An encryption and decryption service method and system based on identity management

Abstract

The present invention discloses an encryption and decryption service method and system based on identity management, which comprises: a client sends basic information of a user to an identity authentication server; the identity authentication server authenticates the user according to a password and a user name, generates a first key pair after the authentication is passed, distributes the first key pair and sends it to the client and the identity management server; the client generates a service request, encrypts the service request by a first public key; the identity management server decrypts the service request using a first private key, generates a second key pair after decryption, and sends the second public key to the client; the client encrypts the original data of the user according to the second public key; the identity management server decrypts the encrypted original data using the second private key, and obtains the original data of the user after the decryption is completed. The present invention encrypts the service request and the original data successively by the identity authentication server and the identity management server, thereby ensuring the security and reliability of the data.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information processing, and in particular to an encryption and decryption service method and system based on identity management. Background Art

[0002] Identity management refers to the process of authenticating, authorizing, and managing permissions for users in a computer system. It is a key component in ensuring system security, especially in encryption and decryption services involving sensitive data. Encryption and decryption services refer to converting data into an unreadable form by using cryptographic algorithms and then restoring it to a readable form. Based on identity management, encryption and decryption services are used to protect users' sensitive information.

[0003] However, the existing encryption and decryption service methods make it easy for unauthorized users to obtain sensitive data or perform malicious operations during data storage and transmission, which is difficult to effectively prevent malicious theft of user data and cannot guarantee the security of user data. Therefore, a method and system are urgently needed to prevent unauthorized access and theft. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an encryption and decryption service method based on identity management, comprising:

[0005] The client sends the user's basic information to the identity verification server, wherein the basic information includes a password and a user name;

[0006] The identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, sends the first public key to the client, and sends the first private key to the identity management server;

[0007] After receiving the first public key, the client generates a service request, encrypts the service request using the first public key, and sends the encrypted request to the identity management server;

[0008] The identity management server decrypts the service request using the first private key, generates a second key pair after decryption, the second key pair including a second public key and a second private key, and sends the second public key to the client;

[0009] The client encrypts the original data of the user according to the second public key, and sends the encrypted original data to the identity management server;

[0010] After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data, and obtains the original data of the user after the decryption is completed.

[0011] Further, the identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, and sends the first public key to the client, and sends the first private key to the identity management server, including:

[0012] The authentication server will search and compare the internally stored username based on the username;

[0013] After confirming that the user name is the internally stored user name, the password corresponding to the internally stored user name is confirmed with the password;

[0014] After confirming that the password is correct, the identity authentication is passed, and the identity authentication server generates a first key pair, wherein the first key pair includes a first public key and a first private key;

[0015] The first public key is sent to the client, and the first private key is sent to the identity management server.

[0016] Further, after receiving the first public key, the client generates a service request, and encrypts the service request by using the first public key and sends it to the identity management server, including:

[0017] After receiving the first public key, the client generates a service request to request service from the identity management server;

[0018] The service request is encrypted using the first public key, and the encrypted service request is sent to an identity management server.

[0019] Further, the identity management server uses the first private key to decrypt the service request, generates a second key pair after decryption, the second key pair includes a second public key and a second private key, and sends the second public key to the client, including:

[0020] After receiving the encrypted service request, the identity management server uses the first private key to decrypt the service request;

[0021] After the decryption is completed, a second key pair is generated, wherein the second key pair includes a second public key and a second private key;

[0022] The second public key is sent to the client, and the second private key is kept on the identity management server.

[0023] Furthermore, the client encrypts the original data of the user according to the second public key, and sends the encrypted original data to the identity management server, including:

[0024] After receiving the second public key, the client encrypts the original data of the user according to the second public key;

[0025] After the encryption is completed, the encrypted original data is sent to the identity management server.

[0026] Further, after receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data, and obtains the original data of the user after decryption, including:

[0027] After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data;

[0028] After the decryption is completed, the obtained data is the user's original data.

[0029] Furthermore, the first private key and the second private key in the identity management server are uniformly encrypted and stored by an encryption key management system.

[0030] The present invention also provides an encryption and decryption service system based on identity management, comprising:

[0031] A sending module, used for the client to send the user's basic information to the identity authentication server, the basic information including the password and user name;

[0032] A verification module, used for the identity authentication server to authenticate the user according to the password and the user name, generate a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, and send the first public key to the client, and send the first private key to the identity management server;

[0033] A request module, configured for the client to generate a service request after receiving the first public key, and to encrypt the service request using the first public key and then send it to the identity management server;

[0034] A service module, configured for the identity management server to decrypt the service request using the first private key, generate a second key pair after decryption, the second key pair including a second public key and a second private key, and send the second public key to the client;

[0035] An encryption module, used for the client to encrypt the original data of the user according to the second public key, and send the encrypted original data to the identity management server;

[0036] The decryption module is used for the identity management server to decrypt the encrypted original data using the second private key after receiving the encrypted original data, and obtain the user's original data after the decryption is completed.

[0037] Compared with the prior art, the encryption and decryption service method and system based on identity management in the embodiment of the present invention has the following beneficial effects:

[0038] The present invention ensures the integrity and reliability of the service request by first encrypting the service request of the client through the identity authentication server and decrypting it by the identity management server. The key pair is generated by the identity management server, and the client encrypts the user's original data, which is decrypted by the identity management server to obtain the user's original data. The entire process converts the user's data into an unreadable form during storage and transmission through an encryption algorithm, thereby preventing unauthorized access and theft. The key is securely managed to prevent the key from being leaked or used by unauthorized personnel, providing reliable data protection and access control, and ensuring the security of the system and the privacy of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flowchart of an encryption and decryption service method based on identity management in an embodiment of the present invention;

[0040] Figure 2 It is a schematic diagram of the composition of the encryption and decryption service system based on identity management in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0042] In the description of the present application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the method or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0043] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0044] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0045] like Figure 1 As shown, in an embodiment of the present application, an encryption and decryption service method based on identity management is provided, including: S100: the client sends the basic information of the user to the identity authentication server, the basic information including the password and the user name; S200: the identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, and sends the first public key to the client, and sends the first private key to the identity management server; S300: after receiving the first public key, the client generates a service request, and encrypts the service request with the first public key and sends it to the identity management server; S400: the identity management server decrypts the service request using the first private key, generates a second key pair after the decryption is completed, the second key pair includes a second public key and a second private key, and sends the second public key to the client; S500: the client encrypts the original data of the user according to the second public key, and sends the encrypted original data to the identity management server; S600: after receiving the encrypted original data, the identity management server decrypts the encrypted original data using the second private key, and obtains the original data of the user after the decryption is completed.

[0046] Furthermore, the present invention ensures the integrity and reliability of the service request by first encrypting the client's service request through the identity authentication server and decrypting it through the identity management server. The identity management server also generates a key pair, and the client encrypts the user's original data, which is decrypted by the identity management server. The entire process converts the user's data into an unreadable form during storage and transmission through an encryption algorithm, thereby preventing unauthorized access and theft. The key is securely managed to prevent the key from being leaked or used by unauthorized personnel, providing reliable data protection and access control, and ensuring the security of the system and the privacy of users.

[0047] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, wherein the identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, and the first key pair includes a first public key and a first private key, and sends the first public key to the client, and sends the first private key to the identity management server, including:

[0048] The authentication server will search and compare the internally stored username based on the username;

[0049] After confirming that the user name is the internally stored user name, the password corresponding to the internally stored user name is confirmed with the password;

[0050] After confirming that the password is correct, the identity authentication is passed, and the identity authentication server generates a first key pair, wherein the first key pair includes a first public key and a first private key;

[0051] The first public key is sent to the client, and the first private key is sent to the identity management server.

[0052] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, wherein after receiving the first public key, the client generates a service request, and encrypts the service request by the first public key and sends it to the identity management server, including:

[0053] After receiving the first public key, the client generates a service request to request service from the identity management server;

[0054] The service request is encrypted using the first public key, and the encrypted service request is sent to an identity management server.

[0055] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, wherein the identity management server uses the first private key to decrypt the service request, generates a second key pair after decryption, the second key pair includes a second public key and a second private key, and sends the second public key to the client, including:

[0056] After receiving the encrypted service request, the identity management server uses the first private key to decrypt the service request;

[0057] After the decryption is completed, a second key pair is generated, wherein the second key pair includes a second public key and a second private key;

[0058] The second public key is sent to the client, and the second private key is kept on the identity management server.

[0059] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, wherein the client encrypts the original data of the user according to the second public key and sends the encrypted original data to the identity management server, including:

[0060] After receiving the second public key, the client encrypts the original data of the user according to the second public key;

[0061] After the encryption is completed, the encrypted original data is sent to the identity management server.

[0062] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, wherein after receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data, and obtains the original data of the user after decryption, including:

[0063] After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data;

[0064] After the decryption is completed, the obtained data is the user's original data.

[0065] In an embodiment of the present application, an encryption and decryption service method based on identity management is provided, and the first private key and the second private key in the identity management server are uniformly encrypted and stored by an encryption key management system.

[0066] like Figure 2As shown, in an embodiment of the present application, an encryption and decryption service system based on identity management is provided, including: a sending module, for a client to send basic information of a user to an identity authentication server, the basic information including a password and a user name; a verification module, for the identity authentication server to authenticate the user according to the password and the user name, generate a first key pair after the identity authentication is passed, the first key pair including a first public key and a first private key, and send the first public key to the client, and send the first private key to the identity management server; a request module, for the client to generate a service request after receiving the first public key, and encrypt the service request with the first public key and send it to the identity management server; a service module, for the identity management server to decrypt the service request using the first private key, generate a second key pair after decryption, the second key pair including a second public key and a second private key, and send the second public key to the client; an encryption module, for the client to encrypt the original data of the user according to the second public key, and send the encrypted original data to the identity management server; a decryption module, for the identity management server to decrypt the encrypted original data using the second private key after receiving the encrypted original data, and obtain the original data of the user after decryption.

[0067] In summary, the embodiment of the present invention provides an encryption and decryption service method and system based on identity management, which includes: the client sends the basic information of the user to the identity authentication server; the identity authentication server authenticates the user according to the password and user name, generates a first key pair after the authentication is passed, distributes the first key pair to the client and the identity management server; the client generates a service request, and encrypts the service request by the first public key; the identity management server decrypts the service request using the first private key, generates a second key pair after decryption, and sends the second public key to the client; the client encrypts the user's original data according to the second public key; the identity management server decrypts the encrypted original data using the second private key, and obtains the user's original data after decryption. The present invention encrypts the service request and the original data successively by the identity authentication server and the identity management server, thereby ensuring the security and reliability of the data.

[0068] Finally, it should be noted that it is obvious that those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0069] The above is only an example of implementation of the present invention, but it cannot be used to limit the scope of the present invention. Any structural changes made according to the present invention, as long as they do not lose the essence of the present invention, should be regarded as falling within the scope of protection of the present invention and being restricted. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process and related instructions of the method described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0070] The term "comprise" or any other similar term is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus / method that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus / method.

[0071] So far, the technical solutions of the present invention have been described in conjunction with the further embodiments shown in the accompanying drawings, but it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. An encryption and decryption service method based on identity management, characterized in that: include: The client sends the user's basic information to the identity verification server, wherein the basic information includes a password and a user name; The identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, sends the first public key to the client, and sends the first private key to the identity management server; After receiving the first public key, the client generates a service request, encrypts the service request using the first public key, and sends the encrypted request to the identity management server; The identity management server decrypts the service request using the first private key, generates a second key pair after decryption, the second key pair including a second public key and a second private key, and sends the second public key to the client; The client encrypts the original data of the user according to the second public key, and sends the encrypted original data to the identity management server; After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data, and obtains the original data of the user after decryption; The identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, sends the first public key to the client, and sends the first private key to the identity management server, including: The authentication server will search and compare the internally stored username based on the username; After confirming that the user name is the internally stored user name, the password corresponding to the internally stored user name is confirmed with the password; After confirming that the password is correct, the identity authentication is passed, and the identity authentication server generates a first key pair, wherein the first key pair includes a first public key and a first private key; Sending the first public key to the client, and sending the first private key to the identity management server; After receiving the first public key, the client generates a service request, and encrypts the service request by using the first public key and sends it to the identity management server, including: After receiving the first public key, the client generates a service request to request service from the identity management server; Encrypting the service request by using the first public key, and sending the encrypted service request to the identity management server; The identity management server uses the first private key to decrypt the service request, generates a second key pair after decryption, the second key pair includes a second public key and a second private key, and sends the second public key to the client, including: After receiving the encrypted service request, the identity management server uses the first private key to decrypt the service request; After the decryption is completed, a second key pair is generated, wherein the second key pair includes a second public key and a second private key; The second public key is sent to the client, and the second private key is kept on the identity management server.

2. The encryption and decryption service method based on identity management according to claim 1, characterized in that: The client encrypts the original data of the user according to the second public key and sends the encrypted original data to the identity management server, including: After receiving the second public key, the client encrypts the original data of the user according to the second public key; After the encryption is completed, the encrypted original data is sent to the identity management server.

3. The encryption and decryption service method based on identity management according to claim 1, characterized in that: After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data, and obtains the original data of the user after decryption, including: After receiving the encrypted original data, the identity management server uses the second private key to decrypt the encrypted original data; After the decryption is completed, the obtained data is the user's original data.

4. The encryption and decryption service method based on identity management according to claim 1, characterized in that: The first private key and the second private key in the identity management server are uniformly encrypted and stored by an encryption key management system.

5. An encryption and decryption service system based on identity management, characterized in that: include: A sending module, used for the client to send the user's basic information to the identity authentication server, the basic information including the password and user name; A verification module, used for the identity authentication server to authenticate the user according to the password and the user name, generate a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, and send the first public key to the client, and send the first private key to the identity management server; A request module, configured for the client to generate a service request after receiving the first public key, and to encrypt the service request using the first public key and then send it to the identity management server; A service module, configured for the identity management server to decrypt the service request using the first private key, generate a second key pair after decryption, the second key pair including a second public key and a second private key, and send the second public key to the client; An encryption module, used for the client to encrypt the original data of the user according to the second public key, and send the encrypted original data to the identity management server; A decryption module, used for the identity management server to decrypt the encrypted original data using the second private key after receiving the encrypted original data, and obtain the original data of the user after the decryption is completed; The identity authentication server authenticates the user according to the password and the user name, generates a first key pair after the identity authentication is passed, the first key pair includes a first public key and a first private key, sends the first public key to the client, and sends the first private key to the identity management server, including: The authentication server will search and compare the internally stored username based on the username; After confirming that the user name is the internally stored user name, the password corresponding to the internally stored user name is confirmed with the password; After confirming that the password is correct, the identity authentication is passed, and the identity authentication server generates a first key pair, wherein the first key pair includes a first public key and a first private key; Sending the first public key to the client, and sending the first private key to the identity management server; After receiving the first public key, the client generates a service request, and encrypts the service request by using the first public key and sends it to the identity management server, including: After receiving the first public key, the client generates a service request to request service from the identity management server; Encrypting the service request by using the first public key, and sending the encrypted service request to the identity management server; The identity management server uses the first private key to decrypt the service request, generates a second key pair after decryption, the second key pair includes a second public key and a second private key, and sends the second public key to the client, including: After receiving the encrypted service request, the identity management server uses the first private key to decrypt the service request; After the decryption is completed, a second key pair is generated, wherein the second key pair includes a second public key and a second private key; The second public key is sent to the client, and the second private key is kept on the identity management server.

Images