A method for encrypting and decrypting telecommunication card data

Abstract

An embodiment of the present invention relates to a method for encrypting and decrypting telecommunications card data. The method comprises: generating two sets of public-private key pairs and a symmetric key; sending the first public key to a telecommunications operator and the second public key to a data user; having three groups of administrators respectively keep the first and second private key fragments and the symmetric key fragments; upon receiving a ciphertext data packet sent by the telecommunications operator, decrypting the ciphertext data packet based on all first private key fragments, and encrypting and storing the decrypted plaintext based on all symmetric key fragments; and upon receiving a data use application from a data user, selecting an original data packet from a database, decrypting the original data packet based on all symmetric key fragments to obtain a plaintext data packet, and encrypting the plaintext data packet based on all second private key fragments to obtain a ciphertext data packet and sending it back to the data user. The present invention can reduce the risk of data leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method for encrypting and decrypting telecommunication card data. Background Art

[0002] IoT device operators conduct business operations by deploying and operating IoT devices. Each IoT device they deploy must be loaded with at least one telecom card for networking operations. When applying to a telecom operator for a new card, the IoT device operator submits the application in paper or electronic form, and receives the personalized telecom card data from the telecom operator and stores it locally for backup. Based on operational and maintenance needs, the IoT device operator submits a telecom card traffic report application in paper or electronic form, and regularly receives the telecom card traffic data from the telecom operator and stores it locally for backup. The aforementioned personalized telecom card data and telecom card traffic data are collectively referred to as telecom card data.

[0003] This means that IoT device operators need to transmit, store, and process large amounts of telecom card data using their own information systems. Currently, most IoT device operators' information systems handle the transmission and storage of telecom card data in plain text. This conventional processing method is prone to data leakage during the data transmission and storage process, and any telecom card data leakage will cause financial losses to IoT device operators. Summary of the Invention

[0004] The purpose of the present invention is to address the deficiencies of the prior art and provide a method for encrypting and decrypting telecommunication card data, an electronic device, and a computer-readable storage medium. A first public-private key pair is agreed upon between a data processing system and a telecommunication operator for processing data transmission between the two, and the first public key is distributed to the telecommunication operator for data encryption. The first private key is divided into multiple first private key fragments based on a threshold key sharing scheme and distributed to multiple first transmission key administrators for safekeeping. A second public-private key pair is agreed upon between the data processing system and a data user for processing data transmission between the two, and the second public key is distributed to the data user for data decryption. The second private key is divided into multiple second private key fragments based on the threshold key sharing scheme and distributed to multiple second transmission key administrators for safekeeping. A first symmetric key for processing data storage and reading is agreed upon between the data processing system and the database storing the data, and the first symmetric key is divided into multiple first symmetric key fragments based on a threshold key sharing scheme and distributed to multiple first storage key administrators for safekeeping; and upon receiving a ciphertext data packet sent by a telecommunications operator, the first private key shared and kept by all first transmission key administrators is used to decrypt the transmission data, and the first symmetric key shared and kept by all first storage key administrators is used to encrypt the storage data; and upon receiving a data use application sent by a data user, the first symmetric key shared and kept by all first storage key administrators is used to decrypt the storage data, and the second private key shared and kept by all second transmission key administrators is used to encrypt the transmission data. Through the present invention, it can be ensured that no plaintext data will be leaked during the telecommunications card data transmission process, and that no plaintext information of key data will be leaked during the telecommunications card data storage process, thereby achieving the purpose of reducing the risk of data leakage and reducing the operation and maintenance risk of IoT device operators.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present invention provides a method for encrypting and decrypting telecommunication card data, the method comprising:

[0006] The first data processing system generates two sets of public-private key pairs of an asymmetric key algorithm system, which are recorded as the corresponding first public-private key pair and the second public-private key pair, and stores them; generates a symmetric key of a symmetric key algorithm system, which is recorded as the corresponding first symmetric key, and stores it; distributes the first public key of the first public-private key pair to the first telecommunications operator, and distributes the second public key of the second public-private key pair to the first data user; the first public-private key includes the first public key and the first private key; the second public-private key includes the second public key and the second private key;

[0007] A first number N of first transmission key administrators, a second number M of first storage key administrators, and a third number K of second transmission key administrators are set; and based on a preset threshold key sharing scheme, N fragment key splitting processing is performed on the first private key to obtain corresponding N first private key fragments, and each first private key fragment is distributed to the corresponding first transmission key administrator; and based on the threshold key sharing scheme, M fragment key splitting processing is performed on the first symmetric key to obtain corresponding M first symmetric key fragments, and each first symmetric key fragment is distributed to the corresponding first storage key administrator; and based on the threshold key sharing scheme, K fragment key splitting processing is performed on the second private key to obtain corresponding K second private key fragments, and each second private key fragment is distributed to the corresponding second transmission key administrator; the first number N, the second number M, and the third number K are all integers greater than 1; the first private key fragment corresponds one-to-one to the first transmission key administrator; the first symmetric key fragment corresponds one-to-one to the first storage key administrator; and the second private key fragment corresponds one-to-one to the second transmission key administrator;

[0008] Upon receiving a first ciphertext data packet sent by the first telecom operator, decrypting the first ciphertext data packet based on the first private key fragments of all the first transmission key administrators to obtain a corresponding first plaintext data packet; and encrypting key data of the first plaintext data packet based on the first symmetric key fragments of all the first storage key administrators, and storing the processed data in a preset first database;

[0009] Upon receiving the first data usage application sent by the first data user, the corresponding storage data is selected from the first database according to the first data usage application to form a first original data packet; and the first original data packet is decrypted based on the first symmetric key fragments of all the first storage key administrators to obtain a corresponding second plaintext data packet; and the second plaintext data packet is encrypted based on the second private key fragments of all the second transmission key administrators to obtain a corresponding second ciphertext data packet; and the second ciphertext data packet is sent to the first data user.

[0010] Preferably, the method further comprises:

[0011] After receiving the first public key distributed by the first data processing system, the first telecommunications operator collects data of each telecommunications card corresponding to the first data processing system at a specified time to generate a corresponding first telecommunications card data record, and all the obtained first telecommunications card data records constitute the corresponding first plaintext data packet; and uses the first public key to encrypt the first plaintext data packet to generate the corresponding first ciphertext data packet and send it to the first data processing system; the first telecommunications card data record includes multiple first data item fields, and each of the first data item fields consists of a data item name and a data item value.

[0012] Preferably, the first data processing system is connected to the first telecommunications operator, the first data user, each of the first transmission key administrators, each of the first storage key administrators, and each of the second transmission key administrators respectively;

[0013] The asymmetric key algorithm system includes the RSA algorithm system and the national secret SM2 algorithm system;

[0014] The symmetric key algorithm system includes the DES algorithm system, the 3DES algorithm system, the AES algorithm system, the national secret SM1 algorithm system, the national secret SM4 algorithm system and the national secret SM7 algorithm system;

[0015] The threshold key sharing scheme includes a standard Shamir scheme, a GMW scheme extended based on the standard Shamir scheme, and a BGW scheme extended based on the standard Shamir scheme;

[0016] The first plaintext data packet is composed of a plurality of first telecommunication card data records; the first telecommunication card data records include a plurality of first data item fields; the first data item fields are composed of a first data item name and a first data item value, and both the first data item name and the first data item value are plaintext data;

[0017] The first database includes a plurality of first storage data records; each of the first storage data records corresponds to a first storage data record identifier; the first storage data record includes a plurality of first storage data item fields; the first storage data item field consists of a first storage data item name and a first storage data item value; if the first storage data item name of the first storage data item field does not satisfy a preset key data item name set, the corresponding first storage data item value is plaintext data; if the first storage data item name of the first storage data item field satisfies the key data item name set, the corresponding first storage data item value is ciphertext data; the key data item name set consists of one or more key data item names; the first storage data item field of the first storage data record has a one-to-one correspondence with the first data item field of the first telecommunications card data record;

[0018] The first data use application includes a plurality of first application record identifiers;

[0019] The first original data packet is composed of a plurality of the first stored data records;

[0020] The second plaintext data packet consists of multiple second telecommunications card data records; the second telecommunications card data record includes multiple second data item fields; the second data item field consists of a second data item name and a second data item value, and the second data item name and the second data item value are both plaintext data.

[0021] Preferably, the decrypting the first ciphertext data packet based on the first private key fragments of all the first transmission key administrators to obtain the corresponding first plaintext data packet specifically includes:

[0022] The first data processing system sends a first transmission key authorization application to all first transmission key administrators; and receives first authorization data sent back by each first transmission key administrator; and upon receiving each first authorization data, verifies the first TOTP password of the current first authorization data based on a TOTP password algorithm to obtain a corresponding first verification result; the first authorization data includes the first TOTP password and the first private key fragment; and the first verification result includes verification success or verification failure;

[0023] When the first verification results corresponding to all the first authorization data obtained are successful, the original key recovery processing is performed based on all the first private key fragments obtained based on the threshold key sharing scheme to obtain the corresponding first private key; and the first ciphertext data packet is decrypted based on the first private key to obtain the corresponding first plaintext data packet.

[0024] Furthermore, the method further comprises:

[0025] When the first transmission key administrator receives the first transmission key authorization application sent by the first data processing system, the first transmission key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding first TOTP password; and the first authorization data corresponding to the first TOTP password and the locally stored first private key fragment are composed and sent back to the first data processing system.

[0026] Furthermore, the TOTP password algorithm is used to verify the first TOTP password of the current first authorization data to obtain a corresponding first verification result, specifically including:

[0027] The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding first dynamic password; and identifies whether the first dynamic password matches the first TOTP password of the current first authorization data; if they match, the corresponding first verification result is set to verification success; if they do not match, the corresponding first verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the first transmission key administrator side.

[0028] Preferably, the performing key data encryption processing on the first plaintext data packet based on the first symmetric key fragments of all the first storage key administrator sides and storing the processed data in a preset first database specifically includes:

[0029] The first data processing system sends a first storage key authorization application to all first storage key administrators; and receives second authorization data sent back by each first storage key administrator; and upon receiving each second authorization data, verifies the second TOTP password of the current second authorization data based on the TOTP password algorithm to obtain a corresponding second verification result; the second authorization data includes the second TOTP password and the first symmetric key fragment; and the second verification result includes verification success or verification failure;

[0030] When the second verification results corresponding to all the obtained second authorization data are successful, performing original key recovery processing based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key;

[0031] All first telecommunication card data records of the first plaintext data packet are traversed; and during the traversal, the first telecommunication card data record currently traversed is taken as the corresponding current record, and the first data item fields in the current record whose first data item names satisfy the key data item name set are recorded as key data item fields, and the first data item fields whose first data item names do not satisfy the key data item name set are recorded as non-key data item fields; and the first data item values ​​of each key data item field are encrypted based on the first symmetric key to obtain corresponding first data item ciphertext data, and the first data item names and the first data item ciphertext data corresponding to each key data item field are used as the corresponding first stored data item names and the first stored data item values ​​to form the corresponding first stored data item fields; and the first data item names and the first data item values ​​of each non-key data item field are used as the corresponding first stored data item names and the first stored data item values ​​to form the corresponding first stored data item fields; and a corresponding first stored data record is formed by all the obtained first stored data item fields and added to the first database, and a corresponding first stored data record identifier is assigned to the added first stored data record in the first database.

[0032] Furthermore, the method further comprises:

[0033] When the first storage key administrator receives the first storage key authorization application sent by the first data processing system, the first storage key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding second TOTP password; and the second authorization data corresponding to the second TOTP password and the locally stored first symmetric key fragment are sent back to the first data processing system.

[0034] Furthermore, the TOTP password algorithm is used to verify the second TOTP password of the second authorization data to obtain a corresponding second verification result, specifically including:

[0035] The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding second dynamic password; and identifies whether the second dynamic password matches the second TOTP password of the current second authorization data; if they match, the corresponding second verification result is set to verification success; if they do not match, the corresponding second verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the first storage key administrator side.

[0036] Preferably, the selecting corresponding stored data from the first database according to the first data use application to form a first original data packet specifically includes:

[0037] The first data processing system extracts the first stored data records in the first database whose first stored data record identifiers match the first application record identifiers of the first data use application to form corresponding first original data packets.

[0038] Preferably, the performing key data decryption processing on the first original data packet based on all the first symmetric key fragments on the first storage key administrator side to obtain the corresponding second plaintext data packet specifically includes:

[0039] The first data processing system sends a second storage key authorization request to all first storage key administrators; and receives third authorization data sent back by each first storage key administrator; and upon receiving each piece of third authorization data, verifies the third TOTP password of the current third authorization data based on the TOTP password algorithm to obtain a corresponding third verification result; the third authorization data includes the third TOTP password and the first symmetric key fragment; the third verification result includes verification success or verification failure;

[0040] When the third verification results corresponding to all the obtained third authorization data are successful, performing original key recovery processing based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key;

[0041] All the first stored data records of the first original data packet are traversed; and during the traversal, the first stored data record currently traversed is taken as the corresponding current record, and the first stored data item field whose first stored data item name satisfies the key data item name set in the current record is recorded as the key data item field, and the first stored data item field whose first stored data item name does not satisfy the key data item name set is recorded as the non-key data item field; and the first stored data item value of each key data item field is decrypted based on the first symmetric key to obtain the corresponding first data item plaintext data, and the first stored data item name and the first data item plaintext data corresponding to each key data item field are used as the corresponding second data item name and the second data item value to form the corresponding second data item field; and the first stored data item name and the first stored data item value of each non-key data item field are used as the corresponding second data item name and the second data item value to form the corresponding second data item field; and all the obtained second data item fields are used to form a corresponding second telecommunications card data record; and at the end of the traversal, all the obtained second telecommunications card data records are used to form the corresponding second plaintext data packet.

[0042] Preferably, the encrypting the second plaintext data packet based on the second private key fragments of all the second transmission key administrators to obtain the corresponding second ciphertext data packet specifically includes:

[0043] The first data processing system sends a second transmission key authorization application to all second transmission key administrators; and receives fourth authorization data sent back by each first storage key administrator; and upon receiving each piece of the fourth authorization data, verifies the fourth TOTP password of the current fourth authorization data based on the TOTP password algorithm to obtain a corresponding fourth verification result; the fourth authorization data includes the fourth TOTP password and the second private key fragment; the fourth verification result includes verification success or verification failure;

[0044] When the fourth verification results corresponding to all the fourth authorization data obtained are successful, the original key recovery processing is performed based on all the second private key fragments obtained based on the threshold key sharing scheme to obtain the corresponding second private key; and the second plaintext data packet is encrypted based on the second private key to obtain the corresponding second ciphertext data packet.

[0045] Furthermore, the method further comprises:

[0046] When the second transmission key administrator receives the second transmission key authorization application sent by the first data processing system, the second transmission key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding fourth TOTP password; and the corresponding fourth authorization data composed of the fourth TOTP password and the locally stored second private key fragment is sent back to the first data processing system.

[0047] Furthermore, the fourth TOTP password of the current fourth authorization data is verified based on the TOTP password algorithm to obtain a corresponding fourth verification result, specifically including:

[0048] The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding third dynamic password; and identifies whether the third dynamic password matches the fourth TOTP password of the current fourth authorization data; if they match, the corresponding fourth verification result is set to verification success; if they do not match, the corresponding fourth verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the second transmission key administrator side.

[0049] A second aspect of an embodiment of the present invention provides an electronic device, including: a memory, a processor, and a transceiver;

[0050] The processor is configured to be coupled to the memory, read and execute instructions in the memory, so as to implement the method described in the first aspect above;

[0051] The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0052] A third aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed by a computer, the computer executes the method described in the first aspect.

[0053] An embodiment of the present invention provides a method for encrypting and decrypting telecommunication card data, an electronic device, and a computer-readable storage medium; a group of first public-private key pairs for processing data transmission between the two are agreed upon between a data processing system and a telecommunication operator, and the first public key is distributed to the telecommunication operator for data encryption, and the first private key is divided into multiple first private key fragments based on a threshold key sharing scheme and distributed to multiple first transmission key administrators for safekeeping; a group of second public-private key pairs for processing data transmission between the two are agreed upon between the data processing system and a data user, and the second public key is distributed to the data user for data decryption, and the second private key is divided into multiple second private key fragments based on a threshold key sharing scheme and distributed to multiple second transmission key administrators for safekeeping; a first symmetric key for processing data storage and reading is agreed upon between the data processing system and a database storing data, and the first symmetric key is divided into multiple first symmetric key fragments based on a threshold key sharing scheme and distributed to multiple first storage key administrators for safekeeping; and upon receiving a ciphertext data packet sent by the telecommunication operator, the first symmetric key is encrypted according to the first symmetric key fragments given by all the first transmission key administrators. The private key fragment is used to perform key recovery to obtain the corresponding first private key, and the first private key is used to decrypt the ciphertext data packet to obtain the corresponding plaintext data packet, and the first symmetric key is used to perform key recovery based on the first symmetric key fragments given by all first storage key administrators to obtain the corresponding first symmetric key, and the first symmetric key is used to encrypt the key data items of each data record in the plaintext data packet, and the data records with the key data items encrypted are stored in the database; and when a data use application sent by a data user is received, the original storage records are obtained from the database according to the data use application to form the original data packet, and the first symmetric key is used to perform key recovery based on the first symmetric key fragments given by all first storage key administrators to obtain the corresponding first symmetric key, and the first symmetric key is used to decrypt the key data items of each data record in the original data packet, and the data records with the key data items decrypted constitute the corresponding plaintext data packet, and the second private key fragments given by all second transmission key administrators are used to perform key recovery to obtain the corresponding second private key, and the plaintext data packet obtained after decryption is encrypted based on the second private key and the encrypted data packet is sent to the data user. The present invention can ensure that no plaintext data will be leaked during the data storage process of the telecommunications card, and can also ensure that no plaintext information of key data will be leaked during the data storage process of the telecommunications card; the present invention reduces both the risk of data leakage and the operation and maintenance risk of IoT device operators. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a method for encrypting and decrypting telecommunication card data provided in the first embodiment of the present invention;

[0055] Figure 2This is a structural diagram of an electronic device provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the embodiments described herein are merely some, rather than all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0057] The first embodiment of the present invention provides a method for encrypting and decrypting telecommunication card data. Figure 1 A schematic diagram of a telecommunications card data encryption and decryption method provided in the first embodiment of the present invention is shown, which mainly includes the following steps:

[0058] Step 1: The first data processing system generates and stores two sets of public and private key pairs of an asymmetric key algorithm system, which are recorded as the corresponding first public and private key pairs and the second public and private key pairs; generates and stores a symmetric key of a symmetric key algorithm system, which is recorded as the corresponding first symmetric key; and distributes the first public key of the first public and private key pair to the first telecommunications operator and the second public key of the second public and private key pair to the first data user;

[0059] Among them, the asymmetric key algorithm system includes the RSA algorithm system and the national secret SM2 algorithm system; the symmetric key algorithm system includes the DES algorithm system, the 3DES algorithm system, the AES algorithm system, the national secret SM1 algorithm system, the national secret SM4 algorithm system and the national secret SM7 algorithm system; the first public and private keys include the first public key and the first private key; the second public and private keys include the second public key and the second private key.

[0060] Here, the first data processing system of the embodiment of the present invention is the data processing system of the Internet of Things device operator, which is used to transmit and store the telecommunications card data of the Internet of Things device operator; the first data processing system of the embodiment of the present invention is connected to the first telecommunications operator and the first data user respectively, and is also connected to the respective first transmission key administrators, the respective first storage key administrators and the respective second transmission key administrators mentioned below; the first telecommunications operator here is the telecommunications operator service end that sends telecommunications card data to the Internet of Things device operator, and the first data user is the data user service end inside or outside the Internet of Things device operator that needs to read information on known telecommunications card data.

[0061] It should be noted that, when generating a public-private key pair of an asymmetric key algorithm system, the embodiment of the present invention performs processing based on a public-private key pair generator corresponding to the current asymmetric key algorithm system.

[0062] It should also be noted that when an embodiment of the present invention generates a symmetric key for a symmetric key algorithm system, it will generate a random number based on a random number generator with a length corresponding to the key length of the current symmetric key algorithm system, and use the random number as the symmetric key generated that time.

[0063] Step 2: Set a first number N of first transmission key administrators, a second number M of first storage key administrators, and a third number K of second transmission key administrators; perform N-fragment key splitting on the first private key based on a preset threshold key sharing scheme to obtain corresponding N first private key fragments, and distribute each first private key fragment to a corresponding first transmission key administrator; perform M-fragment key splitting on the first symmetric key based on the threshold key sharing scheme to obtain corresponding M first symmetric key fragments, and distribute each first symmetric key fragment to a corresponding first storage key administrator; perform K-fragment key splitting on the second private key based on the threshold key sharing scheme to obtain corresponding K second private key fragments, and distribute each second private key fragment to a corresponding second transmission key administrator;

[0064] Among them, the first number N, the second number M and the third number K are all integers greater than 1; the threshold key sharing scheme includes the standard Shamir scheme, the GMW scheme extended based on the standard Shamir scheme and the BGW scheme extended based on the standard Shamir scheme; the first private key fragment corresponds one-to-one to the first transmission key administrator; the first symmetric key fragment corresponds one-to-one to the first storage key administrator; the second private key fragment corresponds one-to-one to the second transmission key administrator.

[0065] Here, the embodiment of the present invention will not store the complete information of the obtained first private key, second private key and first symmetric key in plain text, but will divide each key into multiple fragments, and the designated administrator will distribute and store each fragment; the first transmission key administrator in the step is the server that stores the first private key fragment, the second transmission key administrator is the server that stores the second private key fragment, and the first storage key administrator is the server that stores the first symmetric key fragment.

[0066] It should be noted that the embodiment of the present invention adopts a preset threshold key sharing scheme for processing when splitting each key into fragment keys. The threshold key sharing scheme of the embodiment of the present invention can be configured by selecting one of the following three schemes: the standard Shamir scheme, the GMW scheme extended based on the standard Shamir scheme, and the BGW scheme extended based on the standard Shamir scheme. These three threshold key sharing schemes can divide the original key (first private key, first symmetric key, second private key) into a specified number of key fragments (N first private key fragments, M first symmetric key fragments, K second private key fragments) according to the specified number (N, M, K). In addition, the original key (first private key, first symmetric key, second private key) can be restored based on all key fragments (N first private key fragments, M first symmetric key fragments, K second private key fragments). The specific implementation processes of these three threshold key sharing schemes are all public technical solutions and can be obtained by querying public technical literature, so they will not be further elaborated here.

[0067] Before describing step 3 below, the ciphertext data packet preparation process on the first telecom operator side of an embodiment of the present invention is described as follows: after receiving the first public key distributed by the first data processing system, the first telecom operator collects data from each telecom card corresponding to the first data processing system at a specified time to generate a corresponding first telecom card data record, and all the obtained first telecom card data records form a corresponding first plaintext data packet; and uses the first public key to encrypt the first plaintext data packet to generate a corresponding first ciphertext data packet and send it to the first data processing system; wherein the first telecom card data record includes multiple first data item fields, each of which consists of a data item name and a data item value. Here, if the telecom data sent by the telecom operator to the IoT device operator is telecom card personalized data, then the specified time is a time point after the telecom operator receives the new card purchase application submitted by the IoT device operator; if the telecom data sent by the telecom operator to the IoT device operator is telecom card traffic data, then the specified time is a periodic time point agreed upon by the telecom operator and the IoT device operator.

[0068] Step 3: Upon receiving the first ciphertext data packet sent by the first telecommunications operator, decrypt the first ciphertext data packet based on the first private key fragments of all first transmission key administrators to obtain a corresponding first plaintext data packet; and encrypt the key data of the first plaintext data packet based on the first symmetric key fragments of all first storage key administrators, and store the processed data in a preset first database;

[0069] Specifically comprising: step 31, decrypting the first ciphertext data packet based on the first private key fragments of all first transmission key administrators to obtain a corresponding first plaintext data packet;

[0070] The first plaintext data packet is composed of a plurality of first telecommunication card data records; the first telecommunication card data records include a plurality of first data item fields; the first data item fields are composed of a first data item name and a first data item value, and both the first data item name and the first data item value are plaintext data;

[0071] Specifically, it includes: step 311, sending a first transmission key authorization application to all first transmission key administrators; and receiving first authorization data sent back by each first transmission key administrator;

[0072] The first authorization data includes a first TOTP password and a first private key fragment;

[0073] Here, the TOTP password in the embodiment of the present invention is calculated based on the TOTP (Time-Based One-Time Password) password algorithm. The TOTP password algorithm has two input parameters: a timestamp and a time step. The specific implementation process of this algorithm is also a public technical solution and can be obtained by consulting public technical literature. It is not further described here.

[0074] It should be noted that, upon receiving the first transmission key authorization request from the first data processing system, each first transmission key administrator in the embodiment of the present invention will calculate a dynamic password based on the TOTP password algorithm according to the current time and a preset time step, and use the dynamic password obtained in this calculation as the corresponding first TOTP password; and then send back the corresponding first authorization data composed of the first TOTP password and the locally stored first private key fragment to the first data processing system;

[0075] Step 312: When each first authorization data is received, the first TOTP password of the current first authorization data is verified based on the TOTP password algorithm to obtain a corresponding first verification result;

[0076] The first verification result includes verification success and verification failure;

[0077] Specifically, the method includes: performing a dynamic password calculation based on the current time and a preset time step based on a TOTP password algorithm to obtain a corresponding first dynamic password; and identifying whether the first dynamic password matches the first TOTP password of the current first authorization data; if they match, setting the corresponding first verification result to verification success; if they do not match, setting the corresponding first verification result to verification failure; wherein the time step preset on the first data processing system side matches the time step preset on the first transmission key administrator side;

[0078] Here, the first data processing system of the embodiment of the present invention immediately verifies the first TOTP password of the current first authorization data based on the TOTP password algorithm to obtain a corresponding first verification result every time it receives the first authorization data sent back by the first transmission key administrator. According to the calculation principle of the TOTP password algorithm, if the time interval between the two timestamps of the first data processing system and the first transmission key administrator does not exceed the preset time step, then the two TOTP passwords obtained, namely the first dynamic password and the first TOTP password, should match. Conversely, if the time interval between the two timestamps exceeds the preset time step, then the two TOTP passwords obtained, namely the first dynamic password and the first TOTP password, should not match. In this way, the embodiment of the present invention prevents the first data processing system from falling into a timeout waiting state.

[0079] Step 313: When all first verification results corresponding to the obtained first authorization data are successful, an original key recovery process is performed based on all obtained first private key fragments based on the threshold key sharing scheme to obtain the corresponding first private key;

[0080] Here, as previously mentioned, the number of first transmission key administrators is a first number N. Therefore, when all N first verification results obtained are successful, the first data processing system of the embodiment of the present invention will perform original key recovery using the obtained N first private key fragments based on the threshold key sharing scheme. The recovered original key is the first private key.

[0081] Step 314: decrypt the first ciphertext data packet based on the first private key to obtain a corresponding first plaintext data packet;

[0082] Here, as can be seen from the foregoing, the first ciphertext data packet is obtained by the first telecommunications operator encrypting the first plaintext data packet based on the first public key, and the first private key corresponds to the first public key. Therefore, the first plaintext data packet can be obtained by decrypting the first ciphertext data packet using the first private key.

[0083] Step 32: encrypting the first plaintext data packet based on the first symmetric key fragments of all first storage key administrators and storing the processed data in a preset first database;

[0084] The first database includes a plurality of first storage data records; each first storage data record corresponds to a first storage data record identifier; the first storage data record includes a plurality of first storage data item fields; the first storage data item field consists of a first storage data item name and a first storage data item value; if the first storage data item name of the first storage data item field does not satisfy a preset key data item name set, the corresponding first storage data item value is plaintext data; if the first storage data item name of the first storage data item field satisfies a preset key data item name set, the corresponding first storage data item value is ciphertext data; the key data item name set consists of one or more key data item names; the first storage data item field of the first storage data record has a one-to-one correspondence with the first data item field of the first telecommunications card data record;

[0085] Specifically, it includes: step 321, sending a first storage key authorization application to all first storage key administrators; and receiving second authorization data sent back by each first storage key administrator;

[0086] The second authorization data includes a second TOTP password and a first symmetric key fragment;

[0087] It should be noted that, upon receiving a first storage key authorization request from the first data processing system, each first storage key administrator in the embodiment of the present invention calculates a dynamic password based on the TOTP password algorithm according to the current time and a preset time step, and uses the dynamic password obtained in this calculation as the corresponding second TOTP password; and then sends back corresponding second authorization data composed of the second TOTP password and the locally stored first symmetric key fragment to the first data processing system.

[0088] Step 322: When each second authorization data is received, the second TOTP password of the current second authorization data is verified based on the TOTP password algorithm to obtain a corresponding second verification result;

[0089] The second verification result includes verification success and verification failure;

[0090] Specifically, the method includes: performing a dynamic password calculation based on the current time and a preset time step based on the TOTP password algorithm to obtain a corresponding second dynamic password; and identifying whether the second dynamic password matches the second TOTP password of the current second authorization data; if they match, setting the corresponding second verification result to verification success; if they do not match, setting the corresponding second verification result to verification failure; wherein the time step preset on the first data processing system side matches the time step preset on the first storage key administrator side;

[0091] Here, the first data processing system of the embodiment of the present invention will immediately verify the second TOTP password of the current second authorization data based on the TOTP password algorithm to obtain a corresponding second verification result every time it receives the second authorization data sent back by the first storage key administrator;

[0092] Step 323: When the second verification results corresponding to all the obtained second authorization data are successful, an original key recovery process is performed based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key;

[0093] Here, as previously known, the number of first storage key administrators is the second number M. Therefore, when all M second verification results obtained are successful, the first data processing system of the embodiment of the present invention will perform original key recovery using the obtained M first symmetric key fragments based on the threshold key sharing scheme. The recovered original key is the first symmetric key.

[0094] Step 324: traverse all first telecommunications card data records of the first plaintext data packet; and during the traversal, take the currently traversed first telecommunications card data record as the corresponding current record, and record the first data item field whose first data item name satisfies the key data item name set in the current record as the key data item field, and record the first data item field whose first data item name does not satisfy the key data item name set as the non-key data item field; and encrypt the first data item value of each key data item field based on the first symmetric key to obtain the corresponding first data item ciphertext data, and use the first data item name and the first data item ciphertext data corresponding to each key data item field as the corresponding first storage data item name and the first storage data item value to form the corresponding first storage data item field; and use the first data item name and the first data item value of each non-key data item field as the corresponding first storage data item name and the first storage data item value to form the corresponding first storage data item field; and form a corresponding first storage data record composed of all the obtained first storage data item fields and add it to the first database, and assign a corresponding first storage data record identifier to the first storage data record added this time in the first database.

[0095] Here, when the first data processing system of an embodiment of the present invention uses the first symmetric key to encrypt and store each telecommunications card data, i.e., each first telecommunications card data record, it will not encrypt the entire record of each first telecommunications card data record, which will affect the query efficiency of the data. It will only encrypt one or more key data items in each first telecommunications card data record based on a preset set of key data item names. Under normal circumstances, data items that can uniquely identify telecommunications cards, such as MSISDN data items and ICCID data items, which will not cause losses to IoT device operators, will be placed outside the key data item name set.

[0096] It should also be noted that when the first data processing system of the embodiment of the present invention uses the first symmetric key for encryption, it can directly use the first symmetric key for encryption, or it can first disperse the first symmetric key based on a unique identifier specific to each card (such as ICCID information) to obtain a dispersed key unique to each card, and then encrypt based on the dispersed key. That is, the first data processing system of the embodiment of the present invention encrypts the first data item value of each key data item field based on the first symmetric key to obtain the corresponding first data item ciphertext data, specifically the following steps:

[0097] Step A1: Identify a locally preset key dispersion flag;

[0098] Among them, the key dispersion flag includes an invalid flag and a valid flag;

[0099] Here, if the key dispersion flag is an invalid flag, it means that the first data processing system of the embodiment of the present invention will directly use the first symmetric key for encryption; conversely, if the key dispersion flag is a valid flag, it means that the first data processing system of the embodiment of the present invention will use the dispersion key of the first symmetric key for encryption;

[0100] Step A2: If the key dispersion flag is an invalid flag, the first symmetric key is used as the corresponding current encryption key, and the first data item value of each key data item field of the current record is encrypted using the current encryption key to obtain the corresponding first data item ciphertext data;

[0101] Step A3: If the key dispersion flag is a valid flag, the first stored data item value of the first data item field whose first data item name is ICCID in the current record is extracted as the corresponding current dispersion factor, and the current dispersion factor is encrypted using the first symmetric key and the encryption result is used as the corresponding current encryption key, and the first data item value of each key data item field of the current record is encrypted using the current encryption key to obtain the corresponding first data item ciphertext data.

[0102] Here, the first data item name is ICCID, and the first stored data item value of the first data item field is actually the specific value of the ICCID data item; the first data processing system of the embodiment of the present invention encrypts the ICCID information with the root key, that is, the first symmetric key, when processing key dispersion; because the ICCID information of each telecommunications card is unique, the current encryption key obtained based on the dispersion of the ICCID information is also uniquely corresponding to each card, thus achieving the purpose of one card and one key.

[0103] Before explaining step 4 below, the data usage application preparation process on the first data user side of an embodiment of the present invention is explained as follows: the first data user previews the MSISDN data item field and / or ICCID data item field of all first telecommunications card data records in the first database in advance, and selects one or more first telecommunications card data records to be operated this time from the preview page based on the MSISDN and / or ICCID. Because the first storage data record identifier of each first telecommunications card data record is known, all first data users use the first storage data record identifier of each first telecommunications card data record selected this time as a corresponding first application record identifier, and all the obtained first application record identifiers constitute the first data usage application submitted this time and send it to the first data processing system.

[0104] Step 4: Upon receiving the first data use application from the first data user, corresponding stored data is selected from the first database according to the first data use application to form a first original data packet; key data of the first original data packet is decrypted based on the first symmetric key fragments of all first storage key administrators to obtain a corresponding second plaintext data packet; data of the second plaintext data packet is encrypted based on the second private key fragments of all second transmission key administrators to obtain a corresponding second ciphertext data packet; and the second ciphertext data packet is sent to the first data user;

[0105] Specifically comprising: step 41, selecting corresponding stored data from a first database according to a first data use application to form a first original data packet;

[0106] The first data use application includes a plurality of first application record identifiers; the first original data packet is composed of a plurality of first stored data records;

[0107] Specifically comprising: extracting first stored data records in the first database that match first stored data record identifiers with first application record identifiers of first data use applications to form corresponding first original data packets;

[0108] Here, after receiving the first data use application, the first data processing system of the embodiment of the present invention directly extracts original records from the first database according to the first data use application and all the extracted records form a first original data packet;

[0109] Step 42: decrypting the first original data packet based on the first symmetric key fragments of all first storage key administrators to obtain a corresponding second plaintext data packet;

[0110] The second plaintext data packet is composed of a plurality of second telecommunication card data records; the second telecommunication card data records include a plurality of second data item fields; the second data item fields are composed of a second data item name and a second data item value, and both the second data item name and the second data item value are plaintext data;

[0111] Specifically, it includes: step 421, sending a second storage key authorization application to all first storage key administrators; and receiving third authorization data sent back by each first storage key administrator;

[0112] The third authorization data includes a third TOTP password and a first symmetric key fragment;

[0113] It should be noted that, upon receiving a second storage key authorization request from the first data processing system, each first storage key administrator in the embodiment of the present invention calculates a dynamic password based on the TOTP password algorithm according to the current time and a preset time step, and uses the dynamic password obtained in this calculation as the corresponding third TOTP password; and then sends back corresponding third authorization data composed of the third TOTP password and the locally stored first symmetric key fragment to the first data processing system.

[0114] Step 422: When each third authorization data is received, the third TOTP password of the current third authorization data is verified based on the TOTP password algorithm to obtain a corresponding third verification result;

[0115] The third verification result includes verification success and verification failure;

[0116] Specifically, the method includes: calculating a dynamic password based on the TOTP password algorithm according to the current time and a preset time step to obtain a corresponding dynamic password for the current time; and identifying whether the dynamic password for the current time matches the third TOTP password in the current third authorization data; if they match, setting the corresponding third verification result to verification success; if they do not match, setting the corresponding third verification result to verification failure;

[0117] Here, the first data processing system of the embodiment of the present invention will immediately verify the third TOTP password of the current third authorization data based on the TOTP password algorithm to obtain a corresponding third verification result every time it receives the third authorization data sent back by the first storage key administrator;

[0118] Step 423: When the third verification results corresponding to all the obtained third authorization data are successful, an original key recovery process is performed based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key;

[0119] Here, as previously known, the number of first storage key administrators is the second number M. Therefore, when the M third verification results obtained by the first data processing system in this embodiment of the present invention are all successful, the first data processing system will perform original key recovery using the obtained M first symmetric key fragments based on the threshold key sharing scheme. The recovered original key is the first symmetric key.

[0120] Step 424: traverse all first stored data records of the first original data packet; and during the traversal, take the first stored data record currently traversed as the corresponding current record, and record the first stored data item field whose first stored data item name satisfies the key data item name set in the current record as the key data item field, and record the first stored data item field whose first stored data item name does not satisfy the key data item name set as the non-key data item field; and decrypt the first stored data item value of each key data item field based on the first symmetric key to obtain the corresponding first data item plaintext data, and use the first stored data item name and the first data item plaintext data corresponding to each key data item field as the corresponding second data item name and second data item value to form a corresponding second data item field; and use the first stored data item name and the first stored data item value of each non-key data item field as the corresponding second data item name and second data item value to form a corresponding second data item field; and form a corresponding second telecommunications card data record from all the obtained second data item fields; and at the end of the traversal, form a corresponding second plaintext data packet from all the obtained second telecommunications card data records;

[0121] Here, when the first data processing system of the embodiment of the present invention uses the first symmetric key to decrypt each first stored data record of the first original data packet, it does not decrypt each data item of the first stored data record, but only decrypts one or more key data items in each first stored data record based on a preset set of key data item names;

[0122] It should also be noted that, as described above, when the first data processing system of the embodiment of the present invention uses the first symmetric key for encryption, it can directly use the first symmetric key for encryption, or it can encrypt based on a distributed key of the first symmetric key in a one-card-one-key manner. Conversely, when decrypting the encrypted data, it can also directly use the first symmetric key for decryption, or it can decrypt based on a distributed key of the first symmetric key in a one-card-one-key manner. That is, the specific implementation steps of the first data processing system of the embodiment of the present invention for decrypting the first stored data item value of each key data item field based on the first symmetric key to obtain the corresponding first data item plaintext data include:

[0123] Step B1, identifying a locally preset key dispersion flag;

[0124] Among them, the key dispersion flag includes an invalid flag and a valid flag;

[0125] Step B2: If the key dispersion flag is an invalid flag, the first symmetric key is used as the corresponding current decryption key, and the first stored data item value of each key data item field of the current record is decrypted using the current decryption key to obtain the corresponding first data item plaintext data;

[0126] Step B3: If the key dispersion flag is a valid flag, extract the first stored data item value of the first data item field of the first data item named ICCID in the current record as the corresponding current dispersion factor, encrypt the current dispersion factor using the first symmetric key, and use the encryption result as the corresponding current decryption key. The current decryption key is then used to decrypt the first stored data item value of each key data item field of the current record to obtain the corresponding first data item plaintext data;

[0127] Here, as described above, the first data processing system of the embodiment of the present invention encrypts the ICCID information with the root key, i.e., the first symmetric key, to obtain the distributed encryption key. Therefore, the same processing method should be used when preparing the distributed decryption key.

[0128] Step 43: encrypt the second plaintext data packet based on the second private key fragments of all second transmission key administrators to obtain a corresponding second ciphertext data packet;

[0129] Specifically, step 431 includes sending a second transmission key authorization application to all second transmission key administrators; and receiving fourth authorization data sent back by each first storage key administrator;

[0130] The fourth authorization data includes a fourth TOTP password and a second private key fragment;

[0131] It should be noted that, upon receiving a second transmission key authorization request from the first data processing system, each second transmission key administrator in the embodiment of the present invention calculates a dynamic password based on the TOTP password algorithm according to the current time and a preset time step, and uses the dynamic password obtained in this calculation as the corresponding fourth TOTP password; and then sends back corresponding fourth authorization data composed of the fourth TOTP password and the locally stored second private key fragment to the first data processing system.

[0132] Step 432: When each fourth authorization data is received, the fourth TOTP password of the current fourth authorization data is verified based on the TOTP password algorithm to obtain a corresponding fourth verification result;

[0133] The fourth verification result includes verification success and verification failure;

[0134] Specifically, the method includes: performing a dynamic password calculation based on the current time and a preset time step based on a TOTP password algorithm to obtain a corresponding third dynamic password; and identifying whether the third dynamic password matches the fourth TOTP password of the current fourth authorization data; if they match, setting the corresponding fourth verification result to verification success; if they do not match, setting the corresponding fourth verification result to verification failure; wherein the time step preset on the first data processing system side matches the time step preset on the second transmission key administrator side;

[0135] Here, the first data processing system of the embodiment of the present invention will immediately verify the fourth TOTP password of the current fourth authorization data based on the TOTP password algorithm to obtain a corresponding fourth verification result every time it receives the fourth authorization data sent back by the second transmission key administrator;

[0136] Step 433: When the fourth verification results corresponding to all the obtained fourth authorization data are successful, an original key recovery process is performed based on all the obtained second private key fragments based on the threshold key sharing scheme to obtain the corresponding second private key;

[0137] Here, as previously known, the number of second transmission key administrators is the third number K. Therefore, when all K fourth verification results obtained are successful, the first data processing system of the embodiment of the present invention will perform original key recovery using the obtained K second private key fragments based on the threshold key sharing scheme. The recovered original key is the second private key.

[0138] Step 434: encrypt the second plaintext data packet based on the second private key to obtain a corresponding second ciphertext data packet;

[0139] Step 44, and send the second ciphertext data packet to the first data user.

[0140] Here, as can be seen from the previous text, the second private key corresponds to the second public key, and the second public key is distributed to the first data user in advance. Then, after receiving the second ciphertext data packet sent by the first data processing system, the first data user can decrypt it based on the second public key to obtain the corresponding second plaintext data packet, that is, the plaintext information of all first telecommunications card data records selected in the first data usage application.

[0141] It should also be noted that the first data processing system of the embodiment of the present invention will also regularly refresh the first public-private key pair agreed upon with the first telecommunications operator, the second public-private key pair agreed upon with the first data user, and the first symmetric key; and after the refresh, the new first public key and second public key will be distributed to the first telecommunications operator and the first data user, and a new first private key fragment will be generated and distributed to the first transmission key administrator, a new first symmetric key fragment will be generated and distributed to the first storage key administrator, and a new second private key fragment will be generated and distributed to the second transmission key administrator in a manner similar to step 2; correspondingly, the first telecommunications operator and the first data user will use the new first public key and second public key to update the locally stored old public key data, and the first transmission key administrator, the first storage key administrator, and the second transmission key administrator will use the new first private key fragment, the first symmetric key fragment, and the second private key fragment to update the locally stored old fragment data.

[0142] Figure 2 This is a schematic diagram of the structure of an electronic device provided in the second embodiment of the present invention. The electronic device may be the aforementioned terminal device or server, or may be a terminal device or server connected to the aforementioned terminal device or server to implement the method of the embodiment of the present invention. Figure 2 As shown, the electronic device may include: a processor 301 (such as a CPU), a memory 302, and a transceiver 303; the transceiver 303 is coupled to the processor 301, and the processor 301 controls the transceiver 303's transceiver actions. Various instructions may be stored in the memory 302 for completing various processing functions and implementing the processing steps described in the aforementioned method embodiment. Preferably, the electronic device involved in the embodiment of the present invention further includes: a power supply 304, a system bus 305, and a communication port 306. The system bus 305 is used to realize communication connections between components. The above-mentioned communication port 306 is used for connection and communication between the electronic device and other peripherals.

[0143] exist Figure 2The system bus 305 mentioned in the figure can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The use of a single bold line in the diagram does not necessarily imply a single bus or type of bus. Communication interfaces enable communication between the database access device and other devices (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) and non-volatile memory (NVM), such as at least one disk drive.

[0144] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0145] It should be noted that an embodiment of the present invention further provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, it enables the computer to execute the method provided in the above embodiment.

[0146] An embodiment of the present invention further provides a chip for executing instructions, which is used to execute the processing steps described in the above method embodiment.

[0147] An embodiment of the present invention provides a method for encrypting and decrypting telecommunication card data, an electronic device, and a computer-readable storage medium; a group of first public-private key pairs for processing data transmission between the two are agreed upon between a data processing system and a telecommunication operator, and the first public key is distributed to the telecommunication operator for data encryption, and the first private key is divided into multiple first private key fragments based on a threshold key sharing scheme and distributed to multiple first transmission key administrators for safekeeping; a group of second public-private key pairs for processing data transmission between the two are agreed upon between the data processing system and a data user, and the second public key is distributed to the data user for data decryption, and the second private key is divided into multiple second private key fragments based on a threshold key sharing scheme and distributed to multiple second transmission key administrators for safekeeping; a first symmetric key for processing data storage and reading is agreed upon between the data processing system and a database storing data, and the first symmetric key is divided into multiple first symmetric key fragments based on a threshold key sharing scheme and distributed to multiple first storage key administrators for safekeeping; and upon receiving a ciphertext data packet sent by the telecommunication operator, the first symmetric key is encrypted according to the first symmetric key fragments given by all the first transmission key administrators. The private key fragment is used to perform key recovery to obtain the corresponding first private key, and the first private key is used to decrypt the ciphertext data packet to obtain the corresponding plaintext data packet, and the first symmetric key is used to perform key recovery based on the first symmetric key fragments given by all first storage key administrators to obtain the corresponding first symmetric key, and the first symmetric key is used to encrypt the key data items of each data record in the plaintext data packet, and the data records with the key data items encrypted are stored in the database; and when a data use application sent by a data user is received, the original storage records are obtained from the database according to the data use application to form the original data packet, and the first symmetric key is used to perform key recovery based on the first symmetric key fragments given by all first storage key administrators to obtain the corresponding first symmetric key, and the first symmetric key is used to decrypt the key data items of each data record in the original data packet, and the data records with the key data items decrypted constitute the corresponding plaintext data packet, and the second private key fragments given by all second transmission key administrators are used to perform key recovery to obtain the corresponding second private key, and the plaintext data packet obtained after decryption is encrypted based on the second private key and the encrypted data packet is sent to the data user. The present invention can ensure that no plaintext data will be leaked during the data storage process of the telecommunications card, and can also ensure that no plaintext information of key data will be leaked during the data storage process of the telecommunications card; the present invention reduces both the risk of data leakage and the operation and maintenance risk of IoT device operators.

[0148] Professionals should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0149] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0150] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for encrypting and decrypting telecommunication card data, characterized in that: The method comprises: The first data processing system generates two sets of public-private key pairs of an asymmetric key algorithm system, which are recorded as the corresponding first public-private key pair and the second public-private key pair, and stores them; generates a symmetric key of a symmetric key algorithm system, which is recorded as the corresponding first symmetric key, and stores it; distributes the first public key of the first public-private key pair to the first telecommunications operator, and distributes the second public key of the second public-private key pair to the first data user; the first public-private key includes the first public key and the first private key; the second public-private key includes the second public key and the second private key; A first number N of first transmission key administrators, a second number M of first storage key administrators, and a third number K of second transmission key administrators are set; and based on a preset threshold key sharing scheme, N fragment key splitting processing is performed on the first private key to obtain corresponding N first private key fragments, and each first private key fragment is distributed to the corresponding first transmission key administrator; and based on the threshold key sharing scheme, M fragment key splitting processing is performed on the first symmetric key to obtain corresponding M first symmetric key fragments, and each first symmetric key fragment is distributed to the corresponding first storage key administrator; and based on the threshold key sharing scheme, K fragment key splitting processing is performed on the second private key to obtain corresponding K second private key fragments, and each second private key fragment is distributed to the corresponding second transmission key administrator; the first number N, the second number M, and the third number K are all integers greater than 1; the first private key fragment corresponds one-to-one to the first transmission key administrator; the first symmetric key fragment corresponds one-to-one to the first storage key administrator; and the second private key fragment corresponds one-to-one to the second transmission key administrator; Upon receiving a first ciphertext data packet sent by the first telecom operator, decrypting the first ciphertext data packet based on the first private key fragments of all the first transmission key administrators to obtain a corresponding first plaintext data packet; and encrypting key data of the first plaintext data packet based on the first symmetric key fragments of all the first storage key administrators, and storing the processed data in a preset first database; Upon receiving the first data usage application sent by the first data user, the corresponding storage data is selected from the first database according to the first data usage application to form a first original data packet; and the first original data packet is decrypted based on the first symmetric key fragments of all the first storage key administrators to obtain a corresponding second plaintext data packet; and the second plaintext data packet is encrypted based on the second private key fragments of all the second transmission key administrators to obtain a corresponding second ciphertext data packet; and the second ciphertext data packet is sent to the first data user.

2. The method for encrypting and decrypting telecommunication card data according to claim 1, characterized in that: The method further comprises: After receiving the first public key distributed by the first data processing system, the first telecommunications operator collects data of each telecommunications card corresponding to the first data processing system at a specified time to generate a corresponding first telecommunications card data record, and all the obtained first telecommunications card data records constitute the corresponding first plaintext data packet; and uses the first public key to encrypt the first plaintext data packet to generate the corresponding first ciphertext data packet and send it to the first data processing system; the first telecommunications card data record includes multiple first data item fields, and each of the first data item fields consists of a data item name and a data item value.

3. The method for encrypting and decrypting telecommunication card data according to claim 1, wherein: The first data processing system is connected to the first telecommunications operator, the first data user, each of the first transmission key administrators, each of the first storage key administrators, and each of the second transmission key administrators respectively; The asymmetric key algorithm system includes the RSA algorithm system and the national secret SM2 algorithm system; The symmetric key algorithm system includes the DES algorithm system, the 3DES algorithm system, the AES algorithm system, the national secret SM1 algorithm system, the national secret SM4 algorithm system and the national secret SM7 algorithm system; The threshold key sharing scheme includes a standard Shamir scheme, a GMW scheme extended based on the standard Shamir scheme, and a BGW scheme extended based on the standard Shamir scheme; The first plaintext data packet is composed of a plurality of first telecommunication card data records; the first telecommunication card data records include a plurality of first data item fields; the first data item fields are composed of a first data item name and a first data item value, and both the first data item name and the first data item value are plaintext data; The first database includes a plurality of first storage data records; each of the first storage data records corresponds to a first storage data record identifier; the first storage data record includes a plurality of first storage data item fields; the first storage data item field consists of a first storage data item name and a first storage data item value; if the first storage data item name of the first storage data item field does not satisfy a preset key data item name set, the corresponding first storage data item value is plaintext data; if the first storage data item name of the first storage data item field satisfies the key data item name set, the corresponding first storage data item value is ciphertext data; the key data item name set consists of one or more key data item names; the first storage data item field of the first storage data record has a one-to-one correspondence with the first data item field of the first telecommunications card data record; The first data use application includes a plurality of first application record identifiers; The first original data packet is composed of a plurality of the first stored data records; The second plaintext data packet consists of multiple second telecommunications card data records; the second telecommunications card data record includes multiple second data item fields; the second data item field consists of a second data item name and a second data item value, and the second data item name and the second data item value are both plaintext data.

4. The method for encrypting and decrypting telecommunication card data according to claim 3, wherein: The decrypting the first ciphertext data packet based on the first private key fragments of all the first transmission key administrators to obtain the corresponding first plaintext data packet specifically includes: The first data processing system sends a first transmission key authorization application to all first transmission key administrators; and receives first authorization data sent back by each first transmission key administrator; and upon receiving each first authorization data, verifies the first TOTP password of the current first authorization data based on a TOTP password algorithm to obtain a corresponding first verification result; the first authorization data includes the first TOTP password and the first private key fragment; and the first verification result includes verification success or verification failure; When the first verification results corresponding to all the first authorization data obtained are successful, the original key recovery processing is performed based on all the first private key fragments obtained based on the threshold key sharing scheme to obtain the corresponding first private key; and the first ciphertext data packet is decrypted based on the first private key to obtain the corresponding first plaintext data packet.

5. The method for encrypting and decrypting telecommunication card data according to claim 4, characterized in that: The method further comprises: When the first transmission key administrator receives the first transmission key authorization application sent by the first data processing system, the first transmission key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding first TOTP password; and the first authorization data corresponding to the first TOTP password and the locally stored first private key fragment are composed and sent back to the first data processing system.

6. The method for encrypting and decrypting telecommunication card data according to claim 5, characterized in that: The verifying the first TOTP password of the current first authorization data based on the TOTP password algorithm to obtain a corresponding first verification result specifically includes: The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding first dynamic password; and identifies whether the first dynamic password matches the first TOTP password of the current first authorization data; if they match, the corresponding first verification result is set to verification success; if they do not match, the corresponding first verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the first transmission key administrator side.

7. The method for encrypting and decrypting telecommunication card data according to claim 3, characterized in that: The step of encrypting the key data of the first plaintext data packet based on the first symmetric key fragments of all the first storage key administrators and storing the processed data in a preset first database specifically includes: The first data processing system sends a first storage key authorization application to all first storage key administrators; and receives second authorization data sent back by each first storage key administrator; and upon receiving each second authorization data, verifies the second TOTP password of the current second authorization data based on the TOTP password algorithm to obtain a corresponding second verification result; the second authorization data includes the second TOTP password and the first symmetric key fragment; and the second verification result includes verification success or verification failure; When the second verification results corresponding to all the obtained second authorization data are successful, performing original key recovery processing based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key; All first telecommunication card data records of the first plaintext data packet are traversed; and during the traversal, the first telecommunication card data record currently traversed is taken as the corresponding current record, and the first data item fields in the current record whose first data item names satisfy the key data item name set are recorded as key data item fields, and the first data item fields whose first data item names do not satisfy the key data item name set are recorded as non-key data item fields; and the first data item values ​​of each key data item field are encrypted based on the first symmetric key to obtain corresponding first data item ciphertext data, and the first data item names and the first data item ciphertext data corresponding to each key data item field are used as the corresponding first stored data item names and the first stored data item values ​​to form the corresponding first stored data item fields; and the first data item names and the first data item values ​​of each non-key data item field are used as the corresponding first stored data item names and the first stored data item values ​​to form the corresponding first stored data item fields; and a corresponding first stored data record is formed by all the obtained first stored data item fields and added to the first database, and a corresponding first stored data record identifier is assigned to the added first stored data record in the first database.

8. The method for encrypting and decrypting telecommunication card data according to claim 7, characterized in that: The method further comprises: When the first storage key administrator receives the first storage key authorization application sent by the first data processing system, the first storage key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding second TOTP password; and the second authorization data corresponding to the second TOTP password and the locally stored first symmetric key fragment are sent back to the first data processing system.

9. The method for encrypting and decrypting telecommunication card data according to claim 8, characterized in that: The verifying the second TOTP password of the current second authorization data based on the TOTP password algorithm to obtain a corresponding second verification result specifically includes: The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding second dynamic password; and identifies whether the second dynamic password matches the second TOTP password of the current second authorization data; if they match, the corresponding second verification result is set to verification success; if they do not match, the corresponding second verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the first storage key administrator side.

10. The method for encrypting and decrypting telecommunication card data according to claim 3, characterized in that: The selecting corresponding stored data from the first database according to the first data use application to form a first original data packet specifically includes: The first data processing system extracts the first stored data records in the first database whose first stored data record identifiers match the first application record identifiers of the first data use application to form corresponding first original data packets.

11. The method for encrypting and decrypting telecommunication card data according to claim 3, characterized in that: The performing key data decryption processing on the first original data packet based on all the first symmetric key fragments on the first storage key administrator side to obtain a corresponding second plaintext data packet specifically includes: The first data processing system sends a second storage key authorization request to all first storage key administrators; and receives third authorization data sent back by each first storage key administrator; and upon receiving each piece of third authorization data, verifies the third TOTP password of the current third authorization data based on the TOTP password algorithm to obtain a corresponding third verification result; the third authorization data includes the third TOTP password and the first symmetric key fragment; the third verification result includes verification success or verification failure; When the third verification results corresponding to all the obtained third authorization data are successful, performing original key recovery processing based on all the obtained first symmetric key fragments based on the threshold key sharing scheme to obtain the corresponding first symmetric key; All the first stored data records of the first original data packet are traversed; and during the traversal, the first stored data record currently traversed is taken as the corresponding current record, and the first stored data item field whose first stored data item name satisfies the key data item name set in the current record is recorded as the key data item field, and the first stored data item field whose first stored data item name does not satisfy the key data item name set is recorded as the non-key data item field; and the first stored data item value of each key data item field is decrypted based on the first symmetric key to obtain the corresponding first data item plaintext data, and the first stored data item name and the first data item plaintext data corresponding to each key data item field are used as the corresponding second data item name and the second data item value to form the corresponding second data item field; and the first stored data item name and the first stored data item value of each non-key data item field are used as the corresponding second data item name and the second data item value to form the corresponding second data item field; and all the obtained second data item fields are used to form a corresponding second telecommunications card data record; and at the end of the traversal, all the obtained second telecommunications card data records are used to form the corresponding second plaintext data packet.

12. The method for encrypting and decrypting telecommunication card data according to claim 3, characterized in that: The encrypting the second plaintext data packet based on the second private key fragments of all the second transmission key administrators to obtain the corresponding second ciphertext data packet specifically includes: The first data processing system sends a second transmission key authorization application to all second transmission key administrators; and receives fourth authorization data sent back by each first storage key administrator; and upon receiving each piece of the fourth authorization data, verifies the fourth TOTP password of the current fourth authorization data based on the TOTP password algorithm to obtain a corresponding fourth verification result; the fourth authorization data includes the fourth TOTP password and the second private key fragment; the fourth verification result includes verification success or verification failure; When the fourth verification results corresponding to all the fourth authorization data obtained are successful, the original key recovery processing is performed based on all the second private key fragments obtained based on the threshold key sharing scheme to obtain the corresponding second private key; and the second plaintext data packet is encrypted based on the second private key to obtain the corresponding second ciphertext data packet.

13. The method for encrypting and decrypting telecommunication card data according to claim 12, characterized in that: The method further comprises: When the second transmission key administrator receives the second transmission key authorization application sent by the first data processing system, the second transmission key administrator calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step, and uses the dynamic password calculated this time as the corresponding fourth TOTP password; and the corresponding fourth authorization data composed of the fourth TOTP password and the locally stored second private key fragment is sent back to the first data processing system.

14. The method for encrypting and decrypting telecommunication card data according to claim 13, wherein: The verifying the fourth TOTP password of the current fourth authorization data based on the TOTP password algorithm to obtain a corresponding fourth verification result specifically includes: The first data processing system calculates a dynamic password based on the TOTP password algorithm according to the current time and the preset time step to obtain a corresponding third dynamic password; and identifies whether the third dynamic password matches the fourth TOTP password of the current fourth authorization data; if they match, the corresponding fourth verification result is set to verification success; if they do not match, the corresponding fourth verification result is set to verification failure; the time step preset on the first data processing system side matches the time step preset on the second transmission key administrator side.

15. An electronic device, characterized in that: include: memory, processors, and transceivers; The processor is configured to be coupled to the memory, read and execute instructions in the memory, so as to implement the method according to any one of claims 1 to 14; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a computer, the computer is caused to execute the method according to any one of claims 1 to 14.

Images