Encryption method and computing device

Abstract

The embodiment of the present application provides an encryption method and a computing device. The method is applied to a computing device, the computing device includes a first cryptographic device; the computing device is connected to a second cryptographic device in communication; the second device is a user portable device; the method includes: instructing the first cryptographic device to generate a first key component, and instructing the second cryptographic device to generate a second key component; generating an encryption key based on the first key component and the second key component; wherein the first key component is stored in the first cryptographic device; the second key component is stored in the second cryptographic device; or, the encryption key is stored in the first cryptographic device and the second cryptographic device; encrypting the target object based on the encryption key. The solution of the embodiment of the present application can improve key security by managing keys with dual hardware.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to an encryption method and a computing device. Background Art

[0002] eCryptfs (enterprise cryptographic filesystem) is an enterprise-level encrypted file system that is stacked on top of other file systems and provides transparent, dynamic, efficient and secure encryption functions for applications. In application scenarios with relatively high security requirements, a fixed hardware cryptographic device is installed on the server. When users encrypt eCryptfs files on the server, they can enter the name of the encrypted object (such as the file name or directory name, etc.) and the user's personal identification number (PIN) of the hardware cryptographic device. The server will instruct the hardware cryptographic device to generate the corresponding key for the encrypted object and complete the encryption process. The key is stored in the hardware cryptographic device. During subsequent decryption, the user directly enters the name of the encrypted object and the PIN code of the hardware cryptographic device to complete the authentication. The server can then obtain the key from the hardware cryptographic device to decrypt the encrypted object.

[0003] However, this encryption and decryption method only uses a PIN code to protect the key, which is easy to be guessed and attacked by illegal persons, and the key security is low. In addition, multiple users operating on the server share a hardware password device, which is not conducive to user management and also reduces the key security. The above problems will reduce the security of encryption. Summary of the invention

[0004] The embodiments of the present application provide an encryption method and a computing device, which can improve the security of encryption and decryption.

[0005] In a first aspect, an embodiment of the present application provides an encryption method, which is applied to a computing device, wherein the computing device includes a first cryptographic device; the computing device is communicatively connected to a second cryptographic device; the second device is a user portable device; the method includes: instructing the first cryptographic device to generate a first key component, and instructing the second cryptographic device to generate a second key component; generating an encryption key based on the first key component and the second key component; wherein the first key component is stored in the first cryptographic device; the second key component is stored in the second cryptographic device; or, the encryption key is stored in the first cryptographic device and the second cryptographic device; and encrypting the target object based on the encryption key.

[0006] In this embodiment, the computing device can be connected to a portable second cryptographic device. When encrypting a target object, the computing device can instruct the first and second cryptographic devices to generate a portion of the key component respectively, and synthesize a complete key to encrypt the target object. In addition, the first and second cryptographic devices each save a portion of the key component (or save a key) for subsequent collaborative decryption operations. In this way, only users who have access to the portable cryptographic device can perform file encryption and decryption operations on the server, which is convenient for user identity management. In addition, dual hardware jointly encrypting and decrypting files can greatly improve key security.

[0007] In some possible implementations, before instructing the first cryptographic device to generate a first key component, and instructing the second cryptographic device to generate a second key component, the method also includes: determining whether the first authentication information matches the first identity information; wherein the first authentication information is used to authenticate the identity of the encryption user; the first identity information is identity identification information of the second key device; instructing the first cryptographic device to generate the first key component, and instructing the second cryptographic device to generate the second key component, including: when the first authentication information matches the first identity information, instructing the first cryptographic device to generate the first key component, and instructing the second cryptographic device to generate the second key component.

[0008] In this way, the legitimacy of the second cryptographic device is authenticated by the first authentication information input by the user. If the first authentication information matches the first identity information, the user's identity can be considered legitimate, and the second cryptographic device can be considered safe, which is convenient for user management and helps to improve the security of encryption operations.

[0009] In some possible implementations, the second authentication information of the first cryptographic device is stored in the second cryptographic device; when the first authentication information matches the first identity information, the first cryptographic device is instructed to generate a first key component, and the second cryptographic device is instructed to generate a second key component, including: when the first authentication information matches the first identity information, determining whether the second authentication information matches the second identity information; wherein the second authentication information is used to authenticate the encryption environment; the second identity information is identity identification information of the first key device; when the second authentication information matches the second identity information, the first cryptographic device is instructed to generate the first key component, and the second cryptographic device is instructed to generate the second key component.

[0010] In this way, the legitimacy of the first cryptographic device is authenticated by the second authentication information in the second cryptographic device without user operation, which helps to ensure the reliability of the authentication operation of the fixed first cryptographic device and further helps to improve the security of the encryption operation.

[0011] In some possible implementations, the identification of the target object and the first key component are associated and stored in a first cryptographic device; the identification of the target object and the second key component are associated and stored in a second cryptographic device; the method also includes: based on the identification of the target object, obtaining the first key component from the first cryptographic device and obtaining the second key component from the second cryptographic device; generating a decryption key based on the first key component and the second key component; and decrypting the encrypted target object based on the decryption key.

[0012] In this way, no cryptographic device can decrypt with the key components stored by itself, thus improving key security.

[0013] In some possible implementations, the identifier of the target object and the first identifier are associated and stored in the second cryptographic device; the first identifier is used to identify the first cryptographic device; the identifier of the target object and the second identifier are associated and stored in the first cryptographic device; the second identifier is used to identify the second cryptographic device; before obtaining the first key component from the first cryptographic device and the second key component from the second cryptographic device based on the identifier of the target object, the method includes: obtaining the first identity identifier, the second identity identifier, the third identity identifier and the fourth identity identifier respectively; wherein the third identity identifier is the current identity identifier of the first cryptographic device; the fourth identity identifier is the current identity identifier of the second cryptographic device; determining whether the first identity identifier and the third identity identifier match, and whether the second identity identifier and the fourth identity identifier match; based on the identifier of the target object, obtaining the first key component from the first cryptographic device and the second key component from the second cryptographic device respectively, including: when the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, based on the identifier of the target object, obtaining the first key component from the first cryptographic device and the second key component from the second cryptographic device respectively.

[0014] In this way, the computing device needs to read the mutually stored identity identifiers from the two cryptographic devices, match them with the current identity identifiers of the two cryptographic devices, and verify whether the current decryption environment of the cryptographic device is consistent with the encryption environment of the target object to improve the security of the decryption operation.

[0015] In some possible implementations, the identification of the target object and the encryption key are associated and stored in a first cryptographic device and a second cryptographic device; the method also includes: based on the identification of the target object, obtaining the encryption key from the first cryptographic device and the second cryptographic device respectively, and comparing them; when the encryption key obtained from the first cryptographic device and the encryption key obtained from the second cryptographic device match, decrypting the encrypted target object based on the encryption key.

[0016] In this way, no cryptographic device can decrypt with the key stored in it, thus improving key security.

[0017] In some possible implementations, the identifier of the target object and the first identifier are associated and stored in the second cryptographic device; the first identifier is used to identify the first cryptographic device; the identifier of the target object and the second identifier are associated and stored in the first cryptographic device; the second identifier is used to identify the second cryptographic device; before obtaining the encryption key from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object, the method includes: obtaining the first identifier, the second identifier, the third identifier and the fourth identifier respectively; wherein the third identifier is the current identifier of the first cryptographic device; the fourth identifier is the current identifier of the second cryptographic device; determining whether the first identifier and the third identifier match, and whether the second identifier and the fourth identifier match respectively; obtaining the encryption key from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object, including: when the first identifier matches the third identifier, and the second identifier matches the fourth identifier, obtaining the encryption key from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object.

[0018] In some possible implementations, before respectively obtaining the first identity identifier and the second identity identifier, the method also includes: determining whether the first authentication information matches the first identity information; if the first authentication information matches the first identity information, determining whether the second authentication information matches the second identity information; respectively obtaining the first identity identifier and the second identity identifier includes: if the second authentication information matches the second identity information, respectively obtaining the first identity identifier and the second identity identifier.

[0019] In this way, not only the legitimacy of the two cryptographic devices needs to be authenticated during encryption and decryption, but the matching of the identity tags also needs to be verified during decryption, that is, the reliability of the decryption environment needs to be verified. The double protection greatly improves the security of the decryption operation.

[0020] In some possible implementations, the first key component and the second key component are random numbers.

[0021] In a second aspect, an embodiment of the present application provides an encryption device, which is applied to a computing device, wherein the computing device includes a first cryptographic device; the computing device is communicatively connected to a second cryptographic device; the second device is a user portable device; the device includes: a processing module, used to instruct the first cryptographic device to generate a first key component, and to instruct the second cryptographic device to generate a second key component; the processing module is also used to generate an encryption key based on the first key component and the second key component; wherein the first key component is stored in the first cryptographic device; the second key component is stored in the second cryptographic device; or, the encryption key is stored in the first cryptographic device and the second cryptographic device; the processing module is also used to encrypt the target object based on the encryption key.

[0022] In some possible implementations, the device also includes a determination module for determining whether the first authentication information matches the first identity information; wherein the first authentication information is used to authenticate the identity of the encryption user; the first identity information is the identity identification information of the second key device; the processing module is specifically used to: when the first authentication information matches the first identity information, instruct the first cryptographic device to generate a first key component, and instruct the second cryptographic device to generate a second key component.

[0023] In some possible implementations, the second authentication information of the first cryptographic device is stored in the second cryptographic device; the determination module is specifically used to: determine whether the second authentication information matches the second identity information when the first authentication information matches the first identity information; wherein the second authentication information is used to authenticate the encryption environment; the second identity information is the identity identification information of the first key device; the processing module is specifically used to instruct the first cryptographic device to generate a first key component when the second authentication information matches the second identity information, and to instruct the second cryptographic device to generate a second key component.

[0024] In some possible implementations, the identification of the target object and the first key component are associated and stored in a first cryptographic device; the identification of the target object and the second key component are associated and stored in a second cryptographic device; the processing module is specifically used to: based on the identification of the target object, obtain the first key component from the first cryptographic device and obtain the second key component from the second cryptographic device; generate a decryption key based on the first key component and the second key component; and decrypt the encrypted target object based on the decryption key.

[0025] In some possible implementations, the identifier of the target object and the first identifier are associated and stored in the second cryptographic device; the first identifier is used to identify the first cryptographic device; the identifier of the target object and the second identifier are associated and stored in the first cryptographic device; the second identifier is used to identify the second cryptographic device; the processing module is specifically used to: obtain the first identifier, the second identifier, the third identifier and the fourth identifier respectively; wherein the third identifier is the current identifier of the first cryptographic device; the fourth identifier is the current identifier of the second cryptographic device; the determination module is specifically used to: determine whether the first identifier and the third identifier match, and whether the second identifier and the fourth identifier match; the processing module is specifically used to: when the first identifier matches the third identifier, and the second identifier matches the fourth identifier, based on the identifier of the target object, obtain the first key component from the first cryptographic device and the second key component from the second cryptographic device respectively.

[0026] In some possible implementations, the identification of the target object and the encryption key are associated and stored in a first cryptographic device and a second cryptographic device; the processing module is specifically used to: based on the identification of the target object, obtain the encryption key from the first cryptographic device and the second cryptographic device respectively, and compare them; when the encryption key obtained from the first cryptographic device and the encryption key obtained from the second cryptographic device match, decrypt the encrypted target object based on the encryption key.

[0027] In some possible implementations, the identifier of the target object and the first identifier are associated and stored in the second cryptographic device; the first identifier is used to identify the first cryptographic device; the identifier of the target object and the second identifier are associated and stored in the first cryptographic device; the second identifier is used to identify the second cryptographic device; the processing module is specifically used to: obtain the first identifier, the second identifier, the third identifier and the fourth identifier respectively; wherein the third identifier is the current identifier of the first cryptographic device; the fourth identifier is the current identifier of the second cryptographic device; the determination module is specifically used to: determine whether the first identifier and the third identifier match, and whether the second identifier and the fourth identifier match; the processing module is specifically used to: when the first identifier matches the third identifier, and the second identifier matches the fourth identifier, based on the identifier of the target object, obtain encryption keys from the first cryptographic device and the second cryptographic device respectively.

[0028] In some possible implementations, the determination module is also used to: determine whether the first authentication information matches the first identity information; if the first authentication information matches the first identity information, determine whether the second authentication information matches the second identity information; the processing module is specifically used to: if the second authentication information matches the second identity information, respectively obtain the first identity identifier and the second identity identifier.

[0029] In some possible implementations, the first key component and the second key component are random numbers.

[0030] In a third aspect, an embodiment of the present application provides a computing device, comprising: a memory and a processor; the memory and the processor are coupled; the memory is used to store programs / instructions; the processor is used to execute the programs / instructions stored in the memory; wherein, when the programs / instructions stored in the memory are executed by the processor, the computing device implements the method described in the first aspect or any possible implementation of the first aspect.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program / instruction. When the computer program / instruction runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0032] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0033] In the sixth aspect, an embodiment of the present application provides a chip, characterized in that it includes at least one processor and an interface; at least one processor obtains program instructions or data through the interface; at least one processor is used to execute program line instructions to implement the method described in the first aspect or any possible implementation method of the first aspect.

[0034] It can be understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0036] Figure 2A is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0037] Figure 2B is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0038] Figure 3A is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0039] Figure 3B is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0040] Figure 4A is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0041] Figure 4B is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0042] Figure 5A is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application;

[0043] Figure 5B This is a schematic diagram of a computing device performing encryption and decryption operations in a specific embodiment of the present application.

[0044] Fig. 6AIt is a flowchart of an encryption method provided in an embodiment of the present application;

[0045] Figure 6B It is a flowchart of the encryption method in the implementation of the first embodiment of the present application;

[0046] Figure 6C It is a flowchart of an encryption method in another implementation of the embodiment of the present application;

[0047] Fig. 7A It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0048] Figure 7B It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0049] Fig. 8A It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0050] Figure 8B It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0051] Fig. 9A It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0052] Fig. 9B It is a flowchart of an encryption method provided by a specific embodiment of the present application;

[0053] Fig.10 It is a structural schematic diagram of an encryption device provided in an embodiment of the present application;

[0054] Fig.11 It is a schematic diagram of the structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0056] The terms “first”, “second” and the like in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects.

[0057] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0058] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0059] To facilitate understanding of the technical solution of the present application, the technical terms involved in this document are explained below.

[0060] Directory encryption: refers to encrypting the file system or folders in a computer system to protect the security of files and folders.

[0061] Key: A key is a parameter that is input into an algorithm that converts plaintext to ciphertext or ciphertext to plaintext.

[0062] Fixed hardware cryptographic device: A fixed hardware cryptographic device is a hardware device that has certain cryptographic functions or can complete certain cryptographic tasks. It is usually fixed in one location or integrated on the motherboard.

[0063] Personal identification number (PIN): A PIN code of a cryptographic device is a security measure used to protect a cryptographic device, usually used to authenticate the user and access data in the cryptographic device.

[0064] Universally unique identifier (UUID) for cryptographic devices: The unique identifier of a cryptographic device is a code used to uniquely identify the cryptographic device. It is similar to a person's ID number and can be used to identify and track the cryptographic device in the system. This identifier is usually assigned during the production process of the cryptographic device and is stored in the hardware or software of the device.

[0065] Guessing attack: A guessing attack is an attack on a password-protected device that aims to gain access by trying different passwords. Attackers can use a variety of techniques and tools to try to guess passwords, such as using password guessing programs or dictionary attacks.

[0066] User space encrypted file systems based on FUSE (Filesystem in Userspace) in the Linux kernel, such as the eCryptfs encrypted file system, can provide encryption functions for applications to encrypt objects such as directories, files, and file names. When a user performs the above object encryption operation on the server, the user enters the name of the encrypted object and the PIN code of the fixed hardware password device. If the server verifies that the PIN code is correct, a key is generated for the encrypted object through the password device and the encrypted object is encrypted using the key. The name of the encrypted object and the key are stored in association within the password device. When decrypting, the user enters the name of the encrypted object and the PIN code of the fixed hardware password device. After the authentication is passed, the corresponding key can be obtained from the password device based on the name, thereby performing decryption processing.

[0067] Although this processing method does not require users to remember the key, using only a PIN code to protect the key is prone to guessing attacks and the key security is low. In addition, since multiple users operating on the server share a fixed hardware password device, it is not conducive to user identity management and also reduces the security of the key.

[0068] In order to improve the key security in the file system encryption and decryption scenario, an encryption method is provided in an embodiment of the present application. The method mainly uses a portable cryptographic device and a fixed hardware cryptographic device on a computing device for use in conjunction with each other. The portable cryptographic device can be used to authenticate the fixed cryptographic device, and the two hardware cryptographic devices can each generate a part of the key, and then synthesize it into a complete key for file encryption and decryption. In this way, only users who have mastered the portable cryptographic device can perform file encryption and decryption operations on the server, which is convenient for user identity management, and the dual hardware jointly encrypting and decrypting files can greatly improve key security.

[0069] To facilitate understanding of the technical solution of the present application, a computing device provided in an embodiment of the present application is introduced below.

[0070] For example, Figure 1 A schematic diagram of the structure of a computing device provided in an embodiment of the present application is shown. Figure 1 As shown, the computing device 10 may be a hardware device capable of providing data processing functions, computing functions, storage functions, etc. As a specific example, the computing device 10 may be a server, but is not limited thereto.

[0071] Please refer to Figure 1 As shown, the computing device 10 may include: a processor 110, a memory 120 and a communication interface 130. The processor 110, the memory 120 and the communication interface 130 may be connected via a bus or other means and placed inside a chassis of the computing device 10.

[0072] In this embodiment, the processor 110 may be a central processing unit (CPU), which is the computing core and control core of the computing device 10. In some embodiments, the processor 110 may execute part or all of the steps of the method provided in this embodiment.

[0073] The memory 120 is a memory device of the server, which can be used to store computer program instructions, including a computer operating system (OS) and various programs and data. Exemplarily, the memory 120 may include a non-volatile memory, such as at least one disk memory and / or a read-only memory (ROM); the memory 120 may also include a volatile memory, such as a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, but is not limited thereto.

[0074] The communication interface 130 is mainly used to realize the communication between the modules, devices, units and / or devices in the embodiments of the present application. Exemplarily, the communication interface 130 may include a standard bus interface (port), such as a universal serial bus (USB) interface, a serial advanced technology attachment (SATA) interface, etc., or the communication interface 130 may also include a wireless interface (such as WI-FI, a mobile communication interface, etc.). The communication interface 130 can be controlled by the processor 110 for sending and receiving data. It should be understood that the communication interface 130 may include multiple physical ports.

[0075] In addition, the computing device 10 also includes a first cryptographic device 140, which can be used to generate and manage key components (for ease of description, also referred to herein as "first key components"), and the first key component can be combined with other key components to synthesize a complete key for encrypting or decrypting a target object. The target object is an object that the user wants to encrypt or decrypt, and the target object can be a directory, a file, or a file name. Exemplarily, the first cryptographic device 140 can be set at a corresponding position of the computing device 10, for example, the first cryptographic device 140 can be plugged into an interface inside the chassis of the computing device 10 or an interface outside the chassis, and electrically connected to the processor 110 through a bus or a communication interface 130. The first cryptographic device 140 can also be called a fixed hardware cryptographic device. By way of example and not limitation, the first cryptographic device 140 can be a security chip, a cryptographic card, a cryptographic machine, or an encryption box.

[0076] Furthermore, in this embodiment, the computing device 10 can access the second cryptographic device 20, and the second cryptographic device 20 can be used to store the identity authentication information of the first cryptographic device 140. The computing device 10 can authenticate the environment provided by the first cryptographic device 140 according to the identity authentication information. As an example, the identity authentication information may include, but is not limited to, a PIN code and / or a universally unique identifier (UUID), and the like.

[0077] It should be noted that the second cryptographic device 20 can be connected to the computing device 10 via a wired manner. For example, the second cryptographic device 20 is connected to the terminal via various physical interfaces. The second cryptographic device 20 can also be connected to the computing device 10 via a wireless manner, such as Bluetooth.

[0078] In this embodiment, the second cryptographic device 20 can also be used to generate and manage a key component (for ease of description, also referred to herein as a "second key component"), which can be combined with the first key component to form a key, and the computing device 20 can use the key to perform encryption or decryption processing on the corresponding target object. Correspondingly, in this example, the first cryptographic device 140 can also be used to store the identity of the second cryptographic device 20, and the computing device 10 can authenticate the environment provided by the second cryptographic device 20 based on the identity. The identity can also include, but is not limited to, a universally unique identifier (UUID).

[0079] In this embodiment, the second password device 20 may be a hardware password device that can be carried by the user. By way of example and not limitation, the second password device 20 may be an encrypted USB flash drive or a smart password key.

[0080] Exemplarily, a user can communicate with the computing device 10 through a terminal and perform various maintenance operations on the computing device 10. The second cryptographic device 20 can be inserted into the terminal through a USB interface of the user terminal or other compatible physical port, and thereby access the computing device 10. It should be understood that this access method is only an example and is not the only limited access method.

[0081] It should be noted that the second cryptographic device 20 may be connected to the terminal by wired access. For example, the second cryptographic device 20 may be connected to the terminal through various physical interfaces. The second cryptographic device 20 may also be connected to the terminal wirelessly, for example, the wireless method may be Bluetooth.

[0082] The following describes the principle of the computing device 10 using the first cryptographic device 140 and the second cryptographic device 20 to collaboratively perform encryption / decryption processing in conjunction with the accompanying drawings.

[0083] For some possible implementations, see Figure 2A As shown in (2a), the user carries the second cryptographic device 20, and the user can insert the second cryptographic device 20 into the terminal 2 that communicates with the computing device 10, thereby accessing the computing device 10. When the target object is to be encrypted, the computing device 20 provides an encryption interface, and the user accesses the encryption interface at the terminal 2 to execute step S200, input the identifier of the target object, and instruct the first cryptographic device 140 to execute step S201 to generate the first key component Rand-A, and instruct the second cryptographic device 20 to execute step S202 to generate the second key component Rand-B. As a specific example, Rand-A and Rand-B can be random numbers generated using a preset key generation algorithm, the same below.

[0084] Next, the computing device 10 executes S203 to combine Rand-A and Rand-B into a complete key Key, and executes S204 using the key Key to encrypt the target object.

[0085] After the encryption process is completed, the target object identifier and data such as Rand-B are associated and stored in the second password device 20 through steps S205 and S206, and the target object identifier and data such as Rand-A are associated and stored in the first password device 140. Afterwards, the user can unplug the second password device 20. Exemplarily, the identifier of the target object can be the name or storage path of the target object, etc., the same below.

[0086] When decrypting the encrypted target object, you can refer to Figure 2A As shown in (2b), the user connects the second cryptographic device 20 to the computing device 10, and executes S207 based on the decryption interface provided by the computing device 10, and inputs the target object identifier. Then, the computing device 10 executes S208 and S209, searches for the first key component Rand-A from the first cryptographic device 140 and searches for the second key component Rand-B from the second cryptographic device 20 according to the target object identifier, and then synthesizes Rand-B and Rand-A into a complete key Key through S210, and uses the key Key to execute S211 to decrypt the encrypted target object. After decryption, the content of the target object can be accessed.

[0087] It should be noted that the above steps of obtaining the identification of each cryptographic device and the key component can be exchanged in sequence.

[0088] In this way, during the encryption and decryption process, encryption and decryption operations can only be performed based on the portable second cryptographic device 20 held by the user, which is convenient for user management. In addition, the second cryptographic device 20 and the first cryptographic device 140 store the key components respectively, and a single cryptographic device cannot obtain the complete key, thereby improving key security.

[0089] Optionally, in this embodiment, refer again to Figure 2A As shown, during the process of steps S205 to S206, the synthesized key Key can also be associated and stored in the first cryptographic device 140 and the second cryptographic device 20. In this way, since the first cryptographic device 140 and the second cryptographic device 20 are used together for encryption and decryption, the two cryptographic devices store complete keys Key after encryption. Therefore, if the key component in a cryptographic device is damaged or lost, the intact key Key in the other cryptographic device can be used as a backup key, which is convenient for operators to adopt corresponding remedial measures to use the backup key to obtain the content in the encrypted target object, avoid the inaccessibility of the encrypted content due to the loss of the key, and improve the storage reliability.

[0090] This application embodiment also provides another possible implementation method, please refer to Figure 2B As shown in (2a), in this implementation, when the target object is encrypted, the encryption process is the same as the above Figure 2A The encryption process shown in (2a) is similar, except that when the computing device 10 executes S205 and S206, the target object identifier and the synthesized key Key are associated and stored in the second cryptographic device 20 and the first cryptographic device 140.

[0091] In this way, when the encrypted target object is decrypted, the decryption operation can be completed by verifying the consistency of the Key in the two cryptographic devices 140 and 20. For details, please refer to Figure 2B As shown in (2b), the decryption process of this implementation is the same as that of the above Figure 2A The process illustrated in (2b) is similar, except that when the computing device 10 executes S208 and S209, it obtains the key Key from the first cryptographic device 140 and the second cryptographic device 20 respectively according to the target object identifier, and then executes step 210 to compare the consistency between the keys Key stored in the two cryptographic devices 140 and 20. If the comparison is consistent, S211 is executed to use the key Key to decrypt the encrypted target object. After decryption, the content of the target object can be accessed. If the comparison is inconsistent, an alarm message of decryption failure is generated to notify the user.

[0092] In this implementation, encryption and decryption operations are also implemented based on two cryptographic devices 140 and 20, which is convenient for user management. In addition, when the second cryptographic device 20 and the first cryptographic device 140 store the key Key respectively, a single cryptographic device cannot perform the decryption operation before verifying the consistency of the key Key with the other cryptographic device, thereby improving the key security. In addition, in this implementation, even if the key of one of the cryptographic devices is damaged or lost, corresponding remedial measures can be taken based on the intact key Key in the other cryptographic device to retrieve the content in the encrypted target object, thereby improving the reliability of encryption and decryption.

[0093] This application embodiment also provides another possible implementation method, please refer to Figure 3A As shown in (3a), the user carries a second password device 20, in which the PIN code of the first password device 140 can be pre-stored. The user can insert the second password device 20 into the terminal 2 that communicates with the computing device 10, thereby accessing the computing device 10. When the target object is to be encrypted, the computing device 20 provides an authentication interface. The user can access the authentication interface at the terminal 2 and execute step S301 to enter the target object's identifier and the PIN code of the second password device 20. Then the computing device 20 executes step S302 to verify whether the PIN code is correct, and authenticate (first authentication) the legitimacy of the identity of the second password device 20. If the PIN code is correct, it can be considered that the user's identity is safe. Otherwise, a user identity warning prompt is output.

[0094] Next, the computing device 10 obtains the PIN code of the first cryptographic device 140 from the second cryptographic device 20, and performs step S303 to authenticate (second authentication) the legitimacy of the identity of the first cryptographic device 140. If the PIN code of the first cryptographic device 140 is incorrect, a security warning prompt may be output; if it is correct, the computing device 10 may determine that the first cryptographic device 140 is safe.

[0095] Then, the user can instruct the first cryptographic device 140 to execute step S304 to generate the first key component Rand-A, and instruct the second cryptographic device 20 to execute step S305 to generate the second key component Rand-B based on the encryption interface provided by the computing device 10. Then, the computing device 10 executes S306 to combine Rand-A and Rand-B into a complete key Key, and executes S307 using the key Key to encrypt the target object.

[0096] After the encryption process is completed, the target object identifier and Rand-B and other data are associated and stored in the second cryptographic device 20 through steps S308 and S309, respectively, and the target object identifier and Rand-A and other data are associated and stored in the first cryptographic device 140. Afterwards, the user can unplug the second cryptographic device 20.

[0097] When decrypting the encrypted target object, you can refer to Figure 3A As shown in (3b), the user connects the second cryptographic device 20 to the computing device 10, and executes S310 based on the authentication interface provided by the computing device 10, inputs the target object identification and the PIN code of the second cryptographic device 20; then the computing device 10 executes S311 to determine whether the PIN code is correct based on the PIN code of the second cryptographic device 20, and authenticates (first authentication) the legitimacy of the identity of the second cryptographic device 20. After that, S312 is executed to obtain the PIN code of the first cryptographic device 140 from the second cryptographic device 20 for authentication (second authentication). If the PIN code of the first cryptographic device 140 is also correct, the computing device 10 executes S313 and S314, searches for the first key component Rand-A from the first cryptographic device 140 and searches for the second key component Rand-B from the second cryptographic device 20 according to the target object identification, and then synthesizes Rand-B and Rand-A into a complete key Key through S315, and uses the key Key to execute S316 to decrypt the encrypted target object. After decryption, the content of the target object can be accessed.

[0098] It should be noted that the above steps of obtaining the identification of each cryptographic device and the key component can be exchanged in sequence.

[0099] In this way, during the encryption and decryption process, the first cryptographic device 140 can only be authenticated based on the portable legitimate second cryptographic device 20 held by the user, so that the encryption and decryption operations can be performed, which is convenient for user management and also helps to ensure the security of the first cryptographic device 140. In addition, the second cryptographic device 20 and the first cryptographic device 140 store key components separately, and a single cryptographic device cannot obtain the complete key, thereby improving the key security. The second cryptographic device 20 also stores the first cryptographic device 140.

[0100] Optionally, in this embodiment, refer again to Figure 2B As shown, during steps S308 and S309, the synthesized key Key can also be stored in the first cryptographic device 140 and the second cryptographic device 20 in association, so that when the key component in a cryptographic device is damaged or lost, the operator can adopt corresponding remedial measures to use the key in another cryptographic device to obtain the content of the encrypted target object, thereby improving storage reliability.

[0101] This application embodiment also provides another possible implementation method, please refer to Figure 3B As shown in (3a), in this implementation, when the target object is encrypted, the encryption process is the same as above. Figure 3AThe encryption process shown in (3a) is similar, except that when the computing device 10 executes S308 and S309, the target object identifier and the synthesized key Key are associated and stored in the second cryptographic device 20 and the first cryptographic device 140.

[0102] In this way, when the encrypted target object is decrypted, the decryption operation can be completed by verifying the consistency of the Key in the two cryptographic devices 140 and 20. For details, please refer to Figure 3B As shown in (3b), the decryption process of this implementation is the same as that of the above Figure 3A The process illustrated in (3b) is similar, except that when the computing device 10 executes S313 and S314, it obtains the key Key from the first cryptographic device 140 and the second cryptographic device 20 respectively according to the target object identifier, and then executes step 315 to compare the consistency between the keys Key stored in the two cryptographic devices 140 and 20. If the comparison is consistent, S316 is executed to use the key Key to decrypt the encrypted target object. After decryption, the content of the target object can be accessed. If the comparison is inconsistent, an alarm message of decryption failure is generated to notify the user.

[0103] In this implementation, the two cryptographic devices 140 and 20 must be authenticated to be legitimate before encryption and decryption operations can be performed, which is convenient for user management and helps to ensure the security of the first cryptographic device 140. In addition, when the second cryptographic device 20 and the first cryptographic device 140 store the key Key respectively, a single cryptographic device cannot perform the decryption operation before verifying the consistency of the key Key with the other cryptographic device, thereby improving the key security. In addition, in this implementation, even if the key of one of the cryptographic devices is damaged or lost, corresponding remedial measures can be taken based on the intact key Key in the other cryptographic device to retrieve the content in the encrypted target object, thereby improving the reliability of encryption and decryption.

[0104] This application embodiment also provides another possible implementation method, please refer to Figure 4AAs shown in (4a), the user carries the second cryptographic device 20, and the user can insert the second cryptographic device 20 into the terminal 2 that communicates with the computing device 10, thereby accessing the computing device 10. At this time, the computing device 10 can read the unique identification code UUID-A of the first cryptographic device 140 and the unique identification code UUID-B of the second cryptographic device 20 respectively. When the target object is to be encrypted, the computing device 20 provides an encryption interface. The user accesses the encryption interface at the terminal 2 and can execute step S401, input the identifier of the target object, and instruct the first cryptographic device 140 to execute step S402 to generate the first key component Rand-A, and instruct the second cryptographic device 20 to execute step S403 to generate the second key component Rand-B. Then, the computing device 10 executes S404 to combine Rand-A and Rand-B into a complete key Key, and uses the key Key to execute S405 to encrypt the target object.

[0105] After the encryption process is completed, the target object identifier and data such as Rand-B and UUID-A are associated and stored in the second cryptographic device 20 through steps S406 and S407, and the target object identifier and data such as Rand-A and UUID-B are associated and stored in the first cryptographic device 140. Afterwards, the user can unplug the second cryptographic device 20.

[0106] When decrypting the encrypted target object, you can refer to Figure 4A As shown in (4b), the user connects the second cryptographic device 20 to the computing device 10, and executes S408 based on the decryption interface provided by the computing device 10 to input the target object identifier. Next, the computing device 10 reads the unique identification code UUID-A-now of the current first cryptographic device 140 and the unique identification code UUID-B-now of the current second cryptographic device 20, and respectively executes S409 to obtain the UUID-A stored in the second cryptographic device 20, and S410 to obtain the UUID-B stored in the first cryptographic device 140. Then, the computing device 10 executes S411 to compare the consistency of UUID-B-now with UUID-B, and to compare the consistency of UUID-A-now with UUID-A. If UUID-B-now is consistent with UUID-B, and UUID-A-now is consistent with UUID-A, it can be determined that the user and environment of the current operation are consistent with the user and environment when the target object is encrypted, and the corresponding key components can be obtained from the two passwords for decryption.

[0107] Next, the computing device 10 executes S412 and S413, searches for the first key component Rand-A from the first cryptographic device 140 and the second key component Rand-B from the second cryptographic device 20 according to the target object identifier, and then combines Rand-B and Rand-A into a complete key Key through S414, and uses the key Key to execute S415 to decrypt the encrypted target object. After decryption, the content of the target object can be accessed.

[0108] It should be noted that the above steps of obtaining the identification of each cryptographic device and the key component can be exchanged in sequence.

[0109] In this way, during the encryption and decryption process, the encryption and decryption operations can only be performed based on the portable second password device 20 held by the user. The second password device 20 and the first password device 140 store key components respectively, and a single password device cannot obtain the complete key, thereby improving the key security. In addition, during the decryption operation, the UUID-A stored in the portable second password device 20 can confirm the consistency of the operating user; the UUID-B stored in the fixed first password device 140 can confirm the consistency of the operating host. The dual hardware password devices ensure the consistency of the user and the environment, further improving the security of the encryption and decryption operations.

[0110] Optionally, in this embodiment, refer again to Figure 4A As shown, during steps S406 and S407, the synthesized key Key can also be associated and stored in the first cryptographic device 140 and the second cryptographic device 20. The two keys Key serve as backup keys for each other, so that when one cryptographic device is lost, the backup key of the other cryptographic device can be used to retrieve the content of the target object, thereby improving storage reliability.

[0111] This application embodiment also provides another possible implementation method, please refer to Figure 4B As shown in (4a), in this implementation, when the target object is encrypted, the encryption process is the same as above. Figure 4A The encryption process shown in (4a) is similar, except that: when the computing device 10 executes S406 and S407, the target object identifier and the synthesized key Key are associated with UUID-A and stored in the second cryptographic device 20, and the target object name and the key Key are associated with UUID-B of the second cryptographic device 20 and stored in the first cryptographic device 140.

[0112] In this way, when the encrypted target object is decrypted, the decryption operation can be completed by verifying the consistency of the Key in the two cryptographic devices 140 and 20. For details, please refer to Figure 4B As shown in (4b), the decryption process of this implementation is the same as that of the above Figure 4A The process illustrated in (4b) is similar, except that: when the computing device 10 executes S412 and S413, it obtains the key Key from the first cryptographic device 140 and the second cryptographic device 20 respectively according to the target object identifier, and then executes step 414 to compare the consistency between the keys Key stored in the two cryptographic devices 140 and 20. If the comparison is consistent, S415 is executed to use the key Key to decrypt the encrypted target object. After decryption, the content of the target object can be accessed. If the comparison is inconsistent, an alarm message of decryption failure is generated to notify the user.

[0113] In this implementation, encryption and decryption operations are also implemented based on two cryptographic devices 140 and 20. When the second cryptographic device 20 and the first cryptographic device 140 store the key Key respectively, a single cryptographic device cannot perform a decryption operation before verifying the consistency of the key Key with another cryptographic device, thereby improving the key security. In addition, before the decryption operation, the UUIDs of the two cryptographic devices 140 and 20 are also required to verify the consistency of the user identity and environment, further improving the security of the encryption and decryption operations.

[0114] This application embodiment also provides another possible implementation method, please refer to Figure 5A As shown in (5a), the user carries a second password device 20, in which the PIN code of the first password device 140 can be pre-stored. The user can insert the second password device 20 into the terminal 2 that communicates with the computing device 10, thereby accessing the computing device 10. When the target object is to be encrypted, the computing device 20 provides an authentication interface. The user can access the authentication interface at the terminal 2 and execute step S501 to enter the identifier of the target object and the PIN code of the second password device 20. Then the computing device 20 executes step S502 to verify whether the PIN code is correct, and authenticate (first authentication) the legitimacy of the identity of the second password device 20. If the PIN code is correct, it can be considered that the user's identity is safe. Otherwise, a user identity warning prompt is output.

[0115] Next, the computing device 10 obtains the PIN code of the first cryptographic device 140 from the second cryptographic device 20, and performs step S503 to authenticate (second authentication) the legitimacy of the identity of the first cryptographic device 140. If the PIN code of the first cryptographic device 140 is incorrect, a security warning prompt may be output; if it is correct, the computing device 10 reads the unique identification code UUID-A of the first cryptographic device 140 and the unique identification code UUID-B of the second cryptographic device 20 respectively.

[0116] Then, the user can instruct the first cryptographic device 140 to execute step S504 to generate the first key component Rand-A, and instruct the second cryptographic device 20 to execute step S505 to generate the second key component Rand-B based on the encryption interface provided by the computing device 10. As a specific example, Rand-A and Rand-B can be random numbers generated using a preset key generation algorithm.

[0117] Next, the computing device 10 executes S506 to combine Rand-A and Rand-B into a complete key Key, and executes S507 using the key Key to encrypt the target object.

[0118] After the encryption process is completed, the target object identifier, Rand-B, and UUID-A are stored in association in the second cryptographic device 20 through steps S508 and S509, and the target object identifier, Rand-A, and UUID-B are stored in association in the first cryptographic device 140. Afterwards, the user can unplug the second cryptographic device 20. Exemplarily, the identifier of the target object can be the name or storage path of the target object.

[0119] When decrypting the encrypted target object, you can refer to Figure 5A As shown in (5b), the user connects the second password device 20 to the computing device 10, and executes S510 based on the authentication interface provided by the computing device 10, inputs the target object identifier and the PIN code of the second password device 20; then the computing device 10 executes S511 to determine whether the PIN code is correct based on the PIN code of the second password device 20, and authenticates (first authentication) the legitimacy of the identity of the second password device 20. After that, S512 is executed to obtain the PIN code of the first password device 140 from the second password device 20 for authentication (second authentication). If the PIN code of the first password device 140 is also correct, the computing device 10 will read the unique identification code UUID-A-now of the current first password device 140 and the unique identification code UUID-B-now of the current second password device 20, and respectively execute S513 to obtain the UUID-A stored in the second password device 20, and S514 to obtain the UUID-B stored in the first password device 140. Then, the computing device 10 executes S515, compares UUID-B-now with UUID-B for consistency, and compares UUID-A-now with UUID-A for consistency. If UUID-B-now is consistent with UUID-B, and UUID-A-now is consistent with UUID-A, it can be determined that the user and environment of the current operation are consistent with the user and environment when the target object is encrypted, and the corresponding key components can be obtained from the two passwords for decryption.

[0120] Next, the computing device 10 executes S516 and S517, searches for the first key component Rand-A from the first cryptographic device 140 and the second key component Rand-B from the second cryptographic device 20 according to the target object identifier, and then combines Rand-B and Rand-A into a complete key Key through S518. The key Key can be used to execute S519 to decrypt the encrypted target object. After decryption, the content of the target object can be accessed.

[0121] It should be noted that the above steps of obtaining the identification of each cryptographic device and the key component can be exchanged in sequence.

[0122] In this way, during the encryption and decryption process, the first cryptographic device 140 can only be encrypted and decrypted based on the portable legitimate second cryptographic device 20 held by the user to authenticate the legitimacy of the first cryptographic device 140, which is convenient for user management and also helps to ensure the security of the first cryptographic device 140. In addition, the second cryptographic device 20 and the first cryptographic device 140 store key components separately, and a single cryptographic device cannot obtain the complete key, thereby improving the security of the key. In addition, during the decryption operation, the UUID-A stored in the portable second cryptographic device 20 can confirm the consistency of the operating user; the UUID-B stored in the fixed first cryptographic device 140 can confirm the consistency of the operating host. The dual hardware cryptographic devices ensure the consistency of the user and the environment, further improving the security of the encryption and decryption operations.

[0123] Optionally, in this embodiment, refer again to Figure 5A As shown, during the steps S508 and S509, the synthesized key Key can also be associated and stored in the first cryptographic device 140 and the second cryptographic device 20. In this way, if the key component in a cryptographic device is damaged or lost, the intact key Key in another cryptographic device can be used as a backup key, which is convenient for the operator to adopt corresponding remedial measures to use the backup key to obtain the content in the encrypted target object, avoid the inaccessibility of the encrypted content due to the loss of the key, and improve the storage reliability.

[0124] This application embodiment also provides another possible implementation method, please refer to Figure 5B As shown in (5a), in this implementation, when the target object is encrypted, the encryption process is the same as the above Figure 5A The encryption process is similar to that shown in (5a), except that: when the computing device 10 executes S508 and S509, the target object identifier, the synthesized key Key, and the UUID-A of the first cryptographic device 140 are associated and stored in the second cryptographic device 20, and the target object identifier, the key Key, and the UUID-B of the second cryptographic device 20 are associated and stored in the first cryptographic device 140.

[0125] In this way, when the encrypted target object is decrypted, the decryption operation can be completed by verifying the consistency of the Key in the two cryptographic devices 140 and 20. For details, please refer to Figure 5B As shown in (5b), the decryption process of this implementation is the same as that of the above Figure 5A The process is similar to the example of (5b), except that: after authenticating the user identity and environment through S515, when the computing device 10 executes S516 and 5S17, it obtains the key Key from the first cryptographic device 140 and the second cryptographic device 20 respectively according to the target object identifier, and then executes step 518 to compare the consistency between the keys Key stored in the two cryptographic devices 140 and 20. If the comparison is consistent, S519 is executed to use the key Key to decrypt the encrypted target object. After decryption, the content of the target object can be accessed. If the comparison is inconsistent, an alarm message of decryption failure is generated to notify the user.

[0126] In this implementation, encryption and decryption operations are also implemented based on two authenticated and legal cryptographic devices 140 and 20, which is convenient for user management and ensures the security of the first cryptographic device 140. In addition, when the second cryptographic device 20 and the first cryptographic device 140 store the key Key respectively, a single cryptographic device cannot perform a decryption operation before verifying the consistency of the key Key with another cryptographic device, thereby improving the security of the key. In addition, before the decryption operation, the UUIDs of the two cryptographic devices 140 and 20 are also required to verify the consistency of the user identity and environment, further improving the security of the encryption and decryption operations.

[0127] In this implementation, even if the key of one of the cryptographic devices is damaged or lost, corresponding remedial measures can be taken based on the intact key Key in the other cryptographic device to retrieve the content in the encrypted target object, thereby improving the reliability of encryption and decryption.

[0128] Next, based on the content described above, an encryption method provided by an embodiment of the present application is introduced. It can be understood that the method is proposed based on the content described above, and part or all of the content of the method can refer to the description above.

[0129] See also Fig. 6A , Fig. 6A It is a flowchart of an encryption method provided in an embodiment of the present application. It can be understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. Figure 1 As an example, the computing device 10 shown in FIG. Fig. 6A As shown, the method may include:

[0130] In S601 , a first cryptographic device is instructed to generate a first key component, and a second cryptographic device is instructed to generate a second key component.

[0131] In this embodiment, combined with Figure 1 As shown, the computing device 10 is built with a first cryptographic device 140, and the second cryptographic device 20 as a portable removable hardware can directly or indirectly establish a communication connection with the computing device 10. For example, the user can operate the terminal 2 to encrypt and decrypt files in the computing device 10, and the second cryptographic device 20 can be inserted into the physical interface of the terminal 2 (such as a USB interface, but not limited thereto) to establish a communication connection with the computing device 10.

[0132] Exemplarily, when the second cryptographic device 20 is connected to the computing device 10, the user can access the interface (such as the authentication interface or the encryption interface, etc.) provided by the computing device 10 through the browser of the terminal 2, thereby initiating an encryption request for the target object.

[0133] Specifically, the user can enter the identifier of the target object on the interface and request encryption of the target object. Then, the computing device 10 can generate a part of the key (i.e., the first key component Rand-A) in response to the user's request, and instruct the second cryptographic device 20 to generate another part of the key (i.e., the second key component Rand-B). These key components are not complete keys and can only be used to encrypt and decrypt files when they are reconstructed into a complete key.

[0134] As a specific example, the first key component Rand-A and the second key component Rand-B can both be random numbers generated by a preset key generation algorithm. Since these two random numbers are generated by hardware cryptographic devices, they can have high quality, are not easy to decipher, and have high security.

[0135] Exemplarily, the target object may include a file stored in the memory 120 of the computing device 10, or may include a file on the cloud accessible by the computing device 10, but is not limited thereto.

[0136] By way of example and not limitation, the target object may be a file, or one or more files in a directory, and so on.

[0137] Exemplarily, the identifier of the target object may be a name or a storage path, but is not limited thereto.

[0138] S602: Generate an encryption key based on the first key component and the second key component.

[0139] In this embodiment, the computing device 10 obtains the first key component Rand-A and the second key component Rand-B from the first cryptographic device 140 and the second cryptographic device 20 respectively, and combines the two key components into a complete key Key (ie, encryption key).

[0140] As a specific example, the computing device 10 may synthesize the key Key by XOR calculation to ensure that the quality of the two random numbers is not lost. Of course, the computing device 10 may also use other suitable algorithms to synthesize the two key components into the key Key, which is not limited in this embodiment.

[0141] Exemplarily, the computing device 10 may associate the target object's identifier with the first key component Rand-A and store them together on the first cryptographic device 140, and associate the target object's identifier with the second key component Rand-B and store them together on the second cryptographic device 20 for encryption and decryption of the target object.

[0142] Alternatively, illustratively, after generating the key Key, the computing device 10 may also associate the key Key with the identifier of the target object, and store them together in the first cryptographic device 140 and the second cryptographic device 20, respectively, for encryption and decryption of the target object.

[0143] S603: Encrypt the target object based on the encryption key.

[0144] In this embodiment, the computing device 10 uses the synthesized key Key to encrypt the target object, and the content in the target object cannot be directly accessed after encryption. After completing the encryption operation, the user can unplug the second cryptographic device 20 from the terminal 2.

[0145] In this embodiment, during the encryption process, the encryption operation can only be performed based on the portable second password device 20 held by the user, which is convenient for user management and helps to improve the security of the encryption operation.

[0146] In addition, in one possible implementation of this embodiment, if the target object's identifier is associated with the first key component Rand-A and is stored in the first cryptographic device 140, and the target object's identifier is associated with the second key component Rand-B and is stored in the second cryptographic device 20, when decrypting the encrypted target object, Figure 6B As shown, the method may also include:

[0147] S604: Based on the identifier of the target object, obtain a first key component from the first cryptographic device and obtain a second key component from the second cryptographic device.

[0148] In this embodiment, the user can connect the second cryptographic device 20 to the computing device 10, and input the target object identifier based on the decryption interface provided by the computing device 10. Then, the computing device 10 can search for the first key component Rand-A from the first cryptographic device 140 and search for the second key component Rand-B from the second cryptographic device 20 according to the target object identifier.

[0149] S605: Generate a decryption key based on the first key component and the second key component.

[0150] In this embodiment, the computing device 10 can use XOR calculation to combine Rand-B and Rand-A into a complete key Key (i.e., a decryption key). It should be noted that in this example, the key Key composed of the first key component Rand-A and the second key component Rand-B can be called an encryption key in the encryption operation stage and a decryption key in the decryption operation stage.

[0151] S606: Decrypt the encrypted target object based on the decryption key.

[0152] In this embodiment, the computing device 10 uses the key Key to perform a decryption operation on the encrypted target object. After decryption, the content of the target object can be accessed.

[0153] In another possible implementation of this embodiment, if the complete key Key is associated with the target object identifier and is stored in the first cryptographic device 140 and the second cryptographic device 20, when decrypting the encrypted target object, Figure 6C As shown, the method may also include:

[0154] S607: Based on the identifier of the target object, obtain encryption keys from the first cryptographic device and the second cryptographic device respectively, and compare them.

[0155] In this embodiment, the computing device 10 may query the key Key from the first cryptographic device 140 and the second cryptographic device 20 respectively according to the identification of the target object, and compare the consistency of the two keys Key.

[0156] S608: When the encryption key obtained from the first cryptographic device matches the encryption key obtained from the second cryptographic device, decrypt the encrypted target object based on the encryption key.

[0157] In this embodiment, if the encryption key Key obtained from the first cryptographic device matches the encryption key Key obtained from the second cryptographic device, the encryption key Key can be used as a decryption key to decrypt the target object. After decryption, the content of the target object can be accessed.

[0158] In this embodiment, during the encryption and decryption process, encryption and decryption operations are performed based on the portable second cryptographic device 20 held by the user, which is convenient for user management. In addition, the second cryptographic device 20 and the first cryptographic device 140 store keys or key components respectively, and neither cryptographic device can perform decryption operations alone, thereby improving key security.

[0159] The following is a detailed description of an encryption method in a specific embodiment of the present application in conjunction with the accompanying drawings. It should be understood that the serial numbers before each step in the method herein are only used to distinguish the steps themselves, and do not represent the order in which the steps need to be followed. When implementing the method, the order of the steps of the method can be reasonably adjusted as needed.

[0160] For example, Fig. 7A FIG. 1 shows a schematic diagram of an encryption method flow chart provided by a specific embodiment of the present application. Fig. 7A As shown, the method may specifically include:

[0161] S701, when the computing device is connected to the second cryptographic device, obtaining an encryption request for a target object.

[0162] In this embodiment, the user can insert the portable second password device 20 into the terminal 2, and access the authentication interface provided by the computing device 10 on the terminal 2, and the authentication interface initiates an encryption request to the computing device 10, wherein the encryption request may include the identification of the target object to be encrypted, and the first authentication information of the second password device, and the first authentication information is used to authenticate the identity of the encryption user (the user who initiates the encryption operation). As an example, the first authentication information may be the PIN code of the second password device 20, or other types of passwords, and the user who can enter the correct first authentication information can be regarded as a legitimate user.

[0163] S702: Determine whether the first authentication information matches the first identity information.

[0164] In this embodiment, the computing device 10 can match the first authentication information with the first identity information of the second password device 20. If the first authentication information matches the first identity information, it can be determined that the first authentication information is correct and the second password device 20 is safe. Among them, the first identity information is the identity identification information of the second password device 20, for example, it can be information such as an identity ID or a PIN code (or password). As an example, the computing device 10 can store the identity ID and the PIN code (or password) of the second password device 20 in a secure storage area in advance. In this way, after the computing device 10 obtains the first authentication information input by the user, it can verify whether the first authentication information is consistent with the PIN code (or password) of the second password device 20 in the secure storage area. If they are consistent, the verification is successful, and if they are inconsistent, the verification fails, and the user needs to re-enter the first authentication information.

[0165] In this way, when the computing device 10 determines that the first authentication information matches the first identity information, that is, the verification is successful, it can be determined that the identity of the user carrying the second password device 20 is safe and reliable, and the second password device 20 is also legal and can be used to participate in the target object encryption operation. In addition, if the first authentication information does not match the first identity information, the computing device 10 can generate a warning prompt and display it on the interface accessed by the user to inform the user.

[0166] S703: When the first authentication information matches the first identity information, obtain second authentication information from the second cryptographic device.

[0167] In this embodiment, the second password device 20 is also pre-set with the authentication information of the first password device 140 (i.e., the second authentication information), and the second authentication information can be used to authenticate the encryption environment. If the second authentication information is correct, it can be considered that the first password device 140 is safe. As an example, the second authentication information can be the PIN code of the first password device 140, but is not limited thereto.

[0168] S704: Determine whether the second authentication information matches the second identity information.

[0169] In this embodiment, the second identity information may be the identity identification information of the first password device 140, such as an identity ID or a PIN code. As an example, the computing device 10 may obtain the PIN code of the first password device 140 from the second password device 20 for verification. In this way, the user does not need to manually input the PIN of the first password device 140, but directly reads it from the second password device 20. On the one hand, since the second password device 20 is a mobile hardware in the hands of the user, it is difficult to counterfeit. On the other hand, only after it is determined that the second password device 20 is legitimate, the PIN code stored in the second password device 20 is used to verify the legitimacy of the first password device 140, so the security and reliability are higher, and the occurrence of guessing attacks can be effectively avoided.

[0170] In this way, if the second authentication information matches the second identity information of the first cryptographic device 140, the user may be allowed to use the first cryptographic device 140 to generate the corresponding key component and perform the target object encryption operation. If the match is inconsistent, the computing device 10 may generate a warning prompt and display it on the interface accessed by the user to inform the user.

[0171] S705: When the second authentication information matches the second identity information, instruct the first cryptographic device to generate a first key component, and instruct the second cryptographic device to generate a second key component.

[0172] In this embodiment, when confirming that the second authentication information matches the second identity information of the first cryptographic device 140, the computing device 10 may instruct the two cryptographic devices 140, 20 to generate a first key component Rand-A and a second key component Rand-B, respectively.

[0173] S706: Generate an encryption key based on the first key component and the second key component.

[0174] In this embodiment, the computing device 10 may synthesize the first key component Rand-A and the second key component Rand-B by using methods such as XOR calculation to obtain a complete key Key for encrypting the target object.

[0175] S707, encrypt the target object based on the encryption key.

[0176] In this embodiment, the computing device 10 may use the synthesized key Key to encrypt the target object so that the content of the encrypted target object cannot be directly accessed, thereby protecting the content of the target object.

[0177] In this embodiment, a possible implementation is that the generated first key component Rand-A can be associated with the target object identifier and stored in the first cryptographic device 140, and the second key component Rand-B can be associated with the target object identifier and stored in the second cryptographic device 20. Afterwards, the user can unplug the second cryptographic device 20 from the terminal 2. When decrypting the encrypted target object, the method may further include:

[0178] S708: When the computing device is connected to the second cryptographic device, obtain a decryption request for the target object.

[0179] In this embodiment, in this embodiment, the user can connect the second cryptographic device 20 to the computing device 10, and input the target object identifier and the first authentication information of the second cryptographic device based on the authentication interface provided by the computing device 10 to initiate a decryption request.

[0180] S709: Determine whether the first authentication information matches the first identity information.

[0181] S710: When the first authentication information matches the first identity information, obtain second authentication information from a second cryptographic device.

[0182] S711, determine whether the second authentication information matches the second identity information.

[0183] In this embodiment, the execution principle of S709 to S711 is similar to the above description of S702 to S704, and will not be repeated here.

[0184] S712: When the second authentication information matches the second identity information, based on the identifier of the target object, respectively obtain the first key component from the first cryptographic device and obtain the second key component from the second cryptographic device.

[0185] In this embodiment, when the computing device 10 determines that the second authentication information matches the second identity information, the first key component Rand-A is searched from the first cryptographic device 140 according to the target object identifier, and the second key component Rand-B is searched from the second cryptographic device 20.

[0186] S713: Generate a decryption key based on the first key component and the second key component.

[0187] S714, decrypt the encrypted target object based on the decryption key.

[0188] In this embodiment, the execution principle of S713 to S714 is similar to the description of S605 to S606 in the above embodiment, and will not be repeated here.

[0189] In this embodiment, another possible implementation is that the generated key Key can be associated with the target object identifier and stored in the first cryptographic device 140 and the second cryptographic device 20. Fig. 7A The examples shown differ in that: Figure 7B As shown, after S711, if the second authentication information matches the second identity information, the following steps are executed:

[0190] S715: Based on the identifier of the target object, obtain encryption keys from the first cryptographic device and the second cryptographic device respectively, and compare them.

[0191] S716: When the encryption key obtained from the first cryptographic device matches the encryption key obtained from the second cryptographic device, decrypt the encrypted target object based on the encryption key.

[0192] In this embodiment, the execution principle of S715 to S716 is similar to the description of S607 to S608 in the above embodiment, and will not be repeated here.

[0193] For example, Fig. 8A FIG. 1 shows a schematic diagram of an encryption method flow chart provided by a specific embodiment of the present application. Fig. 8A As shown, the method may specifically include:

[0194] S801, when the computing device is connected to the second cryptographic device, obtaining an encryption request for a target object.

[0195] In this embodiment, the user can insert the portable second cryptographic device 20 into the terminal 2, and access the encryption interface provided by the computing device 10 on the terminal 2, and the encryption interface initiates an encryption request to the computing device 10 to request encryption of the target object. The encryption request may include the identifier of the target object to be encrypted.

[0196] S802: In response to the encryption request, instruct the first cryptographic device to generate a first key component, and instruct the second cryptographic device to generate a second key component.

[0197] In this embodiment, the computing device 10 may instruct the two cryptographic devices 140 and 20 to generate a first key component Rand-A and a second key component Rand-B, respectively, in response to the encryption request.

[0198] S803: Generate an encryption key based on the first key component and the second key component.

[0199] S804, encrypt the target object based on the encryption key.

[0200] In this embodiment, the execution principles of S803 to S804 are similar to those of S602 to S603 in the above embodiment, and are not described in detail.

[0201] S805: Store the identifier of the target object and the first identity identifier in association with each other in the second cryptographic device, and store the identifier of the target object and the second identity identifier in association with each other in the first cryptographic device.

[0202] In this embodiment, the computing device 10 also obtains the first identity of the first cryptographic device 140 and the second identity of the second cryptographic device 20, wherein the two identities are used to uniquely identify the two cryptographic devices. Exemplarily, the first identity may be the unique identification code UUID-A of the first cryptographic device, and the second identity may be the unique identification code UUID-B of the second cryptographic device 20.

[0203] In this embodiment, a possible implementation is that the generated first key component Rand-A can be associated with the target object identifier and UUID-B and stored in the first cryptographic device 140, and the second key component Rand-B can be associated with the target object identifier and UUID-A and stored in the second cryptographic device 20. After that, the user can unplug the second cryptographic device 20 from the terminal 2. At this point, the encryption operation process for the target object is completed, and the user can unplug the second cryptographic device 20, release the communication connection between the second cryptographic device 20 and the computing device 10, and insert it again when the target object needs to be decrypted.

[0204] In this way, the two cryptographic devices store each other's identity and key components. When decrypting later, the two cryptographic devices need to jointly verify the identity and provide each other's stored key components to perform the decryption operation, thereby improving the security of the operation.

[0205] For details, please continue to refer to Fig. 8A As shown, when decrypting the encrypted target object, the method may further include:

[0206] S806: When the computing device is connected to the second cryptographic device, obtain a decryption request.

[0207] In this embodiment, the user can insert the second cryptographic device 20 into the terminal 2, and access the decryption interface provided by the computing device 10 through the terminal 2, input the identifier of the target object, and initiate a decryption request, requesting the computing device 10 to decrypt the encrypted target object.

[0208] S807, respectively obtain a first identity identifier, a second identity identifier, a third identity identifier, and a fourth identity identifier.

[0209] In this embodiment, the computing device 10 can read the current unique identification code (i.e., identity) UUID-A-now of the first cryptographic device 140, and also read the current unique identification code (i.e., identity) UUID-B-now of the second cryptographic device 20, and query the first identity UUID-A associated with the target object identifier from the second cryptographic device 20, and query the second identity UUID-B associated with the target object identifier from the first cryptographic device 140.

[0210] S808: Determine whether the first identity identifier matches the third identity identifier, and whether the second identity identifier matches the fourth identity identifier.

[0211] In this embodiment, the computing device 10 compares UUID-A-now with UUID-A obtained from the second cryptographic device 20, and compares UUID-B-now with UUID-B obtained from the first cryptographic device 140 to determine whether UUID-A-now matches UUID-A, and whether UUID-B-now matches UUID-B.

[0212] S809, when the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, based on the identifier of the target object, respectively obtain the first key component from the first cryptographic device and obtain the second key component from the second cryptographic device.

[0213] In this embodiment, if after comparison, UUID-A-now is consistent with UUID-A obtained from the second cryptographic device 20, and UUID-B-now is consistent with UUID-B obtained from the first cryptographic device 140, it is proved that the current decryption environment is consistent with the environment when the target object is encrypted, the environment is safe, and the decryption operation can be performed. On the contrary, if any of the two sets of compared information is inconsistent, an alarm message is generated to inform the user. In this way, the user and the environment are ensured to be consistent through dual hardware cryptographic devices, further improving the security of encryption and decryption operations.

[0214] Therefore, if the current identity UUID-A-now of the first cryptographic device 140 is consistent with the first identity UUID-A, and the current identity UUID-B-now of the second cryptographic device 20 is consistent with the second identity UUID-B, the computing device 10 searches for the associated second key component Rand-B from the first cryptographic device 140 and searches for the associated first key component Rand-A from the second cryptographic device 20 according to the target object name in the decryption request.

[0215] S810, generate a decryption key based on the first key component and the second key component.

[0216] S811: Decrypt the encrypted target object based on the decryption key.

[0217] In this embodiment, the execution principle of S809 to S810 is similar to the description of S605 to S606 in the above embodiment, and will not be repeated here.

[0218] In this embodiment, another possible implementation is that the generated key Key can be associated with the target object identifier and the second identity identifier UUID-B and stored in the first cryptographic device 140, and the generated key Key can be associated with the target object identifier and the first identity identifier UUID-A and stored in the second cryptographic device 20. This implementation is similar to the above Fig. 8A The examples shown differ in that: Figure 8B As shown, after S807, if the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, then execute:

[0219] S812: Based on the identifier of the target object, obtain encryption keys from the first cryptographic device and the second cryptographic device respectively, and compare them.

[0220] S813: When the encryption key obtained from the first cryptographic device matches the encryption key obtained from the second cryptographic device, decrypt the encrypted target object based on the encryption key.

[0221] In this embodiment, the execution principle of S811 to S812 is similar to the description of S607 to S608 in the above embodiment, and will not be repeated here.

[0222] For example, Fig. 9A FIG. 1 shows a schematic diagram of an encryption method flow chart provided by a specific embodiment of the present application. Fig. 9A As shown, the method may specifically include:

[0223] S901, when the computing device is connected to the second cryptographic device, obtaining an encryption request for a target object.

[0224] S902: Determine whether the first authentication information matches the first identity information.

[0225] S903: When the first authentication information matches the first identity information, obtain second authentication information from the second cryptographic device.

[0226] S904: Determine whether the second authentication information matches the second identity information.

[0227] S905 . When the second authentication information matches the second identity information, instruct the first cryptographic device to generate a first key component, and instruct the second cryptographic device to generate a second key component.

[0228] S906: Generate an encryption key based on the first key component and the second key component.

[0229] S907, encrypt the target object based on the encryption key.

[0230] In this embodiment, the execution principles of S901 to S907 are similar to the description of S701 to S707 in the above embodiment, and will not be repeated here.

[0231] S908: Store the identifier of the target object, the first identity identifier, and the second key component in association with each other in the second cryptographic device, and store the identifier of the target object, the second identity identifier, and the first key component in association with each other in the first cryptographic device.

[0232] S909: When the computing device is connected to the second cryptographic device, obtain a decryption request for the target object.

[0233] S910, determining whether the first authentication information matches the first identity information.

[0234] S911: When the first authentication information matches the first identity information, obtain second authentication information from the second cryptographic device.

[0235] S912: Determine whether the second authentication information matches the second identity information.

[0236] In this embodiment, the execution principle of S909 to S912 is similar to the above description of S708 to S911, and will not be repeated here.

[0237] S913, when the second authentication information matches the second identity information, respectively obtain the first identity identifier, the second identity identifier, the third identity identifier and the fourth identity identifier.

[0238] S914, determining whether the first identity identifier matches the third identity identifier, and whether the second identity identifier matches the fourth identity identifier.

[0239] S915. When the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, based on the identifier of the target object, respectively obtain the first key component from the first cryptographic device and obtain the second key component from the second cryptographic device.

[0240] S916: Generate a decryption key based on the first key component and the second key component.

[0241] S917, decrypt the encrypted target object based on the decryption key.

[0242] In this embodiment, the execution principle of S913 to S917 is similar to the above description of S806 to S810, and will not be repeated here.

[0243] In this embodiment, another possible implementation is that the generated key Key can be associated with the target object identifier and the second identity identifier UUID-B and stored in the first cryptographic device 140, and the generated key Key can be associated with the target object identifier and the first identity identifier UUID-A and stored in the second cryptographic device 20. This implementation is similar to the above Fig. 9A The examples shown differ in that: Fig. 9B As shown, in S908, the target object's identifier, the first identifier and the key Key are stored in the second cryptographic device, and the target object's identifier, the second identifier and the key Key are associated and stored in the first cryptographic device. Thus, after S914, if the first identifier matches the third identifier, and the second identifier matches the fourth identifier, then the following is executed:

[0244] S918, based on the identifier of the target object, respectively obtain encryption keys from the first cryptographic device and the second cryptographic device, and compare them.

[0245] S919: When the encryption key obtained from the first cryptographic device matches the encryption key obtained from the second cryptographic device, decrypt the encrypted target object based on the encryption key.

[0246] In this embodiment, the execution principle of S918 to S919 is similar to the description of S607 to S608 in the above embodiment, and will not be repeated here.

[0247] In this embodiment, the target object is encrypted and decrypted by authenticating the legitimacy of the second cryptographic device 20 and the first cryptographic device 140 through authentication information, and the encryption and decryption operations are highly secure and reliable. In addition, during decryption, the two cryptographic devices 140 and 20 need to collaborate with each other to verify identity information before using each other's stored keys (or key components) to perform decryption operations. The key (or key component) of any single cryptographic device cannot perform decryption operations normally, thereby improving key security.

[0248] Optionally, in the above Figure 6B , Fig. 7A , Fig. 8A as well as Fig. 9AIn the specific embodiment shown, the key Key can also be associated with the target object identifier and then stored separately in each cryptographic device 140, 20. In this optional example, the cryptographic Key stored in the cryptographic devices 140, 20 may not be used for decryption operations. Instead, when the key component of one of the cryptographic devices is damaged or lost, the user can use the key Key in another cryptographic device to perform data recovery operations, thereby decrypting the encrypted content of the target object, avoiding the inaccessibility of the encrypted content due to key loss, and improving storage reliability.

[0249] Based on the method in the above embodiment, the present application embodiment provides an encryption device. Fig.10 , Fig.10 It is a structural diagram of an encryption device provided in an embodiment of the present application.

[0250] like Fig.10 As shown, the encryption device 1000 may include: a processing module 1001. The processing module 1001 may be used to instruct the first cryptographic device to generate a first key component, and to instruct the second cryptographic device to generate a second key component; the processing module 1001 may also be used to generate an encryption key based on the first key component and the second key component; the first key component is stored in the first cryptographic device; the second key component is stored in the second cryptographic device; or the encryption key is stored in the first cryptographic device and the second cryptographic device; the processing module 1001 may also be used to encrypt the target object based on the encryption key.

[0251] In some examples, the encryption device 1000 may further include a determination module 1002, which is used to determine whether the first authentication information matches the first identity information, the first authentication information is used to authenticate the identity of the encryption user; the first identity information is the identity identification information of the second key device. The processing module 1001 may also be used to instruct the first cryptographic device to generate a first key component, and instruct the second cryptographic device to generate a second key component when the first authentication information matches the first identity information.

[0252] In some examples, the determination module 1002 may also be used to determine whether the second authentication information matches the second identity information when the first authentication information matches the first identity information, the second authentication information being used to authenticate the encryption environment; the second identity information being the identity identification information of the first key device. The processing module 1001 may also be used to instruct the first cryptographic device to generate the first key component and instruct the second cryptographic device to generate the second key component when the second authentication information matches the second identity information.

[0253] In some examples, processing module 1001 can also be used to obtain a first key component from a first cryptographic device and a second key component from a second cryptographic device based on an identification of the target object; generate a decryption key based on the first key component and the second key component; and decrypt the encrypted target object based on the decryption key.

[0254] In some examples, processing module 1001 can also be used to obtain encryption keys from the first cryptographic device and the second cryptographic device respectively based on the identification of the target object, and perform comparisons; when the encryption key obtained from the first cryptographic device and the encryption key obtained from the second cryptographic device match, decrypt the encrypted target object based on the encryption key.

[0255] It should be understood that the above-mentioned device is used to execute the encryption method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device 1000 are similar to those described in the above-mentioned method. The working process of the device 1000 can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0256] Based on the method in the above embodiment, an embodiment of the present application provides an electronic device. The electronic device may include: at least one memory for storing programs; at least one processor for executing the programs stored in the memory; wherein, when the programs stored in the memory are executed, the processor is used to execute the method in the above embodiment.

[0257] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0258] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product, characterized in that when the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0259] Based on the method in the above embodiment, the present application embodiment also provides a chip. Fig.11 , Fig.11 This is a schematic diagram of the structure of a chip provided in an embodiment of the present application. Fig.11 As shown, the chip 1100 includes one or more processors 1101 and an interface circuit 1102. Optionally, the chip 1100 may also include a bus 1103. Among them:

[0260] The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1101 or an instruction in the form of software. The above-mentioned processor 1101 can be a general-purpose processor, a digital communicator (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods and steps in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0261] The interface circuit 1102 can be used to send or receive data, instructions or information. The processor 1101 can use the data, instructions or other information received by the interface circuit 1102 to process, and can send the processing completion information through the interface circuit 1102.

[0262] Optionally, the chip 1100 further includes a memory, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory (NVRAM).

[0263] Optionally, the memory stores executable software modules or data structures, and the processor can perform corresponding operations by calling operation instructions stored in the memory (the operation instructions can be stored in the operating system).

[0264] Optionally, the interface circuit 1102 may be used to output the execution result of the processor 1101 .

[0265] It should be noted that the corresponding functions of the processor 1101 and the interface circuit 1102 can be implemented through hardware design, software design, or a combination of hardware and software, and there is no limitation here.

[0266] It should be understood that each step of the above method embodiment can be completed by a hardware-based logic circuit or a software-based instruction in a processor.

[0267] It is understandable that the size of the sequence number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. In addition, in some possible implementations, each step in the above embodiment can be selectively executed according to actual conditions, and can be partially executed or fully executed, which is not limited here.

[0268] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0269] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0270] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0271] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

Claims

1. An encryption method, characterized in that: The method is applied to a computing device, the computing device comprising a first cryptographic device; the computing device is communicatively connected with a second cryptographic device; the second cryptographic device is a user portable device; The method comprises: Instructing the first cryptographic device to generate a first key component, and instructing the second cryptographic device to generate a second key component; Generate an encryption key based on the first key component and the second key component, wherein the first key component is stored in the first cryptographic device and the second key component is stored in the second cryptographic device; or, the encryption key is stored in both the first cryptographic device and the second cryptographic device; The target object is encrypted based on the encryption key, and the identifier of the target object is associated with the first identity identifier and stored in the second cryptographic device, and the identifier of the target object is associated with the second identity identifier and stored in the first cryptographic device, and the first identity identifier and the second identity identifier are used to identify the first cryptographic device and the second cryptographic device respectively; If the two cryptographic devices are used to decrypt the target object, the matching of the first identity identifier and the third identity identifier, as well as the matching of the second identity identifier and the fourth identity identifier are first verified. The third identity identifier and the fourth identity identifier are respectively the current identity identifier of the first cryptographic device and the current identity identifier of the second cryptographic device.

2. The method according to claim 1, characterized in that Before instructing the first cryptographic device to generate a first key component and instructing the second cryptographic device to generate a second key component, the method further includes: Determine whether the first authentication information matches the first identity information, wherein the first authentication information is used to authenticate the identity of the encryption user; the first identity information is the identity identification information of the second cryptographic device; The instructing the first cryptographic device to generate a first key component, and instructing the second cryptographic device to generate a second key component, comprises: In a case where the first authentication information matches the first identity information, the first cryptographic device is instructed to generate a first key component, and the second cryptographic device is instructed to generate a second key component.

3. The method according to claim 2, characterized in that The second authentication information of the first cryptographic device is stored in the second cryptographic device; The step of instructing the first cryptographic device to generate a first key component and instructing the second cryptographic device to generate a second key component when the first authentication information matches the first identity information includes: If the first authentication information matches the first identity information, determining whether the second authentication information matches the second identity information, wherein the second authentication information is used to authenticate the encryption environment, and the second identity information is the identity identification information of the first cryptographic device; In a case where the second authentication information matches the second identity information, the first cryptographic device is instructed to generate a first key component, and the second cryptographic device is instructed to generate a second key component.

4. The method according to any one of claims 1 to 3, characterized in that: The identifier of the target object and the first key component are stored in association with each other in the first cryptographic device; the identifier of the target object and the second key component are stored in association with each other in the second cryptographic device; The method further comprises: Based on the identifier of the target object, respectively obtain the first key component from the first cryptographic device and obtain the second key component from the second cryptographic device; generating a decryption key based on the first key component and the second key component; The encrypted target object is decrypted based on the decryption key.

5. The method according to claim 4, characterized in that Before respectively acquiring the first key component from the first cryptographic device and acquiring the second key component from the second cryptographic device based on the identification of the target object, the method includes: respectively obtaining the first identity identifier, the second identity identifier, the third identity identifier, and the fourth identity identifier; Determine whether the first identity identifier matches the third identity identifier, and whether the second identity identifier matches the fourth identity identifier; The acquiring the first key component from the first cryptographic device and the acquiring the second key component from the second cryptographic device based on the identifier of the target object respectively include: When the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, based on the identifier of the target object, the first key component is obtained from the first cryptographic device, and the second key component is obtained from the second cryptographic device.

6. The method according to any one of claims 1 to 3, characterized in that: The identifier of the target object and the encryption key are stored in association in the first cryptographic device and the second cryptographic device; The method further comprises: Based on the identifier of the target object, respectively obtain the encryption key from the first cryptographic device and the second cryptographic device, and compare them; In a case where the encryption key acquired from the first cryptographic device and the encryption key acquired from the second cryptographic device match, the encrypted target object is decrypted based on the encryption key.

7. The method according to claim 6, characterized in that Before acquiring the encryption key from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object, the method includes: respectively obtaining the first identity identifier, the second identity identifier, the third identity identifier, and the fourth identity identifier; Determine whether the first identity identifier matches the third identity identifier, and whether the second identity identifier matches the fourth identity identifier; The acquiring the encryption key from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object includes: When the first identity identifier matches the third identity identifier, and the second identity identifier matches the fourth identity identifier, the encryption key is obtained from the first cryptographic device and the second cryptographic device respectively based on the identifier of the target object.

8. The method according to claim 5 or 7, characterized in that: Before respectively acquiring the first identity identifier and the second identity identifier, the method further includes: Determine whether the first authentication information matches the first identity information, the first authentication information being used to authenticate the identity of the encryption user; the first identity information being the identity identification information of the second cryptographic device; If the first authentication information matches the first identity information, determining whether the second authentication information matches the second identity information, the second authentication information being used to authenticate the encryption environment and stored in the second cryptographic device, the second identity information being the identity identification information of the first cryptographic device; The obtaining the first identity identifier and the second identity identifier respectively includes: When the second authentication information matches the second identity information, the first identity identifier and the second identity identifier are obtained respectively.

9. The method according to any one of claims 1 to 3, characterized in that: The first key component and the second key component are random numbers.

10. A computing device, characterized in that: include: Memory and processor; The memory is coupled to the processor; The memory is used to store programs / instructions; A processor for executing the program / instructions; When the program / instruction is executed by the processor, the computing device implements the encryption method as described in any one of claims 1-9.

Images