A data encryption method, a data decryption method and apparatus

Abstract

The application discloses a data encryption method, a data decryption method and devices, and belongs to the technical field of computers, wherein the data encryption method is used for a first encryption component, the first encryption component is used for being embedded in a transmission channel between a client and a server, and the method comprises the following steps: obtaining a first key by negotiating with a second encryption component, the second encryption component is used for being embedded in a transmission channel between the server and a target business system; interacting with the second encryption component to obtain an encrypted second key, the encrypted second key is obtained by encrypting the first key, and the second key is from an encryption machine; in the case that first data uploaded by the client is acquired, decrypting the first key to obtain the second key, and encrypting the first data by using the second key to obtain an encrypted data packet. The application can realize the encryption of the transmission channel from the client to the server and the decryption of the transmission channel from the server to the electronic signature system, and improves the security performance of the data protection service.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a data encryption method, a data decryption method, and an apparatus. Background Technology

[0002] In real-world network environments, even a single network transmission carries the risk of data leakage. Among related technologies, the data protection measure for the transmission side of an electronic signature system is Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) protection. Its basic principle is:

[0003] The client initiates HTTPS, connects to the server's port 433 (the default port for HTTPS), generates the public and private keys for the certificate on the server, and returns the public key to the client.

[0004] After the client parses the certificate using the public key, it sends the encrypted key to the server.

[0005] The server parses the encrypted key and decrypts it using the private key to obtain the key and the content encrypted with the key.

[0006] Finally, the server sends the encrypted content to the client.

[0007] However, the aforementioned HTTPS data protection methods are susceptible to being cracked. Attackers can use the key to decrypt and obtain plaintext traffic message information, resulting in low data security performance of the electronic signature system. Summary of the Invention

[0008] The purpose of this invention is to provide a data encryption method, a data decryption method, and an apparatus. This addresses the problem of low data security performance in related electronic signature systems.

[0009] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0010] In a first aspect, the present invention provides a data encryption method for a first encryption component, the first encryption component being embedded in a transmission channel between a client and a server, the method comprising:

[0011] A first key is obtained through negotiation with a second encryption component, which is used to embed the transmission channel between the server and the target business system.

[0012] The second key is obtained by exchanging encrypted second key with the second encryption component. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0013] Upon receiving the first data uploaded by the client, the second key is obtained by decrypting the first key, and the first data is encrypted using the second key to obtain an encrypted data packet. The encrypted data packet is then transmitted to the second encryption component via the client and the server.

[0014] Secondly, the present invention also provides a data encryption device for a first encryption component, the first encryption component being embedded in a transmission channel between a client and a server, the device comprising:

[0015] The first negotiation module is used to negotiate with the second encryption component to obtain a first key, and the second encryption component is used to embed the transmission channel between the server and the target business system.

[0016] The first interaction module is used to interact with the second encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0017] The first processing module is configured to, upon receiving the first data uploaded by the client, decrypt the first data using the first key to obtain the second key, and then use the second key to encrypt the first data to obtain an encrypted data packet, wherein the encrypted data packet is transmitted to the second encryption component via the client and the server.

[0018] Thirdly, the present invention provides a data decryption method for a second encryption component, the second encryption component being embedded in a transmission channel between a server and a target business system, the method comprising:

[0019] A first key is obtained through negotiation with a first encryption component, which is used to embed a transmission channel between the client and the server.

[0020] The second key is obtained by exchanging encrypted second key with the first encryption component. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0021] When the encrypted data packet is obtained from the server, the second key is obtained by decrypting based on the first key, and the encrypted data packet is decrypted using the second key to obtain the first data;

[0022] The first data is sent to the target business system.

[0023] Fourthly, the present invention provides a data decryption device for a second encryption component, the second encryption component being embedded in a transmission channel between a server and a target business system, the device comprising:

[0024] The second negotiation module is used to negotiate with the first encryption component to obtain a first key, and the first encryption component is used to embed a transmission channel between the client and the server.

[0025] The second interaction module is used to interact with the first encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0026] The second processing module is used to, when the encrypted data packet is obtained from the server, decrypt it based on the first key to obtain the second key, and use the second key to decrypt the encrypted data packet to obtain the first data;

[0027] The first sending module is used to send the first data to the target business system.

[0028] Fifthly, the present invention also provides an electronic device comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first or third aspect.

[0029] In a sixth aspect, the present invention also provides a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first or third aspect.

[0030] In this embodiment of the invention, a first encryption component is embedded in the transmission channel between the client and the server, and a second encryption component is embedded in the transmission channel between the server and the target business system (such as an electronic signature system). During operation, if the client initiates a data request, the first encryption component can encrypt the initiated first data. When the encrypted data packet is transmitted to the second encryption component, the second encryption component can decode the second key based on the session key (first key) agreed upon with the first encryption component, and use the second key to decrypt the received encrypted data packet, thereby recovering the plaintext of the first data. The plaintext of the first data can then be transmitted to the target business system via the server. In this way, by modifying the encryption service on the transmission side of the electronic signature system channel through an external component, and by encapsulating the algorithm corresponding to the second key using the channel encryption component, external service-based data encryption and decryption capabilities are provided to the user. This achieves encryption of the transmission channel from the client to the server and decryption of the transmission channel from the server to the electronic signature system, automating the encryption of the data protection service of the target business system, and improving the security performance of the data protection service of the target business system. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of data interaction in an electronic signature system within related technologies;

[0032] Figure 2 This is a schematic diagram of the structure of a data encryption transmission system capable of applying the data encryption and decryption methods provided by this invention;

[0033] Figure 3 This is a flowchart of a data encryption method provided by the present invention;

[0034] Figure 4 Is it like this? Figure 2 The diagram shows the encryption and decryption process of the data encryption transmission system.

[0035] Figure 5 This is a schematic diagram illustrating the encapsulation principle of the first and second encryption components in an embodiment of the present invention.

[0036] Figure 6 This is a schematic diagram of the channel-side encryption business process of the electronic signature system in an embodiment of the present invention;

[0037] Figure 7 This is a flowchart of a data decryption method provided by the present invention;

[0038] Figure 8 This is a schematic diagram of the structure of a data encryption device provided by the present invention;

[0039] Figure 9 This is a schematic diagram of the structure of a data decryption device provided by the present invention;

[0040] Figure 10 This is a schematic diagram of the structure of an electronic device provided by the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, the first object can be one or more.

[0043] In related technologies, the data protection measure for the transmission side of an electronic signature system is HTTPS protection, such as... Figure 1 As shown, the basic principle of this HTTPS protection method is:

[0044] The client initiates HTTPS by connecting to the server's port 433 (the default HTTPS port). The server provides the public and private keys of the certificate and returns the public key to the client. After parsing the certificate, the client sends the encrypted key to the server. The server parses the encrypted key, such as decrypting it based on the private key to obtain the key, and then encrypting the content with the key. Finally, the server sends the encrypted content to the client.

[0045] HTTPS, as a data protection method, is susceptible to being cracked. Attackers may use the key to decrypt and obtain plaintext traffic messages. This is especially true for electronic signature systems, which involve a large amount of data, diverse types, and a significant amount of biometric information. Weaknesses in data protection can potentially lead to huge data security losses.

[0046] In addition, the HTTPS protection methods in related technologies also have the following drawbacks:

[0047] 1) The encryption scope of the HTTPS protocol is relatively limited, and it plays almost no role in hacker attacks, denial-of-service attacks, server hijacking, etc.

[0048] 2) The HTTPS protocol will affect the caching of electronic signature business systems, is less efficient than HTTP, increases data overhead and power consumption, and may even affect existing security measures.

[0049] 3) HTTPS trust requires a Secure Sockets Layer (SSL) certificate and is incompatible with some plugins;

[0050] 4) HTTPS connections consume significantly more server-side resources, and the handshake phase is more time-consuming, which negatively impacts the response speed of electronic signature business systems.

[0051] In this embodiment of the invention, an embedded encryption component is used to embed encryption components in the transmission channel between the client and the server and the transmission channel between the server and the electronic signature system, respectively. This enables encryption of the transmission channel from the client to the server and decryption of the transmission channel from the server to the electronic signature system, thereby automating the encryption of the electronic signature system's data protection service and improving the security performance of the electronic signature system's data protection service.

[0052] For example: Figure 2 As shown, a first encryption component 24 is embedded in the transmission channel between the client program 21 and the server program 22, and a second encryption component 25 is embedded in the transmission channel between the server program 22 and the electronic signature system 23. In operation, the first encryption component 24 is responsible for encrypting the data output from the client program 21 to the server program 22, and the second encryption component 25 is responsible for decrypting the encrypted data output from the server program 22, before transmitting it to the electronic signature system for electronic signature processing. The first encryption component 24 and the second encryption component 25 are communicatively connected to ensure that the keys used in the encryption and decryption processes are consistent.

[0053] It should be noted that, for ease of explanation, the target business system in this embodiment of the invention is an electronic signature system as an example. In practice, the target business system can also be other business systems that require confidential transmission, which does not constitute a specific limitation.

[0054] For ease of explanation, the following embodiments, in conjunction with the accompanying drawings, illustrate the data encryption method, data decryption method, data encryption device, and data decryption device provided by the present invention.

[0055] Please see Figure 3 This is a flowchart of a data encryption method provided by the present invention. The data encryption method can be applied to a first encryption component, which is used to embed in the transmission channel between the client and the server.

[0056] like Figure 3 As shown, the data encryption method may include the following steps:

[0057] Step 301: Negotiate with the second encryption component to obtain the first key. The second encryption component is used to embed in the transmission channel between the server and the target business system.

[0058] In implementation, the first encryption component can be deployed on the server front-end channel side of the client. For example, using aspect-oriented interface data transmission encryption and decryption component embedding technology, the aspect encryption component (first encryption component) is embedded into the channel between the client and the server. In this way, the first encryption component can be configured to replace the client's original publishing port. In addition, the second encryption component can be deployed on the server front-end channel side of the server. For example, using aspect-oriented interface data transmission encryption and decryption component embedding technology, the aspect encryption component (second encryption component) is embedded into the channel between the server and the electronic signature system. The server connects to the application interface of the electronic signature business system, and the encrypted and decrypted data is retrieved through mutual communication and data transmission between the server programs.

[0059] The principle of aspect-based encryption can be to pre-compile the pre-encryption program using the Java language, thereby achieving encryption on the data transmission channel side without changing the original data format. It can be configured as follows:

[0060] 1) Write encryption and decryption interfaces and annotate the encryption and decryption attributes. In this way, when it is not allowed to store sensitive data in the open, the encryption and decryption of sensitive data can be completed through simple annotations.

[0061] 2) Declare the channel aspect: Starting from the transmission channel side, write the channel-side aspect declaration. The aspect declaration is to define the aspect coding mode to achieve aspect encryption.

[0062] 3) Declare the pointcut, locating the user information (message) method of the User Service class. UserService is annotated with @Service to declare the service class, retrieves the message from the User Data Access Object (UserDAO), and returns it. UserDAO is annotated with @Repository to declare the repository class, simulating data return. These, as Java Database Connectivity (JDBC) utility classes provided by Spring MVC (a Java framework), can implement aspect-oriented encryption.

[0063] 4) Add a method for encrypted member variables to the User Model. By adding member variables, the value of the control can be obtained or changed. It can be used for encrypted data exchange and verification.

[0064] 5) Change the proxy method and use the Code Generation Library (CGLIB) proxy instead of the Java Development Kit (JDK) proxy.

[0065] After the above configuration, component embedding technology for aspect-oriented interface data transmission encryption and decryption can be used to embed an encryption component encapsulating a secure transmission protocol and a first encryption algorithm into the channel between the client and the server, as well as the channel between the server and the target business system. This reduces the need for development and modification of existing electronic signature business systems and interfaces, allows for one-click deployment on servers with business interoperability, enables agile implementation and convenient configuration of component deployment to replace existing business ports with new ones, and supports one server and multiple application clients (one-to-many interface mode). It can be applied to national cryptographic encryption of transmission channels.

[0066] In practical applications, encryption components are embedded and integrated with the server of the electronic signature system. The login page of the electronic signature system (e.g., Uniform Resource Locator, URL) embeds a specified aspect encryption program, and the submitted data is encrypted and decrypted using the SM4 symmetric encryption algorithm before it can be transmitted.

[0067] The SM4 algorithm is a block cipher algorithm with a block length of 128 bits and a key length of 128 bits. Both the encryption and key expansion algorithms employ a 32-round non-linear iterative structure, performing encryption operations in units of 32-bit words. Each iteration is a transformation function round. The SM4 encryption and decryption algorithms have the same structure, except that the round keys are reversed; the decryption round key is the reverse of the encryption round key. SM4 offers high flexibility, and the S-box used can be easily replaced to address sudden security threats.

[0068] In implementation, the aforementioned first key can be understood as a session key between the first encryption component and the second encryption component. This session key is used to protect the session between the first encryption component and the second encryption component. In implementation, different sessions can use different session keys, and this session key is not stored in the first encryption component or the second encryption component. Before each session encryption is performed, the first encryption component can negotiate the session key corresponding to that session with the second encryption component.

[0069] Step 302: Interact with the second encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0070] In implementation, the aforementioned second key can be a key issued by the encryption machine for encrypting data. The encryption machine can periodically update the second key and send the latest second key to both the first and second encryption components. At this time, the first and second encryption components can use the first key to encrypt a specific second key and interact with each other to ensure that both components use the same second key for encrypting the data.

[0071] In implementation, the first and second encryption components can encapsulate a Transport Layer Security (TLS) protocol and a first block cipher algorithm (e.g., the SM4 symmetric encryption algorithm), with the first block cipher algorithm corresponding to the second key. Thus, the first and second encryption components can perform secure transmission based on TLS and encrypt data to be sent or decrypt received encrypted data based on the first block cipher algorithm.

[0072] In this embodiment, the first encryption component and the second encryption component can communicate directly and exchange the second key in a session manner. At this time, the second key is encrypted based on the first key to improve the security of the second key during the interaction process.

[0073] Step 303: Upon receiving the first data uploaded by the client, the second key is obtained by decrypting the first key, and the first data is encrypted using the second key to obtain an encrypted data packet. The encrypted data packet is then transmitted to the second encryption component via the client and the server.

[0074] The first encryption component is embedded in the transmission channel between the client and the server. In this way, the first encryption component can intercept the data sent by the client to the server, encrypt the data based on the second key, and then send it to the server. The server then transmits the encrypted data to the second encryption component. The second encryption component can decode the second key based on the first key that has been agreed upon with the first encryption component, and then use the second key to decrypt the encrypted data to obtain the plaintext data, which is then transmitted to the electronic signature system.

[0075] Specifically, as Figure 2 Taking the data encryption transmission system shown as an example, its encryption and decryption process can be referenced. Figure 4As shown, the encryption / decryption process may include the following steps:

[0076] Step 1: Embed a first encryption component 24 on the channel side between the client 21 and the server 22, and encrypt the data by sending a task directory configuration inspection to the first encryption component 24;

[0077] Step 2: The first encryption component 24 detects the application programming interface (API) of the original system (the original system refers to the system that uploads files through the client, which is responsible for uploading data and files sent by the user). When a data request is detected, the response message is discarded, and the first encryption component 24 reassembles the response message. Then, the first encryption component 24 sends the reassembled response message end-to-end to the server 22. During the transmission process, all data is encrypted using the national cryptographic SM4 algorithm, and no modification is required to the entire service process.

[0078] Step 3: Embed a second encryption component 25 on the channel side between the server 22 and the electronic signature system 23. When the second encryption component 25 receives the encrypted data from the server 22, it decrypts the encrypted data and sends the decrypted plaintext data to the electronic signature system for use.

[0079] Step 4: The encryption machine (which can be set on the server 22) performs a timed policy rotation (such as periodic rotation), changes the second key, and sends it to the first encryption component 24 and the second encryption component 25 for caching.

[0080] In implementation, the encryption component can verify the correctness of the received key (second key) and perform encryption or decryption operations on the data based on the trigger of the data port of the client or server. Since the second key is encrypted based on the first key and the first key is obtained through negotiation between the two encryption components, the first key can be decrypted based on the first key obtained through negotiation between the two encryption components, thereby realizing the encryption or decryption of the data based on the first key.

[0081] For example: Figure 5 As shown, the encapsulation principles of the first and second encryption components include:

[0082] 1) The SM4 key (i.e. the second key) of the first encryption component and the second encryption component is generated and distributed by the encryption machine (which can be used as an external hardware system to provide keys for the first encryption component and the second encryption component). The SM4 key is a key based on complex transformation of random numbers.

[0083] 2) The first encryption component and the second encryption component communicate to complete the digital signature verification. The first encryption component requests the second encryption component to negotiate the distribution of a key to protect the session. The second encryption component distributes the latest SM4 key, and the SM4 key is encrypted using the session key (i.e. the first key) before being distributed.

[0084] Optionally, the data encryption method further includes:

[0085] Perform digital signature verification with the second encryption component;

[0086] The process of negotiating the first key with the second encryption component includes:

[0087] If the digital signature verification is successful, a first key is negotiated with the second encryption component.

[0088] In this embodiment, digital signature verification can be used to mutually verify the identity information of the first encryption component and the second encryption component, so that two encryption components with permissions or mutual matching can pass the digital signature verification. Only when the digital signature verification is passed will the first encryption component negotiate with the second encryption component to obtain the first key.

[0089] 3) The first encryption component receives the encrypted SM4 key and performs a correctness verification algorithm on the key (that is, if the SM4 key received from the encryption machine matches the SM4 key from the second encryption component, the verification is successful). When data triggers the encryption source code, the session key is used to decrypt the encrypted SM4 key.

[0090] During this process, the encryption machine can periodically issue different SM4 keys, and the first encryption component and the second encryption component need to agree on the received SM4 keys.

[0091] Optionally, the data encryption method further includes:

[0092] Receive the second key from the encryption machine in real time;

[0093] Send first information to the second encryption component, wherein the first information includes a second key that the first encryption component has recently acquired and which is encrypted based on the first key;

[0094] Receive the second key, which is encrypted based on the first key, from the second encryption component.

[0095] In this embodiment, the first encryption component can inform the second encryption component of the latest SM4 key received from the encryption machine, and / or the second encryption component can inform the first encryption component of the latest SM4 key received from the encryption machine. In this way, the two can perform matching and verification based on the latest SM4 key received by themselves from the encryption machine and the SM4 key received from each other. If the two match, it means that the first encryption component and the second encryption component have reached an agreement on the SM4 key.

[0096] 4) After the deployment of the first encryption component is completed, the original data transmission initiator is embedded with an aspect so that when there is a data request to the server port, the data will be diverted to the first encryption component. The first encryption component uses the session key to decode the SM4 key. After decoding, it performs encryption on the initiated data packet (encryption operation is based on the SM4 algorithm). After completion, it initiates the data request.

[0097] 5) When the second encryption component receives the encrypted data, it uses the session key to decode the SM4 key. After decoding, it uses the SM4 key to decrypt the received encrypted data. After decryption, it returns the data to the original server (i.e., provides the plaintext data to the server of the electronic signature system).

[0098] As an optional implementation, the first data includes request server port data, and the data encryption method further includes:

[0099] Upon obtaining the requested server port data, the original response message corresponding to the requested server port data is discarded, and the response message is reassembled to obtain the target response message, wherein the target response message is encrypted based on the first key.

[0100] Send the target response message to the server.

[0101] In this embodiment, the first encryption component receives and encrypts the plaintext data embedded via facets, and interacts with the server to discard the original message. Instead, it reassembles the response message to obtain ciphertext encrypted with the first key. This ciphertext can replace the original message in related technologies, improving message security. On the second encryption component side, the ciphertext can be decrypted based on the first key, and the decrypted message can be provided to the server.

[0102] Optionally, the step of reassembling the response message to obtain the target response message includes:

[0103] If the first data is decrypted by the second encryption component, data response information transmitted from the second encryption component is received, wherein the data response information is encrypted based on the first key;

[0104] Based on the data response information, the target response message is determined.

[0105] In this embodiment, when the second encryption component decrypts the first data, it generates a corresponding data response. This data response can be transmitted from the second encryption component to the first encryption component, allowing the first encryption component to determine the target response message. The entire encryption and decryption process uses a session key to encrypt and decrypt the transmitted data. For example, if the second encryption component encrypts the data response based on the first key and sends it to the first encryption component, the first encryption component can directly determine the data response received from the second encryption component and encrypted with the first key as the target response message.

[0106] like Figure 6 As shown, when the data encryption and decryption methods provided by this invention are applied to an electronic signature system, electronic signature services can be implemented based on the following process:

[0107] Step 1: By defining the user access permissions in the first encryption component and the second encryption component, the legitimate use of data encryption services by users is guaranteed. For example, in step 3, the first encryption component and the second encryption component can perform digital signature verification based on the user access permissions, and negotiate the first key if the digital signature verification is successful.

[0108] Step 2: Embed the first encryption component into the client's transmission channel and the second encryption component into the server's transmission channel. The server then sends task directory configurations to the first and second encryption components to configure their behavior during the execution of electronic signature business.

[0109] Step 3: Authenticate and control the access of users who need to use the first and second encryption components to ensure that the encryption and decryption services can only be used legally when authorized;

[0110] Step 4: When a user accesses the electronic signature system, the plaintext data can be viewed automatically through the authentication services of the first and second encryption components.

[0111] In this way, the embedded service component approach provides the basic support for SM4 national cryptographic algorithm encryption for data security protection on the transmission channel side, protecting the high confidentiality and security of data on the transmission side; through aspect encryption technology, the encryption and decryption service capabilities are pushed down to the data transmission channel side, linking with the electronic signature business system, simplifying the encryption and decryption service and response process, and realizing a new model of embedded encryption service for electronic signature system components.

[0112] It is worth mentioning that, in this embodiment of the invention, channel-side data security protection is achieved based on aspect-based encryption technology. By embedding aspect-based encryption components, the encryption and decryption processes in the electronic signature system are adaptively adapted, solving the problems of narrow data security protection scope, low efficiency, incompatibility, and slow speed that previously required applying for encryption modes via HTTPS. Furthermore, by using a channel-side encryption component embedding method to provide encryption and decryption services to the electronic signature system, no modifications to the electronic signature system, server-side interface, or client-side interface are required, making it widely applicable.

[0113] Please see Figure 7 This is a flowchart of a data decryption method provided by the present invention. The data decryption method is applied to a second encryption component, which is used to embed in the transmission channel between the server and the target business system.

[0114] In implementation, the steps of the data decryption method performed by the second encryption component are as follows: Figure 3 The steps of the data encryption method executed by the first encryption component in the illustrated embodiment correspond to those of the method. The first encryption component encrypts the data on the transmission channel side of the client, and the second encryption component decrypts the data on the transmission channel side of the server. This can provide embedded encrypted transmission services for the target business system and adaptively provide plaintext data to the target business system. Further details are omitted here.

[0115] like Figure 7 As shown, the data decryption method performed by the second encryption component may include the following steps:

[0116] Step 701: Negotiate with the first encryption component to obtain a first key, wherein the first encryption component is used to embed in the transmission channel between the client and the server.

[0117] Step 702: Interact with the first encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0118] Step 703: If the encrypted data packet is obtained from the server, the second key is obtained by decrypting based on the first key, and the encrypted data packet is decrypted using the second key to obtain the first data.

[0119] Step 704: Send the first data to the target business system.

[0120] Optionally, the target business system is an electronic signature system.

[0121] Optionally, the first encryption component and / or the second encryption component encapsulate the Transport Layer Security (TLS) protocol and a first block cipher algorithm, wherein the first block cipher algorithm corresponds to the second key.

[0122] Optionally, the first encryption component is deployed on the server front-end channel side of the client, and / or the second encryption component is deployed on the server front-end channel side of the server.

[0123] Optionally, after decrypting the encrypted data packet using the second key to obtain the first data, the data decryption method further includes:

[0124] Send data response information to the first encryption component, wherein the data response information is encrypted based on the first key, and the data response information is used by the first encryption component to reassemble the response message.

[0125] Optionally, the data decryption method further includes:

[0126] Verify the digital signature with the first encryption component;

[0127] The process of negotiating the first key with the first encryption component includes:

[0128] If the digital signature verification is successful, a first key is negotiated with the first encryption component.

[0129] Optionally, the data decryption method further includes:

[0130] Receive first information from the first encryption component, wherein the first information includes a second key that the first encryption component has recently acquired and which is encrypted based on the first key;

[0131] The encrypted second key is decrypted based on the first key to obtain the second key;

[0132] The second key is encrypted based on the first key, and the second key encrypted based on the first key is sent to the first encryption component.

[0133] In this embodiment of the invention, the data on the transmission channel side of the server is decrypted by the second encryption component, which can provide embedded encrypted transmission services for the target business system and adaptively provide plaintext data to the target business system, which will not be elaborated further here.

[0134] To facilitate understanding of the data encryption and decryption methods provided in the embodiments of the present invention, the following data encryption system will be used as an example to illustrate the data encryption and decryption methods provided in the embodiments of this application:

[0135] A data encryption system includes: a first encryption component, a second encryption component, a client, a server, and an electronic signature subsystem. The server is connected between the client and the electronic signature subsystem. The first encryption component is embedded in the transmission channel between the client and the server. The second encryption component is embedded in the transmission channel between the server and the electronic signature subsystem. The first encryption component and the second encryption component are communicatively connected.

[0136] In operation, the first encryption component and the second encryption component negotiate to obtain a first key. The second encryption component uses the first key to encrypt the second key to obtain an encrypted second key, and sends the encrypted second key to the first encryption component. The second key comes from the encryption machine.

[0137] Upon receiving the first data uploaded by the client, the first encryption component decrypts the data based on the first key to obtain the second key, and uses the second key to encrypt the first data to obtain an encrypted data packet. The encrypted data packet is then sent to the server through the client.

[0138] When the server receives the encrypted data packet, the second encryption component decrypts it based on the first key to obtain the second key, and uses the second key to decrypt the encrypted data packet to obtain the first data, so that the server can obtain the decrypted first data.

[0139] Optionally, when the first encryption component obtains the encrypted data packet, the client sends a first request message to the server, the first request message including the encrypted data packet;

[0140] When the second encryption component obtains the encrypted data packet from the server, it decrypts the data packet based on the first key to obtain the second key, and uses the second key to decrypt the encrypted data packet to obtain the first data, and sends the first data to the electronic signature system.

[0141] The electronic signature system is used to perform electronic signature-related processing on the first data.

[0142] The first data may be request server port data. Thus, upon obtaining the request server port data, the first encryption component discards the original response message corresponding to the request server port data, reassembles the response message to obtain the target response message, and sends the target response message to the client.

[0143] The process of reassembling the response message can be as follows: after the second encryption component decrypts and obtains the first data, it sends data response information to the first encryption component. The first encryption component determines the target response message based on the received data response information, wherein the data response information is encrypted data after encryption processing based on the first key.

[0144] Optionally, the server is used to perform policy rotation, and the encryption machine is used to update the second key according to the rotated policy, and send the updated second key to the first encryption component and the second encryption component.

[0145] Furthermore, the first encryption component and the second encryption component are also used to perform digital signature verification. If the digital signature verification is successful, the first encryption component and the second encryption component negotiate a first key and exchange a second key based on the negotiated first key, so that the two encryption components can reach an agreement on the second key.

[0146] Optionally, the server is further configured to send a task directory configuration to the first encryption component and the second encryption component, the task directory configuration being configured to configure the first encryption component and the second encryption component to perform tasks related to encrypting and decrypting the first data.

[0147] The data encryption / decryption system provided by this invention has the following advantages:

[0148] 1) It provides a streamlined service for the required data transmission encryption. Aspect-oriented programming allows encryption functionality to be added without altering existing modules, decoupling them from the original modules. It consumes minimal server resources, directly bridges the channel with the business system, eliminates the time-consuming handshake phase, and has no negative impact on the speed of the electronic signature system's business execution.

[0149] 2) The encryption component automatically performs SM4 encryption on the data input by the client, which greatly expands the encryption range, meets the high-performance requirements of data transmission and transaction processing, and ensures that business continuity is not affected;

[0150] 3) Configure the encryption component on the server side. Before the business system uses it for the first time, it uses a key to download the configuration installation package from the page to check the deployment and re-embed the original business client. No modification is required, which is efficient and convenient.

[0151] 4) The application of encryption components does not affect the electronic signature system's cache, nor does it increase or decrease data overhead or power consumption. It uses an end-to-end approach to perform transparent and imperceptible encryption on the application side, which does not affect the operation of other modules of the electronic signature system or change user habits. At the same time, it improves the efficiency of encryption and decryption services and reduces service interruption events caused by hardware failures.

[0152] 5) After the encryption component is applied, the system does not need to use an SSL certificate for encryption. At the same time, it can realize the isolated storage of data encryption keys, eliminate key information silos and eliminate the self-stored key mode in the business system, thus eliminating the risk of theft by the person in charge.

[0153] Please see Figure 8 This is a structural diagram of a data encryption device provided in an embodiment of the present invention. The data encryption device may be a component within a first encryption component, which is embedded in the transmission channel between the client and the server, such as... Figure 8 As shown, the data encryption device 800 includes:

[0154] The first negotiation module 801 is used to negotiate with the second encryption component to obtain a first key, and the second encryption component is used to be embedded in the transmission channel between the server and the target business system.

[0155] The first interaction module 802 is used to interact with the second encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0156] The first processing module 803 is used to, upon receiving the first data uploaded by the client, decrypt the first data based on the first key to obtain the second key, and use the second key to encrypt the first data to obtain an encrypted data packet, wherein the encrypted data packet is transmitted to the second encryption component via the client and the server.

[0157] Optionally, the first encryption component and / or the second encryption component encapsulate the Transport Layer Security (TLS) protocol and a first block cipher algorithm, wherein the first block cipher algorithm corresponds to the second key.

[0158] Optionally, the first encryption component is deployed on the server front-end channel side of the client, and / or the second encryption component is deployed on the server front-end channel side of the server.

[0159] Optionally, the first data includes request server port data, and the data encryption device 800 further includes:

[0160] The message processing module is used to discard the original response message corresponding to the request server port data and reassemble the response message to obtain the target response message when the request server port data is obtained. The target response message is encrypted based on the first key.

[0161] The second sending module is used to send the target response message to the server.

[0162] Optionally, the message processing module includes:

[0163] A receiving unit is configured to receive data response information transmitted from the second encryption component when the second encryption component decrypts the first data, wherein the data response information is encrypted based on the first key;

[0164] The determining unit is used to determine the target response message based on the data response information.

[0165] Optionally, the data encryption device 800 also includes:

[0166] The first verification module is used to perform digital signature verification with the second encryption component;

[0167] The first negotiation module 801 is specifically used for:

[0168] If the digital signature verification is successful, a first key is negotiated with the second encryption component.

[0169] Optionally, the data encryption device 800 also includes:

[0170] The first receiving module is used to receive the second key from the encryption machine in real time;

[0171] The third sending module is used to send first information to the second encryption component, wherein the first information includes a second key that the first encryption component has recently acquired and which is encrypted based on the first key;

[0172] The second receiving module is used to receive the second key, which is encrypted based on the first key, from the second encryption component.

[0173] The data encryption device 800 provided in this embodiment of the invention can achieve Figure 3 The various processes implemented in the method embodiments shown are capable of achieving the same beneficial effects, and will not be described again here to avoid repetition.

[0174] Please see Figure 9 This is a structural diagram of a data decryption device provided in an embodiment of the present invention. The data decryption device can be a component within a second encryption component, which is embedded in the transmission channel between the server and the target business system. Figure 9 As shown, the data decryption device 900 includes:

[0175] The second negotiation module 901 is used to negotiate with the first encryption component to obtain a first key, and the first encryption component is used to embed a transmission channel between the client and the server.

[0176] The second interaction module 902 is used to interact with the first encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine.

[0177] The second processing module 903 is used to, when the encrypted data packet is obtained from the server, decrypt it based on the first key to obtain the second key, and use the second key to decrypt the encrypted data packet to obtain the first data;

[0178] The first sending module 904 is used to send the first data to the target business system.

[0179] Optionally, the target business system is an electronic signature system.

[0180] Optionally, the first encryption component and / or the second encryption component encapsulate the Transport Layer Security (TLS) protocol and a first block cipher algorithm, wherein the first block cipher algorithm corresponds to the second key.

[0181] Optionally, the first encryption component is deployed on the server front-end channel side of the client, and / or the second encryption component is deployed on the server front-end channel side of the server.

[0182] Optionally, the data decryption device 900 further includes:

[0183] The fourth sending module is used to send data response information to the first encryption component, wherein the data response information is encrypted based on the first key, and the data response information is used by the first encryption component to reassemble the response message.

[0184] Optionally, the data decryption device 900 further includes:

[0185] The second verification module is used to perform digital signature verification with the first encryption component;

[0186] The second negotiation module 901 is specifically used for:

[0187] If the digital signature verification is successful, a first key is negotiated with the first encryption component.

[0188] Optionally, the data decryption device 900 further includes:

[0189] The third receiving module is configured to receive first information from the first encryption component, wherein the first information includes a second key recently acquired by the first encryption component and encrypted based on the first key;

[0190] The decryption module is used to decrypt the encrypted second key based on the first key to obtain the second key;

[0191] An encryption module is used to encrypt the second key based on the first key;

[0192] The fourth sending module is used to send the second key, which is encrypted based on the first key, to the first encryption component.

[0193] The data decryption device 900 provided in this embodiment of the invention can achieve Figure 7 The various processes implemented in the method embodiments shown are capable of achieving the same beneficial effects, and will not be described again here to avoid repetition.

[0194] Optional, such as Figure 10 As shown, this embodiment of the invention also provides an electronic device 1000, including a processor 1001, a memory 1002, and a program or instructions stored in the memory 1002 and executable on the processor 1001. When the program or instructions are executed by the processor 1001, they implement the following: Figure 3 and Figure 7 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0195] This invention also provides a computer-readable storage medium storing a program or instructions that, when executed by a processor, implement... Figure 3 and Figure 7 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0196] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0197] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of the present invention is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0198] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0199] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A data encryption method, characterized in that, For a first encryption component, the first encryption component is used to be embedded in the transmission channel between the client and the server using component embedding technology for aspect-oriented interface data transmission encryption and decryption, the method includes: The first key is negotiated with the second encryption component, which is used to embed the component embedding technology of aspect-oriented interface data transmission encryption and decryption into the transmission channel between the server and the target business system. The second key is obtained by exchanging encrypted second key with the second encryption component. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine. Upon receiving the first data uploaded by the client, the second key is obtained by decrypting the first key, and the first data is encrypted using the second key to obtain an encrypted data packet. The encrypted data packet is then transmitted to the second encryption component via the client and the server.

2. The method according to claim 1, characterized in that, The first encryption component and / or the second encryption component encapsulate the Transport Layer Security (TLS) protocol and a first block cipher algorithm, wherein the first block cipher algorithm corresponds to the second key.

3. The method according to claim 2, characterized in that, The first encryption component is used to be deployed on the server front-end channel side of the client, and / or the second encryption component is used to be deployed on the server front-end channel side of the server.

4. The method according to claim 3, characterized in that, The first data includes request server port data, and the method further includes: Upon obtaining the requested server port data, the original response message corresponding to the requested server port data is discarded, and the response message is reassembled to obtain the target response message, wherein the target response message is encrypted based on the first key. Send the target response message to the server.

5. The method according to claim 4, characterized in that, The process of reassembling the response message to obtain the target response message includes: If the first data is decrypted by the second encryption component, data response information transmitted from the second encryption component is received, wherein the data response information is encrypted based on the first key; Based on the data response information, the target response message is determined.

6. The method according to claim 1, characterized in that, The method further includes: Perform digital signature verification with the second encryption component; The process of negotiating the first key with the second encryption component includes: If the digital signature verification is successful, a first key is negotiated with the second encryption component.

7. The method according to claim 6, characterized in that, The method further includes: Receive the second key from the encryption machine in real time; Send first information to the second encryption component, wherein the first information includes a second key that the first encryption component has recently acquired and which is encrypted based on the first key; Receive the second key, which is encrypted based on the first key, from the second encryption component.

8. A data decryption method, characterized in that, For a second encryption component, the second encryption component is used to embed in the transmission channel between the server and the target business system using aspect-oriented interface data transmission encryption and decryption component embedding technology, the method includes: A first key is obtained through negotiation with a first encryption component, which is used to embed a component embedding technology for aspect-oriented interface data transmission encryption and decryption in the transmission channel between the client and the server. The second key is obtained by exchanging encrypted second key with the first encryption component. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine. When the encrypted data packet is obtained from the server, the second key is obtained by decrypting based on the first key, and the encrypted data packet is decrypted using the second key to obtain the first data; The first data is sent to the target business system.

9. The method according to claim 8, characterized in that, The target business system is an electronic signature system.

10. The method according to claim 8, characterized in that, The first encryption component and / or the second encryption component encapsulate the Transport Layer Security (TLS) protocol and a first block cipher algorithm, wherein the first block cipher algorithm corresponds to the second key.

11. The method according to claim 10, characterized in that, The first encryption component is used to be deployed on the server front-end channel side of the client, and / or the second encryption component is used to be deployed on the server front-end channel side of the server.

12. The method according to claim 11, characterized in that, After decrypting the encrypted data packet using the second key to obtain the first data, the method further includes: Send data response information to the first encryption component, wherein the data response information is encrypted based on the first key, and the data response information is used by the first encryption component to reassemble the response message.

13. The method according to claim 8, characterized in that, The method further includes: Verify the digital signature with the first encryption component; The process of negotiating the first key with the first encryption component includes: If the digital signature verification is successful, a first key is negotiated with the first encryption component.

14. The method according to claim 13, characterized in that, The method further includes: Receive first information from the first encryption component, wherein the first information includes a second key that the first encryption component has recently acquired and which is encrypted based on the first key; The encrypted second key is decrypted based on the first key to obtain the second key; The second key is encrypted based on the first key, and the second key encrypted based on the first key is sent to the first encryption component.

15. A data encryption device, characterized in that, For a first encryption component, the first encryption component is used to be embedded in the transmission channel between the client and the server using a component embedding technology for aspect-oriented interface data transmission encryption and decryption, the device includes: The first negotiation module is used to negotiate with the second encryption component to obtain the first key. The second encryption component is used to be embedded in the transmission channel between the server and the target business system using component embedding technology for aspect-oriented interface data transmission encryption and decryption. The first interaction module is used to interact with the second encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine. The first processing module is configured to, upon receiving the first data uploaded by the client, decrypt the first data using the first key to obtain the second key, and then use the second key to encrypt the first data to obtain an encrypted data packet, wherein the encrypted data packet is transmitted to the second encryption component via the client and the server.

16. A data decryption device, characterized in that, For a second encryption component, the second encryption component is used to embed in the transmission channel between the server and the target business system using aspect-oriented interface data transmission encryption and decryption component embedding technology, the device includes: The second negotiation module is used to negotiate with the first encryption component to obtain the first key. The first encryption component is used to be embedded in the transmission channel between the client and the server using a component embedding technology for aspect-oriented interface data transmission encryption and decryption. The second interaction module is used to interact with the first encryption component to obtain the encrypted second key. The encrypted second key is obtained by encrypting the second key based on the first key. The second key comes from the encryption machine. The second processing module is used to, when the encrypted data packet is obtained from the server, decrypt it based on the first key to obtain the second key, and use the second key to decrypt the encrypted data packet to obtain the first data; The first sending module is used to send the first data to the target business system.

17. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the data encryption method as described in any one of claims 1 to 7, or to implement the steps of the data decryption method as described in any one of claims 8 to 14.

18. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the data encryption method as described in any one of claims 1 to 7, or the steps of the data decryption method as described in any one of claims 8 to 14.

Images