Data security access method and system based on encryption algorithm

Abstract

The present invention relates to a data security access method and system based on an encryption algorithm. A business end applies for a key; a data safe generates a key pair A and a key certificate A; the business end sends storage data including business data; the data safe generates a key pair B and a data certificate B; the key certificate A and the data certificate B are spliced ​​to obtain an encrypted string, and the business data is encrypted using a public key B and an AES algorithm to obtain encrypted data C, the encrypted string is its encryption vector value, and an AES key value is configured; the key certificate A and the data certificate B are salted using an MD5 algorithm to obtain a string md5DataKey and stored in a corresponding table of a database, and then the data certificate B is returned to the business end; the extraction of business data is the reverse process of the above process. A variety of encryption methods are used, the key is encrypted, and the business data is encrypted in two layers, thereby ensuring the security of the business data.

Description

Technical Field

[0001] The present invention relates to the field of data encryption, and in particular to a data security access method and system based on encryption algorithm. Background Art

[0002] Government procurement malls have a variety of transaction methods. Unlike mature e-mall markets (such as JD.com and Taobao), users can directly place orders for goods listed by merchants. Government procurement has clearer legal requirements and implementation specifications for both buyers and sellers.

[0003] The current government procurement e-mall has a variety of transaction methods such as direct purchase, online bidding, and online inquiry. Users are divided into two roles: purchasers and suppliers, corresponding to buyers and sellers. Taking online bidding as an example, it has strict transaction processes and time nodes, requiring purchasers to enter information such as commodity demand, purchase quantity, and purchase budget in advance to form a purchase project, and then publish a procurement announcement to the outside world. Suppliers match and register according to the procurement announcement and participate in the project. When the time node arrives for the supplier to quote, the supplier logs in to the system to participate in the quotation of the project. Suppliers can make multiple rounds of quotations within the quotation time. The quotation information suppliers are kept confidential from each other, and the bidding information will not be displayed in the system. When the quotation time is over, the system summarizes the last quotation information of all suppliers, takes the lowest price as the successful supplier, and publishes the procurement result announcement to the outside world. Subsequently, a series of processes such as contract signing, delivery, and payment are carried out between the purchaser and the successful supplier.

[0004] With the continuous improvement of network security requirements, and in order to prevent collusion between people inside and outside the system, the existing code stores quotation information in plain text in the database, and only hides it when it is displayed to the outside. This method obviously has shortcomings. External attackers can obtain quotation information through illegal means, and even internal personnel who are familiar with the database table can easily obtain quotation information and provide it to suppliers, allowing them to close the deal at a price that is a small amount lower than the current lowest quotation.

[0005] Therefore, we want to use an encryption scheme to encrypt and store the quotation information, and only decrypt the data when the transaction is completed. Before the transaction is completed, the data cannot be obtained by the supplier through abnormal means, including preventing external attackers from obtaining the bidding information through illegal means, preventing R&D personnel from reverse decrypting the bidding information through code logic, and preventing implementation and operation personnel who are familiar with the database table from checking the database to obtain the bidding information. Summary of the invention

[0006] The purpose of the present invention is to provide a data security access method and system based on encryption algorithm, which adopts a dynamic, mixed and configurable way of multiple encryption algorithms to encrypt data, and can also be combined with business data to achieve the effect of data security access.

[0007] The present invention is implemented through the following technical solutions: a data security access method based on an encryption algorithm, the main body of which is a data safe, which is connected to a business end and a database respectively;

[0008] The storage process of business data is:

[0009] Step 1: The business end applies for a key from the data safe with the business end information;

[0010] Step 2: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key A, private key A and key certificate A associated with the key. The key certificate A is encrypted using MD5 to obtain the encrypted key certificate A1. The encrypted key certificate A1, public key A and private key A are then stored in the database, and the key certificate A is returned to the business end. The business end obtains the key certificate A and stores it in association with the business data.

[0011] Step 3: The business end sends the storage data to the data safe with the business end information and key certificate A. The storage data includes the data storage expiration time, the relevant user list, the unit information and the business data that needs to be encrypted;

[0012] Step 4: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key B, private key B and key-associated data certificate B. The data certificate B is encrypted using MD5 to obtain the encrypted data certificate B1, and then the encrypted data certificate B1, public key B and private key B are stored in the database;

[0013] Step 5: The data safe concatenates key certificate A and data certificate B to obtain a concatenated certificate, and then uses the MD5 algorithm to encrypt the concatenated certificate to obtain an encrypted string md5Key. Then, the business data is first encrypted using public key B to obtain encrypted data B, and then the encrypted data B is encrypted again using the AES symmetric encryption algorithm to obtain encrypted data C. At the same time, the AES key value is configured and the encrypted string md5Key is associated as the encryption vector value of the encrypted data C. Finally, the encrypted data C, data storage expiration time, relevant user list, and unit information are stored in the database.

[0014] Step 6: Use the MD5 algorithm to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey and store it in the table of encrypted data C in the database, and then return the data certificate B to the business end, and the business end saves the data certificate B;

[0015] The process of extracting business data is as follows:

[0016] Step 7: The business end applies to the data safe for data acquisition by carrying the business end information, key certificate A and data certificate B saved during the storage process;

[0017] Step 8: The data safe verifies the legitimacy of the business end information. After the verification is passed, the MD5 algorithm is used to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey. The string md5DataKey is used to locate the table storing the encrypted data C in the database and retrieve the encrypted data C.

[0018] Step 9: The data safe concatenates the key certificate A and the data certificate B, and calculates the encrypted string md5Key using the MD5 algorithm. The encrypted data C is decrypted into the encrypted data B using md5Key as the encryption vector value of the AES symmetric encryption algorithm.

[0019] Step 10, the data safe uses data certificate B to obtain encrypted data certificate B1 through MD5 encryption, retrieves the private key B associated with encrypted data certificate B1 from the database, uses private key B to decrypt encrypted data B to obtain business data, and finally sends the business data to the business end.

[0020] A data security access system based on encryption algorithm, the main body of which is a data safe, which includes:

[0021] Verification module, which verifies the legitimacy of business-side information when the business-side accesses the data safe;

[0022] A data access module, used to store the received data into a database or extract corresponding data from the database;

[0023] A key module, used to distribute keys to the business end, and save the keys of the business end to the corresponding location in the database through the data access module; and

[0024] The encryption and decryption module is used to encrypt key credentials and business data, and save the encrypted data to the corresponding location in the database through the data access module.

[0025] Compared with the previous technology, the beneficial effects of the present invention are:

[0026] 1. The present invention uses a mixture of multiple encryption methods to encrypt both the key and the business data.

[0027] For the business side, although they have two keys (two tokens), they do not know the real encryption key, and R&D personnel cannot decrypt the data by themselves.

[0028] For the data safe, although the encrypted data and the corresponding keys are stored, since the two tokens are retained by the business party, it is impossible to know the association between the key and the data, and it is impossible to decrypt the data by itself.

[0029] In addition, for operation and maintenance personnel, data (including two tokens) are encrypted and stored in the data safe according to certain rules. There is no explicit association relationship, and its association relationship cannot be directly obtained through the joint table, which increases the difficulty of data cracking.

[0030] 2. The present invention adopts the tenant form, and the encryption algorithms between tenants can be flexibly configured. At the same time, for each business data, the encryption key is dynamically generated, one data one key, and it is highly dynamic.

[0031] 3. The present invention has strong expansibility. On the basis of the present technical solution, the dynamic nature of the key and the security of encryption (such as increasing the number of encryption layers) can be further expanded to further ensure the data security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a data security access method based on an encryption algorithm;

[0033] Figure 2 It is a module block diagram of a data security access system based on encryption algorithm;

[0034] Figure 3 This is the flowchart of the first phase of the online bidding project;

[0035] Figure 4 This is the flowchart for the second phase of the online bidding project;

[0036] Figure 5 This is the flowchart for Phase 3 of the online bidding project. DETAILED DESCRIPTION

[0037] The present invention is described in detail below in conjunction with the accompanying drawings, but the protection content of the present invention is not limited to the following:

[0038] like Figure 1 As shown, the data security access method based on encryption algorithm, the main body is a data safe, which is connected to the business end and the database respectively;

[0039] The storage process of business data is:

[0040] Step 1: The business end applies for a key from the data safe with the business end information;

[0041] Step 2: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key A, private key A and key certificate A associated with the key. The key certificate A is encrypted using MD5 to obtain the encrypted key certificate A1. The encrypted key certificate A1, public key A and private key A are then stored in the database, and the key certificate A is returned to the business end. The business end obtains the key certificate A and stores it in association with the business data.

[0042] Step 3: The business end sends the storage data to the data safe with the business end information and key certificate A. The storage data includes the data storage expiration time, the relevant user list, the unit information and the business data that needs to be encrypted;

[0043] Step 4: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key B, private key B and key-associated data certificate B. The data certificate B is encrypted using MD5 to obtain the encrypted data certificate B1, and then the encrypted data certificate B1, public key B and private key B are stored in the database;

[0044] Step 5: The data safe concatenates key certificate A and data certificate B to obtain a concatenated certificate, and then uses the MD5 algorithm to encrypt the concatenated certificate to obtain an encrypted string md5Key. Then, the business data is first encrypted using public key B to obtain encrypted data B, and then the encrypted data B is encrypted again using the AES symmetric encryption algorithm to obtain encrypted data C. At the same time, the AES key value is configured and the encrypted string md5Key is associated as the encryption vector value of the encrypted data C. Finally, the encrypted data C, data storage expiration time, relevant user list, and unit information are stored in the database.

[0045] Step 6: Use the MD5 algorithm to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey and store it in the table of encrypted data C in the database, and then return the data certificate B to the business end, and the business end saves the data certificate B;

[0046] The process of extracting business data is as follows:

[0047] Step 7: The business end applies to the data safe for data acquisition by carrying the business end information, key certificate A and data certificate B saved during the storage process;

[0048] Step 8: The data safe verifies the legitimacy of the business end information. After the verification is passed, the MD5 algorithm is used to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey. The string md5DataKey is used to locate the table storing the encrypted data C in the database and retrieve the encrypted data C.

[0049] Step 9: The data safe concatenates the key certificate A and the data certificate B, and calculates the encrypted string md5Key using the MD5 algorithm. The encrypted data C is decrypted into the encrypted data B using md5Key as the encryption vector value of the AES symmetric encryption algorithm.

[0050] Step 10, the data safe uses data certificate B to obtain encrypted data certificate B1 through MD5 encryption, retrieves the private key B associated with encrypted data certificate B1 from the database, uses private key B to decrypt encrypted data B to obtain business data, and finally sends the business data to the business end.

[0051] It should be noted that the key pair public key A and private key A generated in step 2 are neither used in the storage process of business data nor in the extraction process of business data. They can have a confusing effect when others steal data, further prevent the leakage of business data, and thus improve the security of this algorithm.

[0052] In the present invention, the data safe operates as an independent module, provides an entry to the outside in the form of an interface and uses the tenant concept for business data access. Taking an online bidding project as an example, after the project is initiated, when the purchaser logs in to the user system, creates a new online bidding project, enters the procurement requirements and publishes a procurement notice, the business data storage process is entered.

[0053] Furthermore, the encryption algorithm is the SM2 algorithm.

[0054] In step 2, use the SM2 algorithm to generate the key pair sm2PubA, sm2PriA and the key certificate keyToken associated with the key;

[0055] In step 4, the SM2 algorithm is used to generate the key pair sm2PubB, sm2PriB and the data certificate dataToken associated with the key.

[0056] Furthermore, the public key, private key and key certificate generated by the SM2 algorithm are stored in the pub_key, pri_key and token fields at the corresponding positions in the database key table respectively;

[0057] Among them, sm2PubA and sm2PubB are stored in pub_key, sm2PriA and sm2PriB are stored in pri_key, and the key certificate keyToken and the data certificate dataToken are stored in token; the key table structure is as follows:

[0058] Serial number Fields type Not empty describe 1 id String Y Primary key id 2 token String Y Credentials (key credentials and data credentials), stored after being encrypted with MD5 3 pub_key String Y Public Key 4 pri_key String Y Private Key

[0059] The token field data in the key table is not stored in plain text, but encrypted by the MD5 algorithm before being stored in the key table in the database. This method avoids storing plain text tokens in the key table and avoids joint table queries, further increasing the difficulty of cracking passwords. The key certificate A and data certificate B returned by the data safe to the business end are both in plain text. The key certificate keyToken and the data certificate dataToken are both in 36-bit uuid format;

[0060] Furthermore, the token in the key table is a key credential, which is used to associate the key data of the response, that is, each time a public-private key pair is generated, a unique token will be generated and associated with it. pub_key and pri_key store the generated public-private key pairs respectively.

[0061] Furthermore, if the encryption algorithm is a symmetric encryption algorithm, its key and the corresponding salt vector are stored. Salting means combining a randomly generated data (called salt, or Salt) with the original data (such as a password) before performing a hash operation to increase the complexity of the hash value. This can effectively prevent rainbow table attacks and other forms of hash collision attacks.

[0062] Furthermore, in step 10, using the data voucher B to retrieve the private key B associated therewith from the database also includes the following process:

[0063] The data safe uses the MD5 algorithm to calculate the data certificate B to obtain the certificate string, and uses the certificate string to find the private key B associated with it from the database.

[0064] The business end information includes the tenant id, tenant password and business identification code. It corresponds to the app_Key_Id, app_Key_Secret and biz_code fields stored in the tenant information table in the database; in addition, the algorithm_code in the table refers to the encryption and decryption algorithm for encrypting and decrypting data, which refers to the AES algorithm for encrypting and decrypting business data in the present invention, and the key_algorithm_code refers to the SM2 algorithm for the encryption key. The tenant information table structure is as follows:

[0065]

[0066] Furthermore, there is no strict control over the granularity of tenants here. A system can be a tenant, a business module can be a tenant, or even a piece of business data can be a tenant. The granularity is agreed upon by the business data party.

[0067] Furthermore, the stored data is saved in a data table in the database, biz_content is used to store encrypted business data, storage_time stores the data storage expiration time of the business data (this field is in some business scenarios, when the time node reaches this time, there is no need to verify the legitimacy, but directly decrypt the data), user_id is the list of related users, org_id is the unit information, biz_detail is the unique data value generated according to certain rules (here it refers to the encrypted string md5Key obtained by splicing the two key credentials keyToken and dataToken through the MD5 algorithm).

[0068] Furthermore, the role of the data storage expiration time is as follows: when requesting to obtain data from the data safe in the subsequent process, the request parameters will carry relevant information of the requesting user, such as the user ID, the user's unit, etc. (this part of data is generated after the user logs into the system). When the data safe receives the retrieval request, it will first verify whether the data storage expiration time is later than the current request time. If so, the data is considered expired, and its user information will not be verified when retrieving the data. Otherwise, the user information will be taken from the request parameters and compared with the user information stored in the safe for verification. Only when the comparison is consistent can the data be retrieved;

[0069] The table structure of the data table is as follows:

[0070]

[0071] Furthermore, in step 6, combined with the SM2 algorithm, the biz_detail column of the data table is filled after the data is stored in the database. The filling rule is: use the MD5 algorithm to perform salt operations on the key certificate keyToken and the data certificate dataToken, obtain the string md5dataKey, and fill the md5dataKey into the biz_detail column. In this way, there is no explicit association between the key table and the data table, and relevant personnel with database operation permissions such as implementation and maintenance cannot use the joint table method to perform data association queries. In addition, due to the irreversible nature of the MD5 algorithm, it is impossible to obtain the corresponding key certificate keyToken and data certificate dataToken through reverse, and finally the data certificate dataToken can be returned to the business end.

[0072] Furthermore, the operation of configuring the AES key value in step 5 is to set a fixed string as the AES key value or to establish a new table to dynamically configure the AES key value.

[0073] It should be noted that in the present invention, based on the requirements of basic information configuration and encrypted data storage, the table structures that need to be maintained in the database are the key table, tenant information table and data table mentioned above. The database also has table structures such as business identification table and encryption algorithm table.

[0074] Business identification table: Different businesses will have different identifications. For example, online bidding business can be further divided into non-fixed-point online bidding projects (such as laptop computers, copy paper and other commodities) and fixed-point bidding projects (such as property management services, vehicle refueling, decoration projects and other non-commodity projects). For unified planning and management, it is required to configure the corresponding identification in this table and carry the identification when the business end requests. The data safe will verify whether the identification is in this table. Only in this table will the request be allowed. The table structure is as follows:

[0075]

[0076] Encryption algorithm table: used to configure the data safe's encryption algorithm, such as SM2 algorithm, RSA algorithm, AES algorithm, etc. The table structure is as follows:

[0077]

[0078] like Figure 2 As shown, a data security access system based on encryption algorithm, the main body is a data safe, which includes:

[0079] Verification module, which verifies the legitimacy of business-side information when the business-side accesses the data safe;

[0080] A data access module, used to store the received data into a database or extract corresponding data from the database;

[0081] A key module, used to distribute keys to the business end, and save the keys of the business end to the corresponding location in the database through the data access module; and

[0082] The encryption and decryption module is used to encrypt key credentials and business data, and save the encrypted data to the corresponding location in the database through the data access module.

[0083] Furthermore, a key application interface, a data storage interface and a data acquisition interface are provided between the business end, the data safe and the database. The present invention realizes encrypted access of data according to the key application interface, the data storage interface and the data acquisition interface and the internal table structure of the database.

[0084] Among them, the key application interface is used by the business end to apply for encryption and decryption keys, the data storage interface is used by the business end to store data, and the data acquisition interface is used by the business end to obtain stored data.

[0085] It should be noted that the access order of the service end to access the system through the key application interface is service end, verification module, key module, data access module, database;

[0086] The order in which the business end accesses the system through the data storage interface is business end, verification module, encryption and decryption module, key module, encryption and decryption module, data access module, and database;

[0087] The access order of the business end to the system through the data acquisition interface is business end, verification module, database, data access module, encryption and decryption module, and business end.

[0088] In summary, the present invention can provide a business scenario case description:

[0089] When a designated service online bidding project is initiated, the purchaser fills in the procurement requirements and initiates the bidding project. After the project is successfully initiated, a procurement announcement will be released to the public. Each supplier (i.e., each tenant) will register for product matching for the project according to the time node specified in the procurement announcement and make multiple quotations during the bidding period.

[0090] After the quotation is completed, the last quotation of each supplier will be taken as the basis, the supplier with the lowest price will be the winning supplier, the procurement result announcement will be released, and the project will be completed.

[0091] The overall process of online bidding projects can be divided into three stages:

[0092] Phase 1: The purchaser initiates the project, such as Figure 3 shown.

[0093] The purchaser logs into the system, creates a new online bidding project, enters the brand, specification and model of the goods or services to be purchased, and the corresponding purchase budget (the highest expected transaction price) and other information. After completing the entry, the purchase notice is issued and the supplier is awaiting matching quotations.

[0094] In this stage, the supplier logs in to the system as a tenant and applies for a key from the data safe. The data safe verifies its tenant ID, tenant password, and the business identification code of the participating project, and generates a key and key certificate (keyToken) after confirmation. The data safe issues the keyToken to this bidding project as the only certificate for the entire bidding project process. At the same time, the bidding project business end associates the keyToken and saves it in the corresponding table structure in the database.

[0095] Phase 2: Supplier registration and quotation phase, such as Figure 4 shown.

[0096] (This stage corresponds to the storage process of the business data of the present invention).

[0097] As tenants, multiple suppliers participate in the registration and make quotations in the quotation stage according to the requirements of the bidding project procurement announcement. When suppliers make quotations, they log in to the system and fill in the price under the project. The system carries the supplier user information, quotation information, data storage expiration time (the time here is the end time of the bidding project quotation) and the project's unique key certificate (keyToken) and other information to initiate a data storage application to the data safe. The data safe generates a key and data certificate (dataToken) based on the supplier's quotation information.

[0098] At the same time, the data safe encrypts the bidding data of each supplier according to the generated key, keyToken and dataToken and the methods described in steps 5 and 6 of the present invention, and stores each information in the corresponding table structure in the database. Also stored together are the supplier user information and the data storage expiration time. Then, the data safe issues the data certificate (dataToken) to the bidding project business end. The bidding project business end associates the dataToken with the supplier information, project information, and quotation information (at this time, the quotation information fill value of the project details table is 0, and the real data is encrypted and stored in the data safe) and stores them in the corresponding table structure in the database. Moreover, each supplier corresponds to a quotation detail information and holds its own data certificate dataToken separately.

[0099] During the project quotation period, each supplier can view their own quoted bidding information and modify the quotation. Since the expiration time of the quotation information stored in the data safe during the quotation stage has not expired, when a supplier applies to the data safe to view their own quoted bidding information, it is necessary to verify whether the identity of the applicant supplier is consistent with the user information stored in the data table. Only when they are consistent can the bidding information be viewed.

[0100] Stage 3: Transaction stage, such as Figure 5 shown.

[0101] (This stage corresponds to the business data extraction process of the present invention).

[0102] During the project transaction phase (i.e. after the quotation is completed), the bidding project business end will uniformly carry the project's unique key certificate keyToken and the data certificate dataToken of all quotation suppliers to the data safe to apply for all quotation information of this project. Since this is a system operation, it is impossible to carry the user information of each supplier (the user information is generated after the user logs into the system). However, since the expiration time of the quotation data storage of this project is later than the current time at this time, the data safe will not verify its user information. The system then automatically carries the keyToken and dataToken to access the data safe, and combines the methods of steps 6 to 10 in the present invention to decrypt the bidding information and return it to the business end. After receiving the bidding information, the business end will put the data of the bidding information into the price field of the project quotation details table, replacing the 0 value filled in stage two.

[0103] Finally, the system takes out all the quotation information for summary calculation, confirms the winning supplier and publishes the project transaction result announcement.

[0104] Although the present invention is illustrated and described by specific embodiments and their alternatives, it should be understood that various changes and modifications within the spirit and scope of the present invention can be implemented. Therefore, it should be understood that the present invention is not limited in any sense except by the limitations of the attached claims and their equivalents.

Claims

1. A data security access method based on an encryption algorithm, characterized in that: The main body is the data safe, which is connected to the business end and the database respectively; The storage process of business data is: Step 1: The business end applies for a key from the data safe with the business end information; Step 2: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key A, private key A and key certificate A associated with the key. The key certificate A is encrypted using MD5 to obtain the encrypted key certificate A1. The encrypted key certificate A1, public key A and private key A are then stored in the database, and the key certificate A is returned to the business end. The business end obtains the key certificate A and stores it in association with the business data. Step 3: The business end sends the storage data to the data safe with the business end information and key certificate A. The storage data includes the data storage expiration time, the relevant user list, the unit information and the business data that needs to be encrypted; Step 4: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key B, private key B and key-associated data certificate B. The data certificate B is encrypted using MD5 to obtain the encrypted data certificate B1, and then the encrypted data certificate B1, public key B and private key B are stored in the database; Step 5: The data safe concatenates key certificate A and data certificate B to obtain a concatenated certificate, and then uses the MD5 algorithm to encrypt the concatenated certificate to obtain an encrypted string md5Key. Then, the business data is first encrypted using public key B to obtain encrypted data B, and then the encrypted data B is encrypted again using the AES symmetric encryption algorithm to obtain encrypted data C. At the same time, the AES key value is configured and the encrypted string md5Key is associated as the encryption vector value of the encrypted data C. Finally, the encrypted data C, data storage expiration time, relevant user list, and unit information are stored in the database. Step 6: Use the MD5 algorithm to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey and store it in the table of encrypted data C in the database, and then return the data certificate B to the business end, and the business end saves the data certificate B; The process of extracting business data is as follows: Step 7: The business end applies to the data safe for data acquisition by carrying the business end information, key certificate A and data certificate B saved during the storage process; Step 8: The data safe verifies the legitimacy of the business end information. After the verification is passed, the MD5 algorithm is used to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey. The string md5DataKey is used to locate the table storing the encrypted data C in the database and retrieve the encrypted data C. Step 9: The data safe concatenates the key certificate A and the data certificate B, and calculates the encrypted string md5Key using the MD5 algorithm. The encrypted data C is decrypted into the encrypted data B using md5Key as the encryption vector value of the AES symmetric encryption algorithm. Step 10, the data safe uses data certificate B to obtain encrypted data certificate B1 through MD5 encryption, retrieves the private key B associated with encrypted data certificate B1 from the database, uses private key B to decrypt encrypted data B to obtain business data, and finally sends the business data to the business end, the business data is bidding data.

2. The data security access method based on encryption algorithm according to claim 1 is characterized in that: The encryption algorithm is the SM2 algorithm.

3. The data security access method based on encryption algorithm according to claim 1 is characterized in that: The service end information includes the tenant ID, tenant password and service identification code.

4. The data security access method based on encryption algorithm according to claim 1 is characterized in that: The operation of configuring the AES key value in step 5 is to set a fixed string as the AES key value or to create a new table to dynamically configure the AES key value.

5. A data security access system based on an encryption algorithm for executing the method according to any one of claims 1 to 4, characterized in that: The main body is the data safe, which includes: Verification module, which verifies the legitimacy of business-side information when the business-side accesses the data safe; A data access module, used to store the received data into a database or extract corresponding data from the database; A key module, used to distribute keys to the business end, and save the keys of the business end to the corresponding location in the database through the data access module; and The encryption and decryption module is used to encrypt key credentials and business data, and save the encrypted data to the corresponding location in the database through the data access module.

6. A data security access system based on encryption algorithm according to claim 5, characterized in that: A key application interface, a data storage interface and a data acquisition interface are provided between the business end, the data safe and the database.

Images