Encryption method, decryption method, device, equipment, storage medium and program product

Abstract

The invention provides an encryption method and device, a decryption method and device, equipment, a storage medium and a program product, and the encryption method comprises the steps: receiving an encryption request sent by an application end, wherein the encryption request comprises a to-be-encrypted plaintext; determining a secret key, encrypting the plaintext to be encrypted by adopting the secret key to obtain a ciphertext, and sending the ciphertext to the application end; sending the secret key to a platform database for storage, or sending a first part of the secret key to the application end for storage, and sending a second part of the secret key to the platform database for storage; and generating an access token for permitting access to the secret key or the second part of the secret key stored in the platform database, and sending the access token to the application end. According to the invention, high encryption security can be realized.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of application development, and in particular to an encryption method, a decryption method, an apparatus, a device, a storage medium and a program product. Background Art

[0002] In order to ensure data security, some sensitive data in plain text state (for example, data with a high security level) usually needs to be encrypted to form ciphertext. When the above data needs to be applied, only after decrypting the ciphertext to obtain the plaintext can the sensitive data be applied.

[0003] Existing encryption methods (eg, disk encryption methods, database encryption methods) have low encryption security. Summary of the invention

[0004] The embodiments of the present invention provide an encryption method, a decryption method, an apparatus, a device, a storage medium and a program product to solve the problem of low encryption security of the existing encryption method.

[0005] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0006] In a first aspect, an embodiment of the present invention provides an encryption method, comprising:

[0007] Receiving an encryption request sent by an application, wherein the encryption request includes plaintext to be encrypted;

[0008] Determine a secret key, use the secret key to encrypt the plaintext to obtain a ciphertext, and send the ciphertext to the application end;

[0009] Sending the secret key to the platform database for storage, or sending the first part of the secret key to the application end for storage, and sending the second part of the secret key to the platform database for storage;

[0010] An access token that permits access to the secret key or the second part of the secret key stored in the platform database is generated, and the access token is sent to the application.

[0011] Optionally, determining the key includes:

[0012] Obtaining a preset encryption and decryption strategy corresponding to the application end;

[0013] If the encryption and decryption strategy is a dynamic generation strategy, a random key is generated as the determined key;

[0014] If the encryption and decryption strategy is a static generation strategy, the platform database is queried to obtain a preset static key of the application end as the determined key.

[0015] Optionally, sending the secret key to a platform database for storage, or sending the first part of the secret key to the application end for storage, and sending the second part of the secret key to the platform database for storage, includes:

[0016] Get the key storage policy;

[0017] If the key storage strategy is a full key storage strategy, the key is sent to the platform database for storage;

[0018] If the key storage strategy is a partial key storage strategy, the key is split into the first part of the key and the second part of the key; the first part of the key is sent to the application end for storage, and the second part of the key is sent to the platform database for storage.

[0019] Optionally, a ratio value M of the first part of the secret key to the whole secret key and a ratio value N of the second part of the secret key to the whole secret key satisfy: M=N.

[0020] In a second aspect, an embodiment of the present invention provides a decryption method, comprising:

[0021] Receive a decryption request sent by an application end, the decryption request including a ciphertext and an access token; obtain a secret key stored in a platform database according to the access token; or receive a decryption request sent by an application end, the decryption request including a ciphertext, an access token, and a first part of the secret key; obtain a second part of the secret key stored in the platform database according to the access token; concatenate the first part of the secret key with the second part of the secret key to obtain the secret key;

[0022] The ciphertext is decrypted using the secret key to obtain plaintext, and the plaintext is sent to the application end.

[0023] In a third aspect, an embodiment of the present invention provides an encryption device, including:

[0024] A receiving module, used to receive an encryption request sent by an application, wherein the encryption request includes a plaintext to be encrypted;

[0025] An encryption module, used to determine a secret key, use the secret key to encrypt the plaintext to be encrypted to obtain a ciphertext, and send the ciphertext to the application end;

[0026] A key storage module, used to send the key to the platform database for storage, or to send the first part of the key to the application end for storage and send the second part of the key to the platform database for storage;

[0027] A token generation module is used to generate an access token that allows access to the secret key or the second part of the secret key stored in the platform database, and send the access token to the application end.

[0028] In a fourth aspect, an embodiment of the present invention provides a decryption device, including:

[0029] A decryption module, configured to receive a decryption request sent by an application, the decryption request including a ciphertext and an access token; obtain a secret key stored in a platform database according to the access token; or receive a decryption request sent by an application, the decryption request including a ciphertext, an access token, and a first part of the secret key; obtain a second part of the secret key stored in the platform database according to the access token; and concatenate the first part of the secret key with the second part of the secret key to obtain the secret key;

[0030] The sending module is used to use the secret key to decrypt the ciphertext to obtain plaintext, and send the plaintext to the application end.

[0031] In a fifth aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the encryption method as described in any one of the first aspects, or implements the steps of the decryption method as described in the second aspect.

[0032] In a sixth aspect, an embodiment of the present invention provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the encryption method as described in any one of the first aspects are implemented, or the steps of the decryption method as described in the second aspect are implemented.

[0033] In the seventh aspect, an embodiment of the present invention provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the encryption method as described in any one of the first aspects, or implement the steps of the decryption method as described in the second aspect.

[0034] In an embodiment of the present invention, an encryption request sent by an application is received, the encryption request includes a plaintext to be encrypted; a secret key is determined, the plaintext to be encrypted is encrypted using the secret key to obtain a ciphertext, and the ciphertext is sent to the application, the secret key is sent to a platform database for storage, or the first part of the secret key is sent to the application for storage, and the second part of the secret key is sent to the platform database for storage. In an embodiment of the present invention, the ciphertext and the secret key are stored separately to achieve high encryption security. In addition, by generating an access token that permits access to the secret key or the second part of the secret key stored in the platform database, and sending the access token to the application, the embodiment of the present invention also uses the access token as a secondary encryption measure to improve the security of encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0036] Figure 1 A schematic diagram of a flow chart of an encryption method according to an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of a decryption method according to an embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of the principle of information interaction between the SaaS platform and the application end;

[0039] Figure 4 This is a principle block diagram of an encryption device according to an embodiment of the present invention;

[0040] Figure 5 This is a functional block diagram of a decryption device according to an embodiment of the present invention;

[0041] Figure 6 The figure is a principle block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The terms "first", "second", etc. of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of one type, and the number of objects is not limited, for example, the first object can be one or more. In addition, "or" in the present application represents at least one of the connected objects. For example, "A or B" covers three schemes, namely, Scheme 1: including A but not including B; Scheme 2: including B but not including A; Scheme 3: including both A and B. The character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0044] In the technical solution of the present disclosure, words such as “connect”, “couple” or “connected” are not limited to physical or mechanical connections, but may include electrical connections.

[0045] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0046] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information and network security.

[0047] Existing disk encryption methods, specifically full disk encryption technology (such as BitLocker, LUKS, etc.), can ensure that data is encrypted even if the hard disk is physically removed. The disadvantage is that for large-capacity disks, the encryption and decryption process may take a long time, resulting in the inability to use the disk or system normally during the encryption and decryption process. In addition, the security of disk encryption depends on the key not being stolen or lost, and the encryption security is low.

[0048] The existing database encryption method uses the built-in encryption function of the database (such as MySQL's transparent data encryption) to encrypt and store sensitive fields. This method has obvious advantages: simple configuration and easy use. The disadvantage is that it can only be used for databases that support encryption. The encryption security depends entirely on the key not being stolen or lost, and the encryption security is low.

[0049] The embodiment of the present invention provides an encryption method, see Figure 1 As shown, Figure 1 The following is a flow chart of an encryption method according to an embodiment of the present invention. The encryption method includes:

[0050] Step 11: receiving an encryption request sent by the application, where the encryption request includes the plaintext to be encrypted;

[0051] The embodiments of the present invention can be applied to a SaaS (Software as a Service) platform deployed in the cloud. In actual applications, the SaaS platform is called to execute the embodiments of the present invention to achieve encryption of sensitive data in an efficient and fast manner. Therefore, in some embodiments, the encryption request may also include the account login authentication information of the SaaS platform tenant, such as account name and account password. Specifically, after receiving the encryption request, the SaaS platform authenticates the identity of the SaaS platform tenant through the account name and account password therein. After the authentication is passed, the subsequent steps of the embodiments of the present invention are continued to be executed, and the execution process of the encryption method of the embodiments of the present invention is allowed to call the preset configuration of the SaaS platform tenant on the SaaS platform. Therefore, the embodiments of the present invention can realize the independent execution of encryption processes under different SaaS platform tenant accounts, thereby improving the security of encryption.

[0052] Step 12: Determine the secret key, use the secret key to encrypt the plaintext to obtain the ciphertext, and send the ciphertext to the application end;

[0053] In some embodiments of the present invention, optionally, determining the secret key may be generating a random secret key. That is, each time an encryption request is received, the SaaS platform generates a random secret key in response to the encryption request, and each encryption uses an independent newly generated secret key. In this way, the security of encryption can be greatly improved.

[0054] In some embodiments of the present invention, optionally, the determined secret key may also be a secret key preset by a SaaS platform tenant stored in a platform database of the SaaS platform (i.e., the configuration preset by the SaaS platform tenant in the SaaS platform may include a secret key), and the secret key corresponds to the application end one-to-one. In other words, as long as the encryption request comes from the A application end, the A secret key preset by the SaaS platform tenant for the A application end is called; as long as the encryption request comes from the B application end, the B secret key preset by the SaaS platform tenant for the B application end is called, and so on. All encryption requests initiated by the same application end use the same secret key, and the secret key is independent only between different application ends, which reduces the computing cost and computing time consumed by generating a random secret key for each encryption request, and improves encryption efficiency.

[0055] In actual applications, users can flexibly configure the scheme for determining the secret key according to their own requirements for encryption. Exemplarily, in scenarios where the requirements for encryption security are low, the scheme for determining the secret key can be a scheme for calling the preset secret key of the SaaS platform tenant stored in the platform database to ensure high encryption efficiency. Exemplarily, in scenarios where the requirements for encryption security are high, the scheme for determining the secret key can be a scheme for generating a random secret key to ensure high encryption security. Exemplarily, according to the user's specific requirements for encryption security and encryption efficiency on the application side, the user can also set a scheme for generating random secret keys for encryption requests sent by some application sides, and correspondingly, for encryption requests sent by other application sides, execute a scheme for calling the preset secret key of the SaaS platform tenant stored in the platform database, refine the scheme for determining the secret key in the application side dimension and flexibly switch to achieve a balance between encryption efficiency and encryption security.

[0056] It should be noted that users, that is, users of SaaS platform services, may include: SaaS platform tenants, and may also include: individuals or organizations that have obtained legal authorization from SaaS platform tenants (with account login authentication information).

[0057] In some embodiments of the present invention, optionally, the encryption algorithm for encrypting the plaintext to be encrypted includes a symmetric encryption algorithm. A symmetric encryption algorithm is an encryption method in which the same key is used for encryption and decryption. The characteristic of this algorithm is that the encryption and decryption processes are symmetric, that is, the same key is used for encryption and decryption. Symmetric encryption algorithms are usually faster and suitable for processing large-scale data. In some embodiments, optionally, the encryption algorithm for encrypting the plaintext to be encrypted includes any one of the following: Advanced Encryption Standard AES algorithm, Data Encryption Standard DES algorithm, Triple Data Encryption Standard 3DES algorithm, Blowfish algorithm, RC4 algorithm.

[0058] In the embodiment of the present invention, the ciphertext is sent to the application end, and the ciphertext is stored by the application end itself, which can effectively reduce the risk of ciphertext leakage from the SaaS platform and effectively reduce the user's concerns about sensitive data leakage caused by the use of the SaaS platform.

[0059] Step 13: Send the secret key to the platform database for storage, or send the first part of the secret key to the application for storage, and send the second part of the secret key to the platform database for storage;

[0060] In some embodiments of the present invention, optionally, the platform database may be a database of a SaaS platform.

[0061] In the embodiment of the present invention, step 12 sends the ciphertext to the application end, and step 13 sends the secret key to the platform database for storage, so that the ciphertext and the secret key are stored separately, which can ensure data security. For example, in the case where the SaaS platform is attacked by a network, even if the SaaS platform is cracked and the attacker obtains the secret key, it will not cause data leakage.

[0062] In step 13 of the embodiment of the present invention, the first part of the secret key is sent to the application end for storage, and the second part of the secret key is sent to the platform database for storage, so that the application end must provide the first part of the secret key each time it requests a decryption service. After the first part of the secret key and the second part of the secret key are concatenated to obtain the secret key, the ciphertext can be decrypted, which greatly improves the security of encryption. Even if part of the secret key of one party in the application end and the SaaS platform is lost, it does not affect the confidentiality of the ciphertext. In particular, in the case of a network attack, the attacker cannot decrypt the ciphertext by invading either the SaaS platform or the application end. The attacker must crack the systems of both the SaaS platform and the application end before he can decrypt the ciphertext and obtain the plaintext, which greatly increases the difficulty of cracking the ciphertext and ensures data security.

[0063] Step 14: Generate an access token that allows access to the secret key or the second part of the secret key stored in the platform database, and send the access token to the application.

[0064] In the embodiment of the present invention, the access token also plays the role of secondary encryption of the ciphertext. Specifically, when requesting to decrypt a ciphertext, the access token corresponding to the secret key of the ciphertext must be sent to the SaaS platform to obtain the secret key or the second part of the secret key of the ciphertext stored in the platform database before the ciphertext can be decrypted. The embodiment of the present invention can prevent the network attacker who only obtains the ciphertext from decrypting the ciphertext through the SaaS platform, thereby improving the security of the ciphertext data.

[0065] In practical applications, access tokens also play a role in improving decryption efficiency. Specifically, when requesting to decrypt a ciphertext, the execution process of the decryption method can quickly locate the secret key or the second part of the secret key of the ciphertext stored in the platform database based on the access token, thereby improving decryption efficiency.

[0066] In an embodiment of the present invention, an encryption request sent by an application is received, the encryption request includes a plaintext to be encrypted; a secret key is determined, the plaintext to be encrypted is encrypted using the secret key to obtain a ciphertext, and the ciphertext is sent to the application, the secret key is sent to a platform database for storage, or the first part of the secret key is sent to the application for storage, and the second part of the secret key is sent to the platform database for storage. In an embodiment of the present invention, the ciphertext and the secret key are stored separately to achieve high encryption security. In addition, by generating an access token that permits access to the secret key or the second part of the secret key stored in the platform database, and sending the access token to the application, the embodiment of the present invention also uses the access token as a secondary encryption measure to improve the security of encryption.

[0067] In some embodiments of the present invention, optionally, determining the key includes:

[0068] Step a: Obtain the preset encryption and decryption strategy corresponding to the application end;

[0069] Step b: If the encryption and decryption strategy is a dynamic generation strategy, a random key is generated as the determined key;

[0070] Step c: If the encryption and decryption strategy is a static generation strategy, query the platform database to obtain the preset application-side static key as the determined key.

[0071] In some embodiments of the present invention, the encryption and decryption strategy may be pre-configured by the SaaS platform tenant and stored in the platform database. Thus, obtaining the preset encryption and decryption strategy corresponding to the application end may specifically include: querying the platform database to obtain the preset encryption and decryption strategy corresponding to the application end.

[0072] In the embodiment of the present invention, a dynamic generation strategy is adopted, that is, each time an encryption request is received, the SaaS platform generates a random key in response to the encryption request, and each encryption uses an independent newly generated key, thereby greatly improving the security of encryption.

[0073] In the embodiment of the present invention, the static generation strategy is to call the static key preset by the SaaS platform tenant stored in the platform database of the SaaS platform, and the static key corresponds to the application end one by one. All encryption requests initiated by the same application end use the same static key, which reduces the computing cost and computing time consumed by generating a random key for each encryption request, and improves encryption efficiency. In some embodiments, the correspondence between the static key and the application end can be pre-configured by the SaaS platform tenant and stored in the platform database.

[0074] In some optional embodiments, the correspondence between the application end and the encryption and decryption strategy is also pre-configured and determined by the SaaS platform tenant. That is, the user can pre-configure the encryption and decryption strategy according to the user's encryption and decryption requirements for different application ends. For example, if the user believes that the data of a certain C application end needs to have high security, the user can configure the encryption and decryption strategy of the C application end as a dynamic generation strategy to ensure high encryption security. For example, for a certain D application end, the user believes that the timeliness of its data encryption is more important than security, then the user can configure the encryption and decryption strategy of the D application end as a static generation strategy to improve encryption efficiency.

[0075] In some embodiments of the present invention, optionally, sending the secret key to the platform database for storage, or sending the first part of the secret key to the application end for storage, and sending the second part of the secret key to the platform database for storage, includes:

[0076] Step d: Obtain key storage strategy;

[0077] Step e: If the key storage policy is a full key storage policy, the key is sent to the platform database for storage;

[0078] Step f: If the key storage strategy is a partial key storage strategy, split the key into a first part of the key and a second part of the key; send the first part of the key to the application for storage, and send the second part of the key to the platform database for storage.

[0079] In some embodiments of the present invention, the key storage policy may be pre-configured by the SaaS platform tenant and stored in the platform database. Thus, obtaining the key storage policy may specifically include: querying the platform database to obtain the key storage policy corresponding to the application end.

[0080] In some embodiments of the present invention, the encryption request may optionally include a key storage policy. Thus, obtaining the key storage policy may specifically include: obtaining the key storage policy from the encryption request.

[0081] In the embodiment of the present invention, the key preservation strategy is to send the complete key to the platform database for storage. Under this strategy, the key and the ciphertext are stored separately to improve the security of encryption.

[0082] In the embodiment of the present invention, the partial key storage strategy, that is, the application end and the platform database store partial keys respectively, and the two parts of the key need to be spliced ​​together to decrypt the ciphertext during decryption, which can greatly improve the security of encryption. In particular, in the case of a network attack, the attacker cannot decrypt the ciphertext by invading either the SaaS platform or the application end. The attacker must crack the systems of both the SaaS platform and the application end before it is possible to decrypt the ciphertext and obtain the plaintext, which increases the difficulty for the attacker to obtain the plaintext and greatly improves the security of encryption.

[0083] In some embodiments of the present invention, optionally, a ratio M of the first part of the key to the entire key and a ratio N of the second part of the key to the entire key satisfy: M=N.

[0084] It should be noted that, since the secret key is split into the first part of the secret key and the second part of the secret key, and the ratio value M of the first part of the secret key to the whole secret key and the ratio value N of the second part of the secret key to the whole secret key satisfy: M=N, then the ratio value M of the first part of the secret key to the whole secret key is M=1 / 2, and the ratio value N of the second part of the secret key to the whole secret key is N=1 / 2, and the secret key is saved in half. In some optional embodiments, the first half of the secret key is used as the first part of the secret key, and the second half of the secret key is used as the second part of the secret key; or, the second half of the secret key is used as the first part of the secret key, and the first part of the secret key is used as the second part of the secret key, which can facilitate the rapid splicing of the two parts of the secret key during decryption and improve the decryption efficiency.

[0085] In some embodiments of the present invention, the user may optionally configure a decomposition algorithm for decomposing the secret key, such as a random decomposition algorithm. Specifically, when M+N=1 is satisfied, each execution of step f randomly decomposes the secret key into the first part of the secret key and the second part of the secret key, further improving the security of encryption.

[0086] The embodiment of the present invention provides a decryption method, see Figure 2 As shown, Figure 2 The flowchart of the decryption method according to the embodiment of the present invention includes:

[0087] Step 21: receiving a decryption request sent by the application end, the decryption request including the ciphertext and the access token; obtaining the secret key stored in the platform database according to the access token; or receiving a decryption request sent by the application end, the decryption request including the ciphertext, the access token, and the first part of the secret key; obtaining the second part of the secret key stored in the platform database according to the access token; concatenating the first part of the secret key with the second part of the secret key to obtain the secret key;

[0088] The embodiments of the present invention can be applied to a SaaS (Software as a Service) platform deployed in the cloud. In actual applications, the SaaS platform is called to execute the embodiments of the present invention to achieve encryption of sensitive data in an efficient and fast manner. Therefore, in some embodiments, the decryption request may also include the account login authentication information of the SaaS platform tenant, such as account name and account password. Specifically, after receiving the decryption request, the SaaS platform authenticates the SaaS platform tenant through the account name and account password therein. After the authentication is passed, the subsequent steps of the embodiments of the present invention are continued to be executed, and the execution process of the decryption method of the embodiments of the present invention is allowed to call the configuration preset by the SaaS platform tenant of the SaaS platform.

[0089] In the embodiment of the present invention, the access token is an access token that allows access to the key or the second part of the key stored in the platform database, generated after the key is sent to the platform database for storage during encryption, or after the first part of the key is sent to the application end for storage and the second part of the key is sent to the platform database for storage during encryption. During the encryption process, the access token is sent to the application end that sends the encryption request. During the decryption process, the key or the second part of the key stored in the platform database can be obtained based on the access token.

[0090] In the embodiment of the present invention, the access token also plays the role of re-encrypting the ciphertext. Specifically, when requesting to decrypt a ciphertext, the access token corresponding to the secret key of the ciphertext must be sent to the SaaS platform to obtain the secret key or the second part of the secret key of the ciphertext stored in the platform database before the ciphertext can be decrypted. The embodiment of the present invention can avoid the situation where the network attacker who only obtains the ciphertext decrypts the ciphertext through the SaaS platform, thereby improving the security of the ciphertext data.

[0091] In actual applications, access tokens also play a role in improving decryption efficiency. Specifically, when requesting to decrypt a ciphertext, the execution process of the decryption method can quickly locate the secret key or the second part of the secret key of the ciphertext stored in the platform database based on the access token, thereby improving decryption efficiency.

[0092] Step 22: Use the secret key to decrypt the ciphertext to obtain plaintext, and send the plaintext to the application end.

[0093] In the embodiment of the present invention, after the ciphertext is decrypted, the plaintext is not stored in the SaaS platform, but is directly sent to the application end, which can reduce the risk of plaintext leakage from the SaaS platform and improve the security of decryption.

[0094] In an embodiment of the present invention, a decryption request is sent by receiving an application end, the decryption request includes a ciphertext and an access token; according to the access token, a secret key stored in a platform database is obtained; or, a decryption request is sent by receiving an application end, the decryption request includes a ciphertext, an access token, and a first part of the secret key; according to the access token, a second part of the secret key stored in the platform database is obtained; the first part of the secret key and the second part of the secret key are concatenated to obtain the secret key; the ciphertext is decrypted using the secret key to obtain plaintext, and the plaintext is sent to the application end. In this embodiment of the present invention, the secret key and the access token are necessary conditions for decrypting the ciphertext, thereby ensuring the security of the ciphertext data.

[0095] The following is an explanation of the SaaS platform with specific examples. Figure 3 As shown, "Application 1" represents an exemplary application end, and "KMS key management service" represents the SaaS platform. The application backend of the application end can call the encryption service and decryption service of the SaaS platform through the API (Application Programming Interface) interface, thereby implementing the various steps of the encryption method and the various steps of the decryption method of the embodiment of the present invention. In some embodiments, the API interface can adopt the common RestFull technology for easy docking.

[0096] Specifically, the SaaS platform may include four modules: SaaS service tenant management module (i.e. Figure 3 "Tenant Management" in the Figure 3 "Application Management"), application key policy management module (i.e. Figure 3 "Key Management" in the ), and the encryption and decryption interface module (i.e. Figure 3 "Encryption Service" and "Decryption Service").

[0097] 1. SaaS service tenant management module:

[0098] The SaaS service tenant management module is the basic management part of the platform, which is mainly responsible for handling all operations related to tenants. The following are the main functions of this module:

[0099] Tenant registration and authentication: Allow new tenants to register accounts on the platform and provide an identity authentication mechanism to ensure the authenticity and security of the tenant's identity.

[0100] Tenant information management: Maintain tenants' basic information, such as company name, contact person, contact information, etc., to facilitate platform administrators to query and update tenant information.

[0101] Tenant permission management: Set different operation permissions according to the tenant's role and level to ensure that the tenant can only access and operate the resources and services for which they are authorized.

[0102] Tenant service activation and deactivation: Activate or deactivate encryption and decryption services on the platform for tenants to meet changes in tenants' business needs.

[0103] 2. Tenant application management module:

[0104] The tenant application management module is responsible for managing the applications created and managed by tenants on the platform. The functions of this module include:

[0105] Application creation and configuration: Allows tenants to create new applications on the platform and configure related parameters and settings for these applications.

[0106] Application list and status view: Displays a list of all tenant applications and displays the application status (such as running, stopped, error, etc.) in real time to facilitate tenant monitoring and management.

[0107] 3. Application key policy management module:

[0108] The application key policy management module is the core security part of the platform, responsible for managing and controlling the keys used in the encryption and decryption process. The following are the main functions of this module:

[0109] Key generation and storage: Generate keys that meet security standards based on tenant needs and application characteristics. Fixed keys and dynamic keys are optional. (Part of) the keys are securely stored in the platform's key management system.

[0110] Key access control: Set access rights for keys to ensure that only authorized tenants and applications can access and use specific keys.

[0111] Key lifecycle management: Manage the entire lifecycle of keys, including key creation, use, update, and destruction, to ensure key security and compliance.

[0112] Key audit and log: record the usage and operation log of the key to facilitate tenants to audit and trace.

[0113] 4. Encryption and decryption interface module:

[0114] The encryption and decryption interface module is the core interface of the platform, responsible for processing encryption and decryption requests of tenant applications. The following are the main functions of this module:

[0115] API interface definition: Provides a standard API interface for tenants' applications to call to implement encryption and decryption operations.

[0116] Encryption algorithm support: supports multiple encryption algorithms, such as AES, DES, etc., to meet the different encryption needs of tenants.

[0117] Interface security assurance: HTTPS, API signatures and other security measures are used to ensure the security of interface calls and the integrity of data.

[0118] The usage process of SaaS service platform:

[0119] A1. Tenant registration and login: New tenants register on the platform, fill in relevant information and complete identity verification. After successful registration, tenants use their account to log in to the platform.

[0120] A2. Create applications and configure: Tenants create new applications on the platform and configure relevant parameters and settings for the applications, including encryption and decryption requirements and key strategies.

[0121] A3. Key management and policy setting: Tenants generate and manage keys in the key policy management module and set key access permissions and usage policies.

[0122] Key generation strategies include:

[0123] Dynamic generation: that is, each time an encryption request is made, the platform automatically generates a key. Each request will generate a key independently. This key generation strategy will slightly reduce encryption performance, but it has high security.

[0124] Static generation: Generate a unified key for the application. There is only one such key in the entire encryption and decryption life cycle of the application. This key generation strategy has high performance.

[0125] Key storage strategies include:

[0126] Platform storage: The secret key is stored by the platform, and the service user does not need to save the secret key part. This strategy makes application integration simple, convenient and fast.

[0127] Half-storage: 1 / 2 of the key is stored by the platform, and the other 1 / 2 is stored by the service user. This strategy makes application integration slightly more complicated but highly secure. Every time an application requests encryption or decryption services, it must provide the other half of the key.

[0128] A4. Calling the encryption and decryption interface: The tenant's application implements data encryption and decryption operations by calling the encryption and decryption interface provided by the platform. The platform processes the plaintext data / ciphertext data according to the key strategy and encryption algorithm set by the tenant and returns the ciphertext result / plaintext result.

[0129] A5. Monitoring and management: Tenants can view the application's running status, key usage, operation logs and other information on the platform for real-time monitoring and management.

[0130] The embodiment of the present invention provides an encryption device, see Figure 4 As shown, Figure 4 The encryption device 40 is a block diagram of the principle of the encryption device according to the embodiment of the present invention. The encryption device 40 includes:

[0131] The receiving module 41 is used to receive an encryption request sent by the application, wherein the encryption request includes a plaintext to be encrypted;

[0132] The encryption module 42 is used to determine a secret key, use the secret key to encrypt the plaintext to obtain a ciphertext, and send the ciphertext to the application end;

[0133] A key storage module 43, used to send the key to the platform database for storage, or to send the first part of the key to the application end for storage and send the second part of the key to the platform database for storage;

[0134] The token generation module 44 is used to generate an access token that allows access to the secret key or the second part of the secret key stored in the platform database, and send the access token to the application end.

[0135] In some embodiments of the present invention, optionally,

[0136] The encryption module 42 is also used to obtain a preset encryption and decryption strategy corresponding to the application end;

[0137] The encryption module 42 is further configured to generate a random key as the determined key if the encryption / decryption strategy is a dynamic generation strategy;

[0138] The encryption module 42 is further configured to query the platform database to obtain a preset static key of the application end as the determined key if the encryption and decryption strategy is a static generation strategy.

[0139] In some embodiments of the present invention, optionally,

[0140] The key storage module 43 is also used to obtain a key storage strategy;

[0141] The key storage module 43 is further configured to send the key to the platform database for storage if the key storage strategy is a full key storage strategy;

[0142] The key storage module 43 is also used to split the key into the first part of the key and the second part of the key if the key storage strategy is a partial key preservation strategy; send the first part of the key to the application end for storage, and send the second part of the key to the platform database for storage.

[0143] In some embodiments of the present invention, optionally, a ratio value M of the first part of the secret key to the whole secret key and a ratio value N of the second part of the secret key to the whole secret key satisfy: M=N.

[0144] The encryption device provided in the embodiment of the present application can achieve Figure 1 The various processes implemented by the method embodiment and achieving the same technical effect are not described here to avoid repetition.

[0145] The present invention provides a decryption device, see Figure 5 As shown, Figure 5 This is a principle block diagram of a decryption device according to an embodiment of the present invention. The decryption device 50 includes:

[0146] The decryption module 51 is used to receive a decryption request sent by an application end, the decryption request including a ciphertext and an access token; obtain a secret key stored in a platform database according to the access token; or receive a decryption request sent by an application end, the decryption request including a ciphertext, an access token, and a first part of the secret key; obtain a second part of the secret key stored in the platform database according to the access token; and concatenate the first part of the secret key with the second part of the secret key to obtain the secret key;

[0147] The sending module 52 is used to use the secret key to decrypt the ciphertext to obtain plaintext, and send the plaintext to the application end.

[0148] The decryption device provided in the embodiment of the present application can achieve Figure 2 The various processes implemented by the method embodiment and achieving the same technical effect are not described here to avoid repetition.

[0149] The embodiment of the present invention provides an electronic device 60, see Figure 6 As shown, Figure 6 This is a principle block diagram of an electronic device 60 according to an embodiment of the present invention, including a processor 61, a memory 62, and a program or instruction stored in the memory 62 and executable on the processor 61. When the program or instruction is executed by the processor, the steps in any encryption method of the present invention are implemented, or the steps in any decryption method of the present invention are implemented.

[0150] An embodiment of the present invention provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of an embodiment of an encryption method such as any one of the above-mentioned items are implemented, or the various processes of an embodiment of a decryption method such as any one of the above-mentioned items are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0151] The readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. In some examples, the readable storage medium may be a non-transitory readable storage medium.

[0152] An embodiment of the present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the various processes of any of the above-mentioned encryption method embodiments, or implement the various processes of any of the above-mentioned decryption method embodiments, and can achieve the same technical effect. To avoid repetition, they are not repeated here.

[0153] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. An encryption method, characterized in that: include: Receiving an encryption request sent by an application, wherein the encryption request includes plaintext to be encrypted; Determine a secret key, use the secret key to encrypt the plaintext to obtain a ciphertext, and send the ciphertext to the application end; Sending the secret key to the platform database for storage, or sending the first part of the secret key to the application end for storage, and sending the second part of the secret key to the platform database for storage; An access token that permits access to the secret key or the second part of the secret key stored in the platform database is generated, and the access token is sent to the application.

2. The encryption method according to claim 1, characterized in that: The determining key comprises: Obtaining a preset encryption and decryption strategy corresponding to the application end; If the encryption and decryption strategy is a dynamic generation strategy, a random key is generated as the determined key; If the encryption and decryption strategy is a static generation strategy, the platform database is queried to obtain a preset static key of the application end as the determined key.

3. The encryption method according to claim 1, characterized in that: Sending the secret key to the platform database for storage, or sending the first part of the secret key to the application end for storage and sending the second part of the secret key to the platform database for storage, includes: Get the key storage policy; If the key storage strategy is a full key storage strategy, the key is sent to the platform database for storage; If the key storage strategy is a partial key storage strategy, the key is split into the first part of the key and the second part of the key; the first part of the key is sent to the application end for storage, and the second part of the key is sent to the platform database for storage.

4. The encryption method according to claim 3, characterized in that: The ratio M of the first part of the secret key to the whole secret key and the ratio N of the second part of the secret key to the whole secret key satisfy: M=N.

5. A decryption method, characterized in that: include: A decryption request is sent by a receiving application, wherein the decryption request includes a ciphertext and an access token; According to the access token, obtain the secret key stored in the platform database; Alternatively, receiving a decryption request sent by the application, the decryption request including the ciphertext, the access token, and the first part of the secret key; Retrieve, based on the access token, a second portion of the secret key stored in the platform database; Concatenating the first part of the secret key with the second part of the secret key to obtain the secret key; The ciphertext is decrypted using the secret key to obtain plaintext, and the plaintext is sent to the application end.

6. An encryption device, characterized in that: include: A receiving module, used to receive an encryption request sent by an application, wherein the encryption request includes a plaintext to be encrypted; An encryption module, used to determine a secret key, use the secret key to encrypt the plaintext to be encrypted to obtain a ciphertext, and send the ciphertext to the application end; A key storage module, used to send the key to the platform database for storage, or to send the first part of the key to the application end for storage and send the second part of the key to the platform database for storage; A token generation module is used to generate an access token that allows access to the secret key or the second part of the secret key stored in the platform database, and send the access token to the application end.

7. A decryption device, characterized in that: include: A decryption module, used to receive a decryption request sent by an application, wherein the decryption request includes a ciphertext and an access token; According to the access token, obtain the secret key stored in the platform database; Alternatively, receiving a decryption request sent by the application, the decryption request including the ciphertext, the access token, and the first part of the secret key; Retrieve, based on the access token, a second portion of the secret key stored in the platform database; Concatenating the first part of the secret key with the second part of the secret key to obtain the secret key; The sending module is used to use the secret key to decrypt the ciphertext to obtain plaintext, and send the plaintext to the application end.

8. An electronic device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the encryption method as claimed in any one of claims 1 to 4, or implements the steps of the decryption method as claimed in claim 5.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, it implements the steps in the encryption method according to any one of claims 1 to 4, or implements the steps in the decryption method according to claim 5.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps in the encryption method according to any one of claims 1 to 4, or implement the steps in the decryption method according to claim 5.

Images