Data encryption and decryption method and system, computer equipment and storage medium

Abstract

The invention discloses a data encryption and decryption method and system, computer equipment and a storage medium, and relates to the technical field of data security, the data encryption and decryption method comprises an initialization hard encryption and decryption module and a soft encryption and decryption module, the hard encryption and decryption module is used for carrying out hard encryption on original data, and the soft encryption and decryption module is used for carrying out soft encryption on the original data; in response to the fact that the hard encryption and decryption module is not normally started, obtaining to-be-processed data obtained by encrypting the original data by the soft encryption and decryption module when the hard encryption and decryption module is not normally started, and setting the to-be-processed data to have a prefix mark; in response to normal starting of the hard encryption and decryption module, querying the prefix mark to obtain to-be-processed data; and decrypting the to-be-processed data through the soft encryption and decryption module to obtain restored original data, and performing hard encryption on the restored original data by adopting the hard encryption and decryption module. According to the method, when hardware encryption is abnormal, soft decryption is used to ensure normal operation of services, and when a large amount of data is encrypted and decrypted, encryption and decryption asynchronous processing is adopted to ensure smooth completion of the encryption and decryption process.

Description

Technical Field

[0001] The present application relates to the technical field of data security, and in particular to a data encryption and decryption method, system, computer device and storage medium. Background Art

[0002] As a carrier of information and knowledge, data plays a vital role in modern society. With the acceleration of digitalization, data has become a key factor in corporate competitiveness. Protecting the confidentiality, integrity and availability of data and preventing data leakage, tampering or loss are crucial to maintaining personal privacy and corporate interests.

[0003] In some related technologies, hardware encryption modules are integrated and deployed to protect the security of sensitive data, which can provide high-strength data encryption and decryption capabilities. During the data encryption process, encryption module failure will cause the system data and functions of the deployed hardware encryption module to be unavailable, affecting the normal operation of the business; and, the encryption and decryption of large amounts of data cannot be completed instantly, and false decryption verification failure scenarios may occur, thereby affecting the operation of the business. Summary of the invention

[0004] In order to solve at least one of the problems mentioned in the above background technology, the present application provides a data encryption and decryption method, system, computer device and storage medium. When the hardware encryption module is abnormal, soft decryption is used to ensure the normal operation of the business. When a large amount of data is encrypted and decrypted, asynchronous encryption and decryption processing is used to ensure the smooth completion of the encryption and decryption process.

[0005] The specific technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, a data encryption and decryption method is provided, the method comprising:

[0007] Initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on the original data, and the soft encryption and decryption module is used to perform soft encryption on the original data;

[0008] In response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0009] In response to the hard encryption and decryption module being normally enabled, querying the prefix tag to obtain the data to be processed;

[0010] The data to be processed is decrypted by the soft encryption and decryption module to obtain the repaired original data, and the hard encryption and decryption module is used to hard encrypt the repaired original data.

[0011] In a specific embodiment, after initializing the hard encryption and decryption module and the soft encryption and decryption module, the method further includes: determining whether the encryption machine is enabled, and if the encryption machine is enabled, obtaining the original data after hard encryption and the original data after soft encryption and saving them separately; or, if the encryption machine is not enabled, configuring the data to be soft-encrypted through the soft encryption and decryption module, and saving the soft-encrypted data.

[0012] In a specific embodiment, in response to the hardware encryption and decryption module adding a hardware encryption and decryption tool, a hardware encryption and decryption file associated with the newly added hardware encryption and decryption tool is obtained; when the encryption machine is started, the hardware encryption and decryption file is triggered to be loaded from the outside.

[0013] In a specific embodiment, environmental configuration information is obtained, and a hard encryption / decryption module and a soft encryption / decryption module are initialized based on the environmental configuration information; an encryption method library is obtained, and the encryption method library includes several encryption methods; keywords of the environmental configuration information are read, and an adapted encryption method is obtained from the encryption method library according to the keywords; and the encryption method is configured in the hard encryption / decryption module and / or the soft encryption / decryption module.

[0014] In a specific embodiment, in response to the failure of the hard encryption / decryption module, the original data updated during the failure of the hard encryption / decryption module is obtained, and the updated original data is encrypted by the soft encryption / decryption module to obtain a first part of data; in response to the hard encryption / decryption module not being turned on, the original data encrypted only by the soft encryption / decryption module when the hard encryption / decryption module is not turned on is obtained to obtain a second part of data; the first part of data and the second part of data are merged to obtain the data to be processed, and the data to be processed is set to have a first field; after the hard encryption / decryption module hard-encrypts the repaired original data, the hard-encrypted repaired original data is set to have a second field; it is determined whether the first field and the second field are the same; if they are the same, it is confirmed that the hard encryption / decryption module has completed hard encryption of the repaired original data; or, if they are different, the hard encryption / decryption module has not completed hard encryption of the repaired original data.

[0015] In a specific embodiment, in response to the first field and the second field being different, the hard encryption and decryption module is triggered to hard-encrypt the repaired original data again; after the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

[0016] In a specific embodiment, all the data to be processed with prefix marks are set to be decrypted using the soft encryption and decryption module; after the hard encryption of the repair original data is completed using the hard encryption and decryption module, the prefix mark in the repair original data is cleared, and the hard encryption and decryption module is set to call the hard-encrypted repair original data.

[0017] In a second aspect, a data encryption and decryption system is provided, for implementing the data encryption and decryption method as described above, the system comprising:

[0018] An initialization unit, used to initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data;

[0019] a marking unit, configured to, in response to the hard encryption and decryption module not being normally enabled, obtain the data to be processed obtained by encrypting the original data by the soft encryption and decryption module during the period when the hard encryption and decryption module is not normally enabled, and set the data to be processed to have a prefix mark;

[0020] an execution unit, configured to query the prefix tag to obtain the data to be processed in response to the normal activation of the hard encryption and decryption module; decrypt the data to be processed by the soft encryption and decryption module to obtain the repaired original data, and hard encrypt the repaired original data by using the hard encryption and decryption module

[0021] In a third aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0022] Step A: Initializing a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on the original data, and the soft encryption and decryption module is used to perform soft encryption on the original data;

[0023] Step B: in response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0024] Step C: in response to the hard encryption and decryption module being normally enabled, querying the prefix tag to obtain the data to be processed;

[0025] Step D: decrypt the data to be processed by the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard encrypt the repaired original data.

[0026] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0027] Step A: Initializing a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on the original data, and the soft encryption and decryption module is used to perform soft encryption on the original data;

[0028] Step B: in response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0029] Step C: in response to the hard encryption and decryption module being normally enabled, querying the prefix tag to obtain the data to be processed;

[0030] Step D: decrypt the data to be processed by the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard encrypt the repaired original data.

[0031] The embodiments of the present application have the following beneficial effects:

[0032] 1. The data encryption and decryption method provided in the embodiment of the present application can obtain the pending data obtained only by soft encryption by the soft encryption and decryption module during the period when the hard encryption and decryption module is not normally enabled, and prefix mark the pending data, so that when the hard encryption and decryption module is normally enabled, the pending data can be obtained by querying the prefix mark, and the pending data can be decrypted by the soft encryption and decryption module to obtain the repaired original data, and the hard encryption and decryption module is used to re-hard-encrypt the repaired original data, and the prefix mark is cleared. When the hardware encryption module is abnormal, soft decryption is used to ensure the normal operation of the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 A schematic diagram showing an application environment according to the present application;

[0035] Figure 2 A schematic diagram showing a data encryption and decryption method according to the present application;

[0036] Figure 3 A schematic diagram showing the architecture of an authenticator according to the present application is shown;

[0037] Figure 4 A schematic diagram showing a data encryption and decryption system according to the present application is shown;

[0038] Figure 5 A schematic diagram showing a computer device according to the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] The data encryption and decryption method provided in this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. That is, the terminal is configured with a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption and decryption on the original data, and the soft encryption and decryption module is used to perform soft encryption and decryption on the original data; when the hard encryption and decryption module is not normally enabled, the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period of abnormal activation is obtained, and the data to be processed is set to have a prefix mark; in response to the normal activation of the hard encryption and decryption module, the prefix mark is queried to obtain the data to be processed; the data to be processed is decrypted by the soft encryption and decryption module to obtain the repaired original data, and the hard encryption and decryption module is used to hard-encrypt the repaired original data. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0041] In one embodiment, Figure 2 As shown, a data encryption and decryption method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps:

[0042] Step 101: Initialize a hard encryption and decryption module and a soft encryption and decryption module. The hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data.

[0043] In order to ensure the normal activation of the hard encryption and decryption modules and the soft encryption and decryption modules, their respective associated configuration files are read from different configuration sources and initialized. The configuration sources include environment variables, environment configuration information, and configuration files. The initialization specifically includes software algorithm keys, adding hardware encryption machine providers enabled in the current environment, configuring encryption machine connection information, and encryption machine keys.

[0044] After initializing the hard encryption and decryption module and the soft encryption and decryption module, the method further includes: determining whether the encryption machine is enabled, and if the encryption machine is enabled, obtaining the original data after hard encryption and the original data after soft encryption and saving them separately; or, if the encryption machine is not enabled, configuring the data to be soft-encrypted through the soft encryption and decryption module, and saving the soft-encrypted data.

[0045] Among them, when the encryption machine is enabled, it is necessary to ensure that the hardware encryption machine must be connected to an available hardware for use. Therefore, only when the hardware encryption and decryption module is enabled can both soft and hard encrypted data be processed at the same time. Hard encryption and decryption are turned off by default. After the encryption machine is turned on, soft and hard integrated encryption is executed. The relevant data to be encrypted is encrypted by hardware and software at the same time and saved separately.

[0046] Whether the encryption machine is enabled is used to distinguish between soft encryption and integrated hardware and software encryption methods, where encryption methods include but are not limited to SM2, SM3, and SM4.

[0047] Step 102: In response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0048] In this embodiment, in response to the failure of the hard encryption / decryption module, the original data updated during the failure of the hard encryption / decryption module is obtained, and the updated original data is encrypted by the soft encryption / decryption module to obtain a first part of data; in response to the hard encryption / decryption module not being turned on, the original data encrypted only by the soft encryption / decryption module when the hard encryption / decryption module is not turned on is obtained to obtain a second part of data; the first part of data and the second part of data are merged to obtain the data to be processed.

[0049] The data to be processed includes two parts of data, namely, the first part is the original data that has changed during the fault period, and the second part is the data that has only been soft-encrypted when hard encryption is not enabled.

[0050] Furthermore, false verification failures can be avoided by adding prefix marks to the data to be processed. For example, when the encryption machine is turned on, the exemplary data a is hard-encrypted to obtain a-1, the encryption machine is disabled, the data a is updated multiple times, and the encryption machine is turned on again. At this time, the decryption will show failure.

[0051] Step 103: In response to the hard encryption and decryption module being normally enabled, query the prefix tag to obtain the data to be processed.

[0052] Step 104: decrypt the data to be processed by the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard-encrypt the repaired original data.

[0053] In a specific embodiment, in response to the hardware encryption and decryption module adding a hardware encryption and decryption tool, a hardware encryption and decryption file associated with the newly added hardware encryption and decryption tool is obtained; when the encryption machine is started, the hardware encryption and decryption file is triggered to be loaded from the outside.

[0054] When a new hardware encryption and decryption tool is added to the hard encryption and decryption module, there is no need to modify and verify the original hard encryption and decryption module. You only need to package the hardware encryption and decryption files associated with the hardware encryption and decryption tool into a file package and load it when the system starts. For example, the hardware encryption and decryption files are packaged into a jar package. The Jar package follows the spi specification to ensure the use of a unified verification interface and contains the dependent libraries required for operation. During deployment, the jar package is mounted to the specified directory to enable loading when the system starts.

[0055] In order to enhance the security of data encryption by the hardware encryption and decryption module, the hardware encryption and decryption module also includes authentication functions, such as Figure 3 As shown, different authentication functions are integrated into corresponding authenticators for implementation. Several integrated authenticators are packaged into a file package and mounted in a preset directory. The integrated authenticator can be composed of several sub-authenticators to complete the authentication flow, specifically including a first authenticator, a second authenticator and a third authenticator arranged in sequence for communication, and the first authenticator, the second authenticator and the third authenticator are respectively associated with different hard encryption functions. According to the hard encryption function required, the corresponding authenticator is selected and configured, and the authenticator interacts with the authentication gateway through the api to process the certificate authentication. The system authentication implementation mechanism is spi loading the authenticator.

[0056] Exemplarily, the first authenticator is configured for account and password authentication, the second authenticator is configured for ukey authentication, and the third authenticator is configured for verification code authentication. The authentication methods and functions associated with the authenticators can be selected and configured according to actual scenario requirements, and are not limited in this embodiment.

[0057] In a specific embodiment, in order to ensure the smooth completion of the hard encryption process of the repaired original data by the hard encryption and decryption module, the data consistency check is set in this scheme, specifically, the data to be processed is set to have a first field; after the hard encryption and decryption module hard encrypts the repaired original data, the hard-encrypted repaired original data is set to have a second field; it is determined whether the first field and the second field are the same; if they are the same, it is confirmed that the hard encryption and decryption module has completed the hard encryption of the repaired original data; or, if they are different, the hard encryption and decryption module has not completed the hard encryption of the repaired original data. In addition, when the encryption machine is enabled, the first field and the second field marked above are displayed on the interface for the user to observe and judge.

[0058] Furthermore, in response to the first field and the second field being different, the hard encryption and decryption module is triggered to hard-encrypt the repaired original data again; after the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

[0059] In a specific embodiment, all the data to be processed with prefix marks are set to be decrypted using the soft encryption and decryption module; after the hard encryption of the repair original data is completed using the hard encryption and decryption module, the prefix mark in the repair original data is cleared, and the hard encryption and decryption module is set to call the hard-encrypted repair original data.

[0060] In this embodiment, when a large amount of data is to be processed, an asynchronous task is set to be used for processing, that is, the data with prefix marks is decrypted using the soft encryption and decryption module; the hard encryption and decryption module is used to hard-encrypt the repaired original data; and other data without prefix marks continue to be encrypted and decrypted according to the preset path. Through the above method, the number of calls to the encryption machine tool is reduced, thereby improving the efficiency of encrypting and decrypting data in this scheme.

[0061] It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0062] In one embodiment, Figure 4 As shown, a data encryption and decryption system is provided, which is used to implement the data encryption and decryption method as described above, and the system includes:

[0063] An initialization unit, used to initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data;

[0064] a marking unit, configured to, in response to the hard encryption and decryption module not being normally enabled, obtain the data to be processed obtained by encrypting the original data by the soft encryption and decryption module during the period when the hard encryption and decryption module is not normally enabled, and set the data to be processed to have a prefix mark;

[0065] The execution unit is used to query the prefix tag to obtain the data to be processed in response to the normal activation of the hard encryption and decryption module; decrypt the data to be processed through the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard-encrypt the repaired original data.

[0066] In a specific embodiment, the initialization unit is also used to determine whether the encryption machine is enabled. If the encryption machine is enabled, the original data after hard encryption and the original data after soft encryption are obtained and saved separately; or, if the encryption machine is not enabled, the data is configured to be soft-encrypted through the soft encryption and decryption module, and the soft-encrypted data is saved.

[0067] In a specific embodiment, it also includes a loading unit for obtaining a hardware encryption and decryption file associated with a new hardware encryption and decryption tool in response to the addition of a hardware encryption and decryption tool to the hard encryption and decryption module; when the encryption machine is started, it triggers the loading of the hardware encryption and decryption file from the outside.

[0068] In a specific embodiment, the initialization unit is also used to obtain environmental configuration information, initialize the hard encryption and decryption module and the soft encryption and decryption module based on the environmental configuration information; obtain an encryption method library, which includes several encryption methods; read the keywords of the environmental configuration information, and obtain an adapted encryption method from the encryption method library according to the keywords; and configure the encryption method to the hard encryption and decryption module and / or the soft encryption and decryption module.

[0069] In a specific embodiment, it further includes a data acquisition unit, which is used to acquire original data updated during the period of the hard encryption and decryption module failure in response to the hard encryption and decryption module failure, and encrypt the updated original data through the soft encryption and decryption module to obtain the first part of data;

[0070] In response to the hard encryption / decryption module not being turned on, the original data encrypted only by the soft encryption / decryption module when the hard encryption / decryption module is not turned on is obtained to obtain a second part of data; the first part of data and the second part of data are combined to obtain the data to be processed, and the data to be processed is set to have a first field; after the hard encryption / decryption module hard-encrypts the repaired original data, the hard-encrypted repaired original data is set to have a second field; it is determined whether the first field and the second field are the same; if they are the same, it is confirmed that the hard encryption / decryption module has completed the hard encryption of the repaired original data; or, if they are different, the hard encryption / decryption module has not completed the hard encryption of the repaired original data.

[0071] In a specific embodiment, the execution unit is also used to trigger the hard encryption and decryption module to hard-encrypt the repaired original data again in response to the first field and the second field being different; after the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

[0072] In a specific embodiment, the execution unit is also used to set all the processed data with prefix marks to be decrypted using the soft encryption and decryption module; after the hard encryption of the repair original data is completed using the hard encryption and decryption module, the prefix mark in the repair original data is cleared, and the hard encryption and decryption module is used to call the hard-encrypted repair original data.

[0073] For the specific definition of the data encryption and decryption system, please refer to the definition of the data encryption and decryption method above, which will not be repeated here. Each module in the above data encryption and decryption system can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0074] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store configuration file data of the hard encryption and decryption module and the soft encryption and decryption module. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data encryption and decryption method is implemented.

[0075] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0076] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0077] Step 201: Initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data;

[0078] Step 202: In response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0079] Step 203: In response to the hard encryption and decryption module being normally enabled, query the prefix tag to obtain the data to be processed;

[0080] Step 204: decrypt the data to be processed by the soft encryption / decryption module to obtain the repaired original data, and hard encrypt the repaired original data by the hard encryption / decryption module.

[0081] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0082] Determine whether the encryption machine is enabled. If the encryption machine is enabled, obtain the original data after hard encryption and the original data after soft encryption and save them separately; or, if the encryption machine is not enabled, configure the data to be soft-encrypted through the soft encryption and decryption module, and save the soft-encrypted data.

[0083] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0084] In response to the hardware encryption and decryption module adding a hardware encryption and decryption tool, a hardware encryption and decryption file associated with the newly added hardware encryption and decryption tool is obtained; when the encryption machine is started, the hardware encryption and decryption file is triggered to be loaded from the outside.

[0085] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0086] Acquire environmental configuration information, and initialize a hard encryption / decryption module and a soft encryption / decryption module based on the environmental configuration information; acquire an encryption method library, which includes several encryption methods; read keywords of the environmental configuration information, and acquire an adapted encryption method from the encryption method library according to the keywords; and configure the encryption method to the hard encryption / decryption module and / or the soft encryption / decryption module.

[0087] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0088] In response to the failure of the hard encryption / decryption module, the original data updated during the failure of the hard encryption / decryption module is obtained, and the updated original data is encrypted by the soft encryption / decryption module to obtain a first part of the data; in response to the hard encryption / decryption module not being turned on, the original data encrypted only by the soft encryption / decryption module when the hard encryption / decryption module is not turned on is obtained to obtain a second part of the data; the first part of the data and the second part of the data are combined to obtain the data to be processed, and the data to be processed is set to have a first field; after the hard encryption / decryption module hard-encrypts the repaired original data, the hard-encrypted repaired original data is set to have a second field; it is determined whether the first field and the second field are the same; if they are the same, it is confirmed that the hard encryption / decryption module has completed the hard encryption of the repaired original data; or, if they are different, the hard encryption / decryption module has not completed the hard encryption of the repaired original data.

[0089] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0090] In response to the first field and the second field being different, the hard encryption and decryption module is triggered to hard-encrypt the repaired original data again; after the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

[0091] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0092] Set all the to-be-processed data with prefix marks to be decrypted by the soft encryption and decryption module; after the hard encryption of the repair original data is completed by the hard encryption and decryption module, clear the prefix mark in the repair original data, and set the hard encryption and decryption module to call the hard-encrypted repair original data.

[0093] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0094] Step 301: Initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data;

[0095] Step 302: In response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark;

[0096] Step 303: In response to the hard encryption and decryption module being normally enabled, query the prefix tag to obtain the data to be processed;

[0097] Step 304: decrypt the data to be processed by the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard-encrypt the repaired original data.

[0098] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0099] Determine whether the encryption machine is enabled. If the encryption machine is enabled, obtain the original data after hard encryption and the original data after soft encryption and save them separately; or, if the encryption machine is not enabled, configure the data to be soft-encrypted through the soft encryption and decryption module, and save the soft-encrypted data.

[0100] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0101] In response to the hardware encryption and decryption module adding a hardware encryption and decryption tool, a hardware encryption and decryption file associated with the newly added hardware encryption and decryption tool is obtained; when the encryption machine is started, the hardware encryption and decryption file is triggered to be loaded from the outside.

[0102] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0103] Acquire environmental configuration information, and initialize a hard encryption / decryption module and a soft encryption / decryption module based on the environmental configuration information; acquire an encryption method library, which includes several encryption methods; read keywords of the environmental configuration information, and acquire an adapted encryption method from the encryption method library according to the keywords; and configure the encryption method to the hard encryption / decryption module and / or the soft encryption / decryption module.

[0104] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0105] In response to the failure of the hard encryption / decryption module, the original data updated during the failure of the hard encryption / decryption module is obtained, and the updated original data is encrypted by the soft encryption / decryption module to obtain a first part of the data; in response to the hard encryption / decryption module not being turned on, the original data encrypted only by the soft encryption / decryption module when the hard encryption / decryption module is not turned on is obtained to obtain a second part of the data; the first part of the data and the second part of the data are combined to obtain the data to be processed, and the data to be processed is set to have a first field; after the hard encryption / decryption module hard-encrypts the repaired original data, the hard-encrypted repaired original data is set to have a second field; it is determined whether the first field and the second field are the same; if they are the same, it is confirmed that the hard encryption / decryption module has completed the hard encryption of the repaired original data; or, if they are different, the hard encryption / decryption module has not completed the hard encryption of the repaired original data.

[0106] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0107] In response to the first field and the second field being different, the hard encryption and decryption module is triggered to hard-encrypt the repaired original data again; after the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

[0108] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0109] Set all the to-be-processed data with prefix marks to be decrypted by the soft encryption and decryption module; after the hard encryption of the repair original data is completed by the hard encryption and decryption module, clear the prefix mark in the repair original data, and set the hard encryption and decryption module to call the hard-encrypted repair original data.

[0110] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0111] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0112] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A data encryption and decryption method, characterized in that: The method comprises: Initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on the original data, and the soft encryption and decryption module is used to perform soft encryption on the original data; In response to the hardware encryption and decryption module not being enabled normally, obtaining the data to be processed obtained by soft-encrypting the original data by the soft encryption and decryption module during the period when the module is not enabled normally, and setting the data to be processed to have a prefix mark; In response to the hard encryption and decryption module being normally enabled, querying the prefix tag to obtain the data to be processed; The data to be processed is decrypted by the soft encryption and decryption module to obtain the repaired original data, and the hard encryption and decryption module is used to hard encrypt the repaired original data.

2. The data encryption and decryption method according to claim 1, characterized in that: After initializing the hard encryption and decryption module and the soft encryption and decryption module, the method further includes: Determine whether the encryption machine is enabled, and if the encryption machine is enabled, obtain the original data after hard encryption and the original data after soft encryption and save them separately; Alternatively, if the encryption machine is not enabled, the data is configured to be soft-encrypted through the soft encryption and decryption module, and the soft-encrypted data is saved.

3. The data encryption and decryption method according to claim 2, characterized in that: The method comprises: In response to the hardware encryption and decryption module adding a hardware encryption and decryption tool, obtaining a hardware encryption and decryption file associated with the newly added hardware encryption and decryption tool; When the encryption machine is started, it triggers the loading of the hardware encryption and decryption file from the outside.

4. The data encryption and decryption method according to claim 1 or 2, characterized in that: The method further comprises: Acquire environment configuration information, and initialize the hard encryption and decryption module and the soft encryption and decryption module based on the environment configuration information; Obtain an encryption method library, wherein the encryption method library includes a plurality of encryption methods; Reading keywords of the environment configuration information, and acquiring an adapted encryption method from the encryption method library according to the keywords; The encryption method is configured in the hard encryption / decryption module and / or the soft encryption / decryption module.

5. The data encryption and decryption method according to claim 2, characterized in that: The method further comprises: In response to the hard encryption and decryption module failure, original data updated during the hard encryption and decryption module failure is acquired, and the updated original data is encrypting by the soft encryption and decryption module to obtain a first portion of data; In response to the hard encryption and decryption module not being turned on, obtaining the original data encrypted only by the soft encryption and decryption module when the hard encryption and decryption module is not turned on, to obtain the second part of data; Combining the first part of data and the second part of data to obtain the data to be processed, and setting the data to be processed to have a first field; After the hard encryption / decryption module hard-encrypts the original repair data, the hard-encrypted original repair data is set to have a second field; Determine whether the first field and the second field are the same; If they are the same, it is confirmed that the hard encryption and decryption module has completed the hard encryption of the repaired original data; Alternatively, if they are different, the hard encryption and decryption module has not completed the hard encryption of the repaired original data.

6. The data encryption and decryption method according to claim 5, characterized in that: The method further comprises: In response to the first field and the second field being different, triggering the hard encryption and decryption module to hard-encrypt the repaired original data again; After the repaired original data is hard-encrypted again, the second field is changed to be the same as the first field.

7. The data encryption and decryption method according to claim 1 or 2, characterized in that: The method further comprises: Setting all the data to be processed with prefix marks to be decrypted using the soft encryption and decryption module; After the hard encryption of the repair original data is completed by using the hard encryption and decryption module, the prefix mark in the repair original data is cleared, and the hard encryption and decryption module is used to call the hard-encrypted repair original data.

8. A data encryption and decryption system, used to implement the data encryption and decryption method according to any one of claims 1 to 7, characterized in that: The system comprises: An initialization unit, used to initialize a hard encryption and decryption module and a soft encryption and decryption module, wherein the hard encryption and decryption module is used to perform hard encryption on original data, and the soft encryption and decryption module is used to perform soft encryption on original data; a marking unit, configured to, in response to the hard encryption and decryption module not being normally enabled, obtain the data to be processed obtained by encrypting the original data by the soft encryption and decryption module during the period when the hard encryption and decryption module is not normally enabled, and set the data to be processed to have a prefix mark; The execution unit is used to query the prefix tag to obtain the data to be processed in response to the normal activation of the hard encryption and decryption module; decrypt the data to be processed through the soft encryption and decryption module to obtain the repaired original data, and use the hard encryption and decryption module to hard-encrypt the repaired original data.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images