Data encryption and decryption method and related device thereof

Abstract

The invention discloses a data encryption and decryption method and a related device thereof, according to the scheme, first key data is generated by using first information in a signature certificate of a target application, and then the generated first key data is used to perform encryption processing on to-be-protected data of the target application, so that the storage security of the to-be-protected data is ensured; and when the to-be-protected data needs to be used, obtaining the signature certificate of the target application again, generating second key data homologous with the signature certificate in the dynamic calculation process, and decrypting the to-be-protected data based on the second key data. In the scheme, the first key data is closely associated with the signature certificate of the target application, and the signature certificate supposed by the target is an important means for verifying the identity of a developer and ensuring the integrity of the target application; therefore, the generation mechanism of the first key data highly associated with the signature certificate effectively resists the risk that the to-be-protected data is illegally acquired while enhancing the uniqueness and security of the key.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and more specifically, to a data encryption and decryption method and related devices. Background Art

[0002] In the field of mobile application development, key security is an important factor in ensuring data integrity and protecting user privacy. However, traditional key storage and use methods often have the risk of being illegally obtained by malicious attackers, resulting in application data leakage and potential threats to users. Therefore, how to better ensure the security of keys and reduce the risk of key leakage is the focus of technical personnel in the field. Summary of the invention

[0003] In view of this, this application provides the following technical solutions:

[0004] The first aspect of the present application provides a data encryption and decryption method, comprising:

[0005] Create a signing certificate for the target application;

[0006] Based on the first information in the signature certificate, generate first key data in a first manner;

[0007] Encrypting the data to be protected based on the first key data to obtain and save the encrypted data, wherein the data to be protected is data related to the target application;

[0008] If the data to be protected needs to be called, the signature certificate is obtained;

[0009] Based on the first information in the signature certificate obtained from the application file, generate second key data in the first manner, where the second key data is the same as the first key data;

[0010] The encrypted data is decrypted based on the second key data to obtain the data to be protected.

[0011] In a possible implementation, obtaining the signature certificate includes:

[0012] The first interface is called to obtain the signature certificate from the application file of the target application stored locally.

[0013] In a possible implementation, before the calling of the first interface to obtain the signature certificate from the application file of the target application stored locally, the method further includes:

[0014] The call verification of the first interface is completed, wherein the call verification includes verifying whether the signature certificate of the calling target application is a preset signature certificate.

[0015] In a possible implementation, the generating first key data in a first manner based on the first information in the signature certificate includes:

[0016] Based on the first information in the signature certificate, generate first key data using a message digest algorithm;

[0017] Generating second key data in the first manner based on first information in the signature certificate obtained from the application file includes:

[0018] Based on the first information in the signature certificate obtained from the application file, the second key data is generated using the message digest algorithm.

[0019] In a possible implementation, the first information includes certificate fingerprint data and certificate public key modulus data, and based on the first information in the signature certificate, a message digest algorithm is used to generate the first key data or the second key data, including:

[0020] Adjusting the size of the certificate fingerprint data to be the same as the size of the input data block of the target hash algorithm to obtain adjusted data;

[0021] Performing hash calculation of the target hash algorithm based on the adjusted data;

[0022] Adding the certificate public key modulus data to the hash calculation to obtain a hash calculation result;

[0023] The hash calculation result is adjusted to the size required by the key of the symmetric encryption algorithm to obtain the first key data or the second key data.

[0024] In a possible implementation, the generating first key data in a first manner based on the first information in the signature certificate includes:

[0025] Based on the first information in the signature certificate, generating first key data of a symmetric cryptographic algorithm in a first manner;

[0026] Generating second key data in the first manner based on first information in the signature certificate obtained from the application file includes:

[0027] Based on the first information in the signature certificate obtained from the application file, second key data of the symmetric cryptographic algorithm is generated in the first manner.

[0028] In a possible implementation, encrypting the data to be protected based on the first key data to obtain and save the encrypted data includes:

[0029] Encrypt the data to be protected using a symmetric cryptographic algorithm based on the first key data to obtain and save the encrypted data;

[0030] Decrypting the encrypted data based on the second key data to obtain the data to be protected includes:

[0031] The encrypted data is decrypted using a symmetric cryptographic algorithm based on the second key data to obtain the data to be protected.

[0032] A second aspect of the present application provides a data encryption and decryption device, comprising:

[0033] The certificate creation module is used to create a signature certificate for the target application;

[0034] A key generation module, configured to generate first key data in a first manner based on the first information in the signature certificate;

[0035] a data encryption module, used to encrypt the data to be protected based on the first key data, obtain the encrypted data and save it, wherein the data to be protected is data related to the target application;

[0036] A certificate obtaining module, used to obtain the signature certificate when the data to be protected needs to be called;

[0037] a key obtaining module, configured to generate second key data in the first manner based on first information in the signature certificate obtained from the application file, wherein the second key data is the same as the first key data;

[0038] A data decryption module is used to decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0039] A third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any one of the above-mentioned data encryption and decryption methods.

[0040] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0041] The memory is used to store computer programs;

[0042] The processor is used to execute the computer program so that the electronic device can implement any one of the above-mentioned data encryption and decryption methods.

[0043] Through the above technical scheme, it can be known that the embodiment of the present application discloses a data encryption and decryption method and related devices. The scheme uses the first information in the signature certificate of the target application to generate the first key data, and then uses the generated first key data to perform encryption processing on the target application's protected data, ensuring the security of the protected data storage; when the protected data needs to be used, the signature certificate of the target application is obtained again, and the second key data with the same source is generated during the dynamic calculation process, and the protected data is decrypted based on the second key data. In this scheme, the first key data is closely related to the signature certificate of the target application, and the signature certificate of the target application itself is an important means to verify the identity of the developer and ensure the integrity of the target application. Therefore, this generation mechanism of the first key data that is highly associated with the signature certificate enhances the uniqueness and security of the key while also effectively resisting the risk of illegal acquisition of the protected data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0045] Figure 1 A flowchart of a data encryption and decryption method disclosed in an embodiment of the present application;

[0046] Figure 2 A flowchart of generating key data for data to be protected disclosed in an embodiment of the present application;

[0047] Figure 3 This is an example diagram of the module implementation process of the data encryption and decryption method disclosed in the embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of a data encryption and decryption device disclosed in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] The embodiments of the present application can be applied to electronic devices. The present application does not limit the product form of the electronic device, which can include but is not limited to smart phones, tablet computers, wearable devices, personal computers (PCs), netbooks, etc., and can be selected according to application requirements.

[0052] Figure 1 This is a flow chart of a data encryption and decryption method disclosed in an embodiment of the present application. Figure 1 As shown, the data encryption and decryption method may include:

[0053] Step 101: Create a signing certificate for the target application.

[0054] The target application may be an Android application, and the operating system of the electronic device executing the method may also be an Android system.

[0055] In the embodiment of the present application, the key for encrypting the protected data is obtained based on the signature certificate of the target application, so it is necessary to first obtain the signature certificate of the target application. In the implementation, the signature certificate can be created using the keytool command or through the build tool of AndroidStudio. The signature certificate is generally a file in the format of .jks (Java keystore) and is used to digitally sign the APK file of the application. The APK file is the installation package format of the Android application, and is a file that packages all the information required for the Android application to be installed and run on the device. Usually the signature certificate of the Android application is a digital certificate used to verify that the application comes from a trusted publisher. When the user installs the application on the Android device, the system will check whether the application is correctly signed to ensure the security and integrity of the application. If the application does not have a valid signature certificate, the system will refuse to install it. Alternatively, in other implementations, the signature certificate can also be obtained directly from the certificate authentication center CA, and this application does not have fixed restrictions on this.

[0056] Step 102: Based on the first information in the signature certificate, generate first key data in a first manner.

[0057] The first information may be any information in the signature certificate, including but not limited to fingerprint information and public key modulus. Different encryption algorithms may have different corresponding key formats. Therefore, in the embodiment of the present application, after determining the encryption algorithm to be used, the corresponding first key data may be generated based on its key format. The specific implementation of generating the first key data will be described in detail in the following embodiments, and will not be described in detail here.

[0058] Step 103: Encrypt the data to be protected based on the first key data to obtain and save the encrypted data, wherein the data to be protected is data related to the target application.

[0059] After obtaining the first key data, the protected data can be encrypted and saved based on the first key data. After the encrypted data is obtained, the first key data does not need to be saved and can be directly deleted to prevent the saved first key data from being illegally stolen.

[0060] The data to be protected is data related to the target application, such as the application key of the target application. Encrypting and saving the application key instead of directly storing it can effectively improve the security of the application key.

[0061] Step 104: If the data to be protected needs to be called, obtain the signature certificate.

[0062] When the protected data is needed later, the confidential data needs to be decrypted first. Since the first key data used to encrypt the protected data has not been saved before, when the encrypted data needs to be decrypted, the key data needs to be obtained again.

[0063] For an APK file that has been signed by the target application, the signing certificate is included in the APK file, so the signing certificate can be obtained from the APK file of the target application.

[0064] Step 105: Based on the first information in the signature certificate obtained from the application file, generate second key data using the first method, where the second key data is the same as the first key data.

[0065] After obtaining the signature certificate, the second key data is generated based on the first information therein, such as the fingerprint information number and the public key modulus, based on the same first method as that for generating the first key data. In theory, since the original data is the same and the generation method is the same, the key data obtained is also the same, that is, the first key data is the same as the second key data.

[0066] Step 106: Decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0067] After obtaining the second key data, the encrypted data is decrypted using the first key data to obtain the data to be protected, such as the application key of the target application, to ensure that the target application can run normally.

[0068] The data encryption and decryption method described in this embodiment generates the first key data by using the first information in the signature certificate of the target application, and then uses the generated first key data to perform encryption processing on the target application's protected data, thereby ensuring the security of the protected data storage; when the protected data needs to be used, the signature certificate of the target application is obtained again, and the second key data with the same source is generated in the dynamic calculation process, and the protected data is decrypted based on the second key data. In this scheme, the first key data is closely associated with the signature certificate of the target application, and the signature certificate of the target application itself is an important means to verify the identity of the developer and ensure the integrity of the target application. Therefore, this generation mechanism of the first key data that is highly associated with the signature certificate not only enhances the uniqueness and security of the key, but also effectively resists the risk of illegal acquisition of the protected data.

[0069] In the above embodiment, obtaining the signature certificate may include: calling a first interface to obtain the signature certificate from an application file of the target application stored locally.

[0070] The first interface may be a native layer interface implemented by JNI (Java Native Interface) technology, which allows Java code and native code to communicate, so that the security features of native languages ​​(such as C, C++) can be utilized. In a specific implementation, the first interface may be an API (Application Programming Interface) interface.

[0071] In order to ensure the security and efficiency of keys in practical applications, an interface designed specifically for key use (first interface) is provided during the implementation of the solution. Its internal logic is designed to eliminate direct contact with keys at the application level, ensuring the security of keys. This solution not only ensures the security of key storage, but also improves the security of key use.

[0072] Based on the above content, in one implementation, before calling the first interface to obtain the signature certificate from the application file of the target application stored locally, it can also include: completing the call verification of the first interface, and the call verification includes verifying whether the signature certificate of the called target application is a preset signature certificate.

[0073] When calling the Native interface, it will check whether the signature certificate of the caller application matches the signature certificate required in the interface. If they do not match, the call of the interface will be rejected, thereby preventing possible attacks. In addition, the application solution will also complete encryption and decryption operations within the target application's running logic to avoid direct exposure of the target application's protected data.

[0074] In an embodiment of the present application, when it is necessary to encrypt the protected data or use the protected data, the decryption operation of the protected data can be performed in the internal logic of the target application through the security interface (first interface), thereby avoiding direct exposure of the protected data and effectively ensuring the security of the protected data.

[0075] In one implementation, the generating the first key data in a first manner based on the first information in the signature certificate includes: generating the first key data using a message digest algorithm based on the first information in the signature certificate. The generating the second key data in the first manner based on the first information in the signature certificate obtained from the application file may include: generating the second key data using the message digest algorithm based on the first information in the signature certificate obtained from the application file.

[0076] That is, in the embodiment of the present application, a message digest algorithm is used to generate key data for encrypting and decrypting the data to be protected. The message digest algorithm may include MD (Message Digest), SHA (Secure Hash Algorithm) and HmacMD5 (Message Authentication Code).

[0077] In one example, the first information includes certificate fingerprint data and certificate public key modulus data, and the flowchart for generating key data for the data to be protected is as follows: Figure 2 As shown. Combined Figure 2 As shown, based on the first information in the signature certificate, using a message digest algorithm to generate the first key data or the second key data may include:

[0078] Step 201: Adjust the size of the certificate fingerprint data to be the same as the size of the input data block of the target hash algorithm to obtain adjusted data.

[0079] Step 202: Perform hash calculation of the target hash algorithm based on the adjusted data.

[0080] Step 203: Add the certificate public key modulus data to the hash calculation to obtain a hash calculation result.

[0081] Step 204: Adjust the hash calculation result to the size required by the key of the symmetric encryption algorithm to obtain the first key data or the second key data.

[0082] For example, the SHA512 (Secure Hash Algorithm 512) secure hash algorithm is used to generate key data for data to be protected. The generation process may include: adjusting the size of the signature certificate fingerprint (such as MD5 fingerprint, SHA-1 fingerprint, etc.) data (random padding or other padding algorithms) to the size of the SHA512 block (usually 64 bytes), and then adding it to the hash calculation, then adding the certificate public key modulus data to the SHA-512 hash process being calculated to complete the SHA-512 hash calculation, and finally adjusting the size of the generated result to the size required for the symmetric encryption algorithm (such as AES) key.

[0083] The purpose of using the SHA512 secure hash algorithm is to combine the certificate fingerprint and public key modulus and other possible information to generate a hash value of appropriate length as a key. Such a key is associated with a specific certificate. Once the content of the signing certificate is tampered with (the application is signed or re-signed with another certificate), the generated hash data will change, and the generated key will also change.

[0084] Based on the above example, the generating the first key data in a first manner based on the first information in the signature certificate may include: generating the first key data of a symmetric cryptographic algorithm in a first manner based on the first information in the signature certificate. The generating the second key data in the first manner based on the first information in the signature certificate obtained from the application file may include: generating the second key data of the symmetric cryptographic algorithm in the first manner based on the first information in the signature certificate obtained from the application file.

[0085] The step of encrypting the data to be protected based on the first key data to obtain the encrypted data and save it includes: encrypting the data to be protected based on the first key data using a symmetric cryptographic algorithm to obtain the encrypted data and save it. The step of decrypting the encrypted data based on the second key data to obtain the data to be protected includes: decrypting the encrypted data based on the second key data using a symmetric cryptographic algorithm to obtain the data to be protected.

[0086] The above content introduces in detail the specific implementation of generating the first key data and the second key data based on the signature certificate, which is convenient for technical personnel in the field to better understand and implement the technical solution of the present application.

[0087] In the implementation, the data encryption and decryption scheme can be implemented based on the cooperation of different functional modules, such as Figure 3 , which is an example diagram of the module implementation process of the data encryption and decryption method disclosed in the embodiment of the present application.

[0088] It includes an encryption key (first key data) generation module, an encryption key storage module and an encryption and decryption module. Figure 3 As shown, the data encryption and decryption method may include the following contents:

[0089] 1. Obtain certificate-specific information (including but not limited to fingerprint information and public key modulus) through the application's signature certificate;

[0090] 2. Based on the specific information of the certificate in 1, a specific algorithm is used to dynamically calculate and generate a key for a symmetric encryption algorithm (such as AES);

[0091] 3. According to the key of the symmetric encryption algorithm in step 2, encrypt the key using a symmetric encryption algorithm (such as AES) to obtain an encryption key;

[0092] 4. Safely store the obtained encryption key;

[0093] 5. Obtain the application's signing certificate through the Android system API (such as SigningInfo.getApkContentsSigners, which is used to return the signing certificate used when signing the APK content) to obtain certificate-specific information;

[0094] 6. Based on the specific information of 5 certificates, the same algorithm is used to dynamically calculate and generate the key of the symmetric encryption algorithm;

[0095] 7. Extract the encryption key;

[0096] 8. According to the key of the symmetric encryption algorithm in step 6 and the encryption key in step 7, the encryption key is decrypted using the symmetric encryption algorithm (such as AES) to obtain the key;

[0097] 9. Encrypt and decrypt data through the provided interface and return the result.

[0098] The data encryption and decryption method described in the embodiment of the present application can be applied to general software encryption schemes. The original key and the key used by the symmetric encryption algorithm are not directly stored during the implementation of the scheme. The key used by the symmetric encryption algorithm is dynamically calculated through specific information in the signature certificate of the target application, and the original key is decrypted by the encryption key using the symmetric encryption algorithm. The scheme ensures the security of the key during storage and use by closely associating the encryption key (first key data) or decryption key (second key data) of the data to be protected with the signature certificate of the target application, and using the key through an interface, effectively preventing illegal acquisition and leakage of the key.

[0099] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0100] The method is described in detail in the embodiments disclosed in the above-mentioned application. The method of the application can be implemented by various forms of devices. Therefore, the application also discloses a device, and a specific embodiment is given below for detailed description.

[0101] Figure 4 This is a schematic diagram of the structure of a data encryption and decryption device disclosed in an embodiment of the present application. Figure 4 As shown, the data encryption and decryption device 40 may include:

[0102] The certificate creation module 401 is used to create a signature certificate for the target application.

[0103] The key generation module 402 is used to generate first key data in a first manner based on the first information in the signature certificate.

[0104] The data encryption module 403 is used to encrypt the data to be protected based on the first key data, obtain the encrypted data and save it, wherein the data to be protected is data related to the target application.

[0105] The certificate obtaining module 404 is used to obtain the signature certificate when the data to be protected needs to be called.

[0106] The key obtaining module 405 is used to generate second key data in the first manner based on the first information in the signature certificate obtained from the application file, where the second key data is the same as the first key data.

[0107] The data decryption module 406 is used to decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0108] The data encryption and decryption device described in this embodiment generates the first key data by using the first information in the signature certificate of the target application, and then uses the generated first key data to perform encryption processing on the target application's protected data, thereby ensuring the security of the protected data storage; when the protected data needs to be used, the signature certificate of the target application is obtained again, and the second key data with the same source is generated in the dynamic calculation process, and the protected data is decrypted based on the second key data. In this scheme, the first key data is closely associated with the signature certificate of the target application, and the signature certificate of the target application itself is an important means to verify the identity of the developer and ensure the integrity of the target application. Therefore, this generation mechanism of the first key data that is highly associated with the signature certificate not only enhances the uniqueness and security of the key, but also effectively resists the risk of illegal acquisition of the protected data.

[0109] The specific implementation of the above-mentioned data encryption and decryption device and the modules it contains can be found in the corresponding parts of the method embodiment, which will not be repeated here.

[0110] Any one of the data encryption and decryption devices described in the above embodiments includes a processor and a memory. The certificate creation module, key generation module, data encryption module, certificate acquisition module, key acquisition module, data decryption module, etc. in the above embodiments are all stored in the memory as program modules, and the processor executes the above program modules stored in the memory to implement corresponding functions.

[0111] The processor includes a kernel, which retrieves the corresponding program module from the memory. One or more kernels can be set, and the processing of the access data can be realized by adjusting the kernel parameters.

[0112] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0113] In an exemplary embodiment, a computer-readable storage medium is also provided, which can be directly loaded into the internal memory of a computer and contains software code. After the computer program is loaded and executed, it can implement the steps shown in any embodiment of the above-mentioned data encryption and decryption method.

[0114] In an exemplary embodiment, a computer program product is also provided, which can be directly loaded into the internal memory of a computer, wherein the computer program contains software codes, and after being loaded and executed by a computer, the computer program can implement the steps shown in any embodiment of the data encryption and decryption method described above.

[0115] Furthermore, an embodiment of the present application provides an electronic device. Figure 5This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. Figure 5 As shown, the electronic device 50 includes at least one processor 501, and at least one memory 502 and a bus 503 connected to the processor; wherein the processor and the memory communicate with each other via the bus; the processor is used to call the program instructions in the memory to execute the above-mentioned data encryption and decryption method.

[0116] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0117] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0118] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0119] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data encryption and decryption method, characterized in that: include: Create a signing certificate for the target application; Based on the first information in the signature certificate, generate first key data in a first manner; Encrypting the data to be protected based on the first key data to obtain and save the encrypted data, wherein the data to be protected is data related to the target application; If the data to be protected needs to be called, the signature certificate is obtained; Based on the first information in the signature certificate obtained from the application file, generate second key data in the first manner, where the second key data is the same as the first key data; The encrypted data is decrypted based on the second key data to obtain the data to be protected.

2. The data encryption and decryption method according to claim 1, characterized in that: The obtaining of the signature certificate comprises: The first interface is called to obtain the signature certificate from the application file of the target application stored locally.

3. The data encryption and decryption method according to claim 2, characterized in that: Before the calling of the first interface to obtain the signature certificate from the application file of the target application stored locally, the method further includes: The call verification of the first interface is completed, wherein the call verification includes verifying whether the signature certificate of the call target application is a preset signature certificate.

4. The data encryption and decryption method according to claim 1, characterized in that: The step of generating first key data in a first manner based on the first information in the signature certificate includes: Based on the first information in the signature certificate, generate first key data using a message digest algorithm; Generating second key data in the first manner based on first information in the signature certificate obtained from the application file includes: Based on the first information in the signature certificate obtained from the application file, the second key data is generated using the message digest algorithm.

5. The data encryption and decryption method according to claim 4, characterized in that: The first information includes certificate fingerprint data and certificate public key modulus data. Based on the first information in the signature certificate, a message digest algorithm is used to generate first key data or second key data, including: Adjusting the size of the certificate fingerprint data to be the same as the size of the input data block of the target hash algorithm to obtain adjusted data; Performing hash calculation of the target hash algorithm based on the adjusted data; Adding the certificate public key modulus data to the hash calculation to obtain a hash calculation result; The hash calculation result is adjusted to the size required by the key of the symmetric encryption algorithm to obtain the first key data or the second key data.

6. The data encryption and decryption method according to claim 1, characterized in that: The step of generating first key data in a first manner based on the first information in the signature certificate includes: Based on the first information in the signature certificate, generating first key data of a symmetric cryptographic algorithm in a first manner; Generating second key data in the first manner based on first information in the signature certificate obtained from the application file includes: Based on the first information in the signature certificate obtained from the application file, second key data of the symmetric cryptographic algorithm is generated in the first manner.

7. The data encryption and decryption method according to claim 6, characterized in that: The step of encrypting the data to be protected based on the first key data to obtain and save the encrypted data includes: Encrypt the data to be protected using a symmetric cryptographic algorithm based on the first key data to obtain and save the encrypted data; Decrypting the encrypted data based on the second key data to obtain the data to be protected includes: The encrypted data is decrypted using a symmetric cryptographic algorithm based on the second key data to obtain the data to be protected.

8. A data encryption and decryption device, characterized in that: include: The certificate creation module is used to create a signature certificate for the target application; A key generation module, configured to generate first key data in a first manner based on the first information in the signature certificate; a data encryption module, used to encrypt the data to be protected based on the first key data, obtain the encrypted data and save it, wherein the data to be protected is data related to the target application; A certificate obtaining module, used to obtain the signature certificate when the data to be protected needs to be called; a key obtaining module, configured to generate second key data in the first manner based on first information in the signature certificate obtained from the application file, wherein the second key data is the same as the first key data; A data decryption module is used to decrypt the encrypted data based on the second key data to obtain the data to be protected.

9. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the data encryption and decryption method as claimed in any one of claims 1 to 7.

10. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the data encryption and decryption method as described in any one of claims 1 to 7.

Images