Configuration file encryption and decryption system, method, device and readable storage medium

Abstract

The application provides a configuration file encryption and decryption system, method, device and readable storage medium. The system comprises a key generation module, a first deployment module and a decryption module which are arranged in the same host as a target program. The key generation module is configured to generate and return a temporary key according to local feature information and a key derivation function when being called, wherein the local feature information corresponding to different hosts is different. The first deployment module is configured to call the key generation module to obtain the temporary key, encrypt sensitive information according to the temporary key to obtain configuration ciphertext, and configure the configuration ciphertext into a configuration file of the target program. The decryption module is configured to call the key generation module to obtain the temporary key, decrypt the configuration ciphertext according to the temporary key to obtain the sensitive information, and provide the sensitive information for the target program. The application does not perform persistent storage of the key, thereby avoiding the problem that the key loss leads to the unavailability of the ciphertext.

Description

Technical Field

[0001] This application relates to the field of data encryption technology, specifically to a configuration file encryption / decryption system, method, device, and readable storage medium. Background Technology

[0002] Configuration files are files containing information needed for a program to operate successfully. This information is structured in a specific way and is not hard-coded into the program but is configurable by the user. Configuration files often contain sensitive user information. Displaying this sensitive information in plaintext poses a serious security risk; therefore, sensitive information in configuration files needs to be encrypted. For programs written in interpreted languages ​​(such as Python), if the encryption key is written in the program code, attackers can easily obtain the key from the source code, and modifying the key requires modifying the program code, making it difficult to maintain.

[0003] In related technologies, keys are persistently stored outside the program and provided to the program each time sensitive information in the configuration file is encrypted or decrypted. This method has high requirements for the security and stability of key storage. Once the stored key is lost, the ciphertext encrypted with that key cannot be used, which has serious consequences. Summary of the Invention

[0004] This application provides a configuration file encryption / decryption system, method, device, and readable storage medium, which can solve the technical problem in the prior art where key loss leads to unusable ciphertext.

[0005] In a first aspect, embodiments of this application provide a configuration file encryption / decryption system, which includes a key generation module, a first deployment module, and a decryption module, wherein the key generation module, the first deployment module, and the decryption module are located on the same host as the target program;

[0006] The key generation module is used to generate and return a temporary key based on local characteristic information and a key derivation function when it is called. The local characteristic information is different for different hosts.

[0007] The first deployment module is used to call the key generation module to obtain a temporary key, encrypt sensitive information according to the temporary key to obtain configuration ciphertext, and configure the configuration ciphertext into the configuration file of the target program;

[0008] The decryption module is used to call the key generation module to obtain a temporary key, and decrypt the configuration ciphertext according to the temporary key to obtain sensitive information for use by the target program.

[0009] Furthermore, in one embodiment, the key generation module has multiple optional types of local feature information and / or key derivation functions;

[0010] The key generation module is also used to update the temporary key in response to a key rotation instruction by changing the type of local feature information and / or key derivation function.

[0011] Furthermore, in one embodiment, the first deployment module is also configured to respond to a key rotation instruction by calling the key generation module to obtain a temporary key corresponding to the current configuration ciphertext, decrypting the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and sending a key rotation instruction to the key generation module before calling the key generation module again.

[0012] Furthermore, in one embodiment, the target software is a cloud platform client, and the configuration file encryption / decryption system further includes a second deployment module set in the cloud;

[0013] The second deployment module is used to send sensitive information and key rotation instructions to at least one host.

[0014] Furthermore, in one embodiment, the second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation;

[0015] The second deployment module is also used to detect whether the cloud has saved the previously sent sensitive information after the rotation cycle is reached or after the cloud administrator performs an operation. If the cloud has saved the previously sent sensitive information, the module sends a key rotation instruction to the key generation module and sends the sensitive information to the first deployment module again.

[0016] Furthermore, in one embodiment, the second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation;

[0017] The second deployment module is also used to detect whether the cloud has saved the previously sent sensitive information after the rotation cycle is reached or after the cloud administrator performs an operation. If the cloud has not saved the previously sent sensitive information, it sends a key rotation instruction to the first deployment module.

[0018] The first deployment module is also configured to respond to the key rotation instruction by calling the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypt the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and send the key rotation instruction to the key generation module before calling the key generation module again.

[0019] Furthermore, in one embodiment, the key generation module is written in a compiled language.

[0020] Secondly, embodiments of this application provide a configuration file encryption / decryption method, applied to a configuration file encryption / decryption system including a key generation module, a first deployment module, and a decryption module, wherein the key generation module, the first deployment module, and the decryption module are located on the same host as the target program, and the configuration file encryption / decryption method includes:

[0021] The first deployment module calls the key generation module to obtain a temporary key;

[0022] The key generation module generates a temporary key based on the local characteristic information and the key derivation function, and returns the temporary key to the first deployment module. The local characteristic information is different for different hosts.

[0023] The first deployment module encrypts sensitive information using a temporary key to obtain configuration ciphertext, and then configures the configuration ciphertext into the configuration file of the target program;

[0024] The decryption module calls the key generation module to obtain a temporary key;

[0025] The key generation module generates a temporary key based on local feature information and key derivation function, and returns the temporary key to the decryption module.

[0026] The decryption module decrypts the configuration ciphertext using the temporary key to obtain sensitive information for use by the target program.

[0027] Thirdly, this application also provides a configuration file encryption / decryption device, which includes a processor, a memory, and a configuration file encryption / decryption program stored in the memory and executable by the processor, wherein when the configuration file encryption / decryption program is executed by the processor, it implements the steps of the above-described configuration file encryption / decryption method.

[0028] Fourthly, embodiments of this application also provide a readable storage medium storing a configuration file encryption / decryption program, wherein when the configuration file encryption / decryption program is executed by a processor, it implements the steps of the above-described configuration file encryption / decryption method.

[0029] In this application, before each encryption / decryption of sensitive information in the configuration file, a temporary key is generated based on the local machine's characteristics and a key derivation function. The key is not persistently stored, thus avoiding the problem of unusable ciphertext due to key loss. Key generation and encryption / decryption operations are performed locally, eliminating the need for key transmission over a network, significantly reducing the risk of leakage. It is not dependent on a central cluster or external deployment tools, facilitating maintenance and offering strong scalability. For different hosts, due to different local machine characteristics, the corresponding keys are also different; a single key is only effective for a specific host, making the risk of leakage controllable. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the architecture of a configuration file encryption / decryption system in one embodiment of this application;

[0031] Figure 2 This is a timing diagram of key rotation in a configuration file encryption / decryption system according to one embodiment of this application;

[0032] Figure 3 A timing diagram of key rotation in a configuration file encryption / decryption system according to another embodiment of this application;

[0033] Figure 4 This is a flowchart illustrating a configuration file encryption / decryption method in one embodiment of this application;

[0034] Figure 5 This is a schematic diagram of the hardware structure of the configuration file encryption / decryption device involved in the embodiments of this application. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0037] In a first aspect, embodiments of this application provide a configuration file encryption / decryption system.

[0038] Figure 1 A schematic diagram of the architecture of a configuration file encryption / decryption system in one embodiment of this application is shown.

[0039] Reference Figure 1In one embodiment, the configuration file encryption / decryption system includes a key generation module, a first deployment module, and a decryption module. These modules are located on the same host as the target program. The key generation module, when invoked, generates and returns a temporary key based on local characteristic information and a key derivation function. The local characteristic information differs for different hosts. The first deployment module invokes the key generation module to obtain the temporary key, encrypts sensitive information using the temporary key to obtain configuration ciphertext, and configures the configuration ciphertext into the target program's configuration file. The decryption module invokes the key generation module to obtain the temporary key, decrypts the configuration ciphertext using the temporary key to obtain the sensitive information for use by the target program.

[0040] A key derivation function is a method for deriving a cryptographically secure key from initial data, such as PBKDF2, Bcrypt, Scrypt, and Argon2. Local machine characteristics serve as the seed information for the key derivation function. Any type of unique local machine information can be used, such as a host identifier or a specified network interface card (NIC) MAC address, ensuring that the same type of local machine characteristics are different across different hosts. Key generation modules on different hosts can use either the same type of local machine characteristics and key derivation functions, or different types of local machine characteristics and key derivation functions. The encryption and decryption operations use the same key and a symmetric encryption algorithm, such as AES or SM4.

[0041] Specifically, the configuration ciphertext is persistently stored locally. The encryption operation of the first deployment module is only performed when a new configuration ciphertext needs to be generated, such as when sensitive information is first obtained, when sensitive information is updated, or when the temporary key is updated. The plaintext of sensitive information is not persistently stored locally; each time the target program runs, the decryption module needs to perform a decryption operation to provide the plaintext of the sensitive information. The temporary key is also not persistently stored locally; each time encryption or decryption operations are involved, the key generation module needs to be called to obtain the temporary key.

[0042] Therefore, in this embodiment, before each encryption / decryption of sensitive information in the configuration file, a temporary key is generated based on the local machine's characteristic information and the key derivation function. The key is not persistently stored, thus avoiding the problem of unusable ciphertext due to key loss. Key generation and encryption / decryption operations are performed locally, eliminating the need for key transmission over a network, significantly reducing the risk of leakage. It is not dependent on a central cluster or external deployment tools, making it easy to maintain and highly scalable. For different hosts, since the local machine's characteristic information is different, the corresponding keys are also different. A single key is only effective for a specific host, making the risk of leakage controllable.

[0043] Compiled languages ​​require a compiler to compile source code into machine code before execution. This typically involves two steps: compilation and linking. Compilation converts the source code into machine code, while linking combines the machine code of individual modules with their dependencies to generate an executable file. Common compiled languages ​​include C and C++. Interpreted languages ​​do not require compilation, saving a step compared to compiled languages. Interpreted languages ​​translate code line by line during runtime. Common interpreted languages ​​include JavaScript and Python.

[0044] Furthermore, in one embodiment, the key generation module is written in a compiled language. This makes it impossible for attackers to view the specific source code and difficult to decompile, thereby improving the security of the native signature information and key derivation functions used in the key generation module.

[0045] Furthermore, in one embodiment, the key generation module has multiple preset optional types for local feature information and / or key derivation functions. The key generation module is also configured to change the type of local feature information and / or key derivation functions in response to a key rotation command, thereby updating the temporary key.

[0046] In this embodiment, the key rotation command can be issued periodically based on the rotation cycle or based on user operations. Any change in the type of either the local characteristic information or the key derivation function will generate a new temporary key, further reducing the risk of leakage. Furthermore, key rotation on different hosts will not affect each other and can be implemented independently, offering high flexibility.

[0047] Furthermore, in one embodiment, the first deployment module is also configured to respond to the key rotation instruction by calling the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypt the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and send the key rotation instruction to the key generation module before calling the key generation module again.

[0048] In this embodiment, when the current sensitive information cannot be directly obtained, the key rotation instruction is not sent directly to the key generation module, but is first sent to the first deployment module. This allows the first deployment module to obtain the current temporary key, decrypt the current configuration ciphertext, and obtain the current sensitive information. Then, the first deployment module forwards the key rotation instruction to the key generation module, enabling the key generation module to update the temporary key. The first deployment module then obtains the new temporary key again to encrypt the current sensitive information and obtain the new configuration ciphertext.

[0049] Understandably, for situations where the current sensitive information can be directly obtained (e.g., re-input from an external source), a key rotation command can be directly sent to the key generation module. After the key generation module completes the update of the temporary key, the first deployment module obtains the new temporary key again to encrypt the current sensitive information, resulting in a new configuration ciphertext.

[0050] Furthermore, in some embodiments, the target program is a cloud platform client, and the configuration file encryption / decryption system also includes a second deployment module located in the cloud. The second deployment module is used to send sensitive information and key rotation instructions to at least one host.

[0051] In this embodiment, the configuration file encryption / decryption system is suitable for cloud platforms, such as OpenStack. Upper-layer deployment services only need to focus on issuing sensitive information and key rotation instructions. The encryption / decryption of sensitive information and the updating of temporary keys are performed independently by each host, which helps improve the overall security of the cloud platform and significantly reduces subsequent maintenance complexity.

[0052] It should be noted that the security of the input process of sensitive information in the cloud and the transmission process from the cloud to the client can be guaranteed by other means, such as intranet communication, which will not be elaborated here.

[0053] Figure 2 The diagram shows a timing diagram of key rotation in a configuration file encryption / decryption system according to an embodiment of this application.

[0054] Reference Figure 2 Furthermore, in one embodiment, the second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation. The second deployment module is also used to detect whether the previously sent sensitive information is saved in the cloud after the rotation cycle is reached or after the cloud administrator's operation. If the previously sent sensitive information is saved in the cloud, the second deployment module sends a key rotation instruction to the key generation module and sends the sensitive information to the first deployment module again.

[0055] Taking an operation on a host targeting sensitive information as an example, the specific steps of this embodiment are explained.

[0056] The initial encryption phase proceeds as follows:

[0057] A1. The second deployment module sends sensitive information X to the first deployment module;

[0058] A2. The first deployment module calls the key generation module;

[0059] A3. The key generation module generates a temporary key M;

[0060] A4. The key generation module returns the temporary key M to the first deployment module;

[0061] A5. The first deployment module encrypts sensitive information X using the temporary key M to obtain the configuration ciphertext MX.

[0062] Before key rotation, the decryption module calls the key generation module multiple times to obtain a temporary key M. Based on the temporary key M, it decrypts the configuration ciphertext MX to obtain sensitive information X for use by the target program.

[0063] Key rotation can be divided into a preparation phase and a re-encryption phase. The preparation phase requires the key generation module to change its local characteristic information and / or the type of the key derivation function, enabling the first deployment module to obtain the original sensitive information. The re-encryption phase involves the first deployment module encrypting the original sensitive information using a new temporary key to obtain a new configuration ciphertext.

[0064] The preliminary preparation phase involves the following steps:

[0065] B1. After the rotation cycle is reached or the cloud administrator performs an operation, the second deployment module checks whether sensitive information X is stored in the cloud.

[0066] B2. In the case of storing sensitive information X in the cloud, the second deployment module sends a key rotation instruction to the key generation module;

[0067] B3. The key generation module changes the local feature information and / or the type of the key derivation function;

[0068] B4. The second deployment module sends sensitive information X to the first deployment module.

[0069] Since sensitive information X is stored in the cloud, the key rotation command can be sent directly to the key generation module through the second deployment module, and sensitive information X can be sent to the first deployment module, thereby simplifying the operation.

[0070] It should be noted that B4 can be executed simultaneously with B2 or before B2. The advantage of executing B2, B3, and B4 in sequence is that the first deployment module can start re-encryption immediately after receiving the sensitive information X. In other sequences, the first deployment module must wait for the key to be changed before it can start re-encryption after receiving the sensitive information X.

[0071] The re-encryption phase proceeds as follows:

[0072] C1. The first deployment module calls the key generation module;

[0073] C2. The key generation module generates a temporary key N;

[0074] C3. The key generation module returns the temporary key N to the first deployment module;

[0075] C4. The first deployment module encrypts sensitive information X using temporary key N to obtain configuration ciphertext NX.

[0076] It is understandable that the operations of the first deployment module and the key generation module are basically the same in the re-encryption phase and the initial encryption phase. The difference lies in the temporary key used, which results in different configuration ciphertexts. Before the next key rotation, the decryption module will call the key generation module multiple times to obtain the temporary key N. Based on the temporary key N, it will decrypt the configuration ciphertext NX to obtain the sensitive information X, which can then be used by the target program.

[0077] Figure 3 A timing diagram of key rotation in the configuration file encryption / decryption system is shown in another embodiment of this application.

[0078] Reference Figure 3 Furthermore, in one embodiment, the second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation. The second deployment module is also used to check whether the previously sent sensitive information is saved in the cloud after the rotation cycle is reached or after the cloud administrator's operation. If the cloud has not saved the previously sent sensitive information, it sends a key rotation instruction to the first deployment module. The first deployment module is also used to respond to the key rotation instruction by calling the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypting the configuration ciphertext using the temporary key to obtain the corresponding sensitive information, and sending a key rotation instruction to the key generation module before calling the key generation module again.

[0079] Continuing with an example of a host's operation on sensitive information, the specific steps of this embodiment will be explained.

[0080] It is understandable that whether or not the cloud stores previously sent sensitive information only changes the operations in the initial preparation stage, and does not change the operations in the initial encryption stage and the re-encryption stage. Figure 3 The steps in A1 to A5 and C1 to C4 are as follows Figure 2 The above description is consistent and will not be repeated here.

[0081] Reference Figure 3 The preliminary preparation stage involves the following steps:

[0082] B1. After the rotation cycle is reached or the cloud administrator performs an operation, the second deployment module checks whether sensitive information X is stored in the cloud.

[0083] B5. In the case where sensitive information X is not stored in the cloud, the second deployment module sends a key rotation instruction to the first deployment module.

[0084] B6. The first deployment module calls the key generation module;

[0085] B7. The key generation module generates a temporary key M;

[0086] B8. The key generation module returns the temporary key M to the first deployment module;

[0087] B9. The first deployment module decrypts the configuration ciphertext MX using the temporary key M to obtain the sensitive information X;

[0088] B10. The first deployment module sends a key rotation instruction to the key generation module;

[0089] B11. The key generation module changes the type of local feature information and / or key derivation function.

[0090] Since the sensitive information X is not stored in the cloud, the only way to obtain the sensitive information X is through the configuration ciphertext MX. Therefore, the second deployment module sends a key rotation instruction to the first deployment module, triggering the first deployment module to decrypt the configuration ciphertext MX and forward the key rotation instruction, so that the first deployment module can obtain the sensitive information X. This allows the key generation module to change the local characteristic information and / or the type of the key derivation function, thereby completing the preliminary preparation work.

[0091] It should be noted that B9 can be executed simultaneously with B10 or after B10. The advantage of executing B9 and B10 in sequence is that it ensures that the first deployment module triggers the key change only after successfully receiving the sensitive information X. In other sequences, there is a possibility that the configuration ciphertext MX may be temporarily unable to be decrypted due to occasional failures, but the temporary key M has already been changed to the temporary key N, causing inconvenience to users.

[0092] Secondly, embodiments of this application also provide a configuration file encryption / decryption method, applied to a configuration file encryption / decryption system including a key generation module, a first deployment module, and a decryption module, wherein the key generation module, the first deployment module, and the decryption module are located on the same host as the target program.

[0093] Figure 4 A flowchart illustrating a configuration file encryption / decryption method according to an embodiment of this application is shown.

[0094] Reference Figure 4 Configuration file encryption and decryption methods include:

[0095] S11. The first deployment module calls the key generation module to obtain a temporary key;

[0096] S12. The key generation module generates a temporary key based on the local characteristic information and the key derivation function, and returns the temporary key to the first deployment module. The local characteristic information is different for different hosts.

[0097] S13. The first deployment module encrypts sensitive information using a temporary key to obtain configuration ciphertext, and then configures the configuration ciphertext into the target program's configuration file.

[0098] S14. The decryption module calls the key generation module to obtain a temporary key;

[0099] S15. The key generation module generates a temporary key based on the local characteristic information and the key derivation function, and returns the temporary key to the decryption module.

[0100] S16. The decryption module decrypts the configuration ciphertext using the temporary key to obtain sensitive information for use by the target program.

[0101] Furthermore, in one embodiment, the key generation module has multiple preset optional types for local feature information and / or key derivation functions; the configuration file encryption / decryption method further includes:

[0102] The key generation module responds to the key rotation command by changing the local characteristic information and / or the type of the key derivation function to update the temporary key.

[0103] Furthermore, in one embodiment, before the step of the key generation module changing the type of local characteristic information and / or key derivation function in response to the key rotation instruction to update the temporary key, the method further includes:

[0104] In response to the key rotation command, the first deployment module calls the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypts the configuration ciphertext using the temporary key to obtain the corresponding sensitive information, and sends the key rotation command to the key generation module before calling the key generation module again.

[0105] Furthermore, in one embodiment, the target software is a cloud platform client, and the configuration file encryption / decryption system also includes a second deployment module set in the cloud;

[0106] The second deployment module is used to send sensitive information and key rotation instructions to at least one host.

[0107] Furthermore, in one embodiment, the configuration file encryption / decryption method further includes:

[0108] The second deployment module sends sensitive information to the first deployment module for the first time based on the cloud administrator's operation;

[0109] After the rotation cycle is reached or the cloud administrator performs an operation, the second deployment module checks whether the cloud has saved the previously sent sensitive information. If the cloud has saved the previously sent sensitive information, it sends a key rotation instruction to the key generation module and sends the sensitive information to the first deployment module again.

[0110] Furthermore, in one embodiment, the configuration file encryption / decryption method further includes:

[0111] The second deployment module sends sensitive information to the first deployment module for the first time based on the cloud administrator's operation;

[0112] After the rotation cycle is reached or the cloud administrator performs an operation, the second deployment module checks whether the cloud has saved the previously sent sensitive information. If the cloud has not saved the previously sent sensitive information, it sends a key rotation instruction to the first deployment module.

[0113] The first deployment module is also used to respond to the key rotation instruction by calling the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypting the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and sending the key rotation instruction to the key generation module before calling the key generation module again.

[0114] Furthermore, in one embodiment, the key generation module is written in a compiled language.

[0115] The analysis of each step in the above configuration file encryption and decryption method corresponds to the function and implementation process of each component in the above configuration file encryption and decryption system, and will not be elaborated here.

[0116] Thirdly, embodiments of this application provide a configuration file encryption / decryption device, which can be a personal computer (PC), laptop computer, server, or other device with data processing capabilities.

[0117] Figure 5 A schematic diagram of the hardware structure of the configuration file encryption / decryption device involved in the embodiments of this application is shown.

[0118] Reference Figure 5 In this embodiment of the application, the configuration file encryption / decryption device may include a processor, a memory, a communication interface, and a communication bus.

[0119] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0120] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the configuration file encryption / decryption device, as well as interfaces used for interconnecting the configuration file encryption / decryption device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0121] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0122] The processor can be a general-purpose processor, which can call the configuration file encryption / decryption program stored in memory and execute the configuration file encryption / decryption method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the configuration file encryption / decryption program is called can be referred to in the various embodiments of the configuration file encryption / decryption method of this application, and will not be repeated here.

[0123] Those skilled in the art will understand that Figure 5 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0124] Fourthly, embodiments of this application also provide a readable storage medium.

[0125] The present application has a readable storage medium storing a configuration file encryption / decryption program, wherein when the configuration file encryption / decryption program is executed by a processor, it implements the steps of the configuration file encryption / decryption method described above.

[0126] The method implemented when the configuration file encryption / decryption program is executed can be referred to in various embodiments of the configuration file encryption / decryption method of this application, and will not be repeated here.

[0127] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0128] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0129] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0130] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0131] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0133] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A configuration file encryption / decryption system, characterized in that, The configuration file encryption / decryption system includes a key generation module, a first deployment module, and a decryption module. The key generation module, the first deployment module, and the decryption module are located on the same host as the target program. The key generation module is used to generate and return a temporary key based on local characteristic information and a key derivation function when it is called. The local characteristic information is different for different hosts. The first deployment module is used to call the key generation module to obtain a temporary key, encrypt sensitive information according to the temporary key to obtain configuration ciphertext, and configure the configuration ciphertext into the configuration file of the target program; The decryption module is used to call the key generation module to obtain a temporary key, and decrypt the configuration ciphertext according to the temporary key to obtain sensitive information for use by the target program; In the key generation module, local feature information and / or key derivation function are preset with multiple optional types; The key generation module is also used to update the temporary key in response to the key rotation instruction by changing the type of local feature information and / or key derivation function. The first deployment module is also used to, in response to a key rotation instruction, call the key generation module to obtain a temporary key corresponding to the current configuration ciphertext when the current sensitive information cannot be directly obtained, decrypt the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and send a key rotation instruction to the key generation module before calling the key generation module again; The first deployment module is further configured to, after the key generation module completes the update of the temporary key, call the key generation module again to obtain a new temporary key, encrypt the current sensitive information according to the new temporary key to obtain a new configuration ciphertext, and configure the new configuration ciphertext into the configuration file of the target program.

2. The configuration file encryption / decryption system as described in claim 1, characterized in that, The target software is a cloud platform client, and the configuration file encryption / decryption system also includes a second deployment module set up in the cloud; The second deployment module is used to send sensitive information and key rotation instructions to at least one host.

3. The configuration file encryption / decryption system as described in claim 2, characterized in that, The second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation; The second deployment module is also used to detect whether the cloud has saved the previously sent sensitive information after the rotation cycle is reached or after the cloud administrator performs an operation. If the cloud has saved the previously sent sensitive information, the module sends a key rotation instruction to the key generation module and sends the sensitive information to the first deployment module again.

4. The configuration file encryption / decryption system as described in claim 2, characterized in that, The second deployment module is used to send sensitive information to the first deployment module for the first time based on the cloud administrator's operation; The second deployment module is also used to detect whether the cloud has saved the previously sent sensitive information after the rotation cycle is reached or after the cloud administrator performs an operation. If the cloud has not saved the previously sent sensitive information, it sends a key rotation instruction to the first deployment module.

5. The configuration file encryption / decryption system as described in any one of claims 1 to 4, characterized in that, The key generation module is written in a compiled language.

6. A method for encrypting and decrypting configuration files, characterized in that, A configuration file encryption / decryption system comprising a key generation module, a first deployment module, and a decryption module, wherein the key generation module, the first deployment module, and the decryption module are located on the same host as the target program, and the configuration file encryption / decryption method includes: The first deployment module calls the key generation module to obtain a temporary key; The key generation module generates a temporary key based on the local characteristic information and the key derivation function, and returns the temporary key to the first deployment module. The local characteristic information is different for different hosts. The first deployment module encrypts sensitive information using a temporary key to obtain configuration ciphertext, and then configures the configuration ciphertext into the configuration file of the target program; The decryption module calls the key generation module to obtain a temporary key; The key generation module generates a temporary key based on local feature information and key derivation function, and returns the temporary key to the decryption module. The decryption module decrypts the configuration ciphertext using the temporary key to obtain sensitive information for use by the target program; When the first deployment module cannot directly obtain the current sensitive information, it responds to the key rotation instruction by calling the key generation module to obtain the temporary key corresponding to the current configuration ciphertext, decrypts the configuration ciphertext according to the temporary key to obtain the corresponding sensitive information, and sends the key rotation instruction to the key generation module before calling the key generation module again. In response to the key rotation command, the key generation module changes the type of local feature information and / or key derivation function to update the temporary key. In the key generation module, the local feature information and / or key derivation function have multiple preset optional types. After the key generation module completes the update of the temporary key, the first deployment module calls the key generation module again to obtain a new temporary key, encrypts the current sensitive information according to the new temporary key to obtain a new configuration ciphertext, and configures the new configuration ciphertext into the configuration file of the target program.

7. A configuration file encryption / decryption device, characterized in that, The configuration file encryption / decryption device includes a processor, a memory, and a configuration file encryption / decryption program stored in the memory and executable by the processor, wherein when the configuration file encryption / decryption program is executed by the processor, it implements the steps of the configuration file encryption / decryption method as described in claim 6.

8. A readable storage medium, characterized in that, The readable storage medium stores a configuration file encryption / decryption program, wherein when the configuration file encryption / decryption program is executed by a processor, it implements the steps of the configuration file encryption / decryption method as described in claim 6.

Images