the second private key component satisfies the legality of the private key.

[0304] The device also includes: a legality determination module 1017;

[0305] The acquisition module 1010 is used to acquire the associated value and the agreed value associated with the first private key component, and to perform a modulo operation based on the first private key component, the associated value and the agreed value to obtain the modulo value corresponding to the first private key component.

[0306] The legality determination module 1017 is used to determine that the first private key component satisfies the legality of the private key if the modulus value corresponding to the first private key component is not equal to the target value.

[0307] The legality determination module 1017 is further used to determine that the first private key component does not meet the private key legality requirement if the modulus value corresponding to the first private key component is equal to the target value.

[0308] The private key component generation module 1013 is used to generate a first private key component for data encryption via a second random number generator.

[0309] In this embodiment, when a first service object conducts a target session with a target service object through a first service terminal, the first service terminal can receive session encrypted data sent by the target service terminal corresponding to the target service object for session service data; the first service object is a service object in a collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object; when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, A random mask is generated by a first random number generator to mask the first encrypted data component. When the first encrypted data component is masked using the random mask to obtain mask data, a first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data. The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain a second decrypted data component after collaborative decryption processing. Upon receiving the second decrypted data component returned by the second service terminal and finding that the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component. Therefore, the embodiments of this application require that the session business data be obtained through collaborative decryption by both parties during the session. This means that neither party can independently decrypt the session business data during the session using its own private key. In other words, by deploying the private key used for collaborative decryption on different business terminals, the embodiments of this application can not only avoid the problem of private key leakage caused by single-point storage of private keys, but also improve the transmission reliability and security of the session business data sent during the session.

[0310] Further, please see Figure 11 , Figure 11 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. The data processing device 2 can be running on a second service terminal (i.e., the one described above). Figure 1The data processing device 2 can be an application software, for example, a computer program (including program code) in the business terminal 102; the data processing device 2 can be used to execute the corresponding steps in the method provided in the embodiments of this application. The data processing device 2 may include: a receiving module 1101, a collaborative decryption module 1102, and a return module 1103.

[0311] The receiving module 1101 is used to receive a first decrypted data component corresponding to a first encrypted data component sent by a first service terminal. The first decrypted data component is generated by the first service terminal based on a first private key component and a mask data when the first service terminal performs masking processing on the first encrypted data component in the session encrypted data using a random mask to obtain mask data. The random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. The session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal. The first service object is a service object in the collaborative decryption object used for data decryption. The target service object is a service object used for data encryption. The session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object. The collaborative public key is generated based on the first private key component and the second private key component of the second service object in the collaborative decryption object.

[0312] The collaborative decryption module 1102 is used to perform collaborative decryption processing on the first decrypted data component based on the second private key component when the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, so as to obtain the second decrypted data component after collaborative decryption processing.

[0313] The return module 1103 is used to return a second decrypted data component to the second service terminal, so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component.

[0314] The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption; the device also includes a strategy determination module 1104.

[0315] The strategy determination module 1104 is used to determine that the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object if the first decrypted data component satisfies the expression of the collaborative elliptic curve and the first decrypted data component is not an infinite point on the collaborative elliptic curve.

[0316] The strategy determination module 1104 is further configured to determine that the first decrypted data component does not satisfy the collaborative decryption strategy associated with the collaborative decryption object if the first decrypted data component does not satisfy the expression of the collaborative elliptic curve or the first decrypted data component is not the point of infinity on the collaborative elliptic curve.

[0317] The return module 1103 is used to return a second error message to the first service terminal. The second error message is used to indicate that the first decrypted data component is incorrect.

[0318] The device also includes: a private key component generation module 1105, a public key generation module 1106, and a public module 1107;

[0319] The receiving module 1101 is used to receive the first public key component of the first service object sent by the first service terminal; the first public key component is generated by the first service terminal through the first private key component and the base point on the cooperative elliptic curve;

[0320] Private key component generation module 1105 is used to generate a second private key component for data encryption via a third random number generator.

[0321] The public key generation module 1106 is used to generate a collaborative public key based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve when the second private key component satisfies the legality of the private key;

[0322] Public module 1107 is used to publish the collaborative public key.

[0323] The second service terminal is the target service terminal, the target service object is the second service object, and the device also includes: an acquisition module 1108, an encryption module 1109 and a sending module 1110.

[0324] The acquisition module 1108 is used to acquire session service data when the first service object conducts a target session with the second service object through the first service terminal;

[0325] The encryption module 1109 is used to encrypt session business data using the collaborative public key associated with the collaborative decryption object to obtain encrypted session data.

[0326] The sending module 1110 is used to send session encrypted data to the first service terminal.

[0327] In this embodiment, when a first service object conducts a target session with a target service object through a first service terminal, the first service terminal can receive session encrypted data sent by the target service terminal corresponding to the target service object for session service data; the first service object is a service object in a collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated based on the first private key component of the first service object and the second private key component of the second service object in the collaborative decryption object; when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, A random mask is generated by a first random number generator to mask the first encrypted data component. When the first encrypted data component is masked using the random mask to obtain mask data, a first decrypted data component corresponding to the first encrypted data component is obtained based on the first private key component and the mask data. The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain a second decrypted data component after collaborative decryption processing. Upon receiving the second decrypted data component returned by the second service terminal and finding that the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component. Therefore, this application embodiment requires collaborative decryption by both parties during the session to obtain the session service data. This means that neither party can independently decrypt the session service data using their own private key. In other words, this application embodiment, by deploying the private key used for collaborative decryption on different service terminals, not only avoids the private key leakage problem caused by single-point storage of the private key, but also improves the reliability and security of the transmission of session service data sent during the session. Further, please refer to... Figure 12 , Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 12 As shown, the computer device 1000 can be a first service terminal, for example, the one described above. Figure 1 The first service terminal 101 in the corresponding embodiment; or the computer device 1000 can be a second service terminal, for example, as described above. Figure 1The corresponding embodiment includes a second service terminal 102. The computer device 1000 may include a processor 1201, a network interface 1204, and a memory 1205. Furthermore, the computer device 1000 may also include a user interface 1203 and at least one communication bus 1202. The communication bus 1202 is used to enable communication between these components. The user interface 1203 may include a standard wired interface and a wireless interface. The network interface 1204 may optionally include a standard wired interface and a wireless interface (such as a Wi-Fi interface). The memory 1205 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1205 may also be at least one storage device located remotely from the aforementioned processor 1201. Figure 12 As shown, the memory 1205, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application.

[0328] The network interface 1204 in the computer device 1000 can also provide network communication functionality. Figure 12 In the computer device 1000 shown, the network interface 1204 provides network communication functionality; the user interface 1203 is mainly used to provide an input interface for the user; and the processor 1201 can be used to call the device control application stored in the memory 1205 to execute the aforementioned... Figures 5-8 The method described in the corresponding embodiment can also be executed as described above. Figure 10 The description of the data processing device 1 in the corresponding embodiment or the execution of the foregoing Figure 11 The description of the data processing device 1 in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated here.

[0329] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores the aforementioned data processing apparatus 1 or a computer program executed by the data processing apparatus, and the computer program includes computer instructions. When the processor executes the computer instructions, it can execute the aforementioned... Figures 5-8The descriptions of the methods in the corresponding embodiments are already provided and will not be repeated here. Similarly, the beneficial effects of using the same methods will not be repeated here either. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the descriptions of the method embodiments of this application. As an example, computer instructions can be deployed and executed on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network. These multiple computing devices distributed across multiple locations and interconnected via a communication network can constitute a blockchain system.

[0330] Furthermore, it should be noted that this application also provides a computer program product or computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions, causing the computer device to perform the aforementioned actions. Figures 5-8 The methods described in the corresponding embodiments are already known, and therefore will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer program products or computer program embodiments related to this application, please refer to the description of the method embodiments of this application.

[0331] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0332] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, The method is executed by a first service terminal, and the method includes: When the first business object conducts a target session with the target business object through the first business terminal, it receives session encrypted data for the session business data sent by the target business terminal corresponding to the target business object; the first business object is a business object in a collaborative decryption object used for data decryption; the target business object is a business object used for data encryption; the session encrypted data is obtained by the target business terminal encrypting the session business data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated by the first business terminal based on the first private key component and the second public key component of the first business object, and the second public key component is generated by the second business terminal based on the second private key component of the second business object in the collaborative decryption object; When the first encrypted data component in the session encrypted data satisfies the collaborative decryption policy associated with the collaborative decryption object, a random mask for masking the first encrypted data component is generated by a first random number generator. Obtain the agreed-upon value associated with the random mask, and perform a modulo operation based on the random mask and the agreed-upon value to obtain the modulus value corresponding to the random mask; the agreed-upon value is the order of the base point on the cooperative elliptic curve; If the modulus value corresponding to the random mask is not equal to the mask value, then the first encrypted data component is masked using the random mask to obtain mask data; the mask value is used to verify whether the random mask is usable. Based on the first private key component and the mask data, the first decrypted data component corresponding to the first encrypted data component is obtained; The first decrypted data component is sent to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing. When the second decrypted data component is received from the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, the session service data is decrypted based on the second decrypted data component and the first encrypted data component. The collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption. The second decrypted data component satisfies the collaborative decryption strategy by: if the second decrypted data component satisfies the expression of the collaborative elliptic curve and the second decrypted data component is not an infinity point on the collaborative elliptic curve, then the second decrypted data component is determined to satisfy the collaborative decryption strategy.

2. The method according to claim 1, characterized in that, The session encrypted data includes a second encrypted data component; the collaborative decryption strategy includes a collaborative elliptic curve for data decryption; The process of decrypting the session service data based on the second decrypted data component and the first encrypted data component includes: Based on the second decrypted data component and the first encrypted data component, a decryption elliptic curve point is determined on the cooperative elliptic curve. Extract the second encrypted data component from the session encrypted data and determine the bit length of the second encrypted data component; The key derivation function is used to extend the bit length and the decryption elliptic curve points to obtain the key-derived bit string; When the key-derived bit string meets the decryption conditions, the session service data is obtained by decryption based on the key-derived bit string and the second encrypted data component.

3. The method according to claim 2, characterized in that, The session encrypted data also includes a third encrypted data component, and the method further includes: A hash calculation is performed on the decrypted session service data and the decrypted elliptic curve points to obtain the digest value corresponding to the session service data. Extract the third encrypted data component from the encrypted session data, and compare the digest value corresponding to the session service data with the third encrypted data component; When the digest value corresponding to the session service data is the same as the third encrypted data component, the session service data is output.

4. The method according to claim 1, characterized in that, The method further includes: If the modulus value corresponding to the random mask is equal to the mask value, then a new random mask for masking the first encrypted data component is generated by the first random number generator.

5. The method according to claim 1, characterized in that, The method further includes: Receive the second public key component sent by the second service terminal, the second public key component being generated by the second service terminal based on the second private key component and the base point on the cooperative elliptic curve; A first private key component for data encryption is generated using a second random number generator. When the first private key component satisfies the private key validity, the collaborative public key is collaboratively generated based on the first private key component, the second public key component, and the base point on the collaborative elliptic curve. The collaborative public key is made public.

6. The method according to claim 1, characterized in that, The method further includes: A first private key component for data encryption is generated using a second random number generator. When the first private key component satisfies the private key validity, the first public key component of the first business object is generated based on the first private key component and the base point on the cooperative elliptic curve. The first public key component is sent to the second service terminal so that the second service terminal generates a second private key component for data encryption through a third random number generator, and when the second private key component satisfies the legality of the private key, the first public key component and the base point on the collaborative elliptic curve are collaboratively generated to generate the collaborative public key.

7. The method according to claim 5 or 6, characterized in that, The method further includes: Obtain the associated value and the agreed value associated with the first private key component. Perform a modulo operation based on the first private key component, the associated value, and the agreed value to obtain the modulo value corresponding to the first private key component, wherein the modulo value corresponding to the first private key component = (first private key component - associated value). -1 mod specifies the numerical value; If the modulus value corresponding to the first private key component is not equal to the target value, then the first private key component is determined to satisfy the private key validity. The target value and the associated value are used to verify the validity of the first private key component.

8. The method according to claim 7, characterized in that, The method further includes: If the modulus value corresponding to the first private key component is equal to the target value, then the first private key component is determined to be invalid, and a new first private key component for data encryption is generated by the second random number generator.

9. A data processing method, characterized in that, The method is executed by the second service terminal, and the method includes: The system receives a first decrypted data component corresponding to a first encrypted data component sent by a first service terminal. The first decrypted data component is generated by the first service terminal based on a first private key component and the mask data when the first service terminal performs masking processing on the first encrypted data component in the session encrypted data using the random mask, provided the modulus of the random mask is not equal to the mask value. The random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. The session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal. The first service object is used for data decryption. The target business object is a business object within the collaborative decryption object; the target business object is a business object used for data encryption; the session encrypted data is obtained by the target business terminal encrypting the session business data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated by the first business terminal based on the first private key component and the second public key component; the second public key component is generated by the second business terminal based on the second private key component of the second business object in the collaborative decryption object; the modulus value corresponding to the random mask is obtained by the first business terminal performing modulo operation based on the random mask and the agreed value after obtaining the agreed value associated with the random mask; the agreed value is the order of the base point on the collaborative elliptic curve; the mask value is used to verify whether the random mask is usable. When the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, the first decrypted data component is subjected to collaborative decryption processing based on the second private key component to obtain the second decrypted data component after collaborative decryption processing. The second decrypted data component is returned to the second service terminal so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component. The collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption. The second decrypted data component satisfies the collaborative decryption strategy by: if the second decrypted data component satisfies the expression of the collaborative elliptic curve and the second decrypted data component is not an infinity point on the collaborative elliptic curve, then the second decrypted data component is determined to satisfy the collaborative decryption strategy.

10. The method as described in claim 9, characterized in that, The collaborative decryption strategy includes a collaborative elliptic curve for performing collaborative decryption; the method further includes: If the first decrypted data component satisfies the expression of the cooperative elliptic curve, and the first decrypted data component is not an infinity point on the cooperative elliptic curve, then it is determined that the first decrypted data component satisfies the cooperative decryption strategy associated with the cooperative decryption object.

11. The method as described in claim 10, characterized in that, The method further includes: If the first decrypted data component does not satisfy the expression of the cooperative elliptic curve, or if the first decrypted data component is not the point of infinity on the cooperative elliptic curve, then it is determined that the first decrypted data component does not satisfy the cooperative decryption strategy associated with the cooperative decryption object, and a second error message is returned to the first service terminal. The second error message is used to indicate that the first decrypted data component is erroneous.

12. The method as described in claim 9, characterized in that, The method further includes: Receive the first public key component of the first service object sent by the first service terminal; the first public key component is generated by the first service terminal through the first private key component and the base point on the cooperative elliptic curve; A second private key component for data encryption is generated using a third random number generator; When the second private key component satisfies the private key validity, the collaborative public key is collaboratively generated based on the second private key component, the first public key component, and the base point on the collaborative elliptic curve. The collaborative public key is made public.

13. The method as described in claim 9, characterized in that, The second service terminal is the target service terminal, the target service object is the second service object, and the method further includes: When the first business object conducts a target session with the second business object through the first business terminal, the session business data is obtained, and the session business data is encrypted using the collaborative public key associated with the collaborative decryption object to obtain encrypted session data. Send the encrypted session data to the first service terminal.

14. A data processing apparatus, characterized in that, The data processing device is installed in the first service terminal, and the device includes: The receiving module is configured to receive session encrypted data for session service data sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal; the first service object is a service object in a collaborative decryption object used for data decryption; the target service object is a service object used for data encryption; the session encrypted data is obtained by the target service terminal encrypting the session service data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated by the first service terminal based on the first private key component and the second public key component of the first service object, and the second public key component is generated by the second service terminal based on the second private key component of the second service object in the collaborative decryption object; A mask generation module is used to generate a random mask for masking the first encrypted data component when the first encrypted data component in the session encrypted data satisfies the collaborative decryption strategy associated with the collaborative decryption object, by using a first random number generator. The acquisition module is used to acquire a predefined value associated with the random mask, and perform a modulo operation based on the random mask and the predefined value to obtain the modulus value corresponding to the random mask; the predefined value is the order of the base point on the cooperative elliptic curve; The masking module is used to mask the first encrypted data component using the random mask if the modulus value corresponding to the random mask is not equal to the mask value, thereby obtaining mask data; the mask value is used to verify whether the random mask is usable. The decrypted data component generation module is used to obtain the first decrypted data component corresponding to the first encrypted data component based on the first private key component and the mask data. The sending module is used to send the first decrypted data component to the second service terminal corresponding to the second service object, so that when the first decrypted data component satisfies the collaborative decryption strategy, the second service terminal performs collaborative decryption processing on the first decrypted data component based on the second private key component to obtain the second decrypted data component after collaborative decryption processing. The decryption module is used to decrypt the session service data based on the second decrypted data component and the first encrypted data component when it receives a second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy. The collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption and a strategy determination module, which determines that the second decrypted data component satisfies the collaborative decryption strategy if the second decrypted data component satisfies the expression of the collaborative elliptic curve and the second decrypted data component is not an infinity point on the collaborative elliptic curve.

15. A data processing apparatus, characterized in that, The data processing device is located in the second service terminal, and the device includes: The receiving module is configured to receive a first decrypted data component corresponding to a first encrypted data component sent by a first service terminal. The first decrypted data component is generated by the first service terminal based on a first private key component and the mask data when the first service terminal performs masking processing on the first encrypted data component in the session encrypted data using the random mask, provided that the modulus of the random mask is not equal to the mask value. The random mask is generated by the first service terminal using a first random number generator when the first encrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object. The session encrypted data is sent by the target service terminal corresponding to the target service object when the first service object conducts a target session with the target service object through the first service terminal. The first service object is a collaborative decryption mechanism used for data decryption. The target business object is a business object used for data encryption; the session encrypted data is obtained by the target business terminal encrypting the session business data using a collaborative public key associated with the collaborative decryption object; the collaborative public key is generated by the first business terminal based on the first private key component and the second public key component of the first business object, and the second public key component is generated by the second business terminal based on the second private key component of the second business object in the collaborative decryption object; the modulus value corresponding to the random mask is obtained by the first business terminal performing modulo operation based on the random mask and the agreed value after obtaining the agreed value associated with the random mask; the agreed value is the order of the base point on the collaborative elliptic curve; the mask value is used to verify whether the random mask is usable. The collaborative decryption module is used to perform collaborative decryption processing on the first decrypted data component based on the second private key component when the first decrypted data component satisfies the collaborative decryption strategy associated with the collaborative decryption object, so as to obtain the second decrypted data component after collaborative decryption processing. The return module is used to return the second decrypted data component to the second service terminal, so that when the first service terminal receives the second decrypted data component returned by the second service terminal and the second decrypted data component satisfies the collaborative decryption strategy, it can decrypt the session service data based on the second decrypted data component and the first encrypted data component. The collaborative decryption strategy includes a collaborative elliptic curve for collaborative decryption. The second decrypted data component satisfies the collaborative decryption strategy by: if the second decrypted data component satisfies the expression of the collaborative elliptic curve and the second decrypted data component is not an infinity point on the collaborative elliptic curve, then the second decrypted data component is determined to satisfy the collaborative decryption strategy.

16. A computer device, characterized in that, include: A processor is used to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, performs the data processing method as described in any one of claims 1-13.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the data processing method as described in any one of claims 1-13.

18. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data processing method as described in any one of claims 1-13.

Images