Signature program encryption method and device, decryption method and device

Abstract

The present specification relates to the technical field of information security, and particularly relates to a signature program encryption method and device, a decryption method and device. The method comprises the following steps: obtaining a unique identifier of a signature program for a certain user; generating a first encryption key according to the unique identifier; encrypting target information of the signature program by using a preset second encryption key to obtain an encrypted signature result; wherein the target information comprises the first encryption key, a signature private key of the signature program and an operation log; encrypting the second encryption key by using the first encryption key to obtain encrypted ciphertext; and forming an encrypted signature program by using the encrypted ciphertext, the encrypted signature result and the signature program after encrypting the target information. According to the embodiment of the present specification, hardware encryption authentication is not needed, and the encryption application scene can be expanded while the protection of the signature program is improved.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of information security, and in particular to a signature program encryption method and device, a decryption method and device. BACKGROUND

[0002] The existing client signature program is usually deployed on a terminal machine, and a database system is deployed on the server side. The operation record is audited for compliance through server-side operation record. The current protection method of the client signature program is to use sensitive media protection, that is, to protect the use of the client program through hardware encryption authentication, such as U shield, dongle, etc. The advantage of this hardware encryption authentication method is that the private key is stored in the hardware, which is highly secure, but has the defects of inconvenience and limited application scenarios. It cannot be used to protect local programs on computers that do not allow external devices to be inserted. Since the client program does not have a database system, only a database system is deployed on the server side, and it is not possible to record operation logs through the server. There is a risk of deleting or tampering with records in the client record. Therefore, there is an urgent need for a signature program encryption method that can expand the encryption application scenario while improving the protection of the signature program. SUMMARY

[0003] In view of the fact that the current protection method of the client signature program is to use sensitive media protection, that is, to protect the use of the client program through hardware encryption authentication, there are defects of inconvenience and limited application scenarios. Since the client program does not have a database system, only a database system is deployed on the server side, and it is not possible to record operation logs through the server. There is a risk of deleting or tampering with records in the client record. The present scheme is proposed in order to overcome the above problems or at least partially solve the above problems.

[0004] In one aspect, some embodiments of the present specification aim to provide a signature program encryption method, which comprises:

[0005] Obtaining a unique identifier of a signature program for a certain user;

[0006] Generating a first encryption key according to the unique identifier;

[0007] Encrypting target information of the signature program using a preset second encryption key to obtain an encrypted signature result; wherein the target information includes the first encryption key, a signature private key of the signature program, and an operation log;

[0008] Encrypting the second encryption key using the first encryption key to obtain an encrypted ciphertext;

[0009] Forming an encrypted signature program by encrypting the encrypted ciphertext, the encrypted signature result, and the encrypted target information of the signature program.

[0010] Further, after obtaining the unique identifier of the user, the method further comprises:

[0011] generating a device identification code corresponding to the unique identifier;

[0012] determining whether the device identification code is in a preset device list;

[0013] if the device identification code is not in the preset device list, terminating the encryption operation of the signing program and returning a security alarm.

[0014] Further, the preset device list is established by the following steps:

[0015] obtaining hardware configuration information of a plurality of machines to be run the signing program;

[0016] inserting a specific string into a specified position of each hardware configuration information to obtain corresponding hardware configuration encryption information;

[0017] inputting the hardware configuration encryption information into a preset national encryption algorithm to generate a plurality of device identifications corresponding to the machines;

[0018] establishing the preset device list according to the plurality of device identifications.

[0019] Further, after establishing the device list, the method further comprises:

[0020] remotely managing the machines to be run the signing program by a bastion host and recording a management log to match and verify the management log with the operation log.

[0021] Further, the first encryption key is generated according to the unique identifier, comprising:

[0022] salt processing the unique identifier;

[0023] inputting the salt processing result into a preset national encryption algorithm to obtain the first encryption key.

[0024] Further, the second encryption key is obtained by the following steps:

[0025] mixing and interleaving a preset random number with a confusion factor;

[0026] inputting the mixing and interleaving result into a preset national encryption algorithm to obtain the second encryption key.

[0027] Further, the target information of the signing program is encrypted by the preset second encryption key to obtain an encrypted signature result, further comprising:

[0028] encrypt the target information of the signature program by using a preset second encryption key through a corresponding national encryption algorithm to obtain an encrypted signature result; the encrypted signature result includes first encryption key ciphertext, signature private key ciphertext, and operation log ciphertext.

[0029] Further, after the encrypted signature result is obtained by encrypting the target information by using the second encryption key, the method further includes:

[0030] storing the first encryption key ciphertext and the signature private key ciphertext to a first storage area and storing the operation log ciphertext to a second storage area.

[0031] Further, after the encrypted ciphertext and the encrypted signature result are returned, the method further includes:

[0032] irreversibly destroying the first encryption key, the second encryption key, and the target information and recording the destruction process.

[0033] Based on the same inventive concept, some embodiments of the present specification also provide a signature program decryption method, which includes:

[0034] obtaining a unique identifier in an encrypted signature program, wherein the encrypted signature program includes encrypted ciphertext, an encrypted signature result, and a signature program after target information is encrypted;

[0035] generating a first decryption key according to the unique identifier;

[0036] decrypting the encrypted ciphertext by using the first decryption key to obtain a second decryption key;

[0037] partially decrypting the encrypted signature result by using the second decryption key to obtain a first encryption key;

[0038] checking whether the first decryption key matches the first encryption key;

[0039] if the first decryption key matches the first encryption key, fully decrypting the encrypted signature result.

[0040] Further, generating the first decryption key according to the unique identifier further includes:

[0041] obtaining a non-encrypted unique identifier of the signature program in the signature program after the target information is encrypted;

[0042] salt processing the unique identifier;

[0043] inputting the salt processing result into a preset national encryption algorithm to obtain the first decryption key.

[0044] Further, after full decryption of the encrypted signature result, the target file is signed using a signature private key of the signature program.

[0045] In another aspect, some embodiments of the present specification also provide a signature program encryption device, which comprises:

[0046] An acquisition module is configured to acquire a unique identifier of a signature program for a certain user.

[0047] An encryption key generation module is configured to generate a first encryption key according to the unique identifier.

[0048] An information encryption module is configured to encrypt target information of the signature program using a preset second encryption key to obtain an encrypted signature result; wherein the target information comprises the first encryption key, a signature private key of the signature program, and an operation log.

[0049] A key encryption module is configured to encrypt the second encryption key using the first encryption key to obtain encrypted ciphertext.

[0050] A formation module is configured to form the encrypted ciphertext, the encrypted signature result, and the signature program after encryption of the target information into an encrypted signature program.

[0051] Based on the same inventive concept, in another aspect, some embodiments of the present specification also provide a signature program decryption device, which comprises:

[0052] A receiving module is configured to acquire a unique identifier in an encrypted signature program, wherein the encrypted signature program comprises encrypted ciphertext, an encrypted signature result, and a signature program after encryption of target information.

[0053] A decryption key generation module is configured to generate a first decryption key according to the unique identifier.

[0054] A decryption module is configured to decrypt the encrypted ciphertext using the first decryption key to obtain a second decryption key.

[0055] A partial decryption module is configured to partially decrypt the encrypted signature result using the second decryption key to obtain a first encryption key.

[0056] A verification module is configured to verify whether the first decryption key matches the first encryption key.

[0057] A full decryption module is configured to, if the match is verified, fully decrypt the encrypted signature result.

[0058] In a further aspect, some embodiments of the present specification also provide a computer device, comprising a memory, a processor, and a computer program stored on the memory, which, when executed by the processor, performs the instructions of the above method.

[0059] In a further aspect, some embodiments of the present specification also provide a computer storage medium having a computer program stored thereon, which, when executed by a processor of a computer device, performs the instructions of the above method.

[0060] Some embodiments of the present specification provide one or more technical solutions, which at least have the following technical effects:

[0061] The embodiment of the present specification automatically acquires the unique identifier of the signature program for a certain user, and generates a first encryption key according to the unique identifier, but does not directly encrypt the target information by using the first encryption key, but encrypts the target information by using a preset second encryption key to obtain an encrypted signature result, and then encrypts the second encryption key by using the first encryption key to obtain an encrypted ciphertext, and forms an encrypted signature program by using the encrypted ciphertext, the encrypted signature result, and the encrypted target information, so as to encrypt the signature program by using double keys, thereby reducing the risk of deleting or tampering with the client record, expanding the encryption application scenario, and improving the protection of the signature program.

[0062] The above description is only a summary of some technical solutions of the present specification. In order to more clearly understand the technical means of some embodiments of the present specification, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of some embodiments of the present specification more obvious and easy to understand, the following will specifically describe the embodiments of the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of some embodiments of the present specification or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present specification, and those skilled in the art can obtain other drawings according to these drawings without creating any creative labor. In the drawings:

[0064] Figure 1 An implementation system schematic diagram of a signature program encryption method in some embodiments of the present specification is shown;

[0065] Figure 2 A flowchart of a signature program encryption method in some embodiments of the present specification is shown;

[0066] Figure 3 A flowchart illustrating a step of matching a device identification code in some embodiments of the present specification;

[0067] Figure 4 A flowchart illustrating a step of establishing a device list in some embodiments of the present specification;

[0068] Figure 5 A flowchart illustrating a step of generating a first encryption key in some embodiments of the present specification;

[0069] Figure 6 A flowchart illustrating a step of generating a second encryption key in some embodiments of the present specification;

[0070] Figure 7 A flowchart illustrating a signature program decryption method in some embodiments of the present specification is shown;

[0071] Figure 8 A flowchart illustrating a step of generating a first decryption key in some embodiments of the present specification is shown;

[0072] Figure 9 A structural diagram of a data encryption hierarchy in some embodiments of the present specification is shown;

[0073] Figure 10 A full flowchart illustrating encryption and decryption of a signature program in some embodiments of the present specification is shown;

[0074] Figure 11 A structural diagram of a signature program encryption device in some embodiments of the present specification is shown;

[0075] Figure 12 A structural diagram of a signature program decryption device in some embodiments of the present specification is shown;

[0076] Figure 13 A structural diagram of a computer device provided in some embodiments of the present specification is shown.

[0077]

Explanation of reference numerals

[0078] 101, terminal;

[0079] 102, server;

[0080] 1101, acquisition module;

[0081] 1102, encryption key generation module;

[0082] 1103, information encryption module;

[0083] 1104, key encryption module;

[0084] 1105, formation module;

[0085] 1201, receiving module;

[0086] 1202, decryption key generation module;

[0087] 1203, decryption module;

[0088] 1204, partial decryption module;

[0089] 1205, verification module;

[0090] 1206, full decryption module;

[0091] 1302, computer device;

[0092] 1304, processor;

[0093] 1306, memory;

[0094] 1308, driving mechanism;

[0095] 1310, input / output interface;

[0096] 1312, input device;

[0097] 1314, output device;

[0098] 1316, presentation device;

[0099] 1318, graphical user interface;

[0100] 1320, network interface;

[0101] 1322, communication link;

[0102] 1324, communication bus. DETAILED DESCRIPTION

[0103] In order to make the person in the technical field better understand the technical solutions in the specification, the technical solutions in the specification will be described clearly and completely in the following by combining the drawings in some embodiments of the specification. Obviously, the described embodiments are only some of the embodiments of the specification, not all. Based on some embodiments in the specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the specification.

[0104] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices. It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of this application comply with the relevant provisions of applicable laws and regulations.

[0105] like Figure 1 The diagram illustrates an implementation system for a signature program encryption method according to an embodiment of the present invention. The system may include a terminal 101 and a server 102. The terminal 101 and server 102 communicate via a network, which may include a Local Area Network (LAN), a Wide Area Network (WAN), the Internet, or a combination thereof, and is connected to a website, user equipment (e.g., a computing device), and a backend system. Staff can send a signature program encryption request to the server 102 via the terminal 101. Upon receiving the request, the server 102 uses data such as a unique identifier and the signature program from its database to perform calculations, obtains the calculation result, and sends the result back to the terminal 101 so that staff can process business based on the result.

[0106] In the embodiments of this specification, the server 102 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0107] In an optional embodiment, the terminal 101 can include, but is not limited to, a self-service terminal device, a desktop computer, a tablet computer, a notebook computer, a smart wearable device, and the like. Optionally, the operating system running on the electronic device can include, but is not limited to, an Android system, an IOS system, Linux, Windows, and the like. Of course, the terminal 101 is not limited to the above-mentioned electronic devices with certain entities, and can also be software running in the above-mentioned electronic devices.

[0108] In addition, it should be noted that, Figure 1 The above-mentioned is only one application environment provided by the present disclosure, and in actual application, a plurality of terminals 101 can be included, and the present specification is not limited.

[0109] Figure 2 is a flowchart of a signature program encryption method provided by an embodiment of the present disclosure, and the present specification provides method operation steps as described in the embodiments or the flowchart, but more or fewer operation steps can be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one of the many step execution orders, and does not represent the only execution order. In actual system or device product execution, the method order can be executed in sequence or in parallel as shown in the embodiments or the drawings. Specifically as Figure 2 As shown, the application is applied to the server side described above, and the method can include:

[0110] S201: obtaining a unique identifier of a signature program for a certain user;

[0111] S202: generating a first encryption key according to the unique identifier;

[0112] S203: encrypting target information of the signature program by using a preset second encryption key to obtain an encrypted signature result; wherein the target information includes the first encryption key, a signature private key of the signature program, and an operation log;

[0113] S204: encrypting the second encryption key by using the first encryption key to obtain an encrypted ciphertext;

[0114] S205: forming an encrypted signature program by using the encrypted ciphertext, the encrypted signature result, and the encrypted target information.

[0115] The embodiment of the specification automatically acquires a unique identifier of a signature program for a certain user, and generates a first encryption key according to the unique identifier, but does not directly encrypt target information by using the first encryption key, but encrypts the target information by using a preset second encryption key to obtain an encrypted signature result, and then encrypts the second encryption key by using the first encryption key to obtain an encrypted ciphertext, and forms an encrypted signature program by using the encrypted ciphertext, the encrypted signature result and the encrypted target information of the signature program, so as to encrypt the signature program by using double keys, thereby reducing the risk of deleting or tampering with the client record, expanding the encryption application scene and improving the protection of the signature program.

[0116] It can be understood that in some embodiments, in the premise that the electronic device in which the signature program has been deployed does not allow the insertion of external devices, in order to ensure the security of the operation and use of the signature program, first, a unique identifier of the signature program for a certain user is acquired, for example, the unique identifier of the user can be a user PIN code and the like, which is used to represent the unique identity of the user, and for the signature program, the unique identifier is legal and safe, then a corresponding first encryption key is generated according to the unique identifier, and a target information of the signature program is encrypted by using a preset second encryption key to obtain an encrypted signature result. Specifically, the target information includes the first encryption key, a signature private key of the signature program and an operation log. The signature private key can be constructed by using an SM2 national secret algorithm (asymmetric algorithm), and has a length of 32 bytes. There is a corresponding public key for signature. On the one hand, the signature program lacking of the target information cannot normally sign and encrypt data files. On the other hand, encrypting the entire signature program has problems of high encryption difficulty, high resource consumption and high decryption cost. Since the attacker can crack the encrypted signature result by obtaining the second encryption key, it is necessary to encrypt the second encryption key by using the first encryption key to generate an encrypted ciphertext. The encrypted ciphertext, the encrypted signature result and the encrypted target information of the signature program form an encrypted signature program, so that subsequent decryption according to the unique identifier of the user needs to be verified by using double keys corresponding to the first encryption key and the second encryption key multiple times, thereby improving the protection of the signature program.

[0117] Referring to the drawings Figure 3 In some embodiments, after acquiring the unique identifier of the signature program for a certain user, the method further can include:

[0118] S301: generating a device identification code corresponding to the unique identifier;

[0119] S302: determining whether the device identification code is in a preset device list;

[0120] S303: If the device identifier is not in the preset device list, terminate the signature program encryption operation, and return a security warning.

[0121] It can be understood that in some embodiments, after obtaining the unique identifier of a signature program for a certain user, it is determined whether the device sending the unique identifier is in the preset security device. Specifically, the device identifier of the device sending the unique identifier is first generated, and then it is determined whether the device identifier is in the preset device list. If the device identifier is in the preset device list, the signature encryption operation continues. However, if the device identifier is not in the preset device list, it means that the unique identifier is not sent by a security device, which may pose a security threat. Therefore, the signature program encryption operation needs to be terminated, and a security warning is returned.

[0122] Referring to the accompanying drawings Figure 4 In some embodiments, the preset device list is established by the following steps:

[0123] S401: Obtain hardware configuration information of a plurality of machines to be run a signature program;

[0124] S402: Insert a specific string in a specified position of each hardware configuration information to obtain corresponding hardware configuration encryption information;

[0125] S403: Input the hardware configuration encryption information into a preset national secret algorithm to generate a plurality of device identifiers corresponding to the machines;

[0126] S404: Establish a preset device list according to the plurality of device identifiers.

[0127] It can be understood that in some embodiments, the preset device list includes one or more device identifiers, which are generated based on the hardware configuration information of the machine to be run the signature program. Specifically, the hardware configuration information is spliced from one or more of the Mac address, CPU information, motherboard number, and hard disk number in a predetermined order to form a string, and a specific string such as a magic code is inserted into the hardware configuration information to preliminarily encrypt the hardware configuration information to obtain corresponding hardware configuration encryption information. Then, the irreversible national secret SM3 algorithm is used to ensure the irreversibility and security of the generated device identifier to establish the preset device list. Further, when generating the device identifier code corresponding to the unique identifier, the specific string is first inserted into the hardware configuration information of the device sending the unique identifier, and then the national secret SM3 algorithm is used to generate the corresponding device identifier code. Similarly, in some embodiments, in the subsequent decryption process, it is also necessary to verify whether the device identifier of the sending source of the unique identifier is in the preset device list to further ensure the security of the signature program.

[0128] Further, in some embodiments, after the device list is established, further comprising:

[0129] Remote management of the machine running the signature program by the bastion host, and recording the management log to match and verify the operation log.

[0130] It can be understood that in some embodiments, an operation log is generated after each signature program signs a data file to be signed, but recording the operation log only on the signature program side may have the risk of being deleted or tampered with. Therefore, a bastion host is introduced to remotely manage the machine running the signature program, that is, in a specific network environment, in order to protect the network and data from intrusion and damage from external and internal users, various technical means are used to monitor and record the operation behavior of operation and maintenance personnel on servers, network devices, security devices, databases and other devices in the network, so as to centralized alarm, timely processing and audit responsibility, through the bastion host to record the management log, double-layer log record ensures the auditability and compliance of the operation log, by checking the operation log and the management log, the protection of the operation log in the target information can be strengthened.

[0131] Referring to the drawings Figure 5 In some embodiments, generating the first encryption key according to the unique identifier can include:

[0132] S501: Salt processing the unique identifier;

[0133] S502: Inputting the salt processing result into a preset national encryption algorithm to obtain the first encryption key.

[0134] It can be understood that in some embodiments, since the unique identifier is in plaintext, it needs to be encrypted. The unique identifier is preliminarily encrypted by salt processing, and then the first encryption key can be obtained by using the national encryption SM3 algorithm.

[0135] Referring to the drawings Figure 6 In some embodiments, the second encryption key can be obtained by the following steps:

[0136] S601: Mixing and inserting a preset random number and a confusion factor;

[0137] S602: Inputting the mixed and inserted result into a preset national encryption algorithm to obtain the second encryption key.

[0138] It can be understood that in some embodiments, the random number can be obtained by using an open-source random number generation model, for example, an open-source openssl, the entropy source model of which is composed of a noise source, an optional adjustment component and a health test component, the generated random number meets the industry security specification, and the confusion factor is a string of special meaning, that is, a fixed string hardcoded in the program, which is used to make the mixing and interleaving result and the second encryption key more random, and the interleaving manner can be to split and insert the confusion factor into the specified position of the random number. Further, the preset second encryption key can be obtained in the following manner:

[0139] The second encryption key innerKey = SM3(random number + confusion factor)

[0140] Wherein, due to the setting of SM3 algorithm, the random number is 16 bytes, and the second encryption key innerKey is 32 bytes, which has the function of acting as a symmetric key. Further, using the national encryption algorithm can reduce the research and development cost, and can also fully guarantee the compliance of regulatory requirements.

[0141] Further, in some embodiments, the target information of the signing program is encrypted by using the preset second encryption key to obtain an encrypted signature result, further comprising:

[0142] The target information of the signing program is encrypted by using the preset second encryption key through a corresponding national encryption algorithm to obtain an encrypted signature result; the encrypted signature result includes first encryption key ciphertext, signature private key ciphertext and operation log ciphertext.

[0143] After returning the encrypted ciphertext and the encrypted signature result, further comprising:

[0144] The first encryption key, the second encryption key and the target information are irreversibly destroyed, and the destruction process is recorded.

[0145] It can be understood that in some embodiments, the target information is encrypted by using the second encryption key, and for the signature private key and the first encryption key, the following method can be used:

[0146] Signature private key ciphertext = SM4(innerKey, signature private key)

[0147] First encryption key ciphertext = SM4(innerKey, first encryption key)

[0148] Wherein, innerKey is the second encryption key, and SM4 is a reversible national encryption algorithm.

[0149] In some embodiments, for the operation log, the following method can be used:

[0150] Operation log ciphertext = SM4 (innerKey, "time machine name operation action execution result")

[0151] Wherein, the innerKey is the second encryption key, "time machine name operation action execution result" represents the basic content in the operation log, and SM4 is a reversible national encryption algorithm. Further, in some embodiments, since the target information needs to be decrypted in the subsequent decryption process, the SM3 algorithm, which is an irreversible national encryption algorithm, is not selected, but the SM4 algorithm is selected, and due to the setting of the national encryption algorithm, the first encryption key ciphertext and the signature private key ciphertext are both 32 bytes. Further, in some embodiments, each operation log ciphertext is usually generated and stored in 128 bytes, but it is not limited to 128 bytes, and this is not limited in this paper.

[0152] Based on the same inventive concept, referring to the accompanying Figure 7 Some embodiments of the present specification also provide a signature program decryption method, which comprises:

[0153] S701: Obtain a unique identifier in an encrypted signature program, wherein the encrypted signature program comprises an encrypted ciphertext, an encrypted signature result, and a signature program after encrypting target information;

[0154] S702: Generate a first decryption key according to the unique identifier;

[0155] S703: Decrypt the encrypted ciphertext by using the first decryption key to obtain a second decryption key;

[0156] S704: Partially decrypt the encrypted signature result by using the second decryption key to obtain a first encryption key;

[0157] S705: Check whether the first decryption key matches the first encryption key;

[0158] S706: If matched, fully decrypt the encrypted signature result.

[0159] It can be understood that, in some embodiments, the unique identifier in the encrypted signature program is first obtained, and the corresponding first decryption key is generated. Only when it is ensured that the unique identifier and the first decryption key are correct, the step of decrypting the encrypted ciphertext can be implemented to obtain the second decryption key. Since the first encryption key ciphertext, the signature private key ciphertext and the operation log ciphertext in the encrypted signature result are stored in different zones, and the signature private key ciphertext and the operation log ciphertext have a corresponding relationship with each other, partial decryption of the encrypted signature result using the second decryption key can obtain the pre-stored first encryption key in the encrypted signature result. Specifically, the partial decryption can be implemented based on a segmented encryption mode. By matching the first encryption key and the first decryption key, the information leakage problem caused by the attack party directly cracking the encrypted signature result can be verified and avoided. Only when the first encryption key and the first decryption key match, the encrypted signature result can be fully decrypted, thereby ensuring the security of the encrypted signature program.

[0160] Referring to the drawings Figure 8 In some embodiments, generating the first decryption key according to the unique identifier can further include:

[0161] S801: Obtain the unique identifier of the signature program that is not encrypted in the signature program after encrypting the target information;

[0162] S802: Perform salt processing on the unique identifier;

[0163] S803: Input the salt processing result into a preset national secret algorithm to obtain the first decryption key.

[0164] It can be understood that, in some embodiments, the user can indirectly log in to the signature program after encrypting the target information through the bastion host, so as to obtain the unique identifier of the signature program that is not encrypted in the signature program after encrypting the target information. In order to verify the compliance of the obtained unique identifier, it needs to be sequentially subjected to salt processing and preset national secret algorithm processing to obtain the first decryption key. The compliance of the unique identifier, the salt processing process and the preset national secret algorithm is verified through the decryption process of the first decryption key. Once any link in the process of obtaining the unique identifier, the salt processing and the preset national secret algorithm processing is problematic, the correct first decryption key cannot be obtained, thereby improving the difficulty of cracking the first decryption key.

[0165] Further, in some embodiments, after fully decrypting the encrypted signature result, the target file is further signed using the signature private key of the signature program.

[0166] It can be understood that in some embodiments, the target file can be signed by the signature private key of the signature program only after the full decryption of the encrypted signature result, otherwise the signature private key of the signature program cannot be called for signature operation.

[0167] Further, in order to enable those skilled in the art to better understand the content of the present document, typical embodiments are given herein, in particular, with reference to the accompanying drawings Figure 9 and accompanying drawings Figure 10 Further, in order to enable those skilled in the art to better understand the content of the present document, typical embodiments are given herein, in particular, with reference to the accompanying drawings The first decryption key is based on a unique identifier sent by the machine where the signature program is deployed and which is indirectly operated by the user through the bastion host, in some embodiments, the unique identifier can be a PIN code, before obtaining the unique identifier, in some embodiments, the compliance of the device identification code of the machine where the signature program is deployed also needs to be verified, for example, the device identification code constructed by the MAC address, in particular, the premise of checking the device identification code is to determine the MAC address and other hardware information of the to-be-deployed machine in the compilation phase, the to-be-deployed machine refers to the machine where the signature program is deployed, that is, the machine where the signature program is to be run, the to-be-deployed machine can be understood as the current communication security computer device, etc., the device identification list is constructed through the device identification code of the to-be-deployed machine, after the compilation phase is completed, the signature program (that is, the client certificate signing tool) can be deployed to the specific machine, after the deployment is completed, the user can remotely control the encrypted signature program in the specific machine through the bastion host, so as to realize the encrypted signature private key and the operation record. Further, in some embodiments, the first decryption key needs to decrypt the encrypted ciphertext to obtain the second decryption key when decrypting, in particular, the encrypted ciphertext stores the encrypted information of the second encryption key encrypted by the first encryption key, only when the first decryption key is consistent with the first encryption key, the second decryption key (that is, the second encryption key) can be obtained, after the encrypted signature result is decrypted by the second decryption key, the first encryption key stored in the encrypted signature result needs to be verified with the first decryption key, so as to further obtain the signature private key and the operation log, thereby avoiding that the attacker can directly obtain the signature private key and the operation log in the case of cracking the second decryption key, and the attacker cannot obtain the signature private key and the operation log even if the first decryption key is cracked.

[0168] It should be noted that although the operations of the method of the present application are described in a specific order in the above embodiments and drawings, this does not require or imply that the operations must be performed in this specific order, or that all of the shown operations must be performed to achieve the desired result. Additionally or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps.

[0169] Corresponding to the above-mentioned signature program encryption method, some embodiments of the present specification also provide a signature program encryption device, for referenceFigure 11 As shown in some embodiments, the apparatus can include:

[0170] The acquisition module 1101 is configured to acquire a unique identifier of a signature program for a certain user.

[0171] The encryption key generation module 1102 is configured to generate a first encryption key according to the unique identifier.

[0172] The information encryption module 1103 is configured to encrypt target information of the signature program by using a preset second encryption key to obtain an encrypted signature result, wherein the target information includes the first encryption key, a signature private key of the signature program, and an operation log.

[0173] The key encryption module 1104 is configured to encrypt the second encryption key by using the first encryption key to obtain an encrypted ciphertext.

[0174] The formation module 1105 is configured to form the encrypted ciphertext, the encrypted signature result, and the signature program after encryption of the target information into an encrypted signature program.

[0175] Corresponding to the signature program decryption method described above, some embodiments of the present specification also provide a signature program decryption apparatus, which is described with reference to Figure 12 As shown in some embodiments, the apparatus can include:

[0176] The receiving module 1201 is configured to acquire a unique identifier in an encrypted signature program, wherein the encrypted signature program includes an encrypted ciphertext, an encrypted signature result, and a signature program after encryption of target information.

[0177] The decryption key generation module 1202 is configured to generate a first decryption key according to the unique identifier.

[0178] The decryption module 1203 is configured to decrypt the encrypted ciphertext by using the first decryption key to obtain a second decryption key.

[0179] The partial decryption module 1204 is configured to perform partial decryption on the encrypted signature result by using the second decryption key to obtain a first encryption key.

[0180] The verification module 1205 is configured to verify whether the first decryption key matches the first encryption key.

[0181] The full decryption module 1206 is configured to perform full decryption on the encrypted signature result if the first decryption key matches the first encryption key.

[0182] For ease of description, the above apparatus is described in various units according to functions respectively. Of course, in the implementation of the present specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0183] It should be noted that in the embodiments of the present specification, the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user and authorized by all parties.

[0184] The embodiments of the present specification also provide a computer device. As shown in Figure 13 In some embodiments of the present specification, the computer device 1302 can include one or more processors 1304, such as one or more central processing units (CPUs) or graphics processing units (GPUs), each of which can implement one or more hardware threads. The computer device 1302 can also include any memory 1306 for storing any kind of information, such as code, settings, data, etc. In a specific embodiment, the memory 1306 stores a computer program that can be run on the processor 1304, and when the computer program is run by the processor 1304, it can execute the instructions of the method described in any of the above embodiments. Without limitation, for example, the memory 1306 can include any one or a combination of the following: any type of RAM, any type of ROM, a flash memory device, a hard disk, an optical disk, etc. More generally, any memory can use any technology for storing information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 1302. In one case, the computer device 1302 can perform any operation of the associated instructions when the processor 1304 executes the associated instructions stored in any memory or combination of memories. The computer device 1302 also includes one or more drive mechanisms 1308 for interacting with any memory, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0185] The computer device 1302 can also include input / output interfaces 1310 (I / O) for receiving various inputs (via input devices 1312) and for providing various outputs (via output devices 1314). One particular output mechanism can include a presentation device 1316 and associated graphical user interface 1318 (GUI). In other embodiments, the input / output interfaces 1310 (I / O), input devices 1312, and output devices 1314 can not be included, and the computer device 1302 can be only a computer device in a network. The computer device 1302 can also include one or more network interfaces 1320 for exchanging data with other devices via one or more communication links 1322. One or more communication buses 1324 couple the above-described components together.

[0186] The communication links 1322 can be implemented in any manner, such as through local area networks, wide area networks (e.g., the Internet), point-to-point connections, etc., or any combination thereof. The communication links 1322 can include any combination of hardwired links, wireless links, routers, gateway functionality, name servers, etc., governed by any protocol or combination of protocols.

[0187] The present application is described with reference to the drawings using methodologies of flow diagrams and / or block diagrams of methods, apparatus (systems), computer-readable storage media, and computer program products according to some embodiments of the present description. It is understood that each flow and / or block in the flow diagrams and / or block diagrams, and combinations of flows and / or blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow or flows and / or blocks in a block or blocks Figure 1 The flow or flows and / or blocks in a block or blocks

[0188] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow or flows and / or blocks in a block or blocks Figure 1 The flow or flows and / or blocks in a block or blocks

[0189] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow diagrams and / or block diagrams block or blocks. Figure 1one or more processes and / or blocks Figure 1 the steps of a function specified in one or more processes and / or blocks.

[0190] In one typical arrangement, the computer device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0191] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0192] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic disks storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computer device. According to the definition in this specification, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0193] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, embodiments of the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, embodiments of the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer usable program code.

[0194] The embodiments of the present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The embodiments of the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0195] It should also be understood that, in the embodiments of the present specification, the term "and / or" only means an association relationship of the associated objects, and means that there can be three relationships. For example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the present specification generally means that the front and rear associated objects are in an "or" relationship.

[0196] Each of the embodiments in the present specification is described in a progressive manner, and the same and similar parts of each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0197] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present specification. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0198] The above only describes the embodiments of the present application and is not intended to limit the present application. The present application can have various changes and modifications for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A signature program encryption method, characterized in that, The method includes: Obtain the unique identifier for a specific user from the signing program; A first encryption key is generated based on the unique identifier; The target information of the signing program is encrypted using a preset second encryption key to obtain an encrypted signature result; wherein, the target information includes the first encryption key, the signing private key of the signing program, and the operation log; The second encryption key is encrypted using the first encryption key to obtain the encrypted ciphertext; The encrypted ciphertext, the encrypted signature result, and the signature program after encrypting the target information are combined to form an encrypted signature program.

2. The method according to claim 1, characterized in that, After obtaining the unique identifier for a specific user from the signing process, the process further includes: Generate the device identification code corresponding to the unique identifier; Determine whether the device identifier is in a preset device list; If the device identifier is not in the preset device list, the signature program encryption operation will be terminated and a security alarm will be returned.

3. The method according to claim 2, characterized in that, The preset device list is obtained using the following steps: Obtain the hardware configuration information of several machines that need to run the signed program; Insert a specific string at a specified location in each hardware configuration information to obtain the corresponding encrypted hardware configuration information; The hardware configuration encryption information is input into a preset national cryptographic algorithm to generate several device identifiers corresponding to the machine; A preset device list is created based on the aforementioned device identifiers.

4. The method according to claim 3, characterized in that, After establishing the device list, the following further includes: The machine to be running the signing program is remotely managed using a bastion host, and management logs are recorded to match and verify the management logs with the operation logs.

5. The method according to claim 1, characterized in that, Generate a first encryption key based on the unique identifier, including: The unique identifier is salted. The salting result is input into a preset national cryptographic algorithm to obtain the first encryption key.

6. The method according to claim 1, characterized in that, The second encryption key is obtained through the following steps: The preset random numbers are mixed and interspersed with a confusion factor; The mixed interleaving result is input into a preset national cryptographic algorithm to obtain the second encryption key.

7. The method according to claim 6, characterized in that, The target information of the signing program is encrypted using a preset second encryption key to obtain an encrypted signature result, further including: The target information of the signing program is encrypted using a preset second encryption key and the corresponding national cryptographic algorithm to obtain an encrypted signature result; the encrypted signature result includes the first encryption key ciphertext, the signature private key ciphertext, and the operation log ciphertext.

8. The method according to claim 7, characterized in that, After encrypting the target encrypted information using the second encryption key to obtain the encrypted signature result, the process further includes: The first encryption key ciphertext and the signature private key ciphertext are stored in the first storage area, and the operation log ciphertext is stored in the second storage area.

9. The method according to claim 1, characterized in that, After returning the encrypted ciphertext and the encrypted signature result, the process further includes: The first encryption key, the second encryption key, and the target information are irreversibly destroyed, and the destruction process is recorded.

10. A method for decrypting a signature program, characterized in that, The method includes: Obtain a unique identifier in the encrypted signing program, wherein the encrypted signing program includes encrypted ciphertext, encrypted signing result, and signing program after encrypting target information; A first decryption key is generated based on the unique identifier; The encrypted ciphertext is decrypted using the first decryption key to obtain the second decryption key; The encrypted signature result is partially decrypted using the second decryption key to obtain the first encryption key; Verify whether the first decryption key matches the first encryption key; If a match is found, the encrypted signature result is fully decrypted.

11. The method according to claim 10, characterized in that, Generating a first decryption key based on the unique identifier further includes: Obtain the unique identifier of the unencrypted signature program from the signature program after encrypting the target information; The unique identifier is salted. The salting result is input into a preset national cryptographic algorithm to obtain the first decryption key.

12. The method according to claim 10, characterized in that, After fully decrypting the encrypted signature result, the process also includes signing the target file using the signing private key of the signing program.

13. A signature program encryption device, characterized in that, The device includes: The acquisition module is used to obtain the unique identifier of the signing program for a specific user. An encryption key generation module is used to generate a first encryption key based on the unique identifier; The information encryption module is used to encrypt the target information of the signing program using a preset second encryption key to obtain an encrypted signature result; wherein, the target information includes the first encryption key, the signing private key of the signing program, and the operation log; A key encryption module is used to encrypt the second encryption key using the first encryption key to obtain encrypted ciphertext; The forming module is used to form an encrypted signature program from the encrypted ciphertext, the encrypted signature result, and the signature program after encrypting the target information.

14. A signature program decryption device, characterized in that, The device includes: The receiving module is used to obtain a unique identifier in the encrypted signing program, wherein the encrypted signing program includes encrypted ciphertext, encrypted signing result, and signing program after encrypting target information; A decryption key generation module is used to generate a first decryption key based on the unique identifier; The decryption module is used to decrypt the encrypted ciphertext using the first decryption key to obtain the second decryption key; A partial decryption module is used to partially decrypt the encrypted signature result using the second decryption key to obtain the first encryption key; The verification module is used to verify whether the first decryption key matches the first encryption key; The full decryption module is used to fully decrypt the encrypted signature result if a match is found.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the computer program is run by the processor, it executes the instructions of the method according to any one of claims 1-12.

16. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1-12.

Images