Data encryption and decryption method and related device thereof

Abstract

The application discloses a data encryption and decryption method and a related device thereof. The scheme generates first key data by using first information in a signature certificate of a target application, and then performs encryption processing on to-be-protected data of the target application by using the generated first key data, so that the security of the to-be-protected data storage is ensured. When the to-be-protected data needs to be used, the signature certificate of the target application is obtained again, and second key data homologous to the signature certificate is generated in a dynamic calculation process, and decryption of the to-be-protected data is performed based on the second key data. In the scheme, the first key data is closely related to the signature certificate of the target application, and the signature certificate of the target application itself is an important means for verifying the identity of a developer and ensuring the integrity of the target application. Therefore, the generation mechanism of the first key data highly related to the signature certificate not only enhances the uniqueness and security of the key, but also effectively resists the risk of illegal acquisition of the to-be-protected data.

Description

Technical Field

[0001] This application relates to the field of software security technology, and more specifically, to a data encryption / decryption method and related apparatus. Background Technology

[0002] In the field of mobile application development, key security is a crucial factor in ensuring data integrity and protecting user privacy. However, traditional key storage and usage methods are often vulnerable to unauthorized access by malicious attackers, leading to application data leaks and posing potential threats to users. Therefore, how to better ensure key security and reduce the risk of key leakage is a key focus for professionals in the field. Summary of the Invention

[0003] In view of the above, this application provides the following technical solution:

[0004] The first aspect of this application provides a data encryption / decryption method, including:

[0005] Create a signing certificate for the target application;

[0006] Based on the first information in the signature certificate, the first key data is generated using the first method;

[0007] The data to be protected is encrypted based on the first key data to obtain encrypted data and save it. The data to be protected is data related to the target application.

[0008] If it is necessary to access the data to be protected, obtain the signature certificate;

[0009] Based on the first information in the signature certificate obtained from the application file, a second key data is generated using the first method, wherein the second key data is the same as the first key data.

[0010] The encrypted data is decrypted based on the second key data to obtain the data to be protected.

[0011] In one possible implementation, obtaining the signature certificate includes:

[0012] The first interface is invoked to obtain the signature certificate from the application file of the target application stored locally.

[0013] In one possible implementation, before the first interface is called to obtain the signing certificate from the application file of the target application stored locally, the method further includes:

[0014] Complete the call verification of the first interface, which includes verifying whether the signature certificate of the target application is a preset signature certificate.

[0015] In one possible implementation, generating the first key data based on the first information in the signature certificate using a first method includes:

[0016] Based on the first information in the signature certificate, a message digest algorithm is used to generate the first key data;

[0017] Based on the first information in the signature certificate obtained from the application file, the second key data is generated using the first method, including:

[0018] Based on the first information in the signature certificate obtained from the application file, the second key data is generated using the message digest algorithm.

[0019] In one possible implementation, the first information includes certificate fingerprint data and certificate public key modulus data. Based on the first information in the signature certificate, a first key data or a second key data is generated using a message digest algorithm, including:

[0020] The size of the certificate fingerprint data is adjusted to be the same as the size of the input data block of the target hash algorithm to obtain the adjusted data;

[0021] The target hash algorithm is used to perform hash calculations based on the adjusted data.

[0022] The certificate public key modulus data is added to the hash calculation to obtain the hash calculation result;

[0023] The hash calculation result is adjusted to the size required for the key in the symmetric cryptography algorithm to obtain either the first key data or the second key data.

[0024] In one possible implementation, generating the first key data based on the first information in the signature certificate using a first method includes:

[0025] Based on the first information in the signature certificate, the first key data of the symmetric cryptography algorithm is generated using the first method.

[0026] Based on the first information in the signature certificate obtained from the application file, the second key data is generated using the first method, including:

[0027] Based on the first information in the signature certificate obtained from the application file, the second key data of the symmetric cryptography algorithm is generated using the first method.

[0028] In one possible implementation, encrypting the data to be protected based on the first key data to obtain encrypted data and saving it includes:

[0029] Based on the first key data, the data to be protected is encrypted using a symmetric cryptographic algorithm to obtain encrypted data, which is then saved.

[0030] The encrypted data is decrypted based on the second key data to obtain the data to be protected, including:

[0031] The encrypted data is decrypted using a symmetric cryptographic algorithm based on the second key data to obtain the data to be protected.

[0032] A second aspect of this application provides a data encryption / decryption apparatus, comprising:

[0033] The certificate creation module is used to create a signing certificate for the target application;

[0034] A key generation module is used to generate first key data based on the first information in the signature certificate using a first method;

[0035] The data encryption module is used to encrypt the data to be protected based on the first key data, obtain encrypted data and save it, wherein the data to be protected is data related to the target application;

[0036] The certificate acquisition module is used to obtain the signature certificate when the data to be protected needs to be accessed;

[0037] A key acquisition module is used to generate second key data based on first information in the signature certificate obtained from the application file, using the first method, wherein the second key data is the same as the first key data.

[0038] The data decryption module is used to decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0039] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement any of the aforementioned data encryption / decryption methods.

[0040] A fourth aspect of this application provides an electronic device, including at least one processor and a memory connected to the processor, wherein:

[0041] The memory is used to store computer programs;

[0042] The processor is used to execute the computer program so that the electronic device can implement any of the above-described data encryption and decryption methods.

[0043] As can be seen from the above technical solution, this application discloses a data encryption / decryption method and related apparatus. The method utilizes first information from the target application's signature certificate to generate first key data, and then uses the generated first key data to encrypt the data to be protected in the target application, ensuring the security of the data storage. When the data to be protected needs to be used, the target application's signature certificate is obtained again, and a second key data of the same origin is generated during dynamic calculation. The data to be protected is then decrypted based on the second key data. In this method, the first key data is closely related to the target application's signature certificate, which is itself an important means of verifying the developer's identity and ensuring the integrity of the target application. Therefore, this mechanism for generating first key data highly correlated with the signature certificate enhances key exclusivity and security while effectively resisting the risk of unauthorized acquisition of the data to be protected. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 This is a flowchart of a data encryption / decryption method disclosed in an embodiment of this application;

[0046] Figure 2 This is a flowchart illustrating the generation of key data for the data to be protected, as disclosed in an embodiment of this application.

[0047] Figure 3 This is a flowchart illustrating the module implementation of the data encryption / decryption method disclosed in the embodiments of this application.

[0048] Figure 4 This is a schematic diagram of the structure of a data encryption / decryption device disclosed in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. Detailed Implementation

[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] The embodiments of this application can be applied to electronic devices. This application does not limit the product form of the electronic device, which may include but is not limited to smartphones, tablets, wearable devices, personal computers (PCs), netbooks, etc., and can be selected according to application requirements.

[0052] Figure 1 This is a flowchart illustrating a data encryption / decryption method disclosed in an embodiment of this application. See also... Figure 1 As shown, data encryption and decryption methods may include:

[0053] Step 101: Create a signing certificate for the target application.

[0054] The target application can be an Android application, and the operating system of the electronic device executing the method can also be an Android system.

[0055] In this embodiment, the key for encrypting the data to be protected is obtained based on the target application's signing certificate; therefore, it is necessary to obtain the target application's signing certificate first. In implementation, the signing certificate can be created using the `keytool` command or through the Android Studio build tools. A signing certificate is generally a .jks (Java keystore) file used to digitally sign the application's APK file. An APK file is the installation package format for Android applications, containing all the information required for an Android application to be installed and run on a device. Typically, the signing certificate for an Android application is a digital certificate used to verify that the application comes from a trusted publisher. When a user installs an application on an Android device, the system checks whether the application is correctly signed to ensure its security and integrity. If the application does not have a valid signing certificate, the system will refuse to install it. Alternatively, in other implementations, the signing certificate can also be obtained directly from a Certificate Authority (CA); this application does not impose a fixed limitation on this.

[0056] Step 102: Based on the first information in the signature certificate, generate the first key data using the first method.

[0057] The first information can be any information in the signature certificate, including but not limited to fingerprint information and public key modulus. Different encryption algorithms may have different key formats. Therefore, in this embodiment, after determining the encryption algorithm to be used, the corresponding first key data can be generated based on its key format. The specific implementation of generating the first key data will be described in detail in the following embodiments and will not be elaborated further here.

[0058] Step 103: Encrypt the data to be protected based on the first key data to obtain encrypted data and save it. The data to be protected is data related to the target application.

[0059] After obtaining the first key data, the data to be protected can be encrypted and saved based on the first key data. After obtaining the encrypted data, there is no need to save the first key data again; it can be directly deleted to prevent the saved first key data from being illegally stolen.

[0060] The data to be protected is data related to the target application, such as the application key of the target application. Encrypting and saving the application key instead of storing it directly can effectively improve the security of the application key.

[0061] Step 104: If it is necessary to access the data to be protected, obtain the signature certificate.

[0062] When the protected data is needed later, it must first be decrypted. Since the initial key used to encrypt the protected data was not saved beforehand, it is necessary to obtain the key again when decrypting the encrypted data.

[0063] For APK files that have already been signed for the target application, the signing certificate is contained within the APK file, so the signing certificate can be obtained from the target application's APK file.

[0064] Step 105: Based on the first information in the signature certificate obtained from the application file, generate second key data using the first method, wherein the second key data is the same as the first key data.

[0065] After obtaining the signature certificate, based on the first information therein, such as the fingerprint information number and public key modulus, the second key data is generated using the same first method as the first key data. Theoretically, since the original data is the same and the generation method is the same, the resulting key data is also the same, that is, the first key data and the second key data are the same.

[0066] Step 106: Decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0067] After obtaining the second key data, the encrypted data is decrypted using the first key data to obtain the data to be protected, such as the application key of the target application, to ensure that the target application can operate normally.

[0068] The data encryption / decryption method described in this embodiment generates first key data using first information from the target application's signature certificate. This first key data is then used to encrypt the data to be protected in the target application, ensuring the security of the data storage. When the protected data is needed, the target application's signature certificate is obtained again, and a second key data of the same origin is generated during dynamic calculation. The protected data is then decrypted based on this second key data. In this scheme, the first key data is closely related to the target application's signature certificate, which is itself a crucial means of verifying the developer's identity and ensuring the integrity of the target application. Therefore, this mechanism for generating first key data highly correlated with the signature certificate enhances key exclusivity and security while effectively mitigating the risk of unauthorized access to the protected data.

[0069] In the above embodiments, obtaining the signature certificate may include: calling a first interface to obtain the signature certificate from the application file of the target application stored locally.

[0070] The first interface can be a native layer interface implemented using JNI (Java Native Interface) technology. This type of interface allows communication between Java code and native code, enabling the utilization of the security features of native languages ​​(such as C and C++). In a specific implementation, the first interface can be an API (Application Programming Interface).

[0071] To ensure the security and efficiency of the keys in practical applications, the solution provides an interface specifically designed for key usage (the first interface). Its internal logic aims to eliminate direct application-level access to the keys, thus ensuring key security. This solution not only ensures the security of key storage but also enhances the security of key usage.

[0072] Based on the above, in one implementation, before the first interface is called to obtain the signature certificate from the application file of the target application stored locally, the implementation may further include: completing the call verification of the first interface, wherein the call verification includes verifying whether the signature certificate of the target application being called is a preset signature certificate.

[0073] When calling a native interface, the system checks whether the caller's application's signing certificate matches the signing certificate required by the interface. If they do not match, the interface call is rejected, thus preventing potential attacks. Furthermore, this solution performs encryption and decryption operations within the target application's runtime logic, preventing the direct exposure of the target application's protected data.

[0074] In this embodiment of the application, when it is necessary to encrypt the data to be protected or to use the data to be protected, the decryption operation of the data to be protected can be performed in the internal logic of the target application through the security interface (first interface), so as to avoid the direct exposure of the data to be protected and effectively ensure the security of the data to be protected.

[0075] In one implementation, generating first key data using a first method based on the first information in the signing certificate includes: generating first key data using a message digest algorithm based on the first information in the signing certificate. Then, generating second key data using the first method based on the first information in the signing certificate obtained from the application file may include: generating second key data using the message digest algorithm based on the first information in the signing certificate obtained from the application file.

[0076] In other words, the embodiments of this application employ message digest algorithms to generate key data for encrypting and decrypting the data to be protected. Message digest algorithms may include MD (Message Digest), SHA (SecureHash Algorithm), and HmacMD5 (Message Authentication Code).

[0077] In one example, if the first information includes certificate fingerprint data and certificate public key modulus data, then the flowchart for generating the key data for the data to be protected is as follows. Figure 2 As shown. Combined with Figure 2 As shown, generating first key data or second key data using a message digest algorithm based on the first information in the signature certificate may include:

[0078] Step 201: Adjust the size of the certificate fingerprint data to be the same as the size of the input data block of the target hash algorithm to obtain the adjusted data.

[0079] Step 202: Perform hash calculation of the target hash algorithm based on the adjusted data.

[0080] Step 203: Add the certificate public key modulus data to the hash calculation to obtain the hash calculation result.

[0081] Step 204: Adjust the hash calculation result to the size required for the key of the symmetric cryptography algorithm to obtain the first key data or the second key data.

[0082] For example, the key data for the data to be protected can be generated using the SHA512 (Secure Hash Algorithm 512) secure hash algorithm. The generation process may include: adjusting the size of the signature certificate fingerprint (such as MD5 fingerprint, SHA-1 fingerprint, etc.) data (using random padding or other padding algorithms) to the size of the SHA512 block (usually 64 bytes), and then adding it to the hash calculation. Next, the certificate public key modulus data is added to the SHA-512 hash calculation process to complete the SHA-512 hash calculation. Finally, the size of the generated result is adjusted to the size required for the key of the symmetric cryptographic algorithm (such as AES).

[0083] The purpose of using the SHA512 secure hash algorithm is to combine the certificate fingerprint, public key modulus, and other possible information to generate a hash value of appropriate length as a key. This key is associated with a specific certificate. Once the content of the signing certificate is tampered with (the application uses another certificate to sign or re-sign), the generated hash data will change, and thus the generated key will also change.

[0084] Based on the above examples, generating first key data using a first method based on the first information in the signature certificate may include: generating first key data for a symmetric cryptography algorithm using a first method based on the first information in the signature certificate. Generating second key data using the first method based on the first information in the signature certificate obtained from the application file may include: generating second key data for the symmetric cryptography algorithm using the first method based on the first information in the signature certificate obtained from the application file.

[0085] The step of encrypting the data to be protected based on the first key data to obtain encrypted data and then saving it includes: encrypting the data to be protected based on the first key data using a symmetric cryptographic algorithm to obtain encrypted data and then saving it. The step of decrypting the encrypted data based on the second key data to obtain the data to be protected includes: decrypting the encrypted data based on the second key data using a symmetric cryptographic algorithm to obtain the data to be protected.

[0086] The above content details the specific implementation of generating the first key data and the second key data based on the signature certificate, which helps those skilled in the art to better understand and implement the technical solution of this application.

[0087] In implementation, data encryption and decryption schemes can be implemented by combining different functional modules, such as... Figure 3 The diagram shown is an example of the module implementation flow of the data encryption / decryption method disclosed in this application.

[0088] This includes an encryption key (first key data) generation module, an encryption key storage module, and an encryption / decryption module. Combined Figure 3 As shown, data encryption and decryption methods can include the following:

[0089] 1. Obtain certificate-specific information (including but not limited to fingerprint information and public key modulus) through the application's signing certificate;

[0090] 2. Based on the specific information in certificate 1, use a specific algorithm to dynamically calculate and generate a key for symmetric cryptographic algorithms (such as AES);

[0091] 3. Based on the key of the symmetric cryptography algorithm, encrypt the key using a symmetric cryptography algorithm (such as AES) to obtain the encryption key;

[0092] 4. Securely store the obtained encryption key;

[0093] 5. Obtain the application's signing certificate through Android system APIs (such as SigningInfo.getApkContentsSigners, which is used to return the signing certificate used when signing APK content), thereby obtaining certificate-specific information;

[0094] 6. Based on the specific information in certificate 5, use the same algorithm to dynamically calculate and generate the key for the symmetric cryptography algorithm;

[0095] 7. Extract the encryption key;

[0096] 8. Based on the key of the symmetric cryptography algorithm (6) and the encryption key (7), use a symmetric cryptography algorithm (such as AES) to decrypt the encryption key to obtain the key;

[0097] 9. Encrypt and decrypt data using the provided interface and return the results.

[0098] The data encryption / decryption method described in this application can be applied to general software encryption schemes. During implementation, the original key and the key used by the symmetric cryptographic algorithm are not directly stored. The key used by the symmetric cryptographic algorithm is dynamically calculated using specific information from the target application's signature certificate. The original key is obtained by decrypting the encryption key using the symmetric cryptographic algorithm. By closely associating the encryption key (first key data) or decryption key (second key data) of the data to be protected with the target application's signature certificate, and by using the key through an interface, the scheme ensures the security of the key during storage and use, effectively preventing unauthorized acquisition and leakage of the key.

[0099] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0100] The methods described in the above-disclosed embodiments of this application are detailed in terms of the methods. The methods of this application can be implemented by various forms of apparatus. Therefore, this application also discloses an apparatus. Specific embodiments are given below for detailed description.

[0101] Figure 4 This is a schematic diagram of the structure of a data encryption / decryption device disclosed in an embodiment of this application. See also... Figure 4 As shown, the data encryption / decryption device 40 may include:

[0102] Certificate creation module 401 is used to create a signing certificate for the target application.

[0103] The key generation module 402 is used to generate first key data based on the first information in the signature certificate using a first method.

[0104] The data encryption module 403 is used to encrypt the data to be protected based on the first key data, obtain encrypted data and save it, wherein the data to be protected is data related to the target application.

[0105] The certificate acquisition module 404 is used to obtain the signature certificate when the data to be protected needs to be accessed.

[0106] The key acquisition module 405 is used to generate second key data based on the first information in the signature certificate obtained from the application file, using the first method, wherein the second key data is the same as the first key data.

[0107] The data decryption module 406 is used to decrypt the encrypted data based on the second key data to obtain the data to be protected.

[0108] The data encryption / decryption device described in this embodiment generates first key data using first information from the target application's signature certificate. Then, it uses this generated first key data to encrypt the data to be protected in the target application, ensuring the security of the data storage. When the data to be protected needs to be used, the target application's signature certificate is obtained again, and a second key data of the same origin is generated during dynamic calculation. The data to be protected is then decrypted based on the second key data. In this scheme, the first key data is closely related to the target application's signature certificate, which is itself an important means of verifying the developer's identity and ensuring the integrity of the target application. Therefore, this mechanism for generating first key data that is highly correlated with the signature certificate enhances key uniqueness and security while effectively resisting the risk of unauthorized acquisition of the data to be protected.

[0109] The specific implementation of the above data encryption / decryption device and its various modules can be found in the corresponding sections of the method embodiments, and will not be repeated here.

[0110] Any of the data encryption and decryption devices described in the above embodiments includes a processor and a memory. The certificate creation module, key generation module, data encryption module, certificate acquisition module, key acquisition module, data decryption module, etc. in the above embodiments are all stored as program modules in the memory, and the processor executes the above program modules stored in the memory to realize the corresponding functions.

[0111] The processor contains a kernel, which retrieves the corresponding program modules from memory. One or more kernels can be configured, and the processing of backtracking data can be achieved by adjusting kernel parameters.

[0112] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0113] In an exemplary embodiment, a computer-readable storage medium is also provided, which can be directly loaded into the internal memory of a computer, and contains software code. After being loaded and executed by the computer, the computer program can implement the steps shown in any of the embodiments of the data encryption and decryption methods described above.

[0114] In an exemplary embodiment, a computer program product is also provided, which can be directly loaded into the internal memory of a computer and contains software code. After being loaded and executed by the computer, the computer program can implement the steps shown in any embodiment of the data encryption and decryption method described above.

[0115] Furthermore, embodiments of this application provide an electronic device. Figure 5This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. See also... Figure 5 As shown, the electronic device 50 includes at least one processor 501, at least one memory 502 connected to the processor, and a bus 503; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the above-mentioned data encryption and decryption methods.

[0116] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0117] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0118] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0119] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data encryption and decryption method, characterized by, The method comprises the following steps: creating a signature certificate of a target application; generating first key data in a first mode based on first information in the signature certificate; encrypting to-be-protected data based on the first key data to obtain encrypted data and save the encrypted data, the to-be-protected data being data related to the target application; if the to-be-protected data needs to be called, obtaining the signature certificate; generating second key data in the first mode based on first information in the signature certificate obtained from an application file of the target application, the second key data being the same as the first key data; decrypting the encrypted data based on the second key data to obtain the to-be-protected data; in the case of generating the first key data or the second key data in the first mode based on the first information in the signature certificate, if the first information comprises certificate fingerprint data and certificate public key modulus data, generating the first key data or the second key data in the first mode comprises the following steps: adjusting the size of the certificate fingerprint data to the same size as that of an input data block of a target hash algorithm to obtain adjusted data; performing hash calculation of the target hash algorithm based on the adjusted data; adding the certificate public key modulus data to the hash calculation to obtain a hash calculation result; and adjusting the hash calculation result to the required size of a key of a symmetric cipher algorithm to obtain the first key data or the second key data.

2. The data encryption and decryption method of claim 1, wherein, The method further comprises the following steps: obtaining the signature certificate by calling a first interface from an application file of the target application stored locally.

3. The data encryption and decryption method of claim 2, wherein, Before the step of obtaining the signature certificate by calling the first interface from the application file of the target application stored locally, the method further comprises the following steps: completing verification of calling the first interface, the verification of calling comprising verifying whether the signature certificate of the target application called is a preset signature certificate.

4. The data encryption and decryption method of claim 1, wherein, The method further comprises the following steps: generating the first key data in the first mode based on the first information in the signature certificate comprises generating the first key data in the first mode based on the first information in the signature certificate by using a message digest algorithm; generating the second key data in the first mode based on the first information in the signature certificate obtained from the application file comprises generating the second key data in the first mode based on the first information in the signature certificate obtained from the application file by using the message digest algorithm. The method further comprises the following steps:

5. The data encryption and decryption method of claim 1, wherein, generating the first key data in the first mode based on the first information in the signature certificate comprises generating the first key data in the first mode based on the first information in the signature certificate by using a symmetric cipher algorithm; generating the second key data in the first mode based on the first information in the signature certificate obtained from the application file comprises generating the second key data in the first mode based on the first information in the signature certificate obtained from the application file by using the symmetric cipher algorithm. The method further comprises the following steps: encrypting the to-be-protected data based on the first key data to obtain encrypted data and save the encrypted data comprises encrypting the to-be-protected data based on the first key data by using a symmetric cipher algorithm to obtain encrypted data and save the encrypted data.

6. The data encryption and decryption method of claim 5, wherein, ​ ​ decrypt the encrypted data based on the second key data to obtain the to-be-protected data, comprising: decrypt the encrypted data based on the second key data to obtain the to-be-protected data, comprising:

7. A data encryption and decryption apparatus, characterized by comprising: comprising: a certificate creation module, configured to create a signature certificate of a target application; a key generation module, configured to generate first key data in a first manner based on first information in the signature certificate; a data encryption module, configured to encrypt to-be-protected data based on the first key data to obtain encrypted data and save the encrypted data, the to-be-protected data being data related to the target application; a certificate obtaining module, configured to obtain the signature certificate when the to-be-protected data needs to be called; a key obtaining module, configured to generate second key data in the first manner based on first information in the signature certificate obtained from an application file of the target application, the second key data being the same as the first key data; a data decryption module, configured to decrypt the encrypted data based on the second key data to obtain the to-be-protected data; wherein, in the case of generating the first key data or the second key data in the message digest algorithm based on the first information in the signature certificate, if the first information comprises certificate fingerprint data and certificate public key modulus data, the first key data or the second key data is generated in the message digest algorithm, and the first key data or the second key data is specifically used for: adjusting the size of the certificate fingerprint data to the same size as the size of the input data block of the target hash algorithm to obtain adjusted data; performing hash calculation of the target hash algorithm based on the adjusted data; adding the certificate public key modulus data to the hash calculation to obtain a hash calculation result; and adjusting the hash calculation result to the required size of the key of the symmetric cipher algorithm to obtain the first key data or the second key data.

8. A computer program product, characterised in that, comprise computer readable instructions which, when run on an electronic device, cause the electronic device to implement the data encryption and decryption method of any one of claims 1 to 6.

9. An electronic device, comprising: comprise at least one processor and a memory connected to the processor, wherein: the memory is configured to store a computer program; the processor is configured to execute the computer program to enable the electronic device to implement the data encryption and decryption method of any one of claims 1 to 6.

Images