Hard encryption method and device

Abstract

The application provides a hard encryption method and device, which can be used in the field of network security. The method comprises the following steps: in response to the operation of inputting a service password by a user, judging whether the first ciphertext of the service password is a soft encryption ciphertext; if yes, performing a verification processing on the service password by using a soft encryption algorithm corresponding to the service password; after the verification passes, calling an encryption machine to convert the encryption mechanism of the service password into hard encryption, and obtaining the hard encryption ciphertext of the service password; replacing the first ciphertext of the service password in a database with the hard encryption ciphertext of the service password; and returning verification pass information. The method of the application solves the problem that the hard encryption method is difficult to be compatible with the existing soft encryption data, and improves the user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a hard encryption method and device. BACKGROUND

[0002] With the rapid development of information technology, the banking industry as the core of the financial field has a very high requirement for information security and transaction authenticity. Passwords, as a key means to protect bank information security and transaction authenticity, play a crucial role in the banking system.

[0003] Currently, in the core system of a bank, password storage mainly relies on soft encryption. This encryption method realizes encryption function through a specific software algorithm, but since the encryption process is carried out in the computer and requires a large amount of calculation process, it not only consumes a lot of memory, but also is vulnerable to attacks by means of analysis, tracking and decompilation of attackers. Attackers can analyze the program to crack the encryption process and thus obtain the core data of the bank, which brings serious security risks to the banking system. Hard encryption technology mainly encrypts data through physical encryption devices (such as encryption chips, security tokens, hardware security modules HSM, etc.), and the encryption process is separated from the host system, so the relatively isolated encryption environment reduces the risk of malicious software and network attacks. At the same time, some hardware encryption devices also have anti-tamper function, which further increases the physical security. At present, when upgrading and reforming the hard encryption, the existing soft encryption data is usually converted and laid out in full amount at one time.

[0004] However, the full-amount conversion hard encryption method requires a long data conversion time, consumes a lot of system resources, and needs to stop the system, which affects the user experience. SUMMARY

[0005] The present application provides a hard encryption method and device to solve the problem that the existing hard encryption reform is difficult to be compatible with the existing soft encryption password data.

[0006] In a first aspect, the present application provides a hard encryption method applied to a server, and the method comprises:

[0007] In response to the operation of inputting a business password by a user, it is judged whether the first ciphertext of the business password is a soft encryption ciphertext;

[0008] If yes, the business password is subjected to a verification process using a soft encryption algorithm corresponding to the business password;

[0009] After the verification is passed, the encryption mechanism of the business password is converted into hard encryption by calling an encryption machine, and the hard encryption ciphertext of the business password is obtained;

[0010] The hard encryption ciphertext of the business password is used to replace the first ciphertext of the business password in the database;

[0011] Returns verification successful information.

[0012] Secondly, this application provides a hardware encryption device, comprising:

[0013] The judgment module is used to respond to the user's input of the business password and determine whether the first ciphertext of the business password is a soft-encrypted ciphertext;

[0014] The encryption module is used to verify the business password using the corresponding soft encryption algorithm when the first ciphertext of the business password is a soft encrypted ciphertext.

[0015] After successful verification, the encryption machine is invoked to convert the encryption mechanism of the business password into hardware encryption, thus obtaining the hardware-encrypted ciphertext of the business password.

[0016] The replacement module is used to replace the first ciphertext of the business password in the database with the hard-encrypted ciphertext of the business password;

[0017] The encryption module is also used to return verification success information.

[0018] Thirdly, this application provides an electronic device, including: a memory and a processor;

[0019] The memory is used to store computer programs; the processor is used to execute the computer programs stored in the memory to implement the hard encryption method of the first aspect and any embodiment of the first aspect.

[0020] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the hardware encryption method of the first aspect and any embodiment of the first aspect.

[0021] Fifthly, this application provides a computer program product, which includes a computer program that, when executed by a processor, implements the hard encryption method of the first aspect and any embodiment of the first aspect.

[0022] The hardware encryption method and device provided in this application, after a user enters a service password, if the password is determined to be soft-encrypted ciphertext, verifies the password. Upon successful verification, the encryption mechanism of the password is converted to hardware encryption, and the hardware-encrypted ciphertext replaces the soft-encrypted ciphertext in the database, completing the hardware encryption process for the current user's service password. During this process, the system does not need to shut down to complete the full conversion of existing soft-encrypted data; users can continue to conduct business normally, achieving a seamless upgrade to hardware encryption and improving user experience. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0024] Figure 1 A flowchart illustrating a hardware encryption method provided in an embodiment of this application;

[0025] Figure 2 This is a schematic diagram of the interaction architecture between a server and an encryption machine provided in one embodiment of this application;

[0026] Figure 3 A signaling interaction diagram between a server and an encryption machine is provided as an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of the structure of a hardware encryption device provided in an embodiment of this application;

[0028] Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application.

[0029] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0030] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0031] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0032] It should be noted that the hardware encryption method and device of this application can be used in the field of network security, or in any field other than network security. The application field of the hardware encryption method and device of this application is not limited.

[0033] Terminology Explanation:

[0034] Medium password: A password set for transaction instruments such as passbooks, deposit slips, debit cards, and checks, and is linked to important blank vouchers. One medium, one password, used to verify the authenticity of transactions.

[0035] Software encryption: refers to encryption using specific software algorithms without the need for hardware resources.

[0036] Hardware encryption: A physical encryption technology that primarily uses hardware chips to encrypt every character and piece of data on the hard drive. Specifically, hardware encryption uses hardware circuits to implement cryptographic algorithms and provides these algorithms to the public through software development kits (SDKs) or service addresses. The computation process and the plaintext key data are all stored in the hardware device, resulting in a high level of security.

[0037] With the rapid development of information technology, the banking industry, as the core of the financial sector, has extremely high requirements for information security and transaction authenticity. Cryptography, as a key means of ensuring bank information security and transaction authenticity, plays a crucial role in the banking system. However, traditional software encryption methods have many security vulnerabilities and performance bottlenecks, and can no longer meet the security performance requirements of modern banking systems.

[0038] Currently, password storage in core banking systems primarily relies on software encryption. This encryption method uses specific software algorithms to achieve encryption, but because the encryption process occurs internally and requires significant computation, it consumes a large amount of memory and is vulnerable to attacks using analysis, tracing, and decompilation techniques. Attackers can analyze the program to crack the encryption process, thereby obtaining the bank's core data and posing a serious security risk to the banking system.

[0039] In recent years, as financial security has risen to the level of national security, ensuring the security of bank information and the authenticity of transactions has become a consensus within the industry. Relevant regulatory agencies have put forward requirements to promote the application and implementation of national cryptographic algorithms and strengthen industry security and controllability. Against this backdrop, hardware encryption technology has emerged, and with its high security and efficiency, it has been widely used in areas such as data encryption and decryption, and key management in banking systems.

[0040] Hardware encryption technology primarily encrypts data using physical encryption devices (such as encryption chips, security tokens, and hardware security modules (HSMs)). This encryption process is separated from the host system, and the relatively isolated encryption environment reduces the risk of malware and cyberattacks. Furthermore, some hardware encryption devices also possess tamper-proof capabilities, further enhancing physical security. In other words, hardware encryption can achieve protection of data confidentiality, integrity, and non-repudiation. However, despite the numerous advantages of hardware encryption technology, in practical applications, the incompatibility between existing software encryption algorithms in banking systems and the hardware encryption algorithms used in encryption machines has become a pressing technical challenge that needs to be addressed.

[0041] A major challenge for banking systems is ensuring compatibility with existing software-encrypted password data during hardware encryption upgrades, guaranteeing the security and effectiveness of the process without impacting customer experience. Directly replacing traditional software-encrypted data with hardware encryption can lead to data loss or corruption, affecting user experience. Currently, the common approach is a one-time full-scale conversion of existing data, but this method requires significant conversion time, consumes substantial system resources, and necessitates system downtime, disrupting customer service. Therefore, achieving a smooth transition from software to hardware encryption while maintaining security is a pressing technical issue in the field of password management for banking systems.

[0042] Based on this, this application proposes a hardware encryption method and device, which performs hardware encryption on the business password when the user enters it during business transactions, thereby gradually converting the existing soft-encrypted data into hardware-encrypted data as the user completes transactions, achieving seamless upgrades for the user and meeting the high security, high reliability and high efficiency requirements of modern banking systems for password management.

[0043] The specific application scenario of this application is that when a user conducts business, if a business password is entered, the business conduct and password encryption mechanism conversion processes are carried out simultaneously. After the password verification is successful, the user can conduct business normally. The backend server will verify the encryption mechanism of the password to confirm that the final encryption mechanism of the password is hard encryption, so as to achieve security and effectiveness without affecting the customer experience.

[0044] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0045] In this application, a server is used as the execution entity to perform the hardware encryption method of the following embodiments. Specifically, the execution entity can be a hardware device of the server, a software application implementing the following embodiments in the server, a computer-readable storage medium on which the software application implementing the following embodiments is installed, or code implementing the software application of the following embodiments.

[0046] Figure 1 A flowchart illustrating a hardware encryption method provided in an embodiment of this application is shown. Figure 1 As shown, with the server as the execution entity, the method in this embodiment may include the following steps:

[0047] S101. In response to the user's input of the business password, determine whether the first ciphertext of the business password is a soft-encrypted ciphertext.

[0048] In this embodiment, when a user conducts a transaction, entering a transaction password triggers the hardware encryption process. This hardware encryption process does not affect the user's ability to conduct other transactions. In other words, the user's transaction and the hardware encryption process can occur simultaneously. After the user enters their password, the server first verifies the password. Once verified, the user can continue conducting the transaction. The hardware encryption process runs in the background, achieving seamless hardware encryption for the user.

[0049] In this embodiment, the focus is on describing the hardware encryption process, and the process of users handling business will not be described in detail.

[0050] After obtaining the business password, the server, during verification, first needs to determine whether the encrypted business password is software-encrypted. If it is software-encrypted, it needs to verify the software-encrypted ciphertext and then convert it to hardware-encrypted ciphertext; if it is not software-encrypted, it verifies the hardware-encrypted ciphertext. Specifically, the server can determine whether the encryption mechanism of the business password is software or hardware encryption through a password database.

[0051] S102. If so, the business password shall be verified using the software encryption algorithm corresponding to the business password.

[0052] Specifically, when the first ciphertext of the business password is determined to be software-encrypted ciphertext, the corresponding software encryption algorithm is invoked to verify the business password. Here, the corresponding software encryption algorithm refers to the algorithm used to encrypt the password when it is stored in the database.

[0053] Optionally, if the business password is not a software-encrypted ciphertext, the server can call the encryption machine to verify the business password.

[0054] It should be understood that an error message can be returned when the password verification fails.

[0055] S103. After successful password verification, the encryption machine is invoked to convert the encryption mechanism of the business password into hardware encryption, thus obtaining the hardware-encrypted ciphertext of the business password.

[0056] In this embodiment, after the password verification is successful, step S105 can be executed. That is, after the password verification is successful, the user can continue to handle other business without affecting the hardware encryption process.

[0057] The encryption machine mainly consists of four functional modules: hardware encryption components, key management menu, encryption machine background process, and encryption machine monitoring program.

[0058] Among them, the hardware encryption component is mainly used to implement various cryptographic algorithms to encrypt plaintext passwords into ciphertext, thereby securely storing passwords.

[0059] The Key Management menu is used to manage the encryption machine's keys, key administrators' and operators' password cards.

[0060] The encryption machine background process receives plaintext passwords sent by the server and provides security services such as encryption and digital signatures to the server. The encryption machine background process operates in a background startup mode and starts automatically upon system boot.

[0061] The encryption machine monitoring program is used to control the background processes of the encryption machine and monitor the hardware encryption components. It can immediately issue an alarm when the hardware encryption components malfunction.

[0062] S104. Replace the first ciphertext of the business password in the database with the hard-encrypted ciphertext of the business password.

[0063] In this embodiment, the hard encrypted ciphertext replaces the soft encrypted ciphertext in the database, making it easier to directly retrieve the ciphertext from the database when verifying the password later.

[0064] S105, Return the verification pass information.

[0065] The hardware encryption method provided in this embodiment verifies and / or hardware-encrypts the business password when the user enters it during business transactions, enabling the user to seamlessly upgrade the encryption mechanism. This allows existing soft-encrypted passwords to be gradually converted to hardware-encrypted passwords without requiring the business to close the counter for a full conversion. It does not affect customer service, consumes little system resources, is convenient and efficient, and improves the user experience.

[0066] like Figure 2 As shown, in some embodiments, the server includes a blank application module, a password application module, and an encryption mechanism service process. Here, "blank" refers to an important blank credential. The blank application module encapsulates application logic related to the important blank credential, including two function codes related to the encryption machine: password creation and password verification.

[0067] Alternatively, the server and the encryption machine communicate via the TCP / IP protocol. Therefore, the encryption machine has no special requirements regarding the type of server or its operating system.

[0068] The server's service requests to the encryption machine are handled by an encryption mechanism service process. This encryption machine service process is a persistent process that establishes a long-lived connection with the encryption machine via TCP / IP sockets. Each encryption machine service process can only establish a connection with one encryption machine, while each encryption machine can receive multiple long-lived connection requests.

[0069] Each encryption machine service process maintains a daemon process for multiple encryption machines. After starting, the daemon process establishes a Socket channel between the encryption machine service process and the target encryption machine, and listens for application requests from the server. Upon detecting an application request, it sends a server call request to the encryption machine, and responds to the calling program after receiving the return message from the encryption machine.

[0070] like Figure 3 As shown, the interaction between the server and the encryption machine mainly includes the following steps:

[0071] S201. After the empty application module generates a call request for password creation or password verification, it will send it to the password application module.

[0072] S202. The cryptographic application module writes the content of the call request into the Transient Data Queue (TDQ) and wakes up the encryption mechanism service process.

[0073] S203. After the encryption mechanism service process is awakened, it reads the call request in TDQ, organizes the call request into an instruction message that the encryption machine can recognize, and sends it to the encryption machine.

[0074] S204. After the encryption machine processes the data according to the data processing instructions in the call request, it responds to the encryption machine service process through the Socket channel.

[0075] S205. After receiving the encryption machine's response, the encryption machine service process writes the received data into the Temporary Storage Queue (TSQ).

[0076] S206. The cryptographic application module obtains the encryption machine's response message from TSQ, processes it according to the message specification, and returns it to the re-empty application module, thereby completing the interaction process between the server and the encryption machine.

[0077] The data processing flow of the encryption machine service process includes:

[0078] S301. Read parameter information and establish a long-term Socket channel connection with the encryption machine.

[0079] In this embodiment, the encryption machine service process is a long-running system process with a dedicated interface for starting, stopping, and monitoring its status.

[0080] After the encryption machine service process starts, it initializes the process according to the parameter file, establishes a long connection with the target encryption machine, and then enters a listening state. The parameter file includes initialization parameter information and TDQ parameter information.

[0081] S302. Read information from TDQ in a loop, send the information packets to the encryption machine and receive the encryption machine's response information, and organize the response information and write it into TSQ.

[0082] Specifically, the TSQ read by the encryption machine service process is the TSQ specified in the parameter file. The encryption machine service process converts the information in the TDQ into encryption machine instruction packets and sends them to the encryption machine for processing. After receiving the return information from the encryption machine, it writes it into the TSQ.

[0083] After processing, continue reading information from TDQ and repeat the above process until TDQ is empty, at which point the encryption machine service process enters a waiting state; when TDQ is detected to be non-empty, the encryption machine service process is awakened.

[0084] In this embodiment, the server and encryption machine are designed with a highly cohesive and loosely coupled system architecture. The hardware interfaces of the server and encryption machine are decoupled to cope with situations such as changes in encryption machine manufacturers and hardware version upgrades, making it easier to modify and maintain in the future.

[0085] In some embodiments, step S103, which involves calling an encryption machine to convert the encryption mechanism of the business password into hardware encryption, specifically includes:

[0086] S1031. Generate a first call request, which includes a password creation instruction and a business password.

[0087] S1032. The first call request is converted into a first instruction message that the encryption machine can recognize and sent to the encryption machine, so that the encryption machine performs hard encryption on the business password according to the first instruction message, and obtains the hard encrypted ciphertext of the business password.

[0088] S1033, Receive the hard-encrypted ciphertext of the business password sent by the encryption machine.

[0089] The steps in this embodiment can be understood by referring to the aforementioned embodiment of server-encryption machine interaction, and will not be repeated here.

[0090] In some embodiments, step S102 uses a software encryption algorithm corresponding to the business password to verify the business password, including:

[0091] S1021. The server uses the software encryption algorithm corresponding to the business password to perform software encryption on the business password, generating a second ciphertext of the business password.

[0092] S1022. The server compares the second ciphertext of the business password with the first ciphertext of the business password. If they match, the server returns a verification pass message; if they do not match, the server returns a verification failure message.

[0093] In this embodiment, the server uses the same soft encryption algorithm used when generating the soft encryption ciphertext for the first time to encrypt the business password. If the two encrypted ciphertexts are consistent, the business password is determined to be correct and the verification passes; otherwise, the business password is determined to be incorrect and the verification fails.

[0094] It should be understood that the information returned as verification successful or verification failed as described in this embodiment is information returned by the server to the terminal device used by the user to conduct business. The terminal device can be a user terminal or a counter terminal.

[0095] In some embodiments, the server invokes an encryption machine to verify the business password, which may include the following steps:

[0096] S401. The server sends the business password to the encryption machine.

[0097] S402. The encryption machine performs hardware encryption on the business password, generates a third ciphertext of the business password, and returns it.

[0098] S403. The server compares the third ciphertext with the first ciphertext of the business password. If they match, it returns a verification pass message; otherwise, it returns a verification failure message.

[0099] In this embodiment, the server calls the encryption machine to encrypt the business password, obtaining the third ciphertext. The first ciphertext stored in the server is the ciphertext stored when the business password was first encrypted. By comparing the first ciphertext with the third ciphertext, it can be determined whether the third ciphertext is correct, that is, whether the business password verification has passed.

[0100] It should be understood that the information returned as verification successful or verification failed as described in this embodiment is information returned by the server to the terminal device used by the user to conduct business. The terminal device can be a user terminal or a counter terminal.

[0101] In some embodiments, the server invokes an encryption machine to verify the business password, which may include the following steps:

[0102] S501. The server generates a second call request, which includes a password verification instruction and a business password.

[0103] S502, Convert the second call request into a second instruction message that the encryption machine can recognize and send it to the encryption machine.

[0104] S503: The encryption machine performs hard encryption on the business password according to the second instruction message to obtain the fourth ciphertext of the business password.

[0105] S504. The encryption machine compares the fourth ciphertext with the fifth ciphertext stored in the encryption machine and returns the verification result. The fifth ciphertext is a hard-encrypted ciphertext.

[0106] S505, The server receives the verification result sent by the encryption machine.

[0107] The steps in this embodiment can be understood by referring to the aforementioned embodiment of server-encryption machine interaction, and will not be repeated here.

[0108] It should be noted that in this embodiment, the encryption machine stores the fifth ciphertext obtained after the first encryption of the business password. By comparing the fourth ciphertext obtained after the second encryption with the fifth ciphertext obtained after the first encryption, it can be determined whether the fourth ciphertext is correct, that is, whether the business password verification is successful.

[0109] It should be understood that in the previous embodiments, the encryption machine returned the encrypted ciphertext, which was then verified by the server. In this embodiment, however, the encryption machine performs the verification and returns the verification result.

[0110] Figure 4 A schematic diagram of a hardware encryption device according to an embodiment of this application is shown. Figure 4 As shown, the hardware encryption device 10 of this embodiment is used to implement the operation corresponding to the server in any of the above method embodiments. The hardware encryption device 10 of this embodiment includes:

[0111] The judgment module 11 is used to determine whether the first ciphertext of the business password is a soft encrypted ciphertext in response to the user's input of the business password.

[0112] Encryption module 12 is used to verify the business password using the soft encryption algorithm corresponding to the business password when the first ciphertext of the business password is a soft encryption ciphertext.

[0113] After successful verification, the encryption machine is invoked to convert the encryption mechanism of the business password into hardware encryption, thus obtaining the hardware-encrypted ciphertext of the business password.

[0114] Replacement module 13 is used to replace the first ciphertext of the business password in the database with the hard-encrypted ciphertext of the business password;

[0115] The encryption module 12 is also used to return verification information.

[0116] In some embodiments, the encryption module 12 is further configured to generate a first call request, the first call request including a password creation instruction and a business password;

[0117] The first call request is converted into a first instruction message that the encryption machine can recognize and sent to the encryption machine, so that the encryption machine performs hardware encryption on the business password according to the first instruction message, and obtains the hardware encrypted ciphertext of the business password.

[0118] Receive the hard-encrypted ciphertext of the business password sent by the encryption machine.

[0119] In some embodiments, the encryption module 12 is further configured to call the encryption machine to verify the business password when the business password is not a soft encrypted ciphertext.

[0120] In some embodiments, the encryption module 12 is further configured to use a soft encryption algorithm corresponding to the business password to perform soft encryption on the business password, thereby generating a second ciphertext of the business password;

[0121] The second ciphertext of the business password is compared with the first ciphertext of the business password. If they match, a verification pass message is returned; otherwise, a verification failure message is returned.

[0122] In some embodiments, the encryption module 12 is further configured to send the business password to the encryption machine, so that the encryption machine performs hardware encryption on the business password and generates a third ciphertext of the business password.

[0123] The third ciphertext is compared with the first ciphertext of the business password. If they match, a verification pass message is returned; otherwise, a verification failure message is returned.

[0124] In some embodiments, the encryption module 12 is further configured to generate a second call request, the call request including a password verification instruction and a business password;

[0125] The second call request is converted into a second instruction message that the encryption machine can recognize and sent to the encryption machine. The encryption machine performs hard encryption on the business password according to the second instruction message to obtain the fourth ciphertext of the business password. The fourth ciphertext is compared with the fifth ciphertext stored in the encryption machine and the verification result is returned. The fifth ciphertext is the hard encrypted ciphertext.

[0126] Receive the verification result sent by the encryption machine.

[0127] In some embodiments, the server and the encryption machine communicate via the TCP / IP protocol.

[0128] The hardware encryption device 10 provided in this application embodiment can execute the above method embodiment. Its specific implementation principle and technical effect can be found in the above method embodiment, and will not be repeated here.

[0129] Figure 5A schematic diagram of the hardware structure of an electronic device according to an embodiment of this application is shown. Figure 5 As shown, the electronic device 20 is used to implement the operation corresponding to the server in any of the above method embodiments. The electronic device 20 in this embodiment may include: a memory 21, a processor 22, and a communication interface 24.

[0130] The memory 21 is used to store computer programs. The memory 21 may include high-speed random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0131] Processor 22 is used to execute computer programs stored in memory to implement the hardware encryption method in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments. The processor 22 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0132] Alternatively, the memory 21 can be either standalone or integrated with the processor 22.

[0133] When the memory 21 is a device independent of the processor 22, the electronic device 20 may also include a bus 23. This bus 23 is used to connect the memory 21 and the processor 22. The bus 23 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0134] The communication interface 24 can be connected to the processor 22 via the bus 23. The processor 22 can control the communication interface 24 to realize the functions of receiving and sending signals.

[0135] The electronic device 20 provided in this embodiment can be used to execute the above-described hardware encryption method. Its implementation method and technical effect are similar, and will not be described again in this embodiment.

[0136] This application also provides a computer-readable storage medium storing a computer program / instructions, which, when executed by a processor, are used to implement the methods provided in the various embodiments described above.

[0137] The computer-readable storage medium can be a computer storage medium or a communication medium. A communication medium includes any medium that facilitates the transfer of a computer program from one location to another. A computer storage medium can be any available medium accessible to a general-purpose or special-purpose computer. For example, a computer-readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the computer-readable storage medium. Of course, the computer-readable storage medium can also be a component of the processor. The processor and the computer-readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the ASIC can reside in a user equipment. Of course, the processor and the computer-readable storage medium can also exist as discrete components in a communication device.

[0138] Specifically, the computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0139] This application also provides a computer program product comprising a computer program / instructions stored in a computer-readable storage medium. At least one processor of the device can read the computer program / instructions from the computer-readable storage medium, and the at least one processor executes the computer program / instructions to cause the device to perform the methods provided in the various embodiments described above.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0141] The modules can be physically separate, for example, installed in different locations within a single device, installed on different devices, distributed across multiple network units, or distributed across multiple processors. Alternatively, the modules can be integrated, for example, installed in the same device, or integrated into a single codebase. The modules can exist in hardware form, software form, or a combination of both. This application can select some or all of the modules to achieve the objectives of this embodiment based on actual needs.

[0142] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0143] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0144] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A hardware encryption method, characterized in that, The method is applied to a server, and the method includes: In response to the user's input of a business password, determine whether the first ciphertext of the business password is a soft-encrypted ciphertext; If so, the business password is verified using the software encryption algorithm corresponding to the business password. After successful verification, the encryption machine is invoked to convert the encryption mechanism of the business password into hardware encryption, thereby obtaining the hardware-encrypted ciphertext of the business password. Replace the first ciphertext of the business password in the database with the hard-encrypted ciphertext of the business password; Returns verification successful information.

2. The method according to claim 1, characterized in that, Calling the encryption machine to convert the encryption mechanism of the business password into hardware encryption includes: Generate a first invocation request, the first invocation request including a password creation instruction and the business password; The first call request is converted into a first instruction message that the encryption machine can recognize and sent to the encryption machine, so that the encryption machine performs hardware encryption on the business password according to the first instruction message to obtain the hardware encrypted ciphertext of the business password; Receive the hard-encrypted ciphertext of the business password sent by the encryption machine.

3. The method according to claim 1, characterized in that, After determining whether the first ciphertext of the business password is a software-encrypted ciphertext, the method further includes: If the business password is not a software-encrypted ciphertext, then the encryption machine is invoked to verify the business password.

4. The method according to claim 1, characterized in that, The business password is verified using the software encryption algorithm corresponding to the business password, including: The business password is encrypted using the software encryption algorithm corresponding to the business password to generate the second ciphertext of the business password. The second ciphertext of the business password is compared with the first ciphertext of the business password. If they match, a verification pass message is returned; otherwise, a verification failure message is returned.

5. The method according to claim 3, characterized in that, The encryption machine is invoked to verify the business password, including: The business password is sent to the encryption machine, which performs hardware encryption on the business password to generate a third ciphertext of the business password. The third ciphertext is compared with the first ciphertext of the business password. If they match, a verification pass message is returned; otherwise, a verification failure message is returned.

6. The method according to claim 3, characterized in that, The encryption machine is invoked to verify the business password, including: Generate a second invocation request, the invocation request including a password verification instruction and the business password; The second call request is converted into a second instruction message that the encryption machine can recognize and sent to the encryption machine. The encryption machine performs hard encryption on the business password according to the second instruction message to obtain the fourth ciphertext of the business password. The fourth ciphertext is compared with the fifth ciphertext stored in the encryption machine and the verification result is returned. The fifth ciphertext is the hard encrypted ciphertext. Receive the verification result sent by the encryption machine.

7. The method according to claim 1, characterized in that, The server and the encryption machine communicate via the TCP / IP protocol.

8. A hardware encryption device, characterized in that, The device includes: The judgment module is used to determine whether the first ciphertext of the business password is a soft-encrypted ciphertext in response to the user's input of the business password. An encryption module is used to verify the business password using a soft encryption algorithm corresponding to the business password when the first ciphertext of the business password is a soft encryption ciphertext; After successful verification, the encryption machine is invoked to convert the encryption mechanism of the business password into hardware encryption, thereby obtaining the hardware-encrypted ciphertext of the business password. A replacement module is used to replace the first ciphertext of the business password in the database with the hard-encrypted ciphertext of the business password; The encryption module is also used to return verification information.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer programs; The processor executes the computer program stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, is used to implement the method as described in any one of claims 1 to 7.

Images