A flexible scalable multi-data encryption and decryption method

Abstract

The application relates to the technical field of data processing, in particular to a flexible multi-data encryption and decryption method.A flexible multi-data encryption and decryption method is characterized by comprising the following steps: S1, establishing a key library scheme; S2, configuring a key library management center; S3, selecting a key management mode; S4, establishing a scene scheme configuration center; S5, user information is accessed to a system, an encryption scheme is selected, user private data is encrypted or masked and then stored; and S6, data decryption, a mall and a detail page of a middle station display user information in a plaintext mode, and the plaintext is pushed to a peripheral system.Compared with the prior art, a friendly configuration interface is provided, a plurality of data encryption and decryption modes are provided for users, flexible expansion is supported, and the application realizes automatic processing of a program, so that user private data is de-identified and anonymized in the safest mode.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically a flexible and expandable multi-data encryption and decryption method. Background Technology

[0002] With the rapid development of the internet and information technology, users' personal information is constantly being collected, stored, and used. This information may include sensitive information such as names, contact information, and addresses. If this information is leaked or misused, it may cause serious harm to users.

[0003] In 2017, the State issued GB / T 35273-2017 "Information Security Technology - Personal Information Security Specification"; in March 2020, the national standard GB / T 35273-2020 "Information Security Technology - Personal Information Security Specification," under the jurisdiction of the National Information Security Standardization Technical Committee, was officially released and will be implemented on October 1, 2020. The specification clearly stipulates the collection, storage, and use of personal information, and stipulates that personal information subjects have the rights to query, correct, delete, withdraw authorization, cancel accounts, and obtain copies of their personal information. The main technical changes are as follows:

[0004] (1) The following content has been added: “Autonomous selection of multiple business functions”, “Use restrictions on user profiles”, “Use of personalized display”, “Aggregation and integration of personal information collected based on different business purposes”, “Third-party access management”, “Personal information security project”, and “Personal information processing activity record”.

[0005] (2) The following content has been revised: “Exceptions to obtaining authorization and consent”, “Cancellation of account by personal information subject”, “Clarification of responsible departments and personnel”, and Appendix C “Methods for realizing the autonomous will of personal information subject”.

[0006] (3) The requirements for personal biometric information should be refined and improved.

[0007] To better protect user privacy, it is necessary to simultaneously achieve data de-identification and anonymization. To address this issue, this invention proposes a flexible and scalable multi-data encryption and decryption method, providing users with multiple data encryption and decryption options and supporting flexible expansion. The invention enables automatic processing by the program to achieve user privacy data de-identification and anonymization in the most secure way, effectively protecting user privacy while also improving data security and reliability. Summary of the Invention

[0008] To overcome the shortcomings of existing technologies, this invention provides a flexible and expandable multi-data encryption and decryption method.

[0009] To achieve the above objectives, a flexible and scalable multi-data encryption and decryption method is designed, characterized by the following steps:

[0010] S1, Establish a key store scheme;

[0011] S2, Configure the key store management center;

[0012] S3, Select key escrow method;

[0013] S4, establish a scenario solution configuration center;

[0014] S5, the user information access system selects an encryption scheme and stores user privacy data after encryption or masking;

[0015] S6, data decryption, displays user information in plain text on the mall and middle platform details page, and pushes it to external systems in plain text;

[0016] The specific method for step S5 is as follows:

[0017] S51, Data access system, determine whether it is necessary to enable information security level protection. If it is necessary to enable information security level protection, proceed to step S52. If it is not necessary to enable information security level protection, proceed to step S56.

[0018] S52, obtain key-related configuration information, determine the source of key information acquisition based on the key escrow method, and obtain key information escrowed from different key management centers;

[0019] S53 performs client data encryption and generates an encrypted result;

[0020] S54. Determine whether to enable centralization. If centralization is enabled, proceed to step S55. If centralization is not required, proceed to step S56.

[0021] S55: Generate a UUID storage mapping relationship for the encryption result and return the UUID;

[0022] S56 stores encrypted data.

[0023] In step S1, the key library scheme includes a self-developed key library and an industry-specific key library, and supports key library expansion and updates.

[0024] In step S2, the key repository management center is configured to support the management of multiple key repositories. The key source configuration includes one or more of self-developed data sources and industry solution data sources, and supports the expansion and addition of data sources.

[0025] When the key source type is a self-developed data source, the key source configuration includes key source code, key source name, key source type, and activation status; when the key source type is an industry solution data source, the key source configuration includes key source code, key source name, key source type, server-side encryption type, third-party key service access KEY, third-party key service access KEY key, third-party key service region, whether via HTTP request, and activation status.

[0026] In the scenario solution configuration, the self-developed data source configuration includes the self-developed key value encoding, the self-developed key value name, and the self-developed key value.

[0027] In step S4, when the key source type in the scenario scheme configuration is a self-developed data source, the encrypted scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, self-developed key value code, service prefix, and enabled status; when the key source type is an industry solution data source, the encrypted scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, key type, third-party key service encryption CMK ID, service prefix, and enabled status.

[0028] In step S5, the client encryption type includes one or more of the following: AES symmetric encryption, RSA asymmetric encryption, RSA2 asymmetric encryption, XOR encryption, and PBE_WITH_MD5_AND_DES symmetric encryption. The types of encryption algorithms can be expanded and updated.

[0029] The multi-data encryption and decryption method with flexible expansion according to claim 1 is characterized in that: in step S5, it supports editing the encryption scenario configuration, which ensures security without affecting the query and use of historical data; adding or modifying configuration information does not require restarting related services, and is refreshed periodically.

[0030] In step S5, a custom 6-character prefix can be configured to quickly identify the source of encrypted content.

[0031] In step S5, key configuration information can be written to the server cache. When the service is started or during the first encryption / decryption, the configured key information will be loaded from the key service. Subsequent calls will directly read the cache to speed up the response.

[0032] In step S5, local caching is supported, and the component adds a second-level cache. If a large amount of the same data is encrypted or decrypted, the lower-level encryption logic call can be avoided, and the local cache can respond quickly.

[0033] The specific method of step S6 is as follows: After the encrypted data is accessed by the system, it is determined whether to encrypt the data based on whether the information security level protection configuration is enabled. If the information security level protection is enabled, it is determined whether the system is neutralized. If the centralization is enabled, the actual encrypted data needs to be obtained based on the mapping relationship between the UUID and the encryption information. Then, the key-related configuration information needs to be obtained. The source of the key information is determined based on the key hosting method. The key information hosted by different key management centers is obtained. The client data is decrypted and the decrypted data is returned. The business system displays the data or sends it back to the third-party system.

[0034] The client encryption process in step S5 is as follows:

[0035] The encryption result for:

[0036]

[0037]

[0038]

[0039]

[0040]

[0041] in Indicates the data to be encrypted The first data encryption is completed using the configured encryption algorithm. Indicates will The result is assembled into JSON. Indicates will The result is then HAND encrypted. Indicates will The result is transposed, with n transposed digits. Indicates will The result is appended with a service prefix, the content of which is "pre";

[0042] The client-side decryption process in step S6 is as follows:

[0043] The decryption result for:

[0044]

[0045]

[0046]

[0047]

[0048]

[0049] in This indicates that the data to be decrypted Remove the concatenated service prefix; the service prefix content is now "pre". Indicates will The result is then transposed for both the first and last digits. Indicates will The result is then decrypted using a HAND method. express The result is parsed into JSON. Indicates will The data is decrypted based on the configured encryption algorithm.

[0050] Compared with existing technologies, this invention provides a user-friendly configuration interface, offers users multiple data encryption and decryption methods, and supports flexible expansion. The invention enables automatic processing by the program, achieving the de-identification and anonymization of user privacy data in the most secure way. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of the main steps of the present invention.

[0052] Figure 2 This is a schematic diagram of the main functional data encryption and storage steps of the present invention.

[0053] Figure 3 This is a schematic diagram illustrating the main functional data decryption and display steps of the present invention.

[0054] Figure 4 This is a schematic diagram illustrating the main function of the present invention: the data encryption and decryption process without enabling centralized data processing.

[0055] Figure 5 This is a schematic diagram illustrating the main functional data encryption / decryption process of the present invention, which initiates centralized data processing.

[0056] Figure 6 The main function of this invention is to provide a diagram of the results without enabling centralized encryption.

[0057] Figure 7 This is a schematic diagram illustrating the main application scenarios of the present invention.

[0058] Figure 8 This is a schematic diagram of data transmission according to the present invention.

[0059] Figure 9 This invention relates to software design UML. Figure 1 .

[0060] Figure 10This invention relates to software design UML. Figure 2 . Detailed Implementation

[0061] The present invention will now be further described with reference to the accompanying drawings.

[0062] like Figures 1 to 3 As shown, this embodiment is a flexible and expandable multi-data encryption and decryption method, including the following steps:

[0063] S1, Establish a key store scheme;

[0064] S2, Configure the key store management center;

[0065] S3, Select key escrow method;

[0066] S4, establish a scenario solution configuration center;

[0067] S5, the user information access system selects an encryption scheme and stores user privacy data after encryption or masking;

[0068] S6, data decryption, displays user information in plain text on the mall and middle platform details page, and pushes it to external systems in plain text;

[0069] In step S1, the key library scheme includes a self-developed key library and an industry-specific key library, and supports key library expansion.

[0070] In step S2, the key repository management center is configured to support the management of multiple key repositories. The key source configuration includes multiple data sources: self-developed data sources, industry solution data sources such as user master key management and credential management, and supports data source expansion.

[0071] As shown in Table 1, this invention supports unified data management across multiple key repository management centers.

[0072] Keystore Management Center Key management quantity HAND Self-Developed Key Management Center 2000w Industry Solution 1 User Master Key Management Center 10000w Industry Solution 2: Credential Management Center 15000w Industry Solution 3 Key Management Center 1000w

[0073] Table 1

[0074] In step S2, when the key source type is a self-developed data source, the key source configuration includes key source code, key source name, key source type, and activation status; when the key source type is an industry solution data source, the key source configuration includes key source code, key source name, key source type, server encryption type, third-party key service access KEY, third-party key service access KEY key, third-party key service region, whether via HTTP request, and activation status.

[0075] In step S3, the scenario solution configuration includes the self-developed key value encoding, self-developed key value name, and self-developed key value.

[0076] In step S3, when the key source type in the scenario scheme configuration is a self-developed data source, the encrypted scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, self-developed key value code, service prefix, and enabled status; when the key source type is an industry solution data source, the encrypted scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, key type, third-party key service encryption CMK ID, service prefix, and enabled status.

[0077] As shown in Table 2, this invention supports the selection of multiple key repository management centers, multiple encryption schemes, and custom service prefixes, enabling configuration for multiple scenarios.

[0078] Scenario Solution Keystore Management Center Encryption scheme Service prefix Scenario A HAND Self-Developed Key Management Center AES encryption scheme JDOMC0 Scene B Industry Solution 1 User Master Key Management Center RSA encryption scheme TMASC0 Scene C Industry Solution 2: Credential Management Center HAND encryption scheme HANDEC Scene D Industry Solution 3 Key Management Center XOR encryption scheme MEMBER

[0079] Table 2

[0080] The specific method for step S5 is as follows:

[0081] S51, Data access system, determine whether to enable information security compliance. If to enable, proceed to step S52; otherwise, proceed to step S56. S52, Obtain key-related configuration information, determine the source of key information acquisition based on the key hosting method, and obtain key information hosted by different key management centers. S53, Perform client data encryption processing and generate encryption results. S54, Determine whether to enable centralization. If centralization is enabled, proceed to step S55; otherwise, proceed to step S56. S55, Generate a UUID storage mapping relationship for the encryption result and return the UUID. S56, Store the encrypted data.

[0082] In step S5, local caching is supported, and components add a second-level cache. If a large amount of the same data is encrypted or decrypted, the lower-level encryption logic can be bypassed and the local cache can respond quickly.

[0083] In step S5, the client encryption type supports AES symmetric encryption, RSA asymmetric encryption, RSA2 asymmetric encryption, XOR encryption, and PBE_WITH_MD5_AND_DES symmetric encryption, and the encryption algorithm can be extended.

[0084] In step S5, it is possible to edit the encrypted scenario configuration, which ensures security without affecting the query and use of historical data; adding or modifying configuration information does not require restarting related services, and the information is refreshed periodically.

[0085] In step S5, a custom 6-character prefix can be configured to quickly identify the source of encrypted content, such as marking the source module or source system.

[0086] In step S5, key configuration information can be written to the server cache. When the service is started or during the first encryption / decryption, the configured key information will be loaded from the key service. Subsequent calls will directly read the cache to speed up the response.

[0087] The specific method for step S6 is as follows: After the encrypted data is accessed into the system, it is determined whether to encrypt the data based on whether the information security level protection configuration is enabled. If the information security level protection is enabled, it is determined whether the system is neutralized. If the centralization is enabled, the actual encrypted data needs to be obtained based on the mapping relationship between the UUID and the encryption information. Then, it is necessary to obtain the key-related configuration information, determine the source of the key information based on the key hosting method, obtain the key information hosted by different key management centers, decrypt the client data, return the decrypted data, and the business system displays the data or sends it back to the third-party system.

[0088] like Figure 4 As shown, this invention supports a content encryption protection mechanism when centralized configuration for data encryption and decryption is not enabled.

[0089] The client encryption process in step S5 is as follows: encryption result for:

[0090]

[0091]

[0092]

[0093]

[0094]

[0095] in Indicates the data to be encrypted The first data encryption is completed using the configured encryption algorithm. Indicates will The result is assembled into JSON. Indicates will The result is then HAND encrypted. Indicates will The result is transposed, with n transposed digits. Indicates will The result is concatenated with a service prefix, the content of which is "pre".

[0096] The client-side decryption process in step S6 is as follows: Decryption result for:

[0097]

[0098]

[0099]

[0100]

[0101]

[0102] in This indicates that the data to be decrypted Remove the concatenated service prefix; the service prefix content is now "pre". Indicates will The result is then transposed for both the first and last digits. Indicates will The result is then decrypted using a HAND method. express The result is parsed into JSON. Indicates will The data is decrypted based on the configured encryption algorithm.

[0103] As shown in Table 3, this invention supports access to multiple business data and multiple data sources, allows selection of suitable scenario solutions, and unifies the final data encryption format.

[0104] Business data Data source Scenario Solution Data to be encrypted Encryption result Order address JD Scenario A Tiananmen Square, Dongcheng District, Beijing JDOMC00011ElkIjo0MX0=……eyJjbGllbnR After-sales address TM Scene B No. 1 Huilian Road, Qingpu District, Shanghai TMASC00009JZCI6NDF9……eyJjbGllb Merchant Information EC Scene C Shanghai Hand Information Technology Co., Ltd. HANDEC0000eyJjb……0MX0= User Information MEMBER Scene D Li Si, 13111112222 MEMBER00056NDF9……eyJjb

[0105] Table 3

[0106] like Figure 5 As shown, this invention supports centralized encryption management. If the text to be encrypted is too long, the encryption result will also be very long, which will waste storage space. When the component encryption centralized function is enabled, the encryption component will map the long text and convert it into a short text UUID and return it, which is convenient for users to store.

[0107] like Figure 6 As shown in the figure, the data encryption result of this invention is displayed in this embodiment. The first 6 bits are the service prefix, the 7th to 10th bits are the limit on the number of transpose bits, the 11th to (11+X) and the last X bits are the transpose contents (X is a random number from 0 to 30 bits), and the bits after the 11th bit are the complete HAND ciphertext.

[0108] As shown in Table 4, this invention employs multiple data encryption methods to ensure data security.

[0109] Data to be encrypted First data encryption Data assembly HNAD's self-developed encryption algorithm Transpose Encryption Service prefix concatenation Tiananmen Square, Dongcheng District, Beijing KU0iJs4EIrlE / 2YqYxuGPOyiV3ftqT1J1 {"clientSecretType":"AES","encryptContent":"KU0iJs4EIrlE / 2YqYxuGPOyiV3ftqT1J1","keyId":"JDOMC0","secretVersionNumber":"mr0010","sourceCode":"HAND","tenantId":0} eyJjbGllbnR……ElkIjo0MX0= 0011ElkIjo0MX0=……eyJjbGllbnR JDOMC00011ElkIjo0MX0=……eyJjbGllbnR No. 1 Huilian Road, Qingpu District, Shanghai APO56jJZCI6NDF9OyiV3ftqQ1J2 {"clientSecretType":"RSA","encryptContent":"APO56jJZCI6NDF9OyiV3ftqQ1J2","keyId":"TMASC0","secretVersionNumber":"0010","sourceCode":"ALI3","tenantId":1} 0009eyJjbGllb……JZCI6NDF9 0009JZCI6NDF9……eyJjbGllb TMASC00009JZCI6NDF9……eyJjbGllb Shanghai Hand Information Technology Co., Ltd. Ne9Oyi3ftqyJ1J2jbDFQ {"clientSecretType":"HAND","encryptContent":"Ne9Oyi3ftqyJ1J2jbDFQ","keyId":"HANDEC","secretVersionNumber":"11","sourceCode":"ALI1","tenantId":3} eyJjb……0MX0= 0000eyJjb……0MX0= HANDEC0000eyJjb……0MX0= Li Si, 13111112222 6NDF9Qe9Oyi3f6NDF9PJN76Art {"clientSecretType":"XOR","encryptContent":"6NDF9Qe9Oyi3f6NDF9PJN76Art","keyId":"MEMBER","secretVersionNumber":"112","sourceCode":"AWS","tenantId":21} eyJjb ……6NDF9 00056NDF9……eyJjb MEMBER00056NDF9……eyJjb

[0110] Table 4

[0111] like Figure 7As shown, the main application scenario of this invention in the consumer ordering scenario is that mobile phone numbers support plaintext, MD5 encryption, masking, and ciphertext storage; recipients support plaintext and ciphertext storage; addresses support plaintext and ciphertext storage; landline numbers support plaintext, MD5 encryption, and ciphertext storage; and ID card numbers support plaintext, masking, and ciphertext storage. It can support plaintext display on the details page; plaintext return of data usage in the e-commerce platform; plaintext push to external systems; and batch anonymized display of mobile phone numbers and ID card numbers on the management platform page. Keys support periodic changes, and historical data supports querying.

[0112] like Figure 8 As shown, the data transmission of this embodiment involves three systems: a cloud vendor key management system, a key management system, and other business systems. In step S1, the third-party cloud vendor applying for a key involves the cloud vendor key management system. In step S2, configuring key source information involves the key management system. In step S3, configuring self-developed key information involves the key management system. In step S4, configuring encryption scenario information involves the key management system. In step S5, the user information access system, after encrypting or masking user privacy data, stores it, involving the key management system and other business systems. In step S6, the user information is decrypted and displayed in plaintext on the e-commerce platform and middle platform details page, and data pushed to external systems is decrypted and pushed in plaintext, involving the key management system and other business systems.

[0113] like Figure 9 , 10 As shown, this embodiment of the invention includes a related software design UML diagram.

Claims

1. A flexible and expandable multi-data encryption and decryption method, characterized in that... Includes the following steps: S1, Establish a key store scheme; S2, Configure the key store management center; S3, Select key escrow method; S4, establish a scenario solution configuration center; S5, the user information access system selects an encryption scheme and stores user privacy data after encryption or masking; S6, data decryption, displays user information in plain text on the mall and middle platform details page, and pushes it to external systems in plain text; The specific method for step S5 is as follows: S51, Data access system, determine whether it is necessary to enable information security level protection. If it is necessary to enable information security level protection, proceed to step S52. If it is not necessary to enable information security level protection, proceed to step S56. S52, obtain key-related configuration information, determine the source of key information acquisition based on the key escrow method, and obtain key information escrowed from different key management centers; S53 performs client data encryption and generates an encrypted result; S54. Determine whether to enable centralization. If centralization is enabled, proceed to step S55. If centralization is not required, proceed to step S56. S55: Generate a UUID storage mapping relationship for the encryption result and return the UUID; S56 stores encrypted data.

2. The flexible and expandable multi-data encryption and decryption method according to claim 1, characterized in that: In step S1, the key library scheme includes a self-developed key library and an industry-specific key library, and supports key library expansion and updates.

3. The flexible and expandable multi-data encryption and decryption method according to claim 1, characterized in that: In step S2, the key repository management center is configured to support the management of multiple key repositories. The key source configuration includes one or more of self-developed data sources and industry solution data sources, and supports the expansion and addition of data sources.

4. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: When the key source type is a self-developed data source, the key source configuration includes key source code, key source name, key source type, and enabled status; when the key source type is an industry solution data source, the key source configuration includes key source code, key source name, key source type, server-side encryption type, third-party key service access KEY, third-party key service access KEY key, third-party key service region, whether via HTTP request, and enabled status.

5. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: In the scenario solution configuration, the self-developed data source configuration includes the self-developed key value encoding, the self-developed key value name, and the self-developed key value.

6. The flexible and expandable multi-data encryption and decryption method according to claim 1, characterized in that: In step S4, when the key source type in the scenario scheme configuration is a self-developed data source, the encrypted scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, self-developed key value code, service prefix, and enabled status. When the key source type is an industry solution data source, the encryption scenario configuration includes scenario code, scenario name, scenario description, key source code, client encryption type, key type, third-party key service encryption CMK ID, service prefix, and enabled status.

7. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: In step S5, the client encryption type includes one or more of the following: AES symmetric encryption, RSA asymmetric encryption, RSA2 asymmetric encryption, XOR encryption, and PBE_WITH_MD5_AND_DES symmetric encryption. The types of encryption algorithms can be expanded and updated.

8. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: In step S5, the encryption scenario configuration can be edited, ensuring security without affecting historical data querying and usage; adding or modifying configuration information does not require restarting related services, and is refreshed periodically; in step S5, a custom 6-character prefix can be configured to quickly identify the source of encrypted content; in step S5, key configuration information can be written to the server cache, and the configured key information will be loaded from the key service when the service starts or during the first encryption / decryption, and subsequent calls will directly read the cache to speed up the response; in step S5, local caching is supported, and components can add a second-level cache. If a large number of identical data are encrypted or decrypted, the lower-level encryption logic calls can be avoided, and the local cache can quickly handle the situation.

9. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: The specific method of step S6 is as follows: After the encrypted data is accessed by the system, it is determined whether to encrypt the data based on whether the information security level protection configuration is enabled. If the information security level protection is enabled, it is determined whether the system is neutralized. If the centralization is enabled, the actual encrypted data needs to be obtained based on the mapping relationship between the UUID and the encryption information. Then, the key-related configuration information needs to be obtained. The source of the key information is determined based on the key hosting method. The key information hosted by different key management centers is obtained. The client data is decrypted and the decrypted data is returned. The business system displays the data or sends it back to the third-party system.

10. The flexibly expandable multi-data encryption and decryption method according to claim 1, characterized in that: The client encryption process in step S5 is as follows: Encryption result for: in Indicates the data to be encrypted The first data encryption is completed using the configured encryption algorithm. Indicates will The result is assembled into JSON. Indicates will The result is then HAND encrypted. Indicates will The result is transposed, with n transposed digits. Indicates will The result is appended with a service prefix, the content of which is "pre"; The client-side decryption process in step S6 is as follows: Decryption result for: in This indicates that the data to be decrypted Remove the concatenated service prefix; the service prefix content is now "pre". Indicates will The result is then transposed for both the first and last digits. Indicates will The result is then decrypted using a HAND method. Indicates to The result is parsed into JSON. Indicates will The data is decrypted based on the configured encryption algorithm.

Images