Digital digest generation method and related device

Abstract

The invention relates to the technical field of computer information security, and provides a digital digest generation method and a related device, and the method comprises the steps: obtaining a to-be-processed character string; dividing the character string to be processed into a plurality of groups; the multiple groups are used for updating the preset parameters multiple times, the preset parameters updated last time serve as final parameters, when the groups are the first groups, the preset parameters are original parameters, and when the groups are not the first groups, the preset parameters are the preset parameters updated last time; and generating a digital digest of the to-be-processed character string according to the final parameters. According to the invention, safe and reliable digital digests can be generated.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security, and in particular to a digital summary generation method and related devices. Background Art

[0002] With the rapid development of information technology, computer and Internet technologies have been applied to all walks of life and all aspects of life, bringing great convenience to people's work and life, but at the same time there are certain security risks. Some application systems usually need to transmit and store a large amount of sensitive data during operation, such as personal identity information, user names, financial data, medical records, website login passwords, credit cards, etc. Sensitive data damage or tampering may lead to serious consequences, including personal privacy leakage, financial fraud, identity theft, etc.

[0003] Digital summary technology is a commonly used data integrity verification method. It is used to generate a digital summary of sensitive data. By comparing the digital summaries of two sensitive data, it is possible to promptly detect whether the sensitive data has been damaged or tampered with, so as to prevent problems before they occur.

[0004] How to generate a safe and reliable digital summary is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] The purpose of the present invention is to provide a digital summary generation method and related devices, which can increase the difficulty of cracking the digital summary by improving the complexity of digital summary generation, thereby effectively ensuring the security and reliability of the digital summary.

[0006] The embodiments of the present invention can be implemented as follows:

[0007] In a first aspect, the present invention provides a method for generating a digital summary, the method comprising:

[0008] Get the string to be processed;

[0009] Dividing the character string to be processed into multiple groups;

[0010] The preset parameters are updated multiple times using the multiple groups, and the preset parameters after the last update are used as final parameters, when the group is the first group, the preset parameters are original parameters, and when the group is not the first group, the preset parameters are the preset parameters after the last update;

[0011] A digital summary of the character string to be processed is generated according to the final parameter.

[0012] In an optional implementation, the step of obtaining the character string to be processed includes:

[0013] Get the original string;

[0014] Adding a randomly generated string salt to the original string to obtain a salted string;

[0015] If the length of the salt string is less than the preset length, fill the salt string with bits to obtain a fill string with the preset length; otherwise, use the salt string as the fill string;

[0016] Continue to fill the padding string with bits to obtain a string to be processed whose length meets the set requirements.

[0017] In an optional implementation manner, the step of using the multiple groups to update the preset parameters multiple times and using the preset parameters after the last update as the final parameters includes:

[0018] Taking the first group as the current group and taking the original parameter as the current parameter;

[0019] Dividing the current group into a plurality of data blocks;

[0020] Using the multiple data blocks of the current group, the current parameter is updated multiple times to obtain the current parameter after the last data block of the current group is updated, when the current group is the first group and the data block is the first data block, the current parameter is the original parameter, otherwise, the current parameter is the current parameter after the most recent update;

[0021] The current parameter updated by the last data block of the current group is used as the new current parameter, and the next group of the current group is used as the new current group, and the step of using the multiple data blocks of the current group to update the current parameter multiple times to obtain the current parameter updated by the last data block of the current group is repeated, and the current parameter updated by the last data block of the last group is used as the final parameter.

[0022] In an optional implementation manner, the step of using the multiple data blocks of the current group to update the current parameter multiple times to obtain the current parameter after the last data block of the current group is updated includes:

[0023] Taking the first data block of the current group as the current data block;

[0024] Updating the current parameters according to the current data blocks to obtain updated current parameters;

[0025] The next data block of the current data block is used as a new current data block, and the updated current parameters are used as new current parameters. The step of updating the current parameters according to the current data block to obtain updated current parameters is repeated until the updated current parameters of the last data block of the current group are obtained.

[0026] In an optional implementation manner, there are multiple current parameters, each of which corresponds to a preset indefinite number, and the step of updating the current parameters according to the current data blocks to obtain updated current parameters includes:

[0027] Adjusting the arrangement order of the plurality of current parameters, taking the first parameter of the sorted plurality of current parameters as the first parameter, and taking the remaining parameters except the first parameter as the second parameter;

[0028] Performing nonlinear operation on all the second parameters to obtain operation results;

[0029] Obtaining the number of times the current group has completed nonlinear operations;

[0030] Calculating an updated first parameter according to the operation result, the current data block, a preset indefinite number corresponding to the first parameter, and the number of operations;

[0031] The updated current parameter includes the updated first parameter and each of the second parameters.

[0032] In an optional implementation, the step of calculating the updated first parameter according to the operation result, the current data block, a preset indefinite number corresponding to the first parameter, and the number of operations of the nonlinear operation performed on the current group includes:

[0033] Determining a constant according to the number of operations;

[0034] Summing the first parameter, the operation result and the constant to obtain a first intermediate result;

[0035] Performing the preset indefinite number of cyclic shift operations on the first intermediate result to obtain a second intermediate result;

[0036] The sum of the second intermediate result and a second parameter adjacent to the first parameter is used as the updated first parameter.

[0037] In an optional implementation, there are multiple preset parameters, and each of the preset parameters is updated multiple times to obtain a final parameter. The step of generating a digital summary of the character string to be processed according to the final parameter includes:

[0038] Concatenate all the final parameters to obtain an initial summary;

[0039] Generate a random hash string;

[0040] Replacing a character string starting from a preset position in the initial digest and having a length equal to the length of the hash character string with the hash character string to obtain a replacement character string;

[0041] Perform at least one hash calculation on the replacement character string to obtain the digital summary.

[0042] In a second aspect, the present invention provides a digital summary generating device, the device comprising:

[0043] The acquisition module is used to obtain the string to be processed;

[0044] A division module, used for dividing the character string to be processed into multiple groups;

[0045] An updating module, used to update the preset parameters multiple times using the multiple groups, and use the preset parameters after the last update as the final parameters, when the group is the first group, the preset parameters are the original parameters, when the group is not the first group, the preset parameters are the preset parameters after the last update;

[0046] A generating module is used to generate a digital summary of the character string to be processed according to the final parameter.

[0047] In a third aspect, the present invention provides a client, including a processor and a memory, wherein the memory is used to store a program, and the processor is used to implement the digital summary generation method as described in any one of the aforementioned implementations when executing the program.

[0048] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the digital abstract generation method as described in any one of the aforementioned embodiments.

[0049] Compared with the prior art, the present invention groups the character strings to be processed, uses multiple groups to update the preset parameters multiple times to obtain the final parameters, and then uses the final parameters to generate a digital summary of the character string to be processed. This can increase the complexity of digital summary generation and the difficulty of cracking the digital summary, thereby effectively ensuring the security and reliability of the digital summary. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 This is an example diagram of an application scenario provided by this embodiment.

[0052] Figure 2 This is a flowchart of an example of a method for generating a digital summary provided in this embodiment.

[0053] Figure 3 This is an example diagram of the process of generating a character string to be processed provided in this embodiment.

[0054] Figure 4 This is an example diagram of parameter update provided in this embodiment.

[0055] Figure 5 This is a block diagram of an example of a digital summary generating device provided in this embodiment.

[0056] Figure 6 This is a block diagram of an example of a client provided in this embodiment.

[0057] Icons: 10 - client; 11 - processor; 12 - memory; 13 - bus; 20 - server; 30 - storage system; 100 - digital summary generating device; 110 - acquisition module; 120 - division module; 130 - update module; 140 - generation module. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0059] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0061] In the description of the present invention, it should be noted that if the terms "upper", "lower", "inside", "outside", etc. appear to indicate an orientation or position relationship, they are based on the orientation or position relationship shown in the accompanying drawings, or are the orientation or position relationship in which the product of the invention is usually placed when used. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0062] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0063] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0064] Before introducing the digital summary generation method and related devices provided by this embodiment, for the sake of easy understanding, this embodiment first introduces the abbreviations and key terms involved in this embodiment.

[0065] Sensitive data: refers to data that may cause serious harm or heavy losses to society, organizations or individuals if leaked. Sensitive data includes personal privacy data, such as name, ID number, address, phone number, bank account, email, password, medical information, educational background, etc.; it also includes data that is not suitable for enterprises or social institutions to publish, such as the business situation of the enterprise, the network structure of the enterprise, IP address list, etc. There are many ways to ensure the security of sensitive data, such as data desensitization, data encryption, access control, etc.

[0066] Plain text: refers to unencrypted text (string), which can usually be understood by people.

[0067] Ciphertext: Encrypted text. If the plain text is the text before encryption, then the ciphertext is the text after encrypting the plain text.

[0068] Encryption: Encryption in English is the process of changing plain text information into cipher text that is difficult to read, making it unreadable. Only objects with decryption methods can restore cipher text to normal readable content through the decryption process. There are three main common encryption algorithms: symmetric encryption algorithm, asymmetric encryption algorithm and digital digest algorithm.

[0069] Symmetric encryption: Symmetric encryption has only one key, and all parties use the same key. Encryption and decryption use the same key, which is easy to be cracked; the speed is faster than asymmetric encryption algorithms; the data transmission process is not secure.

[0070] Asymmetric encryption: There are two keys, one for encryption and one for decryption. Although the encryption key is public, the decryption key is private. It has better confidentiality and eliminates the need for users to exchange keys; the algorithm is complex and has stronger security; it is slower than symmetric encryption algorithms.

[0071] Digital digest algorithm: converts messages of any length into short messages of fixed length. Use a one-way hash function to "summarize" the plaintext to be encrypted into a string of ciphertext of fixed length. The information is of any length, and the digest is of fixed length; the digest algorithm is collision-proof, that is, two messages with the same digest result cannot be found; the digest result is irreversible, that is, the corresponding original information content cannot be restored through the digest. Commonly used digest algorithms include MD5, SHA-1, SHA-2, etc. At present, MD5 and SHA-1 have been proven to be crackable. It is generally used for file integrity verification, interface interaction data integrity verification, login password verification, etc.

[0072] Hash function: converts data of any length into a unique hash value of fixed length. Hash functions are irreversible, that is, the original data cannot be restored from the hash value. Hash functions are often used to verify the integrity of data and prevent tampering. For example, hash functions are used to encrypt and authenticate users in password storage.

[0073] MD5: Message-Digest Algorithm 5, a hash algorithm that operates on messages of any length and obtains a message digest with a fixed length of 128 bits.

[0074] SHA2: Secure Hash Algorithm 2, the second generation secure hash algorithm, can be divided into: SHA-256, SHA-384 and SHA-512 according to the digest length (number of bits).

[0075] Please refer to Figure 1 , Figure 1 This is an example diagram of an application scenario provided in this embodiment. Figure 1 In the embodiment, the client 10 is connected to the server 20 for communication, and the server 20 is connected to the storage system 30 for communication.

[0076] The functions of the client 10 mainly include: receiving the user's login request and verifying the user's identity and authority information; temporarily storing encryption / decryption keys and algorithms; encrypting / decrypting sensitive data and generating digital summary hashes of user passwords; storing application information, including user passwords, digital summary hash generation related information, ciphertext meta-information, etc.

[0077] As a specific implementation method, the client 10 can split the functions it implements into multiple modules for execution, and the multiple modules include a login module, a cache management module, an encryption and decryption module, and a database.

[0078] Functions of the login module: Collect user-specific information for accessing the device or system; receive user login requests; user identity authentication, permission management, etc.

[0079] The functions of the cache management module include local temporary storage of encryption / decryption keys and algorithms, and management of cache expiration time.

[0080] The functions of the encryption and decryption module include encryption / decryption of sensitive data and generation of digital summary hash of user passwords.

[0081] The function of the database is to store client application information, including user passwords, digital summary hash generation related information, ciphertext meta-information, etc.

[0082] The functions of the server 20 mainly include: obtaining a key; sending a key to the client 10; and receiving a key application from the client 10. In order to ensure high availability of the system, 2-3 servers 20 can be set.

[0083] The server 20 can split the functions it implements into multiple modules for execution, and the multiple modules include a key service module and a key management module.

[0084] The key service module has the following functions: transmitting the key to the client 10 and receiving the key application from the client 10 .

[0085] The key management module is responsible for the generation and storage of keys and the selection of encryption and decryption algorithms. It uses multiple roles such as key applicants, key managers, and key accessors to apply for, update, review, and check keys to ensure the security of key management and transmission.

[0086] The functions of the storage system 30 mainly include: storing the sharded key data; storing the key meta information (shard information and storage location). As an implementation method, the storage system 30 can be built into the server 20, and the server 20 provides the functions of the storage system 30. As another implementation method, the storage system 30 can be independent of the server 20. In specific implementation, the storage system 30 may include at least one file server. To ensure high availability of the system, there are usually 2-3 file servers. The file server is used to store the sharded key data; the storage system 30 also includes at least one database server. To ensure high availability of the system, there are usually 2-3 database servers. The database server stores the key meta information (shard information and storage location).

[0087] based on Figure 1 In order to ensure the secure transmission and storage of sensitive data in the application scenario, the processing process is as follows:

[0088] 1) User login. After the visitor opens the client application, he / she enters the assigned or created user name and login password to access sensitive data through the client 10 after successfully logging into the client.

[0089] 2) User judgment. The client 10 queries the local database based on the user name of the visitor to determine whether the user is logging in for the first time. If it is the first login, the digital digest algorithm is used to calculate the digest hash value of the user password, and the relevant information required to calculate the digest hash value and the calculated digest hash value are stored in the database. If it is a second login, the database is searched according to the user name of the logged-in user to obtain the relevant information for generating the digest hash, and the digital digest hash calculation process is executed again, and the obtained digital digest hash is compared with the digital digest hash recorded in the database. If the two are equal, the login is successful, otherwise the login fails.

[0090] 3) User identity authentication. After the user successfully logs in, the client 10 begins to analyze and authenticate the user's permissions. This embodiment sets different user roles and user level rules. A strict access control mechanism is established to restrict only authorized users to access sensitive data of their corresponding levels, ensure that the access rights of the accessing users are consistent with their responsibilities, prevent unauthorized access and abuse, and protect sensitive data.

[0091] 4) Mode judgment. After the user authority is determined, the user authority, that is, the sensitive data storage and sensitive data viewing mode, is determined. Users with different permissions have different access modes, that is, users with query permissions do not have sensitive data storage permissions and can only view sensitive level data within the scope allowed by the corresponding permission level; users with storage permissions can set sensitive data within their scope.

[0092] 5) Sensitive data level determination. According to the preset sensitive data level rules, the sensitive data is classified into extremely sensitive level, sensitive level, relatively sensitive level and low sensitivity level, so as to better manage user data and protect user privacy. A sensitivity level label is set for the data. The encryption and decryption module of the client 10 selects the corresponding encryption algorithm according to the sensitivity level of the data.

[0093] 6) Obtain the encryption key. The client 10 first checks whether there is an encryption key and encryption algorithm in the local cache. If there is a cache, the algorithm and key are directly used for encryption; if there is no encryption key and algorithm cached locally, the encryption key and decryption algorithm are requested from the server 20; after receiving the request, the key management module on the server 20 accesses the database server to check the metadata of the user's encryption key and algorithm; the metadata returned by the database server includes the key sharding information and storage location; the key management module of the server 20 accesses the file server and the database server, obtains the key shards and merges them into a complete key through the key service module, returns them to the encryption and decryption module of the client 10, and saves them in the local process memory.

[0094] The key sharding is the responsibility of the key management module of the server 20. After the key management module obtains the user's key application, if it is the first time for the user to log in, a new key (encryption and decryption key) is generated, and then the key sharding mechanism is followed, that is, the key sharding is performed according to the number of key managers, and the sharding is stored on the same or multiple file servers to achieve physical isolation of the sharding. Specifically, the original key is first divided into n segments (n administrators), and then each segment is sent to the file server (one or more), and the starting interception position of each segment of the original key, the segment length, and the storage location information (file server directory address, file database query id) are stored in the database server again, and finally the user identification, encryption and decryption algorithm information, and key meta information are bound again and written to the database server. When the user needs to decrypt data and needs to apply for a decryption key, he applies to the key management module, obtains the key meta information, and initiates an application to the key management personnel of each segment. After passing, the key management module receives each segment and completes the merger to achieve key exchange management.

[0095] 7) Data encryption. After obtaining the encryption key, the client 10 uses the encryption and decryption module to encrypt the sensitive data to obtain ciphertext. The ciphertext can be stored locally or transmitted to other devices or systems.

[0096] 8) Ciphertext storage: The ciphertext is sliced ​​and segmented for storage, and the database of the client 10 stores the ciphertext meta-information (user name, key cache information, encryption / decryption algorithm, ciphertext segmentation information, etc.).

[0097] 9) Search database. In the data query mode of sensitive data, after the user logs in to the client 10 and selects the sensitive data to be viewed, the local database ciphertext meta-information will be queried based on the user name and the sensitive data alias to obtain the ciphertext meta-information of the sensitive data, that is, the ciphertext segment storage location, key cache information, encryption / decryption algorithm, etc.

[0098] 10) Obtain the decryption key. If it is a sensitive data query mode, first check whether the key cache in the local ciphertext meta-information of the client 10 has the decryption key and decryption algorithm. If there is a cache, use the algorithm and key directly for decryption; if the decryption key and algorithm are not cached locally, request the decryption key and decryption algorithm from the server 20; after receiving the request, the key management module on the server 20 accesses the database server to check the meta-information of the user's decryption key and algorithm; the meta-information returned by the database server includes the key sharding information and storage location; the key management module accesses the file server and the database server, obtains the key shards and merges them into a complete key through the key service module, returns it to the encryption and decryption module of the client 10, and stores it in the local process memory.

[0099] 11) Data decryption. According to the user's sensitive data query requirements, the ciphertext segmentation information and storage location, decryption key, algorithm, etc. in the ciphertext meta-information are used to complete the decryption of the data using the encryption and decryption module of the client 10, so that the user can view the sensitive data within his or her authority.

[0100] 12) Plain text display: The user displays the queried sensitive data in plain text on the client 10.

[0101] In order to further improve the security and reliability of the user's information validity verification in the above process, this embodiment provides a digital summary generation method, so that in the above user judgment, the generated digital summary of the user is more secure and reliable. Of course, if it is necessary to generate a digital summary in other steps, the method provided by this embodiment can also be used to generate the digital summary, which will be described in detail below.

[0102] Please refer to Figure 2 , Figure 2 This is a flowchart of a method for generating a digital summary provided in this embodiment. The method includes the following steps:

[0103] Step S101, obtaining a character string to be processed.

[0104] In this embodiment, the string to be processed can be generated based on the user's username and / or login password. The generation method can be to directly use the username or login password string, or to directly concatenate the two, or to concatenate first and then fill in additional information into the concatenated string to increase the complexity of the string to be processed.

[0105] Step S102, dividing the character string to be processed into multiple groups.

[0106] In this embodiment, the character string to be processed may be divided into groups according to bits of a fixed length. For example, the character string to be processed may be divided into a group every 512 bits.

[0107] Step S103, using multiple groups to update the preset parameters multiple times, and taking the preset parameters after the last update as the final parameters, when the group is the first group, the preset parameters are the original parameters, when the group is not the first group, the preset parameters are the preset parameters after the most recent update.

[0108] In this embodiment, the original parameter may be one or more, and correspondingly, the preset parameter may also be one or more. When there are multiple preset parameters, each group will update multiple preset parameters to obtain multiple updated preset parameters. The updated preset parameters of this group will be used as the preset parameters that need to be updated for the next group. For example, the initial parameters are A0, B0, C0, and D0, and there are three groups in total. After the first group updates A0, B0, C0, and D0, the preset parameters obtained are A1, B1, C1, and D1. After the second group updates A1, B1, C1, and D1, the preset parameters obtained are A2, B2, C2, and D2. After the third group updates A2, B2, C2, and D2, the preset parameters obtained are A3, B3, C3, and D3. Then A3, B3, C3, and D3 are the final parameters.

[0109] Step S104: Generate a digital summary of the character string to be processed according to the final parameters.

[0110] In this embodiment, the final parameter can be one or more. When the final parameter is one, the final parameter can be hashed multiple times to obtain a digital summary of the string to be processed. When the final parameter is multiple, the multiple final parameters can be concatenated first, and then the concatenated result can be hashed multiple times to obtain a digital summary of the string to be processed. Alternatively, in order to further improve security, a substring at a preset position and a preset length in the concatenated result can be replaced first, and then the replaced string can be hashed multiple times to obtain a digital summary of the string to be processed.

[0111] The above method provided in this embodiment groups the character strings to be processed, uses multiple groups to update the preset parameters multiple times to obtain final parameters, and then uses the final parameters to generate a digital summary of the character string to be processed, thereby improving the complexity of digital summary generation, increasing the difficulty of cracking the digital summary, and effectively ensuring the security and reliability of the digital summary.

[0112] In an optional implementation, in order to increase the complexity of the string to be processed and to simplify the implementation of subsequent grouping, this embodiment provides a method for obtaining the string to be processed:

[0113] First, get the original string;

[0114] The original character string may be at least one of a user name and a password, or may be determined according to the needs of an actual scenario, such as an IP address, a device identifier, etc.

[0115] Secondly, add a randomly generated string salt to the original string to get the salted string;

[0116] The string salt can be one or more, and the length of the string salt is a preset fixed length. For example, if there are two string salts, the original string is str_ori, and the two string salts are salt1 and salt2. The three are concatenated into salt1+str_ori+salt2 to obtain the salted string.

[0117] It should be noted that in addition to salt1+str_ori+salt2, the splicing method can also be salt1+salt2+str_ori, or str_ori+salt1+salt2.

[0118] Third, if the length of the salt string is less than the preset length, the salt string is padded with bits to obtain a padded string with the preset length, otherwise the salt string is used as the padded string;

[0119] The preset length is a preset length for facilitating subsequent grouping. For example, when grouping with 512 bits, the preset length L (in bits) satisfies the following condition: Lmod512=448, where mod is a modulus operation.

[0120] Fourth, continue to fill bits into the padding string to obtain a string to be processed whose length meets the set requirements.

[0121] The length that meets the set requirements can be determined according to the needs of the actual grouping. For example, taking a 512-bit grouping as an example, the length that meets the set requirements means that the length of the string to be processed is an integer multiple of 512 bits. Continue to fill the padding string with bits, and you can fill the bits of the length of the original string. For example, if the padding string is 448 bits and the length of the original string is expressed in 64 bits, then the string to be processed is 448 bits + 64 bits = 512 bits. Please refer to Figure 3 , Figure 3 This is an example diagram of the process of generating a character string to be processed provided in this embodiment.

[0122] In an optional implementation manner, when multiple groups are used to update the preset parameters multiple times, in order to further increase the complexity of updating the preset parameters by one group, this embodiment provides an implementation manner:

[0123] First, take the first group as the current group and the original parameter as the current parameter;

[0124] Secondly, the current group is divided into multiple data blocks;

[0125] The length of the data block is a preset fixed length, for example, the length of the data block is 32 bits, that is, 4 bytes.

[0126] Third, the current parameters are updated multiple times using multiple data blocks of the current group to obtain the current parameters updated by the last data block of the current group. When the current group is the first group and the data block is the first data block, the current parameters are the original parameters, otherwise, the current parameters are the current parameters after the most recent update.

[0127] In this embodiment, each data block of the current group will update the current parameters. If the data block is the first data block of the first group, the original parameters are updated. If the current data block is the first data block of a non-first group, the current parameters updated are the last data block of the previous group. If the current data block is a non-first data block of a non-first group, the current parameters updated are the previous data block of the current group.

[0128] Fourth, the current parameter after the last data block of the current group is updated is used as the new current parameter, and the next group of the current group is used as the new current group, and the multiple data blocks of the current group are repeatedly used to update the current parameter multiple times to obtain the current parameter after the last data block of the current group is updated, and the current parameter after the last data block of the last group is updated is used as the final parameter.

[0129] In an optional implementation manner, the method of using multiple data blocks of the current group to update the current parameters multiple times is:

[0130] The first data block of the current group is used as the current data block;

[0131] Update the current parameters according to the current data blocks to obtain the updated current parameters;

[0132] The next data block of the current data block is used as the new current data block, and the updated current parameters are used as the new current parameters. The steps of updating the current parameters according to the current data block to obtain the updated current parameters are repeated until the updated current parameters of the last data block of the current group are obtained.

[0133] For a clearer explanation of the groups and the process of updating parameters for each group, please refer to Figure 4 , Figure 4 This is an example diagram of parameter updating provided in this embodiment. Figure 4 In the example, the string to be processed is divided into two groups: group 1 and group 2. Each group is divided into 4 data blocks. Group 1 is divided into block11, block12, block13, and block14. Group 2 is divided into block21, block22, block23, and block24. Block11 updates the original parameters, block12 updates the current parameters after block11 updates, block13 and block14 are similar to block12, block21 updates the current parameters after block14 updates, and block22, block23, and block24 are similar to block12.

[0134] In an optional implementation manner, when there are multiple current parameters, a method for updating the current parameters for the current data block is:

[0135] First, the arrangement order of the multiple current parameters is adjusted, and the first parameter of the sorted multiple current parameters is used as the first parameter, and the remaining parameters except the first parameter are used as the second parameters;

[0136] In this embodiment, in order to fully update each current parameter by using data blocks, this embodiment arranges multiple current parameters in order, and updates different current parameters each time according to the arrangement order. For example, if the current parameters are A, B, C, and D, they can be adjusted cyclically in the order: (A, B, C, D), (D, A, B, C), (C, D, A, B), (B, C, D, A), and then cycle from (A, B, C, D). For example, if the arrangement order of the current parameters is (A, B, C, D), then A is the first parameter, and B, C, and D are the second parameters.

[0137] Secondly, nonlinear operations are performed on all second parameters to obtain operation results;

[0138] In this embodiment, the nonlinear operation can be implemented by using a nonlinear function. When the second parameter is three, the nonlinear function that can be used is at least one of the following functions:

[0139]

[0140] H(X,Y,Z)=X⊕Y⊕Z;

[0141]

[0142] Among them, & is the logical AND operation, | is the logical OR operation, is the logical NOT operation, and ⊕ is the XOR operation.

[0143] Third, obtain the number of nonlinear operations completed by the current group;

[0144] Fourth, according to the operation result, the current data block, the preset indefinite number corresponding to the first parameter and the number of operations, the updated first parameter is calculated; wherein the updated current parameter includes the updated first parameter and each second parameter.

[0145] In this embodiment, the preset indefinite number corresponding to the first parameter can be predetermined. For example, the current parameters are A, B, C, and D. When A is the first parameter, the preset indefinite number is 7. When B is the first parameter, the preset indefinite number is 12. When C is the first parameter, the preset indefinite number is 17. When D is the first parameter, the preset indefinite number is 22.

[0146] In this embodiment, a method of calculating the updated first parameter is:

[0147] First, determine the constant according to the number of operations;

[0148] Among them, the constant can be calculated using the following formula: the integer part of the constant ti = 4294967296 × abs(sin(i)), where i is the number of operations + 1, in radians, 4294967296 is 2 to the power of 32, sin() is the sine function, and abs() is the absolute value function.

[0149] Secondly, the first parameter, the operation result and the constant are summed to obtain a first intermediate result;

[0150] Third, performing a preset indefinite number of circular shift operations on the first intermediate result to obtain a second intermediate result;

[0151] Fourth, the sum of the second intermediate result and the second parameter adjacent to the first parameter is used as the updated first parameter.

[0152] In this embodiment, the nonlinear functions are different, and the formulas for updating the first parameters are also different. Taking the current parameter order as (A, B, C, D) as an example, A is the first parameter, B, C, D are the second parameters, and the formulas for updating the first parameters corresponding to each nonlinear function are:

[0153] FF(A,B,C,D,M,s,ti) means A'=B+((A+F(B,C,D)+M+ti)< <s)

[0154] GG(A,B,C,D,M,s,ti) means A'=B+((A+G(B,C,D)+M+ti)< <s)

[0155] HH(A,B,C,D,M,s,ti) means A'=B+((A+H(B,C,D)+M+ti)< <s)

[0156] II(A,B,C,D,M,s,ti) means A'=B+((A+I(B,C,D)+M+ti)< <s)

[0157] Among them, A' is the updated first parameter, A is the first parameter, B, C, D are the second parameters, M is the current data block, ti ​​is a constant, and s is a preset indefinite number.

[0158] It should be noted that, for all data blocks, the formula corresponding to any nonlinear function can be used to update the first parameter in turn according to each data block, which is called one round of update. Multiple rounds of updates can also be performed. For all data blocks, each round uses the formula corresponding to a different nonlinear function to update, and the preset indefinite number corresponding to the first parameter in each round may be different.

[0159] For example, for any group, if the group is divided into 16 data blocks: M0-M15, the four variables A, B, C, and D are copied to variables a, b, c, and d respectively. In the first nonlinear operation of the first round, the value of i used to calculate ti is 0+1=1. In the last nonlinear operation of the first round, the value of i used to calculate ti is 16. In the first nonlinear operation of the second round, the value of i used to calculate ti is 17. In the last nonlinear operation of the fourth round, the value of i used to calculate ti is 64. The four rounds of updates are:

[0160] First round

[0161] FF(a,b,c,d,M0,7,0xd76aa478)

[0162] FF(d,a,b,c,M1,12,0xe8c7b756)

[0163] FF(c,d,a,b,M2,17,0x242070db)

[0164] FF(b,c,d,a,M3,22,0xc1bdceee)

[0165] FF(a, b, c, d, M4, 7, 0xf57c0faf)

[0166] FF(d, a, b, c, M5, 12, 0x4787c62a)

[0167] FF(c, d, a, b, M6, 17, 0xa8304613)

[0168] FF(b, c, d, a, M7, 22, 0xfd469501)

[0169] FF(a, b, c, d, M8, 7, 0x698098d8)

[0170] FF(d, a, b, c, M9, 12, 0x8b44f7af)

[0171] FF(c, d, a, b, M10, 17, 0xffff5bb1)

[0172] FF(b, c, d, a, M11, 22, 0x895cd7be)

[0173] FF(a, b, c, d, M12, 7, 0x6b901122)

[0174] FF(d, a, b, c, M13, 12, 0xfd987193) FF(c, d, a, b, M14, 17, 0xa679438e) FF(b, c, d, a, M15, 22, 0x49b40821) Second Round

[0175] GG(a,b,c,d,M1,5,0xf61e2562)GG(d,a,b,c,M6,9,0xc040b340)GG(c,d,a,b,M11,14,0x265e5a51)GG(b,c,d,a,M0,20,0xe9b6c7aa)G G(a,b,c,d,M5,5,0xd62f105d)GG(d,a,b,c,M10,9,0x02441453)GG(c,d,a,b,M15,14,0xd8a1e681)GG(b,c,d,a,M4,20,0xe7d3fbc8)G G(a,b,c,d,M9,5,0x21e1cde6)GG(d,a,b,c,M14,9,0xc33707d6)GG(c,d,a,b,M3,14,0xf4d50d87)GG(b,c,d,a,M8,20,0x455a14ed)GG (a,b,c,d,M13,5,0xa9e3e905)GG(d,a,b,c,M2,9,0xfcefa3f8)GG( c,d,a,b,M7,14,0x676f02d9)GG(b,c,d,a,M12,20,0x8d2a4c8a)Specify

[0176] HH(a,b,c,d,M5,4,0xfffa3942)HH(d,a,b,c,M8,11,0x8771f681)HH(c,d,a,b,M11,16,0x6d9d6122)HH(b,c,d,a,M14,23,0xfde5380c) HH(a,b,c,d,M1,4,0xa4beea44)HH(d,a,b,c,M4,11,0x4bdecfa9)HH(c,d,a,b,M7,16,0xf6bb4b60)HH(b,c,d,a,M10,23,0xbebfbc70)H H(a,b,c,d,M13,4,0x289b7ec6)HH(d,a,b,c,M0,11,0xeaa127fa)HH(c,d,a,b,M3,16,0xd4ef3085)HH(b,c,d,a,M6,23,0x04881d05)HH (a,b,c,d,M9,4,0xd9d4d039)HH(d,a,b,c,M12,11,0xe6db99e5)HH( c,d,a,b,M15,16,0x1fa27cf8)HH(b,c,d,a,M2,23,0xc4ac5665)Specification

[0177] II(a,b,c,d,M0,6,0xf4292244)II(d,a,b,c,M7,10,0x432aff97)II(c,d,a,b,M14,15,0xab9423a7)II(b,c,d,a,M5, 21,0xfc93a039)II(a,b,c,d,M12,6,0x655b59c3)II(d,a,b,c,M3,10,0x8f0ccc92)II(c,d,a,b,M10,15,0xffeff47d)

[0178] II(b,c,d,a,M1,21,0x85845dd1)

[0179] II(a,b,c,d,M8,6,0x6fa87e4f)

[0180] II(d,a,b,c,M15,10,0xfe2ce6e0)

[0181] II(c,d,a,b,M6,15,0xa3014314)

[0182] II(b,c,d,a,M13,21,0x4e0811a1)

[0183] II(a,b,c,d,M4,6,0xf7537e82)

[0184] II(d,a,b,c,M11,10,0xbd3af235)

[0185] II(c,d,a,b,M2,15,0x2ad7d2bb)

[0186] II(b,c,d,a,M9,21,0xeb86d391)

[0187] When there are multiple groups, each group performs the above four rounds of updates in sequence, and the last parameter update of the last group obtains the final parameters corresponding to each parameter. This embodiment also provides an implementation method for generating a digital summary when there are multiple final parameters:

[0188] First, all final parameters are concatenated to obtain the initial summary;

[0189] Among them, taking the final parameters A, B, C, and D as an example, the splicing method can be to use A as the low bit and D as the high bit, for example, A=0Xbfcbfgce, B=0Xc4105a80, C=0X02599277, D=0X5c099ee2, and the initial summary hash_md5 obtained by splicing is: hash_md5=cefgcbbf805a10c477925202e29e095c.

[0190] Secondly, randomly generate a hash string;

[0191] Third, replace the string starting from the preset position in the initial summary and having a length equal to the length of the hash string with the hash string to obtain a replacement string;

[0192] Among them, a random function is used to generate a hash string str_replace with a length of len, and the interception function is used to intercept and replace the value with the starting index start_index in hash_md5 as the beginning and the length of len to obtain the replaced replacement string hash_modified.

[0193] Fourth, perform at least one hash calculation on the replacement string to obtain a digital summary.

[0194] Among them, the algorithms used for hash calculation include but are not limited to SHA-256, SHA-384 and SHA-512.

[0195] It should be noted that the string salt (such as salt1, salt2), hash string str_replace, and starting index start_index in the above digital summary generation method can all be used as Figure 1 The digital summary hash generates relevant information, and when a specified user logs in, the digital summary is generated and saved in the client's local database. When the user logs in again next time, the relevant information is used to generate a digital summary in the same way, and the digital summary generated this time is compared with the digital summary of the user stored in the local database to verify the validity of the user.

[0196] In order to execute the corresponding steps in the above embodiment and each possible implementation method, the following provides a method for implementing the digital summary generation device 100. Figure 5 , Figure 5 This is a block diagram of a digital digest generating device provided in this embodiment. It should be noted that the basic principle and technical effects of the digital digest generating device 100 provided by the present invention are the same as those of the corresponding above-mentioned embodiments, which are not mentioned in this embodiment for the sake of brief description.

[0197] The digital summary generating device 100 includes an acquiring module 110 , a dividing module 120 , an updating module 130 and a generating module 140 .

[0198] An acquisition module 110 is used to acquire a character string to be processed;

[0199] A division module 120, used for dividing the character string to be processed into a plurality of groups;

[0200] An updating module 130, configured to update the preset parameters multiple times using multiple groups, and use the preset parameters updated last time as final parameters. When the group is the first group, the preset parameters are original parameters, and when the group is not the first group, the preset parameters are the preset parameters updated last time.

[0201] The generating module 140 is used to generate a digital summary of the character string to be processed according to the final parameters.

[0202] In an optional implementation manner, the acquisition module 110 is specifically used to:

[0203] Get the original string;

[0204] Add a randomly generated string salt to the original string to get the salted string;

[0205] If the length of the salt string is less than the preset length, then fill the salt string with bits to obtain a fill string with the preset length; otherwise, the salt string is used as the fill string;

[0206] Continue to fill bits into the padding string to obtain a string to be processed whose length meets the set requirements.

[0207] In an optional implementation manner, the updating module 130 is specifically configured to:

[0208] Set the first group as the current group and the original parameter as the current parameter;

[0209] Split the current group into multiple data blocks;

[0210] The current parameters are updated multiple times using multiple data blocks of the current group to obtain the current parameters updated by the last data block of the current group. When the current group is the first group and the data block is the first data block, the current parameters are the original parameters, otherwise, the current parameters are the current parameters after the most recent update.

[0211] The current parameter after the last data block of the current group is updated is used as the new current parameter, and the next group of the current group is used as the new current group. The current parameter is repeatedly updated multiple times using multiple data blocks of the current group to obtain the current parameter after the last data block of the current group is updated, and the current parameter after the last data block of the last group is updated is used as the final parameter.

[0212] In an optional implementation manner, the updating module 130 is used to update the current parameter multiple times using multiple data blocks of the current group, and when obtaining the current parameter after the last data block of the current group is updated, it is specifically used to:

[0213] The first data block of the current group is used as the current data block;

[0214] Update the current parameters according to the current data blocks to obtain the updated current parameters;

[0215] The next data block of the current data block is used as the new current data block, and the updated current parameters are used as the new current parameters. The steps of updating the current parameters according to the current data block to obtain the updated current parameters are repeated until the updated current parameters of the last data block of the current group are obtained.

[0216] In an optional implementation, there are multiple current parameters, each of which corresponds to a preset indefinite number. The updating module 130 is used to update the current parameters according to the current data blocks, and when the updated current parameters are obtained, they are specifically used to:

[0217] Adjust the order of the multiple current parameters, and use the first parameter of the sorted multiple current parameters as the first parameter, and use the remaining parameters except the first parameter as the second parameter;

[0218] Perform nonlinear operations on all second parameters to obtain operation results;

[0219] Get the number of nonlinear operations completed by the current group;

[0220] Calculate the updated first parameter according to the operation result, the current data block, the preset indefinite number corresponding to the first parameter and the number of operations;

[0221] The updated current parameter includes the updated first parameter and each second parameter.

[0222] In an optional implementation, the updating module 130 is used to calculate the updated first parameter according to the operation result, the current data block, the preset indefinite number corresponding to the first parameter, and the number of operations of the current grouping for performing the nonlinear operation, and is specifically used to:

[0223] Determine the constant according to the number of operations;

[0224] Summing the first parameter, the operation result and the constant to obtain a first intermediate result;

[0225] Performing a preset indefinite number of cyclic shift operations on the first intermediate result to obtain a second intermediate result;

[0226] The sum of the second intermediate result and a second parameter adjacent to the first parameter is used as the updated first parameter.

[0227] In an optional implementation, there are multiple preset parameters, and each preset parameter is updated multiple times to obtain a final parameter. The generation module 140 is specifically used to:

[0228] All final parameters are concatenated to obtain the initial summary;

[0229] Generate a random hash string;

[0230] The hash string is used to replace a string starting from a preset position in the initial digest and having a length equal to the length of the hash string, to obtain a replacement string;

[0231] Hash the replacement string at least once to obtain a digital digest.

[0232] The embodiment of the present invention also provides a block diagram of a client 10, and the client 10 implements the digital summary generation method of the above embodiment, please refer to Figure 6 , Figure 6 This is a block diagram of a client 10 provided in this embodiment. The client 10 includes a processor 11 , a memory 12 and a bus 13 . The processor 11 and the memory 12 are connected via the bus 13 .

[0233] The processor 11 may be an integrated circuit chip having signal processing capability. In the implementation process, each step of the digital summary generation method of the above embodiment may be completed by an integrated logic circuit of hardware in the processor 11 or instructions in the form of software. The above processor 11 may be a general-purpose processor, including a CPU (Central Processing Unit), a NP (Network Processor), etc.; it may also be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Logic Gate Array) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0234] The memory 12 is used to store a program for implementing the digital summary generation method. The program may be a software function module stored in the memory 12 in the form of software or firmware or solidified in the OS (Operating System) of the client 10.

[0235] After receiving the execution instruction, the processor 11 executes the program to implement the digital digest generation method of the above embodiment.

[0236] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for generating a digital digest as described in any one of the aforementioned embodiments is implemented.

[0237] In summary, the embodiment of the present invention provides a digital summary generation method and related device, the method comprising: obtaining a character string to be processed; dividing the character string to be processed into multiple groups; using the multiple groups to update the preset parameters multiple times, and taking the preset parameters after the last update as the final parameters, when the group is the first group, the preset parameters are the original parameters, when the group is not the first group, the preset parameters are the preset parameters after the most recent update; generating a digital summary of the character string to be processed according to the final parameters. Compared with the prior art, this embodiment has at least the following advantages: (1) the character string to be processed is grouped, the preset parameters are updated multiple times using the multiple groups to obtain the final parameters, and the digital summary of the character string to be processed is generated using the final parameters, which can increase the complexity of digital summary generation and increase the difficulty of cracking the digital summary, thereby effectively ensuring the security and reliability of the digital summary; (2) by adding salt, replacing strings and multiple hashing operations, the difficulty of cracking MD5 is further increased, and the security and reliability of the algorithm are further improved; (3) centralized, sharded key storage and multi-role authority management are adopted to ensure the security and easy management of keys. The keys are sharded and stored in heterogeneous, physically isolated storage servers, and the key storage meta-information is stored in a database. Multiple roles such as key applicant, key manager, and key accessor are managed to ensure the security of key management and transmission. In scenarios where key exchange is required, each person managing the key can only see one fragment, and both parties need to hand over the key separately to complete a key exchange, which ensures the security of the key; (4) C / S (client / server) architecture is adopted to perform high-availability backup of servers, databases, and file servers, that is, deploy 2-3 servers to build a cluster server, and the client accesses the server machine through load balancing. If a server is found to be down, failover is performed, and the database and file server are also backed up by master and slave. This ensures the reliable and stable operation of encryption and decryption services.

[0238] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for generating a digital summary, characterized in that: The method comprises: Get the string to be processed; Dividing the character string to be processed into multiple groups; The preset parameters are updated multiple times using the multiple groups, and the preset parameters after the last update are used as final parameters, when the group is the first group, the preset parameters are original parameters, and when the group is not the first group, the preset parameters are the preset parameters after the last update; A digital summary of the character string to be processed is generated according to the final parameter.

2. The digital abstract generation method according to claim 1, characterized in that: The step of obtaining the character string to be processed comprises: Get the original string; Adding a randomly generated string salt to the original string to obtain a salted string; If the length of the salt string is less than the preset length, fill the salt string with bits to obtain a fill string with the preset length; otherwise, use the salt string as the fill string; Continue to fill the padding string with bits to obtain a string to be processed whose length meets the set requirements.

3. The digital abstract generation method according to claim 1, characterized in that: The step of using the multiple groups to update the preset parameters multiple times and taking the preset parameters updated last time as the final parameters comprises: Taking the first group as the current group and taking the original parameter as the current parameter; Dividing the current group into a plurality of data blocks; Using the multiple data blocks of the current group, the current parameter is updated multiple times to obtain the current parameter after the last data block of the current group is updated, when the current group is the first group and the data block is the first data block, the current parameter is the original parameter, otherwise, the current parameter is the current parameter after the most recent update; The current parameter updated by the last data block of the current group is used as the new current parameter, and the next group of the current group is used as the new current group, and the step of using the multiple data blocks of the current group to update the current parameter multiple times to obtain the current parameter updated by the last data block of the current group is repeated, and the current parameter updated by the last data block of the last group is used as the final parameter.

4. The digital abstract generation method according to claim 3, characterized in that: The step of using the multiple data blocks of the current group to update the current parameter multiple times to obtain the current parameter after the last data block of the current group is updated comprises: Taking the first data block of the current group as the current data block; Updating the current parameters according to the current data blocks to obtain updated current parameters; The next data block of the current data block is used as a new current data block, and the updated current parameters are used as new current parameters. The step of updating the current parameters according to the current data block to obtain updated current parameters is repeated until the updated current parameters of the last data block of the current group are obtained.

5. The digital abstract generation method according to claim 4, characterized in that: There are multiple current parameters, each of which corresponds to a preset indefinite number. The step of updating the current parameters according to the current data blocks to obtain the updated current parameters includes: Adjusting the arrangement order of the plurality of current parameters, taking the first parameter of the sorted plurality of current parameters as the first parameter, and taking the remaining parameters except the first parameter as the second parameter; Performing nonlinear operation on all the second parameters to obtain operation results; Obtaining the number of times the nonlinear operation has been completed by the current group; Calculating an updated first parameter according to the operation result, the current data block, a preset indefinite number corresponding to the first parameter, and the number of operations; The updated current parameter includes the updated first parameter and each of the second parameters.

6. The method for generating a digital abstract as claimed in claim 5, characterized in that: The step of calculating the updated first parameter according to the operation result, the current data block, the preset indefinite number corresponding to the first parameter and the number of operations of the nonlinear operation performed on the current group includes: Determining a constant according to the number of operations; Summing the first parameter, the operation result and the constant to obtain a first intermediate result; Performing the preset indefinite number of cyclic shift operations on the first intermediate result to obtain a second intermediate result; The sum of the second intermediate result and a second parameter adjacent to the first parameter is used as the updated first parameter.

7. The digital abstract generation method according to claim 1, characterized in that: There are multiple preset parameters, and each of the preset parameters is updated multiple times to obtain a final parameter. The step of generating a digital summary of the character string to be processed according to the final parameter includes: Concatenate all the final parameters to obtain an initial summary; Generate a random hash string; Replacing a character string starting from a preset position in the initial digest and having a length equal to the length of the hash character string with the hash character string to obtain a replacement character string; Perform at least one hash calculation on the replacement character string to obtain the digital summary.

8. A digital summary generating device, characterized in that: The device comprises: The acquisition module is used to obtain the string to be processed; A division module, used for dividing the character string to be processed into multiple groups; An updating module, used to update the preset parameters multiple times using the multiple groups, and use the preset parameters after the last update as the final parameters, when the group is the first group, the preset parameters are the original parameters, when the group is not the first group, the preset parameters are the preset parameters after the last update; A generating module is used to generate a digital summary of the character string to be processed according to the final parameter.

9. A client, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a program, and the processor is used to implement the digital abstract generation method according to any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the digital abstract generation method according to any one of claims 1 to 7 is implemented.

Images